webkitgtk-2.4.9webkitgtk-2.4.9

98 files changed, 1979 insertions, 13190 deletions

diff --git a/Source/JavaScriptCore/ftl/FTLAbbreviatedTypes.h b/Source/JavaScriptCore/ftl/FTLAbbreviatedTypes.h
index 2b9361909..06a68cd67 100644
--- a/Source/JavaScriptCore/ftl/FTLAbbreviatedTypes.h
+++ b/Source/JavaScriptCore/ftl/FTLAbbreviatedTypes.h
@@ -26,6 +26,8 @@
 #ifndef FTLAbbreviatedTypes_h
 #define FTLAbbreviatedTypes_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "LLVMAPI.h"
@@ -43,7 +45,6 @@ typedef LLVMModuleRef LModule;
 typedef LLVMRealPredicate LRealPredicate;
 typedef LLVMTypeRef LType;
 typedef LLVMValueRef LValue;
-typedef LLVMMemoryBufferRef LMemoryBuffer;
 
 } } // namespace JSC::FTL
 
diff --git a/Source/JavaScriptCore/ftl/FTLAbbreviations.h b/Source/JavaScriptCore/ftl/FTLAbbreviations.h
index d3bff4cc1..02e0c04c3 100644
--- a/Source/JavaScriptCore/ftl/FTLAbbreviations.h
+++ b/Source/JavaScriptCore/ftl/FTLAbbreviations.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,9 +26,12 @@
 #ifndef FTLAbbreviations_h
 #define FTLAbbreviations_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviatedTypes.h"
+#include "FTLSwitchCase.h"
 #include "FTLValueFromBlock.h"
 #include "LLVMAPI.h"
 #include <cstring>
@@ -55,7 +58,6 @@ static inline LType floatType(LContext context) { return llvm->FloatTypeInContex
 static inline LType doubleType(LContext context) { return llvm->DoubleTypeInContext(context); }
 
 static inline LType pointerType(LType type) { return llvm->PointerType(type, 0); }
-static inline LType arrayType(LType type, unsigned count) { return llvm->ArrayType(type, count); }
 static inline LType vectorType(LType type, unsigned count) { return llvm->VectorType(type, count); }
 
 enum PackingMode { NotPacked, Packed };
@@ -77,9 +79,6 @@ static inline LType structType(LContext context, LType element1, LType element2,
     return structType(context, elements, 2, packing);
 }
 
-// FIXME: Make the Variadicity argument not be the last argument to functionType() so that this function
-// can use C++11 variadic templates
-// https://bugs.webkit.org/show_bug.cgi?id=141575
 enum Variadicity { NotVariadic, Variadic };
 static inline LType functionType(LType returnType, const LType* paramTypes, unsigned paramCount, Variadicity variadicity)
 {
@@ -113,27 +112,13 @@ static inline LType functionType(LType returnType, LType param1, LType param2, L
     LType paramTypes[] = { param1, param2, param3, param4 };
     return functionType(returnType, paramTypes, 4, variadicity);
 }
-static inline LType functionType(LType returnType, LType param1, LType param2, LType param3, LType param4, LType param5, Variadicity variadicity = NotVariadic)
-{
-    LType paramTypes[] = { param1, param2, param3, param4, param5 };
-    return functionType(returnType, paramTypes, 5, variadicity);
-}
-static inline LType functionType(LType returnType, LType param1, LType param2, LType param3, LType param4, LType param5, LType param6, Variadicity variadicity = NotVariadic)
-{
-    LType paramTypes[] = { param1, param2, param3, param4, param5, param6 };
-    return functionType(returnType, paramTypes, 6, variadicity);
-}
 
 static inline LType typeOf(LValue value) { return llvm->TypeOf(value); }
 
-static inline LType getElementType(LType value) { return llvm->GetElementType(value); }
-
 static inline unsigned mdKindID(LContext context, const char* string) { return llvm->GetMDKindIDInContext(context, string, std::strlen(string)); }
 static inline LValue mdString(LContext context, const char* string, unsigned length) { return llvm->MDStringInContext(context, string, length); }
 static inline LValue mdString(LContext context, const char* string) { return mdString(context, string, std::strlen(string)); }
 static inline LValue mdNode(LContext context, LValue* args, unsigned numArgs) { return llvm->MDNodeInContext(context, args, numArgs); }
-template<typename VectorType>
-static inline LValue mdNode(LContext context, const VectorType& vector) { return mdNode(context, const_cast<LValue*>(vector.begin()), vector.size()); }
 static inline LValue mdNode(LContext context) { return mdNode(context, 0, 0); }
 static inline LValue mdNode(LContext context, LValue arg1) { return mdNode(context, &arg1, 1); }
 static inline LValue mdNode(LContext context, LValue arg1, LValue arg2)
@@ -141,39 +126,12 @@ static inline LValue mdNode(LContext context, LValue arg1, LValue arg2)
     LValue args[] = { arg1, arg2 };
     return mdNode(context, args, 2);
 }
-static inline LValue mdNode(LContext context, LValue arg1, LValue arg2, LValue arg3)
-{
-    LValue args[] = { arg1, arg2, arg3 };
-    return mdNode(context, args, 3);
-}
 
 static inline void setMetadata(LValue instruction, unsigned kind, LValue metadata) { llvm->SetMetadata(instruction, kind, metadata); }
 
-static inline LValue getFirstInstruction(LBasicBlock block) { return llvm->GetFirstInstruction(block); }
-static inline LValue getNextInstruction(LValue instruction) { return llvm->GetNextInstruction(instruction); }
-
-
 static inline LValue addFunction(LModule module, const char* name, LType type) { return llvm->AddFunction(module, name, type); }
-static inline LValue getNamedFunction(LModule module, const char* name) { return llvm->GetNamedFunction(module, name); }
-static inline LValue getFirstFunction(LModule module) { return llvm->GetFirstFunction(module); }
-static inline LValue getNextFunction(LValue function) { return llvm->GetNextFunction(function); }
-
+static inline void setLinkage(LValue global, LLinkage linkage) { llvm->SetLinkage(global, linkage); }
 static inline void setFunctionCallingConv(LValue function, LCallConv convention) { llvm->SetFunctionCallConv(function, convention); }
-static inline void addTargetDependentFunctionAttr(LValue function, const char* key, const char* value) { llvm->AddTargetDependentFunctionAttr(function, key, value); }
-static inline void removeFunctionAttr(LValue function, LLVMAttribute pa) { llvm->RemoveFunctionAttr(function, pa); }
-
-static inline LLVMLinkage getLinkage(LValue global) { return llvm->GetLinkage(global); }
-static inline void setLinkage(LValue global, LLVMLinkage linkage) { llvm->SetLinkage(global, linkage); }
-static inline void setVisibility(LValue global, LLVMVisibility viz) { llvm->SetVisibility(global, viz); }
-static inline LLVMBool isDeclaration(LValue global) { return llvm->IsDeclaration(global); }
-
-static inline LLVMBool linkModules(LModule dest, LModule str, LLVMLinkerMode mode, char** outMessage) { return llvm->LinkModules(dest, str, mode, outMessage); }
-
-static inline const char * getValueName(LValue global) { return llvm->GetValueName(global); }
-
-static inline LValue getNamedGlobal(LModule module, const char* name) { return llvm->GetNamedGlobal(module, name); }
-static inline LValue getFirstGlobal(LModule module) { return llvm->GetFirstGlobal(module); }
-static inline LValue getNextGlobal(LValue global) { return llvm->GetNextGlobal(global); }
 
 static inline LValue addExternFunction(LModule module, const char* name, LType type)
 {
@@ -182,29 +140,7 @@ static inline LValue addExternFunction(LModule module, const char* name, LType t
     return result;
 }
 
-static inline LLVMBool createMemoryBufferWithContentsOfFile(const char* path, LLVMMemoryBufferRef* outMemBuf, char** outMessage) 
-{ 
-    return llvm->CreateMemoryBufferWithContentsOfFile(path, outMemBuf, outMessage); 
-}
-
-
-static inline LLVMBool parseBitcodeInContext(LLVMContextRef contextRef, LLVMMemoryBufferRef memBuf, LModule *outModule, char **outMessage)
-{ 
-    return llvm->ParseBitcodeInContext(contextRef, memBuf, outModule, outMessage); 
-}
-
-
-static inline void disposeMemoryBuffer(LLVMMemoryBufferRef memBuf){ llvm->DisposeMemoryBuffer(memBuf); }
-
-
-static inline LModule moduleCreateWithNameInContext(const char* moduleID, LContext context){ return llvm->ModuleCreateWithNameInContext(moduleID, context); }
-static inline void disposeModule(LModule m){ llvm->DisposeModule(m); }
-
-static inline void disposeMessage(char* outMsg) { llvm->DisposeMessage(outMsg); }
-
 static inline LValue getParam(LValue function, unsigned index) { return llvm->GetParam(function, index); }
-
-static inline void getParamTypes(LType function, LType* dest) { return llvm->GetParamTypes(function, dest); }
 static inline LValue getUndef(LType type) { return llvm->GetUndef(type); }
 
 enum BitExtension { ZeroExtend, SignExtend };
@@ -214,9 +150,6 @@ static inline LValue constIntToPtr(LValue value, LType type) { return llvm->Cons
 static inline LValue constNull(LType type) { return llvm->ConstNull(type); }
 static inline LValue constBitCast(LValue value, LType type) { return llvm->ConstBitCast(value, type); }
 
-static inline LBasicBlock getFirstBasicBlock(LValue function) { return llvm->GetFirstBasicBlock(function); }
-static inline LBasicBlock getNextBasicBlock(LBasicBlock block) { return llvm->GetNextBasicBlock(block); }
-
 static inline LBasicBlock appendBasicBlock(LContext context, LValue function, const char* name = "") { return llvm->AppendBasicBlockInContext(context, function, name); }
 static inline LBasicBlock insertBasicBlock(LContext context, LBasicBlock beforeBasicBlock, const char* name = "") { return llvm->InsertBasicBlockInContext(context, beforeBasicBlock, name); }
 
@@ -311,13 +244,41 @@ static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1)
 {
     return buildCall(builder, function, &arg1, 1);
 }
-template<typename... Args>
-LValue buildCall(LBuilder builder, LValue function, LValue arg1, Args... args)
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2)
 {
-    LValue argsArray[] = { arg1, args... };
-    return buildCall(builder, function, argsArray, sizeof(argsArray) / sizeof(LValue));
+    LValue args[] = { arg1, arg2 };
+    return buildCall(builder, function, args, 2);
+}
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2, LValue arg3)
+{
+    LValue args[] = { arg1, arg2, arg3 };
+    return buildCall(builder, function, args, 3);
+}
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4)
+{
+    LValue args[] = { arg1, arg2, arg3, arg4 };
+    return buildCall(builder, function, args, 4);
+}
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5)
+{
+    LValue args[] = { arg1, arg2, arg3, arg4, arg5 };
+    return buildCall(builder, function, args, 5);
+}
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5, LValue arg6)
+{
+    LValue args[] = { arg1, arg2, arg3, arg4, arg5, arg6 };
+    return buildCall(builder, function, args, 6);
+}
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5, LValue arg6, LValue arg7)
+{
+    LValue args[] = { arg1, arg2, arg3, arg4, arg5, arg6, arg7 };
+    return buildCall(builder, function, args, 7);
+}
+static inline LValue buildCall(LBuilder builder, LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5, LValue arg6, LValue arg7, LValue arg8)
+{
+    LValue args[] = { arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8 };
+    return buildCall(builder, function, args, 8);
 }
-
 static inline void setInstructionCallingConvention(LValue instruction, LCallConv callingConvention) { llvm->SetInstructionCallConv(instruction, callingConvention); }
 static inline LValue buildExtractValue(LBuilder builder, LValue aggVal, unsigned index) { return llvm->BuildExtractValue(builder, aggVal, index, ""); }
 static inline LValue buildSelect(LBuilder builder, LValue condition, LValue taken, LValue notTaken) { return llvm->BuildSelect(builder, condition, taken, notTaken, ""); }
diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeap.cpp b/Source/JavaScriptCore/ftl/FTLAbstractHeap.cpp
index ce9fa0f04..eadd5af97 100644
--- a/Source/JavaScriptCore/ftl/FTLAbstractHeap.cpp
+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeap.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,7 +32,7 @@
 #include "FTLAbstractHeapRepository.h"
 #include "FTLOutput.h"
 #include "FTLTypedPointer.h"
-#include "JSCInlines.h"
+#include "Operations.h"
 #include "Options.h"
 
 namespace JSC { namespace FTL {
@@ -53,24 +53,9 @@ void AbstractHeap::decorateInstruction(LValue instruction, const AbstractHeapRep
     setMetadata(instruction, repository.m_tbaaKind, tbaaMetadata(repository));
 }
 
-void AbstractHeap::dump(PrintStream& out) const
-{
-    out.print(heapName());
-    if (m_parent)
-        out.print("->", *m_parent);
-}
-
-void AbstractField::dump(PrintStream& out) const
-{
-    out.print(heapName(), "(", m_offset, ")");
-    if (parent())
-        out.print("->", *parent());
-}
-
-IndexedAbstractHeap::IndexedAbstractHeap(LContext context, AbstractHeap* parent, const char* heapName, ptrdiff_t offset, size_t elementSize)
+IndexedAbstractHeap::IndexedAbstractHeap(LContext context, AbstractHeap* parent, const char* heapName, size_t elementSize)
     : m_heapForAnyIndex(parent, heapName)
     , m_heapNameLength(strlen(heapName))
-    , m_offset(offset)
     , m_elementSize(elementSize)
     , m_scaleTerm(0)
     , m_canShift(false)
@@ -78,7 +63,7 @@ IndexedAbstractHeap::IndexedAbstractHeap(LContext context, AbstractHeap* parent,
     // See if there is a common shift amount we could use instead of multiplying. Don't
     // try too hard. This is just a speculative optimization to reduce load on LLVM.
     for (unsigned i = 0; i < 4; ++i) {
-        if (1U << i == m_elementSize) {
+        if ((1 << i) == m_elementSize) {
             if (i)
                 m_scaleTerm = constInt(intPtrType(context), i, ZeroExtend);
             m_canShift = true;
@@ -108,7 +93,7 @@ TypedPointer IndexedAbstractHeap::baseIndex(Output& out, LValue base, LValue ind
     } else
         result = out.add(base, out.mul(index, m_scaleTerm));
     
-    return TypedPointer(atAnyIndex(), out.addPtr(result, m_offset + offset));
+    return TypedPointer(atAnyIndex(), out.addPtr(result, offset));
 }
 
 const AbstractField& IndexedAbstractHeap::atSlow(ptrdiff_t index)
@@ -116,7 +101,7 @@ const AbstractField& IndexedAbstractHeap::atSlow(ptrdiff_t index)
     ASSERT(static_cast<size_t>(index) >= m_smallIndices.size());
     
     if (UNLIKELY(!m_largeIndices))
-        m_largeIndices = std::make_unique<MapType>();
+        m_largeIndices = adoptPtr(new MapType());
 
     std::unique_ptr<AbstractField>& field = m_largeIndices->add(index, nullptr).iterator->value;
     if (!field) {
@@ -183,20 +168,16 @@ void IndexedAbstractHeap::initialize(AbstractField& field, ptrdiff_t signedIndex
             accumulator >>= 4;
         }
         
-        field.initialize(&m_heapForAnyIndex, characters, m_offset + signedIndex * m_elementSize);
+        field.initialize(&m_heapForAnyIndex, characters, signedIndex * m_elementSize);
         return;
     }
     
     RELEASE_ASSERT_NOT_REACHED();
 }
 
-void IndexedAbstractHeap::dump(PrintStream& out) const
-{
-    out.print("Indexed:", atAnyIndex());
-}
-
-NumberedAbstractHeap::NumberedAbstractHeap(LContext context, AbstractHeap* heap, const char* heapName)
-    : m_indexedHeap(context, heap, heapName, 0, 1)
+NumberedAbstractHeap::NumberedAbstractHeap(
+    LContext context, AbstractHeap* heap, const char* heapName)
+    : m_indexedHeap(context, heap, heapName, 1)
 {
 }
 
@@ -204,13 +185,9 @@ NumberedAbstractHeap::~NumberedAbstractHeap()
 {
 }
 
-void NumberedAbstractHeap::dump(PrintStream& out) const
-{
-    out.print("Numbered: ", atAnyNumber());
-}
-
-AbsoluteAbstractHeap::AbsoluteAbstractHeap(LContext context, AbstractHeap* heap, const char* heapName)
-    : m_indexedHeap(context, heap, heapName, 0, 1)
+AbsoluteAbstractHeap::AbsoluteAbstractHeap(
+    LContext context, AbstractHeap* heap, const char* heapName)
+    : m_indexedHeap(context, heap, heapName, 1)
 {
 }
 
@@ -218,11 +195,6 @@ AbsoluteAbstractHeap::~AbsoluteAbstractHeap()
 {
 }
 
-void AbsoluteAbstractHeap::dump(PrintStream& out) const
-{
-    out.print("Absolute:", atAnyAddress());
-}
-
 } } // namespace JSC::FTL
 
 #endif // ENABLE(FTL_JIT)
diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeap.h b/Source/JavaScriptCore/ftl/FTLAbstractHeap.h
index a19ce38a5..e92a2fc2c 100644
--- a/Source/JavaScriptCore/ftl/FTLAbstractHeap.h
+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeap.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef FTLAbstractHeap_h
 #define FTLAbstractHeap_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviations.h"
@@ -34,6 +36,7 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
 
@@ -71,11 +74,6 @@ public:
         m_parent = parent;
         m_heapName = heapName;
     }
-    
-    void changeParent(AbstractHeap* parent)
-    {
-        m_parent = parent;
-    }
 
     AbstractHeap* parent() const
     {
@@ -99,8 +97,6 @@ public:
     
     void decorateInstruction(LValue instruction, const AbstractHeapRepository&) const;
 
-    void dump(PrintStream&) const;
-
 private:
     friend class AbstractHeapRepository;
     
@@ -137,15 +133,13 @@ public:
         return m_offset;
     }
     
-    void dump(PrintStream&) const;
-
 private:
     ptrdiff_t m_offset;
 };
 
 class IndexedAbstractHeap {
 public:
-    IndexedAbstractHeap(LContext, AbstractHeap* parent, const char* heapName, ptrdiff_t offset, size_t elementSize);
+    IndexedAbstractHeap(LContext, AbstractHeap* parent, const char* heapName, size_t elementSize);
     ~IndexedAbstractHeap();
     
     const AbstractHeap& atAnyIndex() const { return m_heapForAnyIndex; }
@@ -161,8 +155,6 @@ public:
     
     TypedPointer baseIndex(Output& out, LValue base, LValue index, JSValue indexAsConstant = JSValue(), ptrdiff_t offset = 0);
     
-    void dump(PrintStream&) const;
-
 private:
     const AbstractField& returnInitialized(AbstractField& field, ptrdiff_t index)
     {
@@ -176,7 +168,6 @@ private:
 
     AbstractHeap m_heapForAnyIndex;
     size_t m_heapNameLength;
-    ptrdiff_t m_offset;
     size_t m_elementSize;
     LValue m_scaleTerm;
     bool m_canShift;
@@ -188,7 +179,7 @@ private:
     };
     typedef HashMap<ptrdiff_t, std::unique_ptr<AbstractField>, WTF::IntHash<ptrdiff_t>, WithoutZeroOrOneHashTraits> MapType;
     
-    std::unique_ptr<MapType> m_largeIndices;
+    OwnPtr<MapType> m_largeIndices;
     Vector<CString, 16> m_largeIndexNames;
 };
 
@@ -207,8 +198,6 @@ public:
     const AbstractHeap& at(unsigned number) { return m_indexedHeap.at(number); }
     const AbstractHeap& operator[](unsigned number) { return at(number); }
 
-    void dump(PrintStream&) const;
-
 private:
     
     // We use the fact that the indexed heap already has a superset of the
@@ -230,8 +219,6 @@ public:
     
     const AbstractHeap& operator[](void* address) { return at(address); }
 
-    void dump(PrintStream&) const;
-
 private:
     // The trick here is that the indexed heap is "indexed" by a pointer-width
     // integer. Pointers are themselves pointer-width integers. So we can reuse
diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp
index e416fdaaf..d7f83c960 100644
--- a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp
+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,14 +28,9 @@
 
 #if ENABLE(FTL_JIT)
 
-#include "DirectArguments.h"
-#include "GetterSetter.h"
-#include "JSEnvironmentRecord.h"
-#include "JSPropertyNameEnumerator.h"
 #include "JSScope.h"
-#include "JSCInlines.h"
-#include "ScopedArguments.h"
-#include "ScopedArgumentsTable.h"
+#include "JSVariableObject.h"
+#include "Operations.h"
 
 namespace JSC { namespace FTL {
 
@@ -50,9 +45,9 @@ AbstractHeapRepository::AbstractHeapRepository(LContext context)
     FOR_EACH_ABSTRACT_FIELD(ABSTRACT_FIELD_INITIALIZATION)
 #undef ABSTRACT_FIELD_INITIALIZATION
     
-    , JSCell_freeListNext(JSCell_structureID)
+    , JSCell_freeListNext(JSCell_structure)
     
-#define INDEXED_ABSTRACT_HEAP_INITIALIZATION(name, offset, size) , name(context, &root, #name, offset, size)
+#define INDEXED_ABSTRACT_HEAP_INITIALIZATION(name, size) , name(context, &root, #name, size)
     FOR_EACH_INDEXED_ABSTRACT_HEAP(INDEXED_ABSTRACT_HEAP_INITIALIZATION)
 #undef INDEXED_ABSTRACT_HEAP_INITIALIZATION
     
@@ -64,17 +59,6 @@ AbstractHeapRepository::AbstractHeapRepository(LContext context)
     , m_context(context)
     , m_tbaaKind(mdKindID(m_context, "tbaa"))
 {
-    // Make sure that our explicit assumptions about the StructureIDBlob match reality.
-    RELEASE_ASSERT(!(JSCell_indexingType.offset() & (sizeof(int32_t) - 1)));
-    RELEASE_ASSERT(JSCell_indexingType.offset() + 1 == JSCell_typeInfoType.offset());
-    RELEASE_ASSERT(JSCell_indexingType.offset() + 2 == JSCell_typeInfoFlags.offset());
-    RELEASE_ASSERT(JSCell_indexingType.offset() + 3 == JSCell_gcData.offset());
-
-    JSCell_indexingType.changeParent(&JSCell_usefulBytes);
-    JSCell_typeInfoType.changeParent(&JSCell_usefulBytes);
-    JSCell_typeInfoFlags.changeParent(&JSCell_usefulBytes);
-    JSCell_gcData.changeParent(&JSCell_usefulBytes);
-    
     root.m_tbaaMetadata = mdNode(m_context, mdString(m_context, root.m_heapName));
     
     RELEASE_ASSERT(m_tbaaKind);
diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
index 581f4cbd9..f811c8be5 100644
--- a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,89 +26,52 @@
 #ifndef FTLAbstractHeapRepository_h
 #define FTLAbstractHeapRepository_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
-#include "DFGArrayMode.h"
 #include "FTLAbstractHeap.h"
 #include "IndexingType.h"
 
 namespace JSC { namespace FTL {
 
 #define FOR_EACH_ABSTRACT_HEAP(macro) \
-    macro(typedArrayProperties)
+    macro(length) \
+    macro(typedArrayProperties) \
+    macro(WriteBarrierBuffer_bufferContents)
 
 #define FOR_EACH_ABSTRACT_FIELD(macro) \
-    macro(ArrayBuffer_data, ArrayBuffer::offsetOfData()) \
-    macro(Butterfly_arrayBuffer, Butterfly::offsetOfArrayBuffer()) \
     macro(Butterfly_publicLength, Butterfly::offsetOfPublicLength()) \
     macro(Butterfly_vectorLength, Butterfly::offsetOfVectorLength()) \
     macro(CallFrame_callerFrame, CallFrame::callerFrameOffset()) \
-    macro(DirectArguments_callee, DirectArguments::offsetOfCallee()) \
-    macro(DirectArguments_length, DirectArguments::offsetOfLength()) \
-    macro(DirectArguments_minCapacity, DirectArguments::offsetOfMinCapacity()) \
-    macro(DirectArguments_overrides, DirectArguments::offsetOfOverrides()) \
-    macro(GetterSetter_getter, GetterSetter::offsetOfGetter()) \
-    macro(GetterSetter_setter, GetterSetter::offsetOfSetter()) \
     macro(JSArrayBufferView_length, JSArrayBufferView::offsetOfLength()) \
     macro(JSArrayBufferView_mode, JSArrayBufferView::offsetOfMode()) \
     macro(JSArrayBufferView_vector, JSArrayBufferView::offsetOfVector()) \
-    macro(JSCell_structureID, JSCell::structureIDOffset()) \
-    macro(JSCell_usefulBytes, JSCell::indexingTypeOffset()) \
-    macro(JSCell_typeInfoFlags, JSCell::typeInfoFlagsOffset()) \
-    macro(JSCell_typeInfoType, JSCell::typeInfoTypeOffset()) \
-    macro(JSCell_indexingType, JSCell::indexingTypeOffset()) \
-    macro(JSCell_gcData, JSCell::gcDataOffset()) \
-    macro(JSFunction_executable, JSFunction::offsetOfExecutable()) \
-    macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
-    macro(JSFunction_rareData, JSFunction::offsetOfRareData()) \
+    macro(JSCell_structure, JSCell::structureOffset()) \
     macro(JSObject_butterfly, JSObject::butterflyOffset()) \
-    macro(JSPropertyNameEnumerator_cachedInlineCapacity, JSPropertyNameEnumerator::cachedInlineCapacityOffset()) \
-    macro(JSPropertyNameEnumerator_cachedPropertyNamesVector, JSPropertyNameEnumerator::cachedPropertyNamesVectorOffset()) \
-    macro(JSPropertyNameEnumerator_cachedStructureID, JSPropertyNameEnumerator::cachedStructureIDOffset()) \
-    macro(JSPropertyNameEnumerator_endGenericPropertyIndex, JSPropertyNameEnumerator::endGenericPropertyIndexOffset()) \
-    macro(JSPropertyNameEnumerator_endStructurePropertyIndex, JSPropertyNameEnumerator::endStructurePropertyIndexOffset()) \
-    macro(JSPropertyNameEnumerator_indexLength, JSPropertyNameEnumerator::indexedLengthOffset()) \
     macro(JSScope_next, JSScope::offsetOfNext()) \
-    macro(JSString_flags, JSString::offsetOfFlags()) \
     macro(JSString_length, JSString::offsetOfLength()) \
     macro(JSString_value, JSString::offsetOfValue()) \
-    macro(JSSymbolTableObject_symbolTable, JSSymbolTableObject::offsetOfSymbolTable()) \
-    macro(JSWrapperObject_internalValue, JSWrapperObject::internalValueOffset()) \
+    macro(JSVariableObject_registers, JSVariableObject::offsetOfRegisters()) \
     macro(MarkedAllocator_freeListHead, MarkedAllocator::offsetOfFreeListHead()) \
     macro(MarkedBlock_markBits, MarkedBlock::offsetOfMarks()) \
-    macro(ScopedArguments_overrodeThings, ScopedArguments::offsetOfOverrodeThings()) \
-    macro(ScopedArguments_scope, ScopedArguments::offsetOfScope()) \
-    macro(ScopedArguments_table, ScopedArguments::offsetOfTable()) \
-    macro(ScopedArguments_totalLength, ScopedArguments::offsetOfTotalLength()) \
-    macro(ScopedArgumentsTable_arguments, ScopedArgumentsTable::offsetOfArguments()) \
-    macro(ScopedArgumentsTable_length, ScopedArgumentsTable::offsetOfLength()) \
     macro(StringImpl_data, StringImpl::dataOffset()) \
     macro(StringImpl_hashAndFlags, StringImpl::flagsOffset()) \
     macro(Structure_classInfo, Structure::classInfoOffset()) \
     macro(Structure_globalObject, Structure::globalObjectOffset()) \
-    macro(Structure_prototype, Structure::prototypeOffset()) \
-    macro(Structure_structureID, Structure::structureIDOffset()) \
-    macro(Symbol_privateName, Symbol::offsetOfPrivateName())
+    macro(Structure_indexingType, Structure::indexingTypeOffset()) \
+    macro(Structure_typeInfoFlags, Structure::typeInfoFlagsOffset()) \
+    macro(Structure_typeInfoType, Structure::typeInfoTypeOffset())
 
 #define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \
-    macro(DirectArguments_storage, DirectArguments::storageOffset(), sizeof(EncodedJSValue)) \
-    macro(JSEnvironmentRecord_variables, JSEnvironmentRecord::offsetOfVariables(), sizeof(EncodedJSValue)) \
-    macro(JSPropertyNameEnumerator_cachedPropertyNamesVectorContents, 0, sizeof(WriteBarrier<JSString>)) \
-    macro(JSRopeString_fibers, JSRopeString::offsetOfFibers(), sizeof(WriteBarrier<JSString>)) \
-    macro(MarkedSpace_Subspace_impreciseAllocators, OBJECT_OFFSETOF(MarkedSpace::Subspace, impreciseAllocators), sizeof(MarkedAllocator)) \
-    macro(MarkedSpace_Subspace_preciseAllocators, OBJECT_OFFSETOF(MarkedSpace::Subspace, preciseAllocators), sizeof(MarkedAllocator)) \
-    macro(ScopedArguments_overflowStorage, ScopedArguments::overflowStorageOffset(), sizeof(EncodedJSValue)) \
-    macro(WriteBarrierBuffer_bufferContents, 0, sizeof(JSCell*)) \
-    macro(characters8, 0, sizeof(LChar)) \
-    macro(characters16, 0, sizeof(UChar)) \
-    macro(indexedInt32Properties, 0, sizeof(EncodedJSValue)) \
-    macro(indexedDoubleProperties, 0, sizeof(double)) \
-    macro(indexedContiguousProperties, 0, sizeof(EncodedJSValue)) \
-    macro(indexedArrayStorageProperties, 0, sizeof(EncodedJSValue)) \
-    macro(scopedArgumentsTableArguments, 0, sizeof(int32_t)) \
-    macro(singleCharacterStrings, 0, sizeof(JSString*)) \
-    macro(structureTable, 0, sizeof(Structure*)) \
-    macro(variables, 0, sizeof(Register))
+    macro(characters8, sizeof(LChar)) \
+    macro(characters16, sizeof(UChar)) \
+    macro(indexedInt32Properties, sizeof(EncodedJSValue)) \
+    macro(indexedDoubleProperties, sizeof(double)) \
+    macro(indexedContiguousProperties, sizeof(EncodedJSValue)) \
+    macro(indexedArrayStorageProperties, sizeof(EncodedJSValue)) \
+    macro(singleCharacterStrings, sizeof(JSString*)) \
+    macro(variables, sizeof(Register))
     
 #define FOR_EACH_NUMBERED_ABSTRACT_HEAP(macro) \
     macro(properties)
@@ -134,7 +97,7 @@ public:
     
     AbstractField& JSCell_freeListNext;
     
-#define INDEXED_ABSTRACT_HEAP_DECLARATION(name, offset, size) IndexedAbstractHeap name;
+#define INDEXED_ABSTRACT_HEAP_DECLARATION(name, size) IndexedAbstractHeap name;
     FOR_EACH_INDEXED_ABSTRACT_HEAP(INDEXED_ABSTRACT_HEAP_DECLARATION)
 #undef INDEXED_ABSTRACT_HEAP_DECLARATION
     
@@ -168,24 +131,6 @@ public:
             return 0;
         }
     }
-    
-    IndexedAbstractHeap& forArrayType(DFG::Array::Type type)
-    {
-        switch (type) {
-        case DFG::Array::Int32:
-            return indexedInt32Properties;
-        case DFG::Array::Double:
-            return indexedDoubleProperties;
-        case DFG::Array::Contiguous:
-            return indexedContiguousProperties;
-        case DFG::Array::ArrayStorage:
-        case DFG::Array::SlowPutArrayStorage:
-            return indexedArrayStorageProperties;
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-            return indexedInt32Properties;
-        }
-    }
 
 private:
     friend class AbstractHeap;
diff --git a/Source/JavaScriptCore/ftl/FTLAvailableRecovery.cpp b/Source/JavaScriptCore/ftl/FTLAvailableRecovery.cpp
deleted file mode 100644
index 6c00fa4d9..000000000
--- a/Source/JavaScriptCore/ftl/FTLAvailableRecovery.cpp
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLAvailableRecovery.h"
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC { namespace FTL {
-
-void AvailableRecovery::dump(PrintStream& out) const
-{
-    out.print(node(), " => ", opcode(), ", ", RawPointer(m_left), ", ", RawPointer(m_right), ", ", m_format);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLAvailableRecovery.h b/Source/JavaScriptCore/ftl/FTLAvailableRecovery.h
deleted file mode 100644
index fcaf4a22d..000000000
--- a/Source/JavaScriptCore/ftl/FTLAvailableRecovery.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLAvailableRecovery_h
-#define FTLAvailableRecovery_h
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGNode.h"
-#include "FTLAbbreviatedTypes.h"
-#include "FTLRecoveryOpcode.h"
-#include "FTLValueFormat.h"
-
-namespace JSC { namespace FTL {
-
-class AvailableRecovery {
-public:
-    AvailableRecovery()
-        : m_node(0)
-        , m_format(InvalidValueFormat)
-        , m_opcode(AddRecovery)
-        , m_left(0)
-        , m_right(0)
-    {
-    }
-    
-    AvailableRecovery(DFG::Node* node, RecoveryOpcode opcode, LValue left, LValue right, ValueFormat format)
-        : m_node(node)
-        , m_format(format)
-        , m_opcode(opcode)
-        , m_left(left)
-        , m_right(right)
-    {
-    }
-    
-    DFG::Node* node() const { return m_node; }
-    ValueFormat format() const { return m_format; }
-    RecoveryOpcode opcode() const { return m_opcode; }
-    LValue left() const { return m_left; }
-    LValue right() const { return m_right; }
-    
-    void dump(PrintStream&) const;
-    
-private:
-    DFG::Node* m_node;
-    ValueFormat m_format;
-    RecoveryOpcode m_opcode;
-    LValue m_left;
-    LValue m_right;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLAvailableRecovery_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
index b27d3a25a..86a28cf8a 100644
--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,11 +32,6 @@ namespace JSC { namespace FTL {
 
 using namespace DFG;
 
-static bool verboseCapabilities()
-{
-    return verboseCompilationEnabled() || Options::verboseFTLFailure();
-}
-
 inline CapabilityLevel canCompile(Node* node)
 {
     // NOTE: If we ever have phantom arguments, we can compile them but we cannot
@@ -44,11 +39,9 @@ inline CapabilityLevel canCompile(Node* node)
     
     switch (node->op()) {
     case JSConstant:
+    case WeakJSConstant:
     case GetLocal:
     case SetLocal:
-    case PutStack:
-    case KillStack:
-    case GetStack:
     case MovHint:
     case ZombieHint:
     case Phantom:
@@ -63,23 +56,20 @@ inline CapabilityLevel canCompile(Node* node)
     case BitLShift:
     case BitURShift:
     case CheckStructure:
-    case DoubleAsInt32:
+    case StructureTransitionWatchpoint:
     case ArrayifyToStructure:
     case PutStructure:
+    case PhantomPutStructure:
     case GetButterfly:
     case NewObject:
     case NewArray:
     case NewArrayBuffer:
     case GetByOffset:
-    case GetGetterSetterByOffset:
-    case GetGetter:
-    case GetSetter:
     case PutByOffset:
     case GetGlobalVar:
     case PutGlobalVar:
     case ValueAdd:
     case ArithAdd:
-    case ArithClz32:
     case ArithSub:
     case ArithMul:
     case ArithDiv:
@@ -87,124 +77,46 @@ inline CapabilityLevel canCompile(Node* node)
     case ArithMin:
     case ArithMax:
     case ArithAbs:
-    case ArithSin:
-    case ArithCos:
-    case ArithPow:
-    case ArithRound:
-    case ArithSqrt:
-    case ArithLog:
-    case ArithFRound:
     case ArithNegate:
     case UInt32ToNumber:
+    case Int32ToDouble:
     case CompareEqConstant:
+    case CompareStrictEqConstant:
     case Jump:
     case ForceOSRExit:
     case Phi:
     case Upsilon:
     case ExtractOSREntryLocal:
     case LoopHint:
+    case Call:
+    case Construct:
+    case GetMyScope:
     case SkipScope:
-    case CreateActivation:
-    case NewFunction:
+    case GetClosureRegisters:
     case GetClosureVar:
     case PutClosureVar:
-    case CreateDirectArguments:
-    case CreateScopedArguments:
-    case CreateClonedArguments:
-    case GetFromArguments:
-    case PutToArguments:
+    case Int52ToValue:
     case InvalidationPoint:
     case StringCharAt:
-    case CheckCell:
-    case CheckBadCell:
-    case CheckNotEmpty:
-    case CheckIdent:
+    case CheckFunction:
     case StringCharCodeAt:
     case AllocatePropertyStorage:
-    case ReallocatePropertyStorage:
-    case GetTypedArrayByteOffset:
+    case FunctionReentryWatchpoint:
+    case TypedArrayWatchpoint:
+    case VariableWatchpoint:
     case NotifyWrite:
     case StoreBarrier:
-    case Call:
-    case Construct:
-    case CallVarargs:
-    case CallForwardVarargs:
-    case ConstructVarargs:
-    case ConstructForwardVarargs:
-    case LoadVarargs:
+    case ConditionalStoreBarrier:
+    case StoreBarrierWithNullCheck:
     case ValueToInt32:
     case Branch:
     case LogicalNot:
     case CheckInBounds:
     case ConstantStoragePointer:
     case Check:
-    case CountExecution:
-    case GetExecutable:
-    case GetScope:
-    case GetCallee:
-    case GetArgumentCount:
-    case ToString:
-    case CallStringConstructor:
-    case MakeRope:
-    case NewArrayWithSize:
-    case GetById:
-    case ToThis:
-    case MultiGetByOffset:
-    case MultiPutByOffset:
-    case ToPrimitive:
-    case Throw:
-    case ThrowReferenceError:
-    case Unreachable:
-    case IsUndefined:
-    case IsBoolean:
-    case IsNumber:
-    case IsString:
-    case IsObject:
-    case IsObjectOrNull:
-    case IsFunction:
-    case CheckHasInstance:
-    case InstanceOf:
-    case DoubleRep:
-    case ValueRep:
-    case Int52Rep:
-    case DoubleConstant:
-    case Int52Constant:
-    case BooleanToNumber:
-    case HasGenericProperty:
-    case HasStructureProperty:
-    case GetDirectPname:
-    case GetEnumerableLength:
-    case GetPropertyEnumerator:
-    case GetEnumeratorStructurePname:
-    case GetEnumeratorGenericPname:
-    case ToIndexString:
-    case BottomValue:
-    case PhantomNewObject:
-    case PhantomNewFunction:
-    case PhantomCreateActivation:
-    case PutHint:
-    case CheckStructureImmediate:
-    case MaterializeNewObject:
-    case MaterializeCreateActivation:
-    case PhantomDirectArguments:
-    case PhantomClonedArguments:
-    case GetMyArgumentByVal:
-    case ForwardVarargs:
-    case Switch:
-    case TypeOf:
         // These are OK.
         break;
-    case Identity:
-        // No backend handles this because it will be optimized out. But we may check
-        // for capabilities before optimization. It would be a deep error to remove this
-        // case because it would prevent us from catching bugs where the FTL backend
-        // pipeline failed to optimize out an Identity.
-        break;
-    case In:
-        if (node->child2().useKind() == CellUse)
-            break;
-        return CannotCompile;
-    case PutByIdDirect:
+    case GetById:
     case PutById:
         if (node->child1().useKind() == CellUse)
             break;
@@ -220,8 +132,6 @@ inline CapabilityLevel canCompile(Node* node)
         case Array::Int32:
         case Array::Double:
         case Array::Contiguous:
-        case Array::DirectArguments:
-        case Array::ScopedArguments:
             break;
         default:
             if (isTypedView(node->arrayMode().typedArrayType()))
@@ -235,8 +145,6 @@ inline CapabilityLevel canCompile(Node* node)
         case Array::Double:
         case Array::Contiguous:
         case Array::String:
-        case Array::DirectArguments:
-        case Array::ScopedArguments:
             break;
         default:
             if (isTypedView(node->arrayMode().typedArrayType()))
@@ -244,17 +152,6 @@ inline CapabilityLevel canCompile(Node* node)
             return CannotCompile;
         }
         break;
-    case HasIndexedProperty:
-        switch (node->arrayMode().type()) {
-        case Array::ForceExit:
-        case Array::Int32:
-        case Array::Double:
-        case Array::Contiguous:
-            break;
-        default:
-            return CannotCompile;
-        }
-        break;
     case GetByVal:
         switch (node->arrayMode().type()) {
         case Array::ForceExit:
@@ -263,9 +160,6 @@ inline CapabilityLevel canCompile(Node* node)
         case Array::Int32:
         case Array::Double:
         case Array::Contiguous:
-        case Array::Undecided:
-        case Array::DirectArguments:
-        case Array::ScopedArguments:
             break;
         default:
             if (isTypedView(node->arrayMode().typedArrayType()))
@@ -289,62 +183,27 @@ inline CapabilityLevel canCompile(Node* node)
             return CannotCompile;
         }
         break;
-    case ArrayPush:
-    case ArrayPop:
-        switch (node->arrayMode().type()) {
-        case Array::Int32:
-        case Array::Contiguous:
-        case Array::Double:
-            break;
-        default:
-            return CannotCompile;
-        }
-        break;
     case CompareEq:
         if (node->isBinaryUseKind(Int32Use))
             break;
-        if (node->isBinaryUseKind(Int52RepUse))
+        if (node->isBinaryUseKind(MachineIntUse))
             break;
-        if (node->isBinaryUseKind(DoubleRepUse))
-            break;
-        if (node->isBinaryUseKind(StringIdentUse))
+        if (node->isBinaryUseKind(NumberUse))
             break;
         if (node->isBinaryUseKind(ObjectUse))
             break;
         if (node->isBinaryUseKind(UntypedUse))
             break;
-        if (node->isBinaryUseKind(BooleanUse))
-            break;
-        if (node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse))
-            break;
-        if (node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse))
-            break;
         return CannotCompile;
     case CompareStrictEq:
         if (node->isBinaryUseKind(Int32Use))
             break;
-        if (node->isBinaryUseKind(Int52RepUse))
-            break;
-        if (node->isBinaryUseKind(DoubleRepUse))
-            break;
-        if (node->isBinaryUseKind(StringIdentUse))
-            break;
-        if (node->isBinaryUseKind(ObjectUse, UntypedUse))
+        if (node->isBinaryUseKind(MachineIntUse))
             break;
-        if (node->isBinaryUseKind(UntypedUse, ObjectUse))
+        if (node->isBinaryUseKind(NumberUse))
             break;
         if (node->isBinaryUseKind(ObjectUse))
             break;
-        if (node->isBinaryUseKind(BooleanUse))
-            break;
-        if (node->isBinaryUseKind(MiscUse, UntypedUse))
-            break;
-        if (node->isBinaryUseKind(UntypedUse, MiscUse))
-            break;
-        if (node->isBinaryUseKind(StringIdentUse, NotStringVarUse))
-            break;
-        if (node->isBinaryUseKind(NotStringVarUse, StringIdentUse))
-            break;
         return CannotCompile;
     case CompareLess:
     case CompareLessEq:
@@ -352,13 +211,22 @@ inline CapabilityLevel canCompile(Node* node)
     case CompareGreaterEq:
         if (node->isBinaryUseKind(Int32Use))
             break;
-        if (node->isBinaryUseKind(Int52RepUse))
+        if (node->isBinaryUseKind(MachineIntUse))
             break;
-        if (node->isBinaryUseKind(DoubleRepUse))
+        if (node->isBinaryUseKind(NumberUse))
             break;
         if (node->isBinaryUseKind(UntypedUse))
             break;
         return CannotCompile;
+    case Switch:
+        switch (node->switchData()->kind) {
+        case SwitchImm:
+        case SwitchChar:
+            break;
+        default:
+            return CannotCompile;
+        }
+        break;
     default:
         // Don't know how to handle anything else.
         return CannotCompile;
@@ -368,15 +236,9 @@ inline CapabilityLevel canCompile(Node* node)
 
 CapabilityLevel canCompile(Graph& graph)
 {
-    if (graph.m_codeBlock->instructionCount() > Options::maximumFTLCandidateInstructionCount()) {
-        if (verboseCapabilities())
-            dataLog("FTL rejecting ", *graph.m_codeBlock, " because it's too big.\n");
-        return CannotCompile;
-    }
-    
     if (graph.m_codeBlock->codeType() != FunctionCode) {
-        if (verboseCapabilities())
-            dataLog("FTL rejecting ", *graph.m_codeBlock, " because it doesn't belong to a function.\n");
+        if (verboseCompilationEnabled())
+            dataLog("FTL rejecting code block that doesn't belong to a function.\n");
         return CannotCompile;
     }
     
@@ -402,37 +264,23 @@ CapabilityLevel canCompile(Graph& graph)
                 case UntypedUse:
                 case Int32Use:
                 case KnownInt32Use:
-                case Int52RepUse:
+                case MachineIntUse:
                 case NumberUse:
+                case KnownNumberUse:
                 case RealNumberUse:
-                case DoubleRepUse:
-                case DoubleRepRealUse:
                 case BooleanUse:
-                case KnownBooleanUse:
                 case CellUse:
                 case KnownCellUse:
                 case ObjectUse:
-                case FunctionUse:
                 case ObjectOrOtherUse:
                 case StringUse:
-                case KnownStringUse:
-                case StringObjectUse:
-                case StringOrStringObjectUse:
-                case SymbolUse:
                 case FinalObjectUse:
-                case NotCellUse:
-                case OtherUse:
-                case MiscUse:
-                case StringIdentUse:
-                case NotStringVarUse:
-                case MachineIntUse:
-                case DoubleRepMachineIntUse:
                     // These are OK.
                     break;
                 default:
                     // Don't know how to handle anything else.
-                    if (verboseCapabilities()) {
-                        dataLog("FTL rejecting node in ", *graph.m_codeBlock, " because of bad use kind: ", edge.useKind(), " in node:\n");
+                    if (verboseCompilationEnabled()) {
+                        dataLog("FTL rejecting node because of bad use kind: ", edge.useKind(), " in node:\n");
                         graph.dump(WTF::dataFile(), "    ", node);
                     }
                     return CannotCompile;
@@ -441,8 +289,8 @@ CapabilityLevel canCompile(Graph& graph)
             
             switch (canCompile(node)) {
             case CannotCompile: 
-                if (verboseCapabilities()) {
-                    dataLog("FTL rejecting node in ", *graph.m_codeBlock, ":\n");
+                if (verboseCompilationEnabled()) {
+                    dataLog("FTL rejecting node:\n");
                     graph.dump(WTF::dataFile(), "    ", node);
                 }
                 return CannotCompile;
diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.h b/Source/JavaScriptCore/ftl/FTLCapabilities.h
index 4a79b2a1b..75a426df1 100644
--- a/Source/JavaScriptCore/ftl/FTLCapabilities.h
+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.h
@@ -26,6 +26,8 @@
 #ifndef FTLCapabilities_h
 #define FTLCapabilities_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGGraph.h"
diff --git a/Source/JavaScriptCore/ftl/FTLCommonValues.cpp b/Source/JavaScriptCore/ftl/FTLCommonValues.cpp
index f25bbe291..653bb7ddd 100644
--- a/Source/JavaScriptCore/ftl/FTLCommonValues.cpp
+++ b/Source/JavaScriptCore/ftl/FTLCommonValues.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -61,10 +61,6 @@ CommonValues::CommonValues(LContext context)
     , intPtrEight(constInt(intPtr, 8, SignExtend))
     , intPtrPtr(constInt(intPtr, sizeof(void*), SignExtend))
     , doubleZero(constReal(doubleType, 0))
-    , rangeKind(mdKindID(context, "range"))
-    , profKind(mdKindID(context, "prof"))
-    , branchWeights(mdString(context, "branch_weights"))
-    , nonNegativeInt32(constInt(int32, 0, SignExtend), constInt(int32, 1ll << 31, SignExtend))
     , m_context(context)
     , m_module(0)
 {
diff --git a/Source/JavaScriptCore/ftl/FTLCommonValues.h b/Source/JavaScriptCore/ftl/FTLCommonValues.h
index 7ae059bc8..848090210 100644
--- a/Source/JavaScriptCore/ftl/FTLCommonValues.h
+++ b/Source/JavaScriptCore/ftl/FTLCommonValues.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,11 @@
 #ifndef FTLCommonValues_h
 #define FTLCommonValues_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviations.h"
-#include "FTLValueRange.h"
 
 namespace JSC { namespace FTL {
 
@@ -73,12 +74,6 @@ public:
     const LValue intPtrPtr;
     const LValue doubleZero;
     
-    const unsigned rangeKind;
-    const unsigned profKind;
-    const LValue branchWeights;
-    
-    const ValueRange nonNegativeInt32;
-
     LContext const m_context;
     LModule m_module;
 };
diff --git a/Source/JavaScriptCore/ftl/FTLCompile.cpp b/Source/JavaScriptCore/ftl/FTLCompile.cpp
index c6fcca05e..6c01f4fa5 100644
--- a/Source/JavaScriptCore/ftl/FTLCompile.cpp
+++ b/Source/JavaScriptCore/ftl/FTLCompile.cpp
@@ -1,7 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
- * Copyright (C) 2014 Samsung Electronics
- * Copyright (C) 2014 University of Szeged
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,14 +31,12 @@
 #include "CodeBlockWithJITType.h"
 #include "CCallHelpers.h"
 #include "DFGCommon.h"
-#include "DFGGraphSafepoint.h"
 #include "DataView.h"
 #include "Disassembler.h"
 #include "FTLExitThunkGenerator.h"
 #include "FTLInlineCacheSize.h"
 #include "FTLJITCode.h"
 #include "FTLThunks.h"
-#include "FTLUnwindInfo.h"
 #include "JITStubs.h"
 #include "LLVMAPI.h"
 #include "LinkBuffer.h"
@@ -53,30 +49,14 @@ using namespace DFG;
 static uint8_t* mmAllocateCodeSection(
     void* opaqueState, uintptr_t size, unsigned alignment, unsigned, const char* sectionName)
 {
+    
     State& state = *static_cast<State*>(opaqueState);
     
     RELEASE_ASSERT(alignment <= jitAllocationGranule);
     
     RefPtr<ExecutableMemoryHandle> result =
         state.graph.m_vm.executableAllocator.allocate(
-            state.graph.m_vm, size, state.graph.m_codeBlock, JITCompilationCanFail);
-    
-    if (!result) {
-        // Signal failure. This compilation will get tossed.
-        state.allocationFailed = true;
-        
-        // Fake an allocation, since LLVM cannot handle failures in the memory manager.
-        RefPtr<DataSection> fakeSection = adoptRef(new DataSection(size, jitAllocationGranule));
-        state.jitCode->addDataSection(fakeSection);
-        return bitwise_cast<uint8_t*>(fakeSection->base());
-    }
-    
-    // LLVM used to put __compact_unwind in a code section. We keep this here defensively,
-    // for clients that use older LLVMs.
-    if (!strcmp(sectionName, SECTION_NAME("compact_unwind"))) {
-        state.unwindDataSection = result->start();
-        state.unwindDataSectionSize = result->sizeInBytes();
-    }
+            state.graph.m_vm, size, state.graph.m_codeBlock, JITCompilationMustSucceed);
     
     state.jitCode->addHandle(result);
     state.codeSectionNames.append(sectionName);
@@ -91,32 +71,21 @@ static uint8_t* mmAllocateDataSection(
     UNUSED_PARAM(sectionID);
     UNUSED_PARAM(isReadOnly);
 
-    // Allocate the GOT in the code section to make it reachable for all code.
-    if (!strcmp(sectionName, SECTION_NAME("got")))
-        return mmAllocateCodeSection(opaqueState, size, alignment, sectionID, sectionName);
-
     State& state = *static_cast<State*>(opaqueState);
-
-    RefPtr<DataSection> section = adoptRef(new DataSection(size, alignment));
-
-    if (!strcmp(sectionName, SECTION_NAME("llvm_stackmaps")))
+    
+    RELEASE_ASSERT(alignment <= sizeof(LSectionWord));
+    
+    RefCountedArray<LSectionWord> section(
+        (size + sizeof(LSectionWord) - 1) / sizeof(LSectionWord));
+    
+    if (!strcmp(sectionName, "__llvm_stackmaps"))
         state.stackmapsSection = section;
     else {
         state.jitCode->addDataSection(section);
         state.dataSectionNames.append(sectionName);
-#if OS(DARWIN)
-        if (!strcmp(sectionName, SECTION_NAME("compact_unwind"))) {
-#elif OS(LINUX)
-        if (!strcmp(sectionName, SECTION_NAME("eh_frame"))) {
-#else
-#error "Unrecognized OS"
-#endif
-            state.unwindDataSection = section->base();
-            state.unwindDataSectionSize = size;
-        }
     }
-
-    return bitwise_cast<uint8_t*>(section->base());
+    
+    return bitwise_cast<uint8_t*>(section.data());
 }
 
 static LLVMBool mmApplyPermissions(void*, char**)
@@ -128,74 +97,13 @@ static void mmDestroy(void*)
 {
 }
 
-static void dumpDataSection(DataSection* section, const char* prefix)
+static void dumpDataSection(RefCountedArray<LSectionWord> section, const char* prefix)
 {
-    for (unsigned j = 0; j < section->size() / sizeof(int64_t); ++j) {
+    for (unsigned j = 0; j < section.size(); ++j) {
         char buf[32];
-        int64_t* wordPointer = static_cast<int64_t*>(section->base()) + j;
-        snprintf(buf, sizeof(buf), "0x%lx", static_cast<unsigned long>(bitwise_cast<uintptr_t>(wordPointer)));
-        dataLogF("%s%16s: 0x%016llx\n", prefix, buf, static_cast<long long>(*wordPointer));
-    }
-}
-
-static int offsetOfStackRegion(StackMaps::RecordMap& recordMap, uint32_t stackmapID)
-{
-    if (stackmapID == UINT_MAX)
-        return 0;
-    
-    StackMaps::RecordMap::iterator iter = recordMap.find(stackmapID);
-    RELEASE_ASSERT(iter != recordMap.end());
-    RELEASE_ASSERT(iter->value.size() == 1);
-    RELEASE_ASSERT(iter->value[0].locations.size() == 1);
-    Location capturedLocation =
-        Location::forStackmaps(nullptr, iter->value[0].locations[0]);
-    RELEASE_ASSERT(capturedLocation.kind() == Location::Register);
-    RELEASE_ASSERT(capturedLocation.gpr() == GPRInfo::callFrameRegister);
-    RELEASE_ASSERT(!(capturedLocation.addend() % sizeof(Register)));
-    return capturedLocation.addend() / sizeof(Register);
-}
-
-static void generateInlineIfPossibleOutOfLineIfNot(State& state, VM& vm, CodeBlock* codeBlock, CCallHelpers& code, char* startOfInlineCode, size_t sizeOfInlineCode, const char* codeDescription, const std::function<void(LinkBuffer&, CCallHelpers&, bool wasCompiledInline)>& callback)
-{
-    std::unique_ptr<LinkBuffer> codeLinkBuffer;
-    size_t actualCodeSize = code.m_assembler.buffer().codeSize();
-
-    if (actualCodeSize <= sizeOfInlineCode) {
-        LinkBuffer codeLinkBuffer(vm, code, startOfInlineCode, sizeOfInlineCode);
-
-        // Fill the remainder of the inline space with nops to avoid confusing the disassembler.
-        MacroAssembler::AssemblerType_T::fillNops(bitwise_cast<char*>(startOfInlineCode) + actualCodeSize, sizeOfInlineCode - actualCodeSize);
-
-        callback(codeLinkBuffer, code, true);
-
-        return;
+        snprintf(buf, sizeof(buf), "0x%lx", static_cast<unsigned long>(bitwise_cast<uintptr_t>(section.data() + j)));
+        dataLogF("%s%16s: 0x%016llx\n", prefix, buf, static_cast<long long>(section[j]));
     }
-
-    // If there isn't enough space in the provided inline code area, allocate out of line
-    // executable memory to link the provided code. Place a jump at the beginning of the
-    // inline area and jump to the out of line code. Similarly return by appending a jump
-    // to the provided code that goes to the instruction after the inline code.
-    // Fill the middle with nop's.
-    MacroAssembler::Jump returnToMainline = code.jump();
-
-    // Allocate out of line executable memory and link the provided code there.
-    codeLinkBuffer = std::make_unique<LinkBuffer>(vm, code, codeBlock, JITCompilationMustSucceed);
-
-    // Plant a jmp in the inline buffer to the out of line code.
-    MacroAssembler callToOutOfLineCode;
-    MacroAssembler::Jump jumpToOutOfLine = callToOutOfLineCode.jump();
-    LinkBuffer inlineBuffer(vm, callToOutOfLineCode, startOfInlineCode, sizeOfInlineCode);
-    inlineBuffer.link(jumpToOutOfLine, codeLinkBuffer->entrypoint());
-
-    // Fill the remainder of the inline space with nops to avoid confusing the disassembler.
-    MacroAssembler::AssemblerType_T::fillNops(bitwise_cast<char*>(startOfInlineCode) + inlineBuffer.size(), sizeOfInlineCode - inlineBuffer.size());
-
-    // Link the end of the out of line code to right after the inline area.
-    codeLinkBuffer->link(returnToMainline, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(startOfInlineCode)).labelAtOffset(sizeOfInlineCode));
-
-    callback(*codeLinkBuffer.get(), code, false);
-
-    state.finalizer->outOfLineCodeInfos.append(OutOfLineCodeInfo(WTF::move(codeLinkBuffer), codeDescription));
 }
 
 template<typename DescriptorType>
@@ -211,360 +119,148 @@ void generateICFastPath(
         return;
     }
     
-    Vector<StackMaps::Record>& records = iter->value;
-    
-    RELEASE_ASSERT(records.size() == ic.m_generators.size());
-    
-    for (unsigned i = records.size(); i--;) {
-        StackMaps::Record& record = records[i];
-        auto generator = ic.m_generators[i];
+    StackMaps::Record& record = iter->value;
 
-        CCallHelpers fastPathJIT(&vm, codeBlock);
-        generator.generateFastPath(fastPathJIT);
-        
-        char* startOfIC =
-            bitwise_cast<char*>(generatedFunction) + record.instructionOffset;
+    CCallHelpers fastPathJIT(&vm, codeBlock);
+    ic.m_generator.generateFastPath(fastPathJIT);
 
-        generateInlineIfPossibleOutOfLineIfNot(state, vm, codeBlock, fastPathJIT, startOfIC, sizeOfIC, "inline cache fast path", [&] (LinkBuffer& linkBuffer, CCallHelpers&, bool) {
-            state.finalizer->sideCodeLinkBuffer->link(ic.m_slowPathDone[i],
-                CodeLocationLabel(startOfIC + sizeOfIC));
-
-            linkBuffer.link(generator.slowPathJump(),
-                state.finalizer->sideCodeLinkBuffer->locationOf(generator.slowPathBegin()));
-
-            generator.finalize(linkBuffer, *state.finalizer->sideCodeLinkBuffer);
-        });
-    }
-}
-
-static void generateCheckInICFastPath(
-    State& state, CodeBlock* codeBlock, GeneratedFunction generatedFunction,
-    StackMaps::RecordMap& recordMap, CheckInDescriptor& ic, size_t sizeOfIC)
-{
-    VM& vm = state.graph.m_vm;
-
-    StackMaps::RecordMap::iterator iter = recordMap.find(ic.stackmapID());
-    if (iter == recordMap.end()) {
-        // It was optimized out.
-        return;
-    }
-    
-    Vector<StackMaps::Record>& records = iter->value;
+    char* startOfIC =
+        bitwise_cast<char*>(generatedFunction) + record.instructionOffset;
+            
+    LinkBuffer linkBuffer(vm, &fastPathJIT, startOfIC, sizeOfIC);
+    // Note: we could handle the !isValid() case. We just don't appear to have a
+    // reason to do so, yet.
+    RELEASE_ASSERT(linkBuffer.isValid());
     
-    RELEASE_ASSERT(records.size() == ic.m_generators.size());
-
-    for (unsigned i = records.size(); i--;) {
-        StackMaps::Record& record = records[i];
-        auto generator = ic.m_generators[i];
-
-        StructureStubInfo& stubInfo = *generator.m_stub;
-        auto call = generator.m_slowCall;
-        auto slowPathBegin = generator.m_beginLabel;
-
-        CCallHelpers fastPathJIT(&vm, codeBlock);
-        
-        auto jump = fastPathJIT.patchableJump();
-        auto done = fastPathJIT.label();
-
-        char* startOfIC =
-            bitwise_cast<char*>(generatedFunction) + record.instructionOffset;
-
-        auto postLink = [&] (LinkBuffer& fastPath, CCallHelpers&, bool) {
-            LinkBuffer& slowPath = *state.finalizer->sideCodeLinkBuffer;
-
-            state.finalizer->sideCodeLinkBuffer->link(
-                ic.m_slowPathDone[i], CodeLocationLabel(startOfIC + sizeOfIC));
-
-            CodeLocationLabel slowPathBeginLoc = slowPath.locationOf(slowPathBegin);
-            fastPath.link(jump, slowPathBeginLoc);
-
-            CodeLocationCall callReturnLocation = slowPath.locationOf(call);
-
-            stubInfo.patch.deltaCallToDone = MacroAssembler::differenceBetweenCodePtr(
-                callReturnLocation, fastPath.locationOf(done));
-
-            stubInfo.patch.deltaCallToJump = MacroAssembler::differenceBetweenCodePtr(
-                callReturnLocation, fastPath.locationOf(jump));
-            stubInfo.callReturnLocation = callReturnLocation;
-            stubInfo.patch.deltaCallToSlowCase = MacroAssembler::differenceBetweenCodePtr(
-                callReturnLocation, slowPathBeginLoc);
-        };
-
-        generateInlineIfPossibleOutOfLineIfNot(state, vm, codeBlock, fastPathJIT, startOfIC, sizeOfIC, "CheckIn inline cache", postLink);
-    }
-}
-
-
-static RegisterSet usedRegistersFor(const StackMaps::Record& record)
-{
-    if (Options::assumeAllRegsInFTLICAreLive())
-        return RegisterSet::allRegisters();
-    return RegisterSet(record.usedRegisterSet(), RegisterSet::calleeSaveRegisters());
-}
-
-template<typename CallType>
-void adjustCallICsForStackmaps(Vector<CallType>& calls, StackMaps::RecordMap& recordMap)
-{
-    // Handling JS calls is weird: we need to ensure that we sort them by the PC in LLVM
-    // generated code. That implies first pruning the ones that LLVM didn't generate.
-
-    Vector<CallType> oldCalls;
-    oldCalls.swap(calls);
+    MacroAssembler::AssemblerType_T::fillNops(
+        startOfIC + linkBuffer.size(), sizeOfIC - linkBuffer.size());
     
-    for (unsigned i = 0; i < oldCalls.size(); ++i) {
-        CallType& call = oldCalls[i];
-        
-        StackMaps::RecordMap::iterator iter = recordMap.find(call.stackmapID());
-        if (iter == recordMap.end())
-            continue;
-        
-        for (unsigned j = 0; j < iter->value.size(); ++j) {
-            CallType copy = call;
-            copy.m_instructionOffset = iter->value[j].instructionOffset;
-            calls.append(copy);
-        }
-    }
-
-    std::sort(calls.begin(), calls.end());
+    state.finalizer->sideCodeLinkBuffer->link(
+        ic.m_slowPathDone, CodeLocationLabel(startOfIC + sizeOfIC));
+            
+    linkBuffer.link(
+        ic.m_generator.slowPathJump(),
+        state.finalizer->sideCodeLinkBuffer->locationOf(ic.m_generator.slowPathBegin()));
+            
+    ic.m_generator.finalize(linkBuffer, *state.finalizer->sideCodeLinkBuffer);
 }
 
 static void fixFunctionBasedOnStackMaps(
     State& state, CodeBlock* codeBlock, JITCode* jitCode, GeneratedFunction generatedFunction,
-    StackMaps::RecordMap& recordMap, bool didSeeUnwindInfo)
+    StackMaps::RecordMap& recordMap)
 {
-    Graph& graph = state.graph;
-    VM& vm = graph.m_vm;
+    VM& vm = state.graph.m_vm;
     StackMaps stackmaps = jitCode->stackmaps;
-    
-    int localsOffset = offsetOfStackRegion(recordMap, state.capturedStackmapID) + graph.m_nextMachineLocal;
-    int varargsSpillSlotsOffset = offsetOfStackRegion(recordMap, state.varargsSpillSlotsStackmapID);
-    
-    for (unsigned i = graph.m_inlineVariableData.size(); i--;) {
-        InlineCallFrame* inlineCallFrame = graph.m_inlineVariableData[i].inlineCallFrame;
-        
-        if (inlineCallFrame->argumentCountRegister.isValid())
-            inlineCallFrame->argumentCountRegister += localsOffset;
-        
-        for (unsigned argument = inlineCallFrame->arguments.size(); argument-- > 1;) {
-            inlineCallFrame->arguments[argument] =
-                inlineCallFrame->arguments[argument].withLocalsOffset(localsOffset);
-        }
-        
-        if (inlineCallFrame->isClosureCall) {
-            inlineCallFrame->calleeRecovery =
-                inlineCallFrame->calleeRecovery.withLocalsOffset(localsOffset);
-        }
-
-        if (graph.hasDebuggerEnabled())
-            codeBlock->setScopeRegister(codeBlock->scopeRegister() + localsOffset);
-    }
-    
-    MacroAssembler::Label stackOverflowException;
-
-    {
-        CCallHelpers checkJIT(&vm, codeBlock);
-        
-        // At this point it's perfectly fair to just blow away all state and restore the
-        // JS JIT view of the universe.
-        checkJIT.move(MacroAssembler::TrustedImmPtr(&vm), GPRInfo::argumentGPR0);
-        checkJIT.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
-        MacroAssembler::Call callLookupExceptionHandler = checkJIT.call();
-        checkJIT.jumpToExceptionHandler();
-
-        stackOverflowException = checkJIT.label();
-        checkJIT.move(MacroAssembler::TrustedImmPtr(&vm), GPRInfo::argumentGPR0);
-        checkJIT.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1);
-        MacroAssembler::Call callLookupExceptionHandlerFromCallerFrame = checkJIT.call();
-        checkJIT.jumpToExceptionHandler();
-
-        auto linkBuffer = std::make_unique<LinkBuffer>(
-            vm, checkJIT, codeBlock, JITCompilationCanFail);
-        if (linkBuffer->didFailToAllocate()) {
-            state.allocationFailed = true;
-            return;
-        }
-        linkBuffer->link(callLookupExceptionHandler, FunctionPtr(lookupExceptionHandler));
-        linkBuffer->link(callLookupExceptionHandlerFromCallerFrame, FunctionPtr(lookupExceptionHandlerFromCallerFrame));
-
-        state.finalizer->handleExceptionsLinkBuffer = WTF::move(linkBuffer);
-    }
 
     ExitThunkGenerator exitThunkGenerator(state);
     exitThunkGenerator.emitThunks();
     if (exitThunkGenerator.didThings()) {
-        RELEASE_ASSERT(state.finalizer->osrExit.size());
-        RELEASE_ASSERT(didSeeUnwindInfo);
+        OwnPtr<LinkBuffer> linkBuffer = adoptPtr(new LinkBuffer(
+            vm, &exitThunkGenerator, codeBlock, JITCompilationMustSucceed));
         
-        auto linkBuffer = std::make_unique<LinkBuffer>(
-            vm, exitThunkGenerator, codeBlock, JITCompilationCanFail);
-        if (linkBuffer->didFailToAllocate()) {
-            state.allocationFailed = true;
-            return;
-        }
-        
-        RELEASE_ASSERT(state.finalizer->osrExit.size() == state.jitCode->osrExit.size());
+        ASSERT(state.finalizer->osrExit.size() == state.jitCode->osrExit.size());
         
         for (unsigned i = 0; i < state.jitCode->osrExit.size(); ++i) {
             OSRExitCompilationInfo& info = state.finalizer->osrExit[i];
             OSRExit& exit = jitCode->osrExit[i];
             
-            if (verboseCompilationEnabled())
+            if (Options::verboseCompilation())
                 dataLog("Handling OSR stackmap #", exit.m_stackmapID, " for ", exit.m_codeOrigin, "\n");
-
-            auto iter = recordMap.find(exit.m_stackmapID);
+            
+            StackMaps::RecordMap::iterator iter = recordMap.find(exit.m_stackmapID);
             if (iter == recordMap.end()) {
                 // It was optimized out.
                 continue;
             }
             
             info.m_thunkAddress = linkBuffer->locationOf(info.m_thunkLabel);
-            exit.m_patchableCodeOffset = linkBuffer->offsetOf(info.m_thunkJump);
-            
-            for (unsigned j = exit.m_values.size(); j--;)
-                exit.m_values[j] = exit.m_values[j].withLocalsOffset(localsOffset);
-            for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
-                materialization->accountForLocalsOffset(localsOffset);
             
-            if (verboseCompilationEnabled()) {
-                DumpContext context;
-                dataLog("    Exit values: ", inContext(exit.m_values, &context), "\n");
-                if (!exit.m_materializations.isEmpty()) {
-                    dataLog("    Materializations: \n");
-                    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
-                        dataLog("        Materialize(", pointerDump(materialization), ")\n");
-                }
-            }
+            exit.m_patchableCodeOffset = linkBuffer->offsetOf(info.m_thunkJump);
         }
         
-        state.finalizer->exitThunksLinkBuffer = WTF::move(linkBuffer);
+        state.finalizer->exitThunksLinkBuffer = linkBuffer.release();
     }
 
-    if (!state.getByIds.isEmpty() || !state.putByIds.isEmpty() || !state.checkIns.isEmpty()) {
+    if (!state.getByIds.isEmpty() || !state.putByIds.isEmpty()) {
         CCallHelpers slowPathJIT(&vm, codeBlock);
         
-        CCallHelpers::JumpList exceptionTarget;
-        
         for (unsigned i = state.getByIds.size(); i--;) {
             GetByIdDescriptor& getById = state.getByIds[i];
             
-            if (verboseCompilationEnabled())
+            if (Options::verboseCompilation())
                 dataLog("Handling GetById stackmap #", getById.stackmapID(), "\n");
             
-            auto iter = recordMap.find(getById.stackmapID());
+            StackMaps::RecordMap::iterator iter = recordMap.find(getById.stackmapID());
             if (iter == recordMap.end()) {
                 // It was optimized out.
                 continue;
             }
             
-            for (unsigned i = 0; i < iter->value.size(); ++i) {
-                StackMaps::Record& record = iter->value[i];
+            StackMaps::Record& record = iter->value;
             
-                RegisterSet usedRegisters = usedRegistersFor(record);
-                
-                GPRReg result = record.locations[0].directGPR();
-                GPRReg base = record.locations[1].directGPR();
-                
-                JITGetByIdGenerator gen(
-                    codeBlock, getById.codeOrigin(), usedRegisters, JSValueRegs(base),
-                    JSValueRegs(result), NeedToSpill);
-                
-                MacroAssembler::Label begin = slowPathJIT.label();
-
-                MacroAssembler::Call call = callOperation(
-                    state, usedRegisters, slowPathJIT, getById.codeOrigin(), &exceptionTarget,
-                    operationGetByIdOptimize, result, gen.stubInfo(), base, getById.uid());
-
-                gen.reportSlowPathCall(begin, call);
-
-                getById.m_slowPathDone.append(slowPathJIT.jump());
-                getById.m_generators.append(gen);
-            }
+            // FIXME: LLVM should tell us which registers are live.
+            RegisterSet usedRegisters = RegisterSet::allRegisters();
+            
+            GPRReg result = record.locations[0].directGPR();
+            GPRReg callFrameRegister = record.locations[1].directGPR();
+            GPRReg base = record.locations[2].directGPR();
+            
+            JITGetByIdGenerator gen(
+                codeBlock, getById.codeOrigin(), usedRegisters, callFrameRegister,
+                JSValueRegs(base), JSValueRegs(result), false);
+            
+            MacroAssembler::Label begin = slowPathJIT.label();
+            
+            MacroAssembler::Call call = callOperation(
+                state, usedRegisters, slowPathJIT, operationGetByIdOptimize, result,
+                callFrameRegister, gen.stubInfo(), base, getById.uid());
+            
+            gen.reportSlowPathCall(begin, call);
+            
+            getById.m_slowPathDone = slowPathJIT.jump();
+            getById.m_generator = gen;
         }
         
         for (unsigned i = state.putByIds.size(); i--;) {
             PutByIdDescriptor& putById = state.putByIds[i];
             
-            if (verboseCompilationEnabled())
+            if (Options::verboseCompilation())
                 dataLog("Handling PutById stackmap #", putById.stackmapID(), "\n");
             
-            auto iter = recordMap.find(putById.stackmapID());
+            StackMaps::RecordMap::iterator iter = recordMap.find(putById.stackmapID());
             if (iter == recordMap.end()) {
                 // It was optimized out.
                 continue;
             }
             
-            for (unsigned i = 0; i < iter->value.size(); ++i) {
-                StackMaps::Record& record = iter->value[i];
-                
-                RegisterSet usedRegisters = usedRegistersFor(record);
-                
-                GPRReg base = record.locations[0].directGPR();
-                GPRReg value = record.locations[1].directGPR();
-                
-                JITPutByIdGenerator gen(
-                    codeBlock, putById.codeOrigin(), usedRegisters, JSValueRegs(base),
-                    JSValueRegs(value), GPRInfo::patchpointScratchRegister, NeedToSpill,
-                    putById.ecmaMode(), putById.putKind());
-                
-                MacroAssembler::Label begin = slowPathJIT.label();
-                
-                MacroAssembler::Call call = callOperation(
-                    state, usedRegisters, slowPathJIT, putById.codeOrigin(), &exceptionTarget,
-                    gen.slowPathFunction(), gen.stubInfo(), value, base, putById.uid());
-                
-                gen.reportSlowPathCall(begin, call);
-                
-                putById.m_slowPathDone.append(slowPathJIT.jump());
-                putById.m_generators.append(gen);
-            }
-        }
-
-        for (unsigned i = state.checkIns.size(); i--;) {
-            CheckInDescriptor& checkIn = state.checkIns[i];
+            StackMaps::Record& record = iter->value;
             
-            if (verboseCompilationEnabled())
-                dataLog("Handling checkIn stackmap #", checkIn.stackmapID(), "\n");
+            // FIXME: LLVM should tell us which registers are live.
+            RegisterSet usedRegisters = RegisterSet::allRegisters();
             
-            auto iter = recordMap.find(checkIn.stackmapID());
-            if (iter == recordMap.end()) {
-                // It was optimized out.
-                continue;
-            }
+            GPRReg callFrameRegister = record.locations[0].directGPR();
+            GPRReg base = record.locations[1].directGPR();
+            GPRReg value = record.locations[2].directGPR();
             
-            for (unsigned i = 0; i < iter->value.size(); ++i) {
-                StackMaps::Record& record = iter->value[i];
-                RegisterSet usedRegisters = usedRegistersFor(record);
-                GPRReg result = record.locations[0].directGPR();
-                GPRReg obj = record.locations[1].directGPR();
-                StructureStubInfo* stubInfo = codeBlock->addStubInfo(); 
-                stubInfo->codeOrigin = checkIn.codeOrigin();
-                stubInfo->patch.baseGPR = static_cast<int8_t>(obj);
-                stubInfo->patch.valueGPR = static_cast<int8_t>(result);
-                stubInfo->patch.usedRegisters = usedRegisters;
-                stubInfo->patch.spillMode = NeedToSpill;
-
-                MacroAssembler::Label begin = slowPathJIT.label();
-
-                MacroAssembler::Call slowCall = callOperation(
-                    state, usedRegisters, slowPathJIT, checkIn.codeOrigin(), &exceptionTarget,
-                    operationInOptimize, result, stubInfo, obj, checkIn.m_uid);
-
-                checkIn.m_slowPathDone.append(slowPathJIT.jump());
-                
-                checkIn.m_generators.append(CheckInGenerator(stubInfo, slowCall, begin));
-            }
+            JITPutByIdGenerator gen(
+                codeBlock, putById.codeOrigin(), usedRegisters, callFrameRegister,
+                JSValueRegs(base), JSValueRegs(value), MacroAssembler::scratchRegister,
+                false, putById.ecmaMode(), putById.putKind());
+            
+            MacroAssembler::Label begin = slowPathJIT.label();
+            
+            MacroAssembler::Call call = callOperation(
+                state, usedRegisters, slowPathJIT, gen.slowPathFunction(), callFrameRegister,
+                gen.stubInfo(), value, base, putById.uid());
+            
+            gen.reportSlowPathCall(begin, call);
+            
+            putById.m_slowPathDone = slowPathJIT.jump();
+            putById.m_generator = gen;
         }
         
-        exceptionTarget.link(&slowPathJIT);
-        MacroAssembler::Jump exceptionJump = slowPathJIT.jump();
-        
-        state.finalizer->sideCodeLinkBuffer = std::make_unique<LinkBuffer>(vm, slowPathJIT, codeBlock, JITCompilationCanFail);
-        if (state.finalizer->sideCodeLinkBuffer->didFailToAllocate()) {
-            state.allocationFailed = true;
-            return;
-        }
-        state.finalizer->sideCodeLinkBuffer->link(
-            exceptionJump, state.finalizer->handleExceptionsLinkBuffer->entrypoint());
+        state.finalizer->sideCodeLinkBuffer = adoptPtr(
+            new LinkBuffer(vm, &slowPathJIT, codeBlock, JITCompilationMustSucceed));
         
         for (unsigned i = state.getByIds.size(); i--;) {
             generateICFastPath(
@@ -576,227 +272,108 @@ static void fixFunctionBasedOnStackMaps(
                 state, codeBlock, generatedFunction, recordMap, state.putByIds[i],
                 sizeOfPutById());
         }
-
-        for (unsigned i = state.checkIns.size(); i--;) {
-            generateCheckInICFastPath(
-                state, codeBlock, generatedFunction, recordMap, state.checkIns[i],
-                sizeOfIn()); 
-        } 
-    }
-    
-    adjustCallICsForStackmaps(state.jsCalls, recordMap);
-    
-    for (unsigned i = state.jsCalls.size(); i--;) {
-        JSCall& call = state.jsCalls[i];
-
-        CCallHelpers fastPathJIT(&vm, codeBlock);
-        call.emit(fastPathJIT);
-
-        char* startOfIC = bitwise_cast<char*>(generatedFunction) + call.m_instructionOffset;
-
-        generateInlineIfPossibleOutOfLineIfNot(state, vm, codeBlock, fastPathJIT, startOfIC, sizeOfCall(), "JSCall inline cache", [&] (LinkBuffer& linkBuffer, CCallHelpers&, bool) {
-            call.link(vm, linkBuffer);
-        });
-    }
-    
-    adjustCallICsForStackmaps(state.jsCallVarargses, recordMap);
-    
-    for (unsigned i = state.jsCallVarargses.size(); i--;) {
-        JSCallVarargs& call = state.jsCallVarargses[i];
-        
-        CCallHelpers fastPathJIT(&vm, codeBlock);
-        call.emit(fastPathJIT, varargsSpillSlotsOffset);
-
-        char* startOfIC = bitwise_cast<char*>(generatedFunction) + call.m_instructionOffset;
-        size_t sizeOfIC = sizeOfICFor(call.node());
-
-        generateInlineIfPossibleOutOfLineIfNot(state, vm, codeBlock, fastPathJIT, startOfIC, sizeOfIC, "varargs call inline cache", [&] (LinkBuffer& linkBuffer, CCallHelpers&, bool) {
-            call.link(vm, linkBuffer, state.finalizer->handleExceptionsLinkBuffer->entrypoint());
-        });
     }
     
     RepatchBuffer repatchBuffer(codeBlock);
-
-    auto iter = recordMap.find(state.handleStackOverflowExceptionStackmapID);
-    // It's sort of remotely possible that we won't have an in-band exception handling
-    // path, for some kinds of functions.
-    if (iter != recordMap.end()) {
-        for (unsigned i = iter->value.size(); i--;) {
-            StackMaps::Record& record = iter->value[i];
-            
-            CodeLocationLabel source = CodeLocationLabel(
-                bitwise_cast<char*>(generatedFunction) + record.instructionOffset);
-
-            RELEASE_ASSERT(stackOverflowException.isSet());
-
-            repatchBuffer.replaceWithJump(source, state.finalizer->handleExceptionsLinkBuffer->locationOf(stackOverflowException));
-        }
-    }
-    
-    iter = recordMap.find(state.handleExceptionStackmapID);
-    // It's sort of remotely possible that we won't have an in-band exception handling
-    // path, for some kinds of functions.
-    if (iter != recordMap.end()) {
-        for (unsigned i = iter->value.size(); i--;) {
-            StackMaps::Record& record = iter->value[i];
-            
-            CodeLocationLabel source = CodeLocationLabel(
-                bitwise_cast<char*>(generatedFunction) + record.instructionOffset);
-            
-            repatchBuffer.replaceWithJump(source, state.finalizer->handleExceptionsLinkBuffer->entrypoint());
-        }
-    }
     
-    for (unsigned exitIndex = 0; exitIndex < jitCode->osrExit.size(); ++exitIndex) {
+    for (unsigned exitIndex = jitCode->osrExit.size(); exitIndex--;) {
         OSRExitCompilationInfo& info = state.finalizer->osrExit[exitIndex];
         OSRExit& exit = jitCode->osrExit[exitIndex];
-        iter = recordMap.find(exit.m_stackmapID);
+        StackMaps::RecordMap::iterator iter = recordMap.find(exit.m_stackmapID);
+        if (iter == recordMap.end()) {
+            // This could happen if LLVM optimizes out an OSR exit.
+            continue;
+        }
         
-        Vector<const void*> codeAddresses;
+        StackMaps::Record& record = iter->value;
         
-        if (iter != recordMap.end()) {
-            for (unsigned i = iter->value.size(); i--;) {
-                StackMaps::Record& record = iter->value[i];
-                
-                CodeLocationLabel source = CodeLocationLabel(
-                    bitwise_cast<char*>(generatedFunction) + record.instructionOffset);
-                
-                codeAddresses.append(bitwise_cast<char*>(generatedFunction) + record.instructionOffset + MacroAssembler::maxJumpReplacementSize());
-                
-                if (info.m_isInvalidationPoint)
-                    jitCode->common.jumpReplacements.append(JumpReplacement(source, info.m_thunkAddress));
-                else
-                    repatchBuffer.replaceWithJump(source, info.m_thunkAddress);
-            }
+        CodeLocationLabel source = CodeLocationLabel(
+            bitwise_cast<char*>(generatedFunction) + record.instructionOffset);
+        
+        if (info.m_isInvalidationPoint) {
+            jitCode->common.jumpReplacements.append(JumpReplacement(source, info.m_thunkAddress));
+            continue;
         }
         
-        if (graph.compilation())
-            graph.compilation()->addOSRExitSite(codeAddresses);
+        repatchBuffer.replaceWithJump(source, info.m_thunkAddress);
     }
 }
 
-void compile(State& state, Safepoint::Result& safepointResult)
+void compile(State& state)
 {
     char* error = 0;
     
-    {
-        GraphSafepoint safepoint(state.graph, safepointResult);
-        
-        LLVMMCJITCompilerOptions options;
-        llvm->InitializeMCJITCompilerOptions(&options, sizeof(options));
-        options.OptLevel = Options::llvmBackendOptimizationLevel();
-        options.NoFramePointerElim = true;
-        if (Options::useLLVMSmallCodeModel())
-            options.CodeModel = LLVMCodeModelSmall;
-        options.EnableFastISel = enableLLVMFastISel;
-        options.MCJMM = llvm->CreateSimpleMCJITMemoryManager(
-            &state, mmAllocateCodeSection, mmAllocateDataSection, mmApplyPermissions, mmDestroy);
+    LLVMMCJITCompilerOptions options;
+    llvm->InitializeMCJITCompilerOptions(&options, sizeof(options));
+    options.OptLevel = Options::llvmBackendOptimizationLevel();
+    options.NoFramePointerElim = true;
+    if (Options::useLLVMSmallCodeModel())
+        options.CodeModel = LLVMCodeModelSmall;
+    options.EnableFastISel = Options::enableLLVMFastISel();
+    options.MCJMM = llvm->CreateSimpleMCJITMemoryManager(
+        &state, mmAllocateCodeSection, mmAllocateDataSection, mmApplyPermissions, mmDestroy);
     
-        LLVMExecutionEngineRef engine;
-        
-        if (isARM64()) {
-#if OS(DARWIN)
-            llvm->SetTarget(state.module, "arm64-apple-ios");
-#elif OS(LINUX)
-            llvm->SetTarget(state.module, "aarch64-linux-gnu");
-#else
-#error "Unrecognized OS"
-#endif
-        }
-
-        if (llvm->CreateMCJITCompilerForModule(&engine, state.module, &options, sizeof(options), &error)) {
-            dataLog("FATAL: Could not create LLVM execution engine: ", error, "\n");
-            CRASH();
-        }
-        
-        // At this point we no longer own the module.
-        LModule module = state.module;
-        state.module = nullptr;
-
-        // The data layout also has to be set in the module. Get the data layout from the MCJIT and apply
-        // it to the module.
-        LLVMTargetMachineRef targetMachine = llvm->GetExecutionEngineTargetMachine(engine);
-        LLVMTargetDataRef targetData = llvm->GetExecutionEngineTargetData(engine);
-        char* stringRepOfTargetData = llvm->CopyStringRepOfTargetData(targetData);
-        llvm->SetDataLayout(module, stringRepOfTargetData);
-        free(stringRepOfTargetData);
-
-        LLVMPassManagerRef functionPasses = 0;
-        LLVMPassManagerRef modulePasses;
-
-        if (Options::llvmSimpleOpt()) {
-            modulePasses = llvm->CreatePassManager();
-            llvm->AddTargetData(targetData, modulePasses);
-            llvm->AddAnalysisPasses(targetMachine, modulePasses);
-            llvm->AddPromoteMemoryToRegisterPass(modulePasses);
-            llvm->AddGlobalOptimizerPass(modulePasses);
-            llvm->AddFunctionInliningPass(modulePasses);
-            llvm->AddPruneEHPass(modulePasses);
-            llvm->AddGlobalDCEPass(modulePasses);
-            llvm->AddConstantPropagationPass(modulePasses);
-            llvm->AddAggressiveDCEPass(modulePasses);
-            llvm->AddInstructionCombiningPass(modulePasses);
-            // BEGIN - DO NOT CHANGE THE ORDER OF THE ALIAS ANALYSIS PASSES
-            llvm->AddTypeBasedAliasAnalysisPass(modulePasses);
-            llvm->AddBasicAliasAnalysisPass(modulePasses);
-            // END - DO NOT CHANGE THE ORDER OF THE ALIAS ANALYSIS PASSES
-            llvm->AddGVNPass(modulePasses);
-            llvm->AddCFGSimplificationPass(modulePasses);
-            llvm->AddDeadStoreEliminationPass(modulePasses);
-            
-            if (enableLLVMFastISel)
-                llvm->AddLowerSwitchPass(modulePasses);
-
-            llvm->RunPassManager(modulePasses, module);
-        } else {
-            LLVMPassManagerBuilderRef passBuilder = llvm->PassManagerBuilderCreate();
-            llvm->PassManagerBuilderSetOptLevel(passBuilder, Options::llvmOptimizationLevel());
-            llvm->PassManagerBuilderUseInlinerWithThreshold(passBuilder, 275);
-            llvm->PassManagerBuilderSetSizeLevel(passBuilder, Options::llvmSizeLevel());
-        
-            functionPasses = llvm->CreateFunctionPassManagerForModule(module);
-            modulePasses = llvm->CreatePassManager();
-        
-            llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
-        
-            llvm->PassManagerBuilderPopulateFunctionPassManager(passBuilder, functionPasses);
-            llvm->PassManagerBuilderPopulateModulePassManager(passBuilder, modulePasses);
-        
-            llvm->PassManagerBuilderDispose(passBuilder);
-        
-            llvm->InitializeFunctionPassManager(functionPasses);
-            for (LValue function = llvm->GetFirstFunction(module); function; function = llvm->GetNextFunction(function))
-                llvm->RunFunctionPassManager(functionPasses, function);
-            llvm->FinalizeFunctionPassManager(functionPasses);
-        
-            llvm->RunPassManager(modulePasses, module);
-        }
-
-        if (shouldShowDisassembly() || verboseCompilationEnabled())
-            state.dumpState(module, "after optimization");
-        
-        // FIXME: Need to add support for the case where JIT memory allocation failed.
-        // https://bugs.webkit.org/show_bug.cgi?id=113620
-        state.generatedFunction = reinterpret_cast<GeneratedFunction>(llvm->GetPointerToGlobal(engine, state.function));
-        if (functionPasses)
-            llvm->DisposePassManager(functionPasses);
-        llvm->DisposePassManager(modulePasses);
-        llvm->DisposeExecutionEngine(engine);
+    LLVMExecutionEngineRef engine;
+    
+    if (llvm->CreateMCJITCompilerForModule(&engine, state.module, &options, sizeof(options), &error)) {
+        dataLog("FATAL: Could not create LLVM execution engine: ", error, "\n");
+        CRASH();
     }
 
-    if (safepointResult.didGetCancelled())
-        return;
-    RELEASE_ASSERT(!state.graph.m_vm.heap.isCollecting());
+    LLVMPassManagerRef functionPasses = 0;
+    LLVMPassManagerRef modulePasses;
     
-    if (state.allocationFailed)
-        return;
+    if (Options::llvmSimpleOpt()) {
+        modulePasses = llvm->CreatePassManager();
+        llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
+        llvm->AddPromoteMemoryToRegisterPass(modulePasses);
+        llvm->AddConstantPropagationPass(modulePasses);
+        llvm->AddInstructionCombiningPass(modulePasses);
+        llvm->AddBasicAliasAnalysisPass(modulePasses);
+        llvm->AddTypeBasedAliasAnalysisPass(modulePasses);
+        llvm->AddGVNPass(modulePasses);
+        llvm->AddCFGSimplificationPass(modulePasses);
+        llvm->RunPassManager(modulePasses, state.module);
+    } else {
+        LLVMPassManagerBuilderRef passBuilder = llvm->PassManagerBuilderCreate();
+        llvm->PassManagerBuilderSetOptLevel(passBuilder, Options::llvmOptimizationLevel());
+        llvm->PassManagerBuilderSetSizeLevel(passBuilder, Options::llvmSizeLevel());
+        
+        functionPasses = llvm->CreateFunctionPassManagerForModule(state.module);
+        modulePasses = llvm->CreatePassManager();
+        
+        llvm->AddTargetData(llvm->GetExecutionEngineTargetData(engine), modulePasses);
+        
+        llvm->PassManagerBuilderPopulateFunctionPassManager(passBuilder, functionPasses);
+        llvm->PassManagerBuilderPopulateModulePassManager(passBuilder, modulePasses);
+        
+        llvm->PassManagerBuilderDispose(passBuilder);
+        
+        llvm->InitializeFunctionPassManager(functionPasses);
+        for (LValue function = llvm->GetFirstFunction(state.module); function; function = llvm->GetNextFunction(function))
+            llvm->RunFunctionPassManager(functionPasses, function);
+        llvm->FinalizeFunctionPassManager(functionPasses);
+        
+        llvm->RunPassManager(modulePasses, state.module);
+    }
+
+    if (DFG::shouldShowDisassembly() || DFG::verboseCompilationEnabled())
+        state.dumpState("after optimization");
     
+    // FIXME: Need to add support for the case where JIT memory allocation failed.
+    // https://bugs.webkit.org/show_bug.cgi?id=113620
+    state.generatedFunction = reinterpret_cast<GeneratedFunction>(llvm->GetPointerToGlobal(engine, state.function));
+    if (functionPasses)
+        llvm->DisposePassManager(functionPasses);
+    llvm->DisposePassManager(modulePasses);
+    llvm->DisposeExecutionEngine(engine);
+
     if (shouldShowDisassembly()) {
         for (unsigned i = 0; i < state.jitCode->handles().size(); ++i) {
             ExecutableMemoryHandle* handle = state.jitCode->handles()[i].get();
             dataLog(
                 "Generated LLVM code for ",
-                CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::FTLJIT),
+                CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::DFGJIT),
                 " #", i, ", ", state.codeSectionNames[i], ":\n");
             disassemble(
                 MacroAssemblerCodePtr(handle->start()), handle->sizeInBytes(),
@@ -804,37 +381,26 @@ void compile(State& state, Safepoint::Result& safepointResult)
         }
         
         for (unsigned i = 0; i < state.jitCode->dataSections().size(); ++i) {
-            DataSection* section = state.jitCode->dataSections()[i].get();
+            const RefCountedArray<LSectionWord>& section = state.jitCode->dataSections()[i];
             dataLog(
                 "Generated LLVM data section for ",
-                CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::FTLJIT),
+                CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::DFGJIT),
                 " #", i, ", ", state.dataSectionNames[i], ":\n");
             dumpDataSection(section, "    ");
         }
     }
     
-    bool didSeeUnwindInfo = state.jitCode->unwindInfo.parse(
-        state.unwindDataSection, state.unwindDataSectionSize,
-        state.generatedFunction);
-    if (shouldShowDisassembly()) {
-        dataLog("Unwind info for ", CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::FTLJIT), ":\n");
-        if (didSeeUnwindInfo)
-            dataLog("    ", state.jitCode->unwindInfo, "\n");
-        else
-            dataLog("    <no unwind info>\n");
-    }
-    
-    if (state.stackmapsSection && state.stackmapsSection->size()) {
+    if (state.stackmapsSection.size()) {
         if (shouldShowDisassembly()) {
             dataLog(
                 "Generated LLVM stackmaps section for ",
-                CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::FTLJIT), ":\n");
+                CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::DFGJIT), ":\n");
             dataLog("    Raw data:\n");
-            dumpDataSection(state.stackmapsSection.get(), "    ");
+            dumpDataSection(state.stackmapsSection, "    ");
         }
         
         RefPtr<DataView> stackmapsData = DataView::create(
-            ArrayBuffer::create(state.stackmapsSection->base(), state.stackmapsSection->size()));
+            ArrayBuffer::create(state.stackmapsSection.data(), state.stackmapsSection.byteSize()));
         state.jitCode->stackmaps.parse(stackmapsData.get());
     
         if (shouldShowDisassembly()) {
@@ -842,40 +408,29 @@ void compile(State& state, Safepoint::Result& safepointResult)
             state.jitCode->stackmaps.dumpMultiline(WTF::dataFile(), "        ");
         }
         
-        StackMaps::RecordMap recordMap = state.jitCode->stackmaps.computeRecordMap();
+        StackMaps::RecordMap recordMap = state.jitCode->stackmaps.getRecordMap();
         fixFunctionBasedOnStackMaps(
             state, state.graph.m_codeBlock, state.jitCode.get(), state.generatedFunction,
-            recordMap, didSeeUnwindInfo);
-        if (state.allocationFailed)
-            return;
+            recordMap);
         
-        if (shouldShowDisassembly() || Options::asyncDisassembly()) {
+        if (shouldShowDisassembly()) {
             for (unsigned i = 0; i < state.jitCode->handles().size(); ++i) {
-                if (state.codeSectionNames[i] != SECTION_NAME("text"))
+                if (state.codeSectionNames[i] != "__text")
                     continue;
                 
                 ExecutableMemoryHandle* handle = state.jitCode->handles()[i].get();
-                
-                CString header = toCString(
+                dataLog(
                     "Generated LLVM code after stackmap-based fix-up for ",
-                    CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::FTLJIT),
-                    " in ", state.graph.m_plan.mode, " #", i, ", ",
-                    state.codeSectionNames[i], ":\n");
-                
-                if (Options::asyncDisassembly()) {
-                    disassembleAsynchronously(
-                        header, MacroAssemblerCodeRef(handle), handle->sizeInBytes(), "    ",
-                        LLVMSubset);
-                    continue;
-                }
-                
-                dataLog(header);
+                    CodeBlockWithJITType(state.graph.m_codeBlock, JITCode::DFGJIT),
+                    " #", i, ", ", state.codeSectionNames[i], ":\n");
                 disassemble(
                     MacroAssemblerCodePtr(handle->start()), handle->sizeInBytes(),
                     "    ", WTF::dataFile(), LLVMSubset);
             }
         }
     }
+    
+    state.module = 0; // We no longer own the module.
 }
 
 } } // namespace JSC::FTL
diff --git a/Source/JavaScriptCore/ftl/FTLCompile.h b/Source/JavaScriptCore/ftl/FTLCompile.h
index e4da4bd3d..c963643ed 100644
--- a/Source/JavaScriptCore/ftl/FTLCompile.h
+++ b/Source/JavaScriptCore/ftl/FTLCompile.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,14 +26,15 @@
 #ifndef FTLCompile_h
 #define FTLCompile_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
-#include "DFGSafepoint.h"
 #include "FTLState.h"
 
 namespace JSC { namespace FTL {
 
-void compile(State&, DFG::Safepoint::Result&);
+void compile(State&);
 
 } } // namespace JSC::FTL
 
diff --git a/Source/JavaScriptCore/ftl/FTLDWARFDebugLineInfo.cpp b/Source/JavaScriptCore/ftl/FTLDWARFDebugLineInfo.cpp
deleted file mode 100644
index 0a7a50898..000000000
--- a/Source/JavaScriptCore/ftl/FTLDWARFDebugLineInfo.cpp
+++ /dev/null
@@ -1,337 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "FTLDWARFDebugLineInfo.h"
-
-#if ENABLE(FTL_JIT)
-
-#include <wtf/DataLog.h>
-
-namespace JSC { namespace FTL {
-
-DebugLineInterpreter::DebugLineInterpreter(const char* program)
-    : m_program(program)
-    , m_logResults(false)
-{
-    resetInterpreterState();
-}
-
-template <typename T> inline T read(const char*& program)
-{
-    T result = *reinterpret_cast<const T*>(program);
-    program += sizeof(T);
-    return result;
-}
-
-uint32_t DebugLineInterpreter::parseULEB128(const char*& offset)
-{
-    uint32_t result = 0;
-    uint8_t byte;
-    unsigned shiftAmount = 0;
-    do {
-        byte = read<uint8_t>(offset);
-        result |= (byte & ~0x80) << shiftAmount;
-        shiftAmount += 7;
-    } while (byte & 0x80);
-    return result;
-}
-
-int32_t DebugLineInterpreter::parseSLEB128(const char*& offset)
-{
-    int32_t result = 0;
-    uint8_t byte;
-    unsigned shiftAmount = 0;
-    do {
-        byte = read<uint8_t>(offset);
-        result |= (byte & ~0x80) << shiftAmount;
-        shiftAmount += 7;
-    } while (byte & 0x80);
-    
-    // If the sign bit (in this case, the second MSB) on the last byte is set we need to zero extend.
-    if (byte & 0x40)
-        result |= -(1 << shiftAmount);
-    return result;
-}
-
-void DebugLineInterpreter::run()
-{
-    parsePrologue();
-    interpretStatementProgram();
-    if (m_logResults)
-        printLineInfo();
-}
-
-void DebugLineInterpreter::parsePrologue()
-{
-    const char* currentProgramOffset = m_program;
-    m_prologue.totalLength = read<uint32_t>(currentProgramOffset);
-    if (m_prologue.totalLength == 0xffffffff) {
-        // This is 64-bit DWARF format.
-        m_prologue.format = SixtyFourBit;
-        m_prologue.totalLength = read<uint64_t>(currentProgramOffset);
-    } else
-        m_prologue.format = ThirtyTwoBit;
-    m_prologue.version = read<uint16_t>(currentProgramOffset);
-    
-    if (m_prologue.format == ThirtyTwoBit)
-        m_prologue.prologueLength = read<uint32_t>(currentProgramOffset);
-    else
-        m_prologue.prologueLength = read<uint64_t>(currentProgramOffset);
-    const char* afterLengthOffset = currentProgramOffset;
-    
-    m_prologue.minimumInstructionLength = read<uint8_t>(currentProgramOffset);
-    m_prologue.defaultIsStatement = read<uint8_t>(currentProgramOffset);
-    m_prologue.lineBase = read<int8_t>(currentProgramOffset);
-    m_prologue.lineRange = read<uint8_t>(currentProgramOffset);
-    m_prologue.opcodeBase = read<uint8_t>(currentProgramOffset);
-    for (unsigned i = 1; i < m_prologue.opcodeBase; ++i)
-        m_prologue.standardOpcodeLengths.append(read<uint8_t>(currentProgramOffset));
-    parseIncludeDirectories(currentProgramOffset);
-    parseFileEntries(currentProgramOffset);
-    
-    m_program = afterLengthOffset + m_prologue.prologueLength;
-
-    if (!m_logResults)
-        return;
-
-    dataLog("\nPrologue:\n");
-    dataLog("totalLength = ", m_prologue.totalLength, "\n");
-    dataLog("version = ", m_prologue.version, "\n");
-    dataLog("prologueLength = ", m_prologue.prologueLength, "\n");
-    dataLog("minimumInstructionLength = ", m_prologue.minimumInstructionLength, "\n");
-    dataLog("defaultIsStatement = ", m_prologue.defaultIsStatement, "\n");
-    dataLog("lineBase = ", m_prologue.lineBase, "\n");
-    dataLog("lineRange = ", m_prologue.lineRange, "\n");
-    dataLog("opcodeBase = ", m_prologue.opcodeBase, "\n");
-    
-    dataLog("\nStandard Opcode Lengths:\n");
-    for (unsigned i = 1; i < m_prologue.opcodeBase; ++i)
-        dataLog("standardOpcodeLengths[", i - 1, "] = ", m_prologue.standardOpcodeLengths[i - 1], "\n");
-    
-    dataLog("\nInclude Directories:\n");
-    for (unsigned i = 0; i < m_prologue.includeDirectories.size(); ++i)
-        dataLog("includeDirectories[", i, "] = ", m_prologue.includeDirectories[i], "\n");
-    
-    dataLog("\nFiles:\n");
-    for (unsigned i = 0; i < m_prologue.fileEntries.size(); ++i) {
-        FileEntry& entry = m_prologue.fileEntries[i];
-        dataLog("fileEntries[", i, "] = {name: \"", entry.name, "\", dir_index: ", entry.directoryIndex, ", last_modified: ", entry.lastModified, ", size: ", entry.size, "}\n");
-    }
-}
-
-void DebugLineInterpreter::parseIncludeDirectories(const char*& offset)
-{
-    size_t length = 0;
-    while ((length = strlen(offset))) {
-        m_prologue.includeDirectories.append(offset);
-        offset += length + 1;
-    }
-    
-    // Extra increment to get past the last null byte.
-    offset += 1;
-}
-
-void DebugLineInterpreter::parseFileEntries(const char*& offset)
-{
-    while (true) {
-        DebugLineInterpreter::FileEntry nextEntry;
-        if (!parseFileEntry(offset, nextEntry))
-            break;
-        m_prologue.fileEntries.append(nextEntry);
-    }
-}
-
-bool DebugLineInterpreter::parseFileEntry(const char*& offset, FileEntry& entry)
-{
-    size_t length = strlen(offset);
-    if (!length) {
-        offset += 1;
-        return false;
-    }
-    entry.name = offset;
-    offset += length + 1;
-    entry.directoryIndex = parseULEB128(offset);
-    entry.lastModified = parseULEB128(offset);
-    entry.size = parseULEB128(offset);
-    
-    return true;
-}
-
-void DebugLineInterpreter::interpretStatementProgram()
-{
-    const char* currentProgramOffset = m_program;
-    bool keepGoing = true;
-    do {
-        keepGoing = interpretOpcode(currentProgramOffset);
-    } while (keepGoing);
-}
-
-bool DebugLineInterpreter::interpretOpcode(const char*& offset)
-{
-    uint8_t nextOpcode = read<uint8_t>(offset);
-    switch (nextOpcode) {
-    case ExtendedOpcodes: {
-        uint32_t length = parseULEB128(offset);
-        if (!length)
-            return false;
-        uint8_t extendedOpcode = read<uint8_t>(offset);
-        switch (extendedOpcode) {
-        case DW_LNE_end_sequence: {
-            m_currentState.endSequence = true;
-            m_lineInfoMatrix.append(m_currentState);
-            resetInterpreterState();
-            break;
-        }
-        case DW_LNE_set_address: {
-            m_currentState.address = read<size_t>(offset);
-            break;
-        }
-        case DW_LNE_define_file: {
-            fprintf(stderr, "Unimplemented extended opcode DW_LNE_define_file.\n");
-            RELEASE_ASSERT_NOT_REACHED();
-            break;
-        }
-        default: {
-            fprintf(stderr, "Unknown extended opcode.\n");
-            RELEASE_ASSERT_NOT_REACHED();
-            break;
-        }
-        }
-        break;
-    }
-        /* Standard opcodes */
-    case DW_LNS_copy: {
-        m_lineInfoMatrix.append(m_currentState);
-        m_currentState.isBasicBlock = false;
-        m_currentState.prologueEnd = false;
-        m_currentState.epilogueBegin = false;
-        break;
-    }
-    case DW_LNS_advance_pc: {
-        uint32_t advance = parseULEB128(offset);
-        m_currentState.address += advance * m_prologue.minimumInstructionLength;
-        break;
-    }
-    case DW_LNS_advance_line: {
-        int32_t advance = parseSLEB128(offset);
-        m_currentState.line += advance;
-        break;
-    }
-    case DW_LNS_set_file: {
-        uint32_t fileIndex = parseULEB128(offset);
-        m_currentState.file = fileIndex;
-        break;
-    }
-    case DW_LNS_set_column: {
-        m_currentState.column = parseULEB128(offset);
-        break;
-    }
-    case DW_LNS_negate_stmt: {
-        m_currentState.isStatement = !m_currentState.isStatement;
-        break;
-    }
-    case DW_LNS_set_basic_block: {
-        m_currentState.isBasicBlock = true;
-        break;
-    }
-    case DW_LNS_const_add_pc: {
-        uint8_t adjustedOpcode = nextOpcode - m_prologue.opcodeBase;
-        uint32_t addressIncrement = (adjustedOpcode / m_prologue.lineRange) * m_prologue.minimumInstructionLength;
-        m_currentState.address += addressIncrement;
-        break;
-    }
-    case DW_LNS_fixed_advance_pc: {
-        uint16_t advance = read<uint16_t>(offset);
-        m_currentState.address += advance;
-        break;
-    }
-    case DW_LNS_set_prologue_end: {
-        m_currentState.prologueEnd = true;
-        break;
-    }
-    case DW_LNS_set_epilogue_begin: {
-        m_currentState.epilogueBegin = true;
-        break;
-    }
-    case DW_LNS_set_isa: {
-        m_currentState.isa = parseULEB128(offset);
-        break;
-    }
-        /* Special opcodes */
-    default: {
-        uint8_t adjustedOpcode = nextOpcode - m_prologue.opcodeBase;
-        uint32_t addressIncrement = (adjustedOpcode / m_prologue.lineRange) * m_prologue.minimumInstructionLength;
-        int32_t lineIncrement = m_prologue.lineBase + (adjustedOpcode % m_prologue.lineRange);
-        m_currentState.address += addressIncrement;
-        m_currentState.line += lineIncrement;
-        m_lineInfoMatrix.append(m_currentState);
-        m_currentState.isBasicBlock = false;
-        m_currentState.prologueEnd = false;
-        m_currentState.epilogueBegin = false;
-        break;
-    }
-    }
-    return true;
-}
-
-void DebugLineInterpreter::printLineInfo()
-{
-    dataLog("\nLine Info Matrix:\n");
-    for (unsigned i = 0; i < m_lineInfoMatrix.size(); ++i)
-        printLineInfo(m_lineInfoMatrix[i]);
-    dataLog("\n");
-}
-
-void DebugLineInterpreter::printLineInfo(LineInfo& info)
-{
-    dataLogF("address: %p", reinterpret_cast<void*>(info.address));
-    dataLog("  file: ", info.file, "  line: ", info.line, "  column: ", info.column, "  isa: ", info.isa, "  ");
-    dataLog("  statement?: ", info.isStatement);
-    dataLog("  basic block?: ", info.isBasicBlock);
-    dataLog("  end sequence?: ", info.endSequence);
-    dataLog("  prologue end?: ", info.prologueEnd);
-    dataLog("  epilogue begin?: ", info.epilogueBegin);
-    dataLog("\n");
-}
-
-void DebugLineInterpreter::resetInterpreterState()
-{
-    m_currentState.address = 0;
-    m_currentState.file = 1;
-    m_currentState.line = 1;
-    m_currentState.column = 0;
-    m_currentState.isa = 0;
-    m_currentState.isStatement = false;
-    m_currentState.isBasicBlock = false;
-    m_currentState.endSequence = false;
-    m_currentState.prologueEnd = false;
-    m_currentState.epilogueBegin = false;
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLDWARFDebugLineInfo.h b/Source/JavaScriptCore/ftl/FTLDWARFDebugLineInfo.h
deleted file mode 100644
index 174a6c462..000000000
--- a/Source/JavaScriptCore/ftl/FTLDWARFDebugLineInfo.h
+++ /dev/null
@@ -1,142 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef FTLDWARFDebugLineInfo_h
-#define FTLDWARFDebugLineInfo_h
-
-#if ENABLE(FTL_JIT)
-
-#include <wtf/Vector.h>
-#include <wtf/text/WTFString.h>
-
-namespace JSC { namespace FTL {
-
-class DebugLineInterpreter {
-public:
-    DebugLineInterpreter(const char* program);
-
-    void run();
-
-private:
-    struct FileEntry {
-        String name;
-        uint32_t directoryIndex;
-        uint32_t lastModified;
-        uint32_t size;
-    };
-
-    void resetInterpreterState();
-    void interpretStatementProgram();
-    bool interpretOpcode(const char*&);
-    void parsePrologue();
-    void parseIncludeDirectories(const char*&);
-    void parseFileEntries(const char*&);
-    bool parseFileEntry(const char*&, DebugLineInterpreter::FileEntry&);
-    uint32_t parseULEB128(const char*&);
-    int32_t parseSLEB128(const char*&);
-
-    const char* m_program;
-    bool m_logResults;
-
-    struct LineInfo {
-        size_t address;
-        uint32_t file;
-        uint32_t line;
-        uint32_t column;
-        uint32_t isa;
-        bool isStatement;
-        bool isBasicBlock;
-        bool endSequence;
-        bool prologueEnd;
-        bool epilogueBegin;
-    };
-    
-    void printLineInfo(LineInfo&);
-    void printLineInfo();
-
-    LineInfo m_currentState;
-    Vector<LineInfo> m_lineInfoMatrix;
-
-    enum DwarfFormat {
-        SixtyFourBit,
-        ThirtyTwoBit
-    };
-
-    struct Prologue {
-        Prologue()
-            : totalLength(0)
-            , format(ThirtyTwoBit)
-            , version(0)
-            , prologueLength(0)
-            , minimumInstructionLength(0)
-            , defaultIsStatement(0)
-            , lineBase(0)
-            , lineRange(0)
-            , opcodeBase(0)
-        {
-        }
-
-        uint64_t totalLength;
-        DwarfFormat format;
-        uint16_t version;
-        uint64_t prologueLength;
-        uint8_t minimumInstructionLength;
-        uint8_t defaultIsStatement;
-        int8_t lineBase;
-        uint8_t lineRange;
-        uint8_t opcodeBase;
-        Vector<uint8_t> standardOpcodeLengths;
-        Vector<String> includeDirectories;
-        Vector<FileEntry> fileEntries;
-    } m_prologue;
-
-    enum ExtendedOpcode {
-        DW_LNE_end_sequence = 0x1,
-        DW_LNE_set_address  = 0x2,
-        DW_LNE_define_file  = 0x3
-    };
-
-    enum StandardOpcode {
-        ExtendedOpcodes             = 0x0,
-        DW_LNS_copy                 = 0x1,
-        DW_LNS_advance_pc           = 0x2,
-        DW_LNS_advance_line         = 0x3,
-        DW_LNS_set_file             = 0x4,
-        DW_LNS_set_column           = 0x5,
-        DW_LNS_negate_stmt          = 0x6,
-        DW_LNS_set_basic_block      = 0x7,
-        DW_LNS_const_add_pc         = 0x8,
-        DW_LNS_fixed_advance_pc     = 0x9,
-        DW_LNS_set_prologue_end     = 0xa,
-        DW_LNS_set_epilogue_begin   = 0xb,
-        DW_LNS_set_isa              = 0xc
-    };
-};
-
-} } // namespace JSC::FTL
-    
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLDWARFDebugLineInfo_h
diff --git a/Source/JavaScriptCore/ftl/FTLDWARFRegister.cpp b/Source/JavaScriptCore/ftl/FTLDWARFRegister.cpp
deleted file mode 100644
index 9bdaf05e7..000000000
--- a/Source/JavaScriptCore/ftl/FTLDWARFRegister.cpp
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLDWARFRegister.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "FPRInfo.h"
-#include "GPRInfo.h"
-
-namespace JSC { namespace FTL {
-
-Reg DWARFRegister::reg() const
-{
-#if CPU(X86_64)
-    if (m_dwarfRegNum >= 0 && m_dwarfRegNum < 16) {
-        switch (dwarfRegNum()) {
-        case 0:
-            return X86Registers::eax;
-        case 1:
-            return X86Registers::edx;
-        case 2:
-            return X86Registers::ecx;
-        case 3:
-            return X86Registers::ebx;
-        case 4:
-            return X86Registers::esi;
-        case 5:
-            return X86Registers::edi;
-        case 6:
-            return X86Registers::ebp;
-        case 7:
-            return X86Registers::esp;
-        default:
-            RELEASE_ASSERT(m_dwarfRegNum < 16);
-            // Registers r8..r15 are numbered sensibly.
-            return static_cast<GPRReg>(m_dwarfRegNum);
-        }
-    }
-    if (m_dwarfRegNum >= 17 && m_dwarfRegNum <= 32)
-        return static_cast<FPRReg>(m_dwarfRegNum - 17);
-#elif CPU(ARM64)
-    if (m_dwarfRegNum >= 0 && m_dwarfRegNum <= 31)
-        return static_cast<GPRReg>(m_dwarfRegNum);
-    if (m_dwarfRegNum >= 64 && m_dwarfRegNum <= 95)
-        return static_cast<FPRReg>(m_dwarfRegNum - 64);
-#endif
-    return Reg();
-}
-
-void DWARFRegister::dump(PrintStream& out) const
-{
-    Reg reg = this->reg();
-    if (!!reg)
-        out.print(reg);
-    else
-        out.print("<unknown:", m_dwarfRegNum, ">");
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLDWARFRegister.h b/Source/JavaScriptCore/ftl/FTLDWARFRegister.h
deleted file mode 100644
index c2449c48d..000000000
--- a/Source/JavaScriptCore/ftl/FTLDWARFRegister.h
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLDWARFRegister_h
-#define FTLDWARFRegister_h
-
-#if ENABLE(FTL_JIT)
-
-#include "Reg.h"
-#include <wtf/PrintStream.h>
-
-namespace JSC { namespace FTL {
-
-class DWARFRegister {
-public:
-    DWARFRegister()
-        : m_dwarfRegNum(-1)
-    {
-    }
-    
-    explicit DWARFRegister(int16_t dwarfRegNum)
-        : m_dwarfRegNum(dwarfRegNum)
-    {
-    }
-    
-    int16_t dwarfRegNum() const { return m_dwarfRegNum; }
-    
-    Reg reg() const; // This may return Reg() if it can't parse the Dwarf register number.
-    
-    void dump(PrintStream&) const;
-    
-private:
-    int16_t m_dwarfRegNum;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLDWARFRegister_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLDataSection.cpp b/Source/JavaScriptCore/ftl/FTLDataSection.cpp
deleted file mode 100644
index 1ea1cc52c..000000000
--- a/Source/JavaScriptCore/ftl/FTLDataSection.cpp
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLDataSection.h"
-
-#if ENABLE(FTL_JIT)
-
-#include <wtf/Assertions.h>
-#include <wtf/DataLog.h>
-#include <wtf/FastMalloc.h>
-
-namespace JSC { namespace FTL {
-
-DataSection::DataSection(size_t size, unsigned alignment)
-    : m_size(size)
-{
-    RELEASE_ASSERT(WTF::bitCount(alignment) == 1);
-    
-    const unsigned nativeAlignment = 8;
-    
-    alignment = std::max(nativeAlignment, alignment);
-    
-    size_t allocatedSize = size + alignment - nativeAlignment;
-    m_allocationBase = fastMalloc(allocatedSize);
-    
-    m_base = bitwise_cast<void*>(
-        (bitwise_cast<uintptr_t>(m_allocationBase) + alignment - 1) & ~static_cast<uintptr_t>(alignment - 1));
-    
-    RELEASE_ASSERT(!(bitwise_cast<uintptr_t>(m_base) & (alignment - 1)));
-    RELEASE_ASSERT(bitwise_cast<uintptr_t>(m_base) + size <= bitwise_cast<uintptr_t>(m_allocationBase) + allocatedSize);
-}
-
-DataSection::~DataSection()
-{
-    fastFree(m_allocationBase);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLDataSection.h b/Source/JavaScriptCore/ftl/FTLDataSection.h
deleted file mode 100644
index 25e58e1ca..000000000
--- a/Source/JavaScriptCore/ftl/FTLDataSection.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLDataSection_h
-#define FTLDataSection_h
-
-#if ENABLE(FTL_JIT)
-
-#include "CodeBlock.h"
-#include "VM.h"
-#include <wtf/RefCounted.h>
-
-namespace JSC { namespace FTL {
-
-class DataSection : public RefCounted<DataSection> {
-public:
-    DataSection(size_t, unsigned alignment);
-    ~DataSection();
-    
-    void* base() { return m_base; }
-    size_t size() const { return m_size; }
-    
-private:
-    void* m_allocationBase;
-    void* m_base;
-    size_t m_size;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLDataSection_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLExitArgument.cpp b/Source/JavaScriptCore/ftl/FTLExitArgument.cpp
index 381b3d3a4..cbe0de7fd 100644
--- a/Source/JavaScriptCore/ftl/FTLExitArgument.cpp
+++ b/Source/JavaScriptCore/ftl/FTLExitArgument.cpp
@@ -32,7 +32,7 @@ namespace JSC { namespace FTL {
 
 void ExitArgument::dump(PrintStream& out) const
 {
-    out.print("#", argument(), " as ", format());
+    out.print("arg", argument(), " as ", format());
 }
 
 } } // namespace JSC::FTL
diff --git a/Source/JavaScriptCore/ftl/FTLExitArgument.h b/Source/JavaScriptCore/ftl/FTLExitArgument.h
index 85b14d720..ae292c69e 100644
--- a/Source/JavaScriptCore/ftl/FTLExitArgument.h
+++ b/Source/JavaScriptCore/ftl/FTLExitArgument.h
@@ -26,6 +26,8 @@
 #ifndef FTLExitArgument_h
 #define FTLExitArgument_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLValueFormat.h"
diff --git a/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.cpp b/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.cpp
index 074e7a69e..775abe18f 100644
--- a/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.cpp
+++ b/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.cpp
@@ -32,7 +32,7 @@ namespace JSC { namespace FTL {
 
 void ExitArgumentForOperand::dump(PrintStream& out) const
 {
-    out.print(m_exitArgument, " for ", m_operand);
+    out.print(m_exitArgument, " for r", m_operand);
 }
 
 } } // namespace JSC::FTL
diff --git a/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.h b/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.h
index c3dc6d4a5..a5ec737c0 100644
--- a/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.h
+++ b/Source/JavaScriptCore/ftl/FTLExitArgumentForOperand.h
@@ -26,6 +26,8 @@
 #ifndef FTLExitArgumentForOperand_h
 #define FTLExitArgumentForOperand_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLExitArgument.h"
diff --git a/Source/JavaScriptCore/ftl/FTLExitArgumentList.h b/Source/JavaScriptCore/ftl/FTLExitArgumentList.h
index bb611e7e5..a466edc46 100644
--- a/Source/JavaScriptCore/ftl/FTLExitArgumentList.h
+++ b/Source/JavaScriptCore/ftl/FTLExitArgumentList.h
@@ -26,6 +26,8 @@
 #ifndef FTLExitArgumentList_h
 #define FTLExitArgumentList_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviations.h"
diff --git a/Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp b/Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp
deleted file mode 100644
index d57db747a..000000000
--- a/Source/JavaScriptCore/ftl/FTLExitPropertyValue.cpp
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLExitPropertyValue.h"
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC { namespace FTL {
-
-ExitPropertyValue ExitPropertyValue::withLocalsOffset(int offset) const
-{
-    return ExitPropertyValue(m_location, m_value.withLocalsOffset(offset));
-}
-
-void ExitPropertyValue::dump(PrintStream& out) const
-{
-    out.print(m_location, " => ", m_value);
-}
-
-void ExitPropertyValue::validateReferences(const TrackedReferences& trackedReferences) const
-{
-    m_value.validateReferences(trackedReferences);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLExitPropertyValue.h b/Source/JavaScriptCore/ftl/FTLExitPropertyValue.h
deleted file mode 100644
index 76fd00c59..000000000
--- a/Source/JavaScriptCore/ftl/FTLExitPropertyValue.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLExitPropertyValue_h
-#define FTLExitPropertyValue_h
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGPromotedHeapLocation.h"
-#include "FTLExitValue.h"
-
-namespace JSC {
-
-class TrackedReferences;
-
-namespace FTL {
-
-class ExitPropertyValue {
-public:
-    ExitPropertyValue()
-    {
-    }
-    
-    ExitPropertyValue(DFG::PromotedLocationDescriptor location, const ExitValue& value)
-        : m_location(location)
-        , m_value(value)
-    {
-        ASSERT(!!location == !!value);
-    }
-    
-    bool operator!() const { return !m_location; }
-    
-    DFG::PromotedLocationDescriptor location() const { return m_location; }
-    const ExitValue& value() const { return m_value; }
-    
-    ExitPropertyValue withLocalsOffset(int offset) const;
-    
-    void dump(PrintStream& out) const;
-    
-    void validateReferences(const TrackedReferences&) const;
-
-private:
-    DFG::PromotedLocationDescriptor m_location;
-    ExitValue m_value;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLExitPropertyValue_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.cpp b/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.cpp
index 3d40bdfdc..86c872307 100644
--- a/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.cpp
+++ b/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.cpp
@@ -51,7 +51,7 @@ void ExitThunkGenerator::emitThunk(unsigned index)
     OSRExitCompilationInfo& info = m_state.finalizer->osrExit[index];
     
     info.m_thunkLabel = label();
-    pushToSaveImmediateWithoutTouchingRegisters(TrustedImm32(index));
+    push(TrustedImm32(index));
     info.m_thunkJump = patchableJump();
     
     m_didThings = true;
diff --git a/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.h b/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.h
index 62ebd3fe8..56936b518 100644
--- a/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.h
+++ b/Source/JavaScriptCore/ftl/FTLExitThunkGenerator.h
@@ -26,6 +26,8 @@
 #ifndef FTLExitThunkGenerator_h
 #define FTLExitThunkGenerator_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "CCallHelpers.h"
diff --git a/Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp b/Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp
deleted file mode 100644
index 858d1babc..000000000
--- a/Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLExitTimeObjectMaterialization.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGGraph.h"
-
-namespace JSC { namespace FTL {
-
-using namespace JSC::DFG;
-
-ExitTimeObjectMaterialization::ExitTimeObjectMaterialization(NodeType type, CodeOrigin codeOrigin)
-    : m_type(type)
-    , m_origin(codeOrigin)
-{
-}
-
-ExitTimeObjectMaterialization::~ExitTimeObjectMaterialization()
-{
-}
-
-void ExitTimeObjectMaterialization::add(
-    PromotedLocationDescriptor location, const ExitValue& value)
-{
-    m_properties.append(ExitPropertyValue(location, value));
-}
-
-ExitValue ExitTimeObjectMaterialization::get(PromotedLocationDescriptor location) const
-{
-    for (ExitPropertyValue value : m_properties) {
-        if (value.location() == location)
-            return value.value();
-    }
-    return ExitValue();
-}
-
-void ExitTimeObjectMaterialization::accountForLocalsOffset(int offset)
-{
-    for (ExitPropertyValue& property : m_properties)
-        property = property.withLocalsOffset(offset);
-}
-
-void ExitTimeObjectMaterialization::dump(PrintStream& out) const
-{
-    out.print(RawPointer(this), ":", Graph::opName(m_type), "(", listDump(m_properties), ")");
-}
-
-void ExitTimeObjectMaterialization::validateReferences(const TrackedReferences& trackedReferences) const
-{
-    for (ExitPropertyValue value : m_properties)
-        value.validateReferences(trackedReferences);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.h b/Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.h
deleted file mode 100644
index e2003c600..000000000
--- a/Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLExitTimeObjectMaterialization_h
-#define FTLExitTimeObjectMaterialization_h
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGNodeType.h"
-#include "FTLExitPropertyValue.h"
-#include "FTLExitValue.h"
-#include <wtf/Noncopyable.h>
-
-namespace JSC {
-
-class TrackedReferences;
-
-namespace FTL {
-
-class ExitTimeObjectMaterialization {
-    WTF_MAKE_NONCOPYABLE(ExitTimeObjectMaterialization)
-public:
-    ExitTimeObjectMaterialization(DFG::NodeType, CodeOrigin);
-    ~ExitTimeObjectMaterialization();
-    
-    void add(DFG::PromotedLocationDescriptor, const ExitValue&);
-    
-    DFG::NodeType type() const { return m_type; }
-    CodeOrigin origin() const { return m_origin; }
-    
-    ExitValue get(DFG::PromotedLocationDescriptor) const;
-    const Vector<ExitPropertyValue>& properties() const { return m_properties; }
-    
-    void accountForLocalsOffset(int offset);
-    
-    void dump(PrintStream& out) const;
-    
-    void validateReferences(const TrackedReferences&) const;
-    
-private:
-    DFG::NodeType m_type;
-    CodeOrigin m_origin;
-    Vector<ExitPropertyValue> m_properties;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLExitTimeObjectMaterialization_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLExitValue.cpp b/Source/JavaScriptCore/ftl/FTLExitValue.cpp
index 24a0f3c22..a987c60ce 100644
--- a/Source/JavaScriptCore/ftl/FTLExitValue.cpp
+++ b/Source/JavaScriptCore/ftl/FTLExitValue.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,62 +28,10 @@
 
 #if ENABLE(FTL_JIT)
 
-#include "FTLExitTimeObjectMaterialization.h"
-#include "JSCInlines.h"
-#include "TrackedReferences.h"
+#include "Operations.h"
 
 namespace JSC { namespace FTL {
 
-ExitValue ExitValue::materializeNewObject(ExitTimeObjectMaterialization* data)
-{
-    ExitValue result;
-    result.m_kind = ExitValueMaterializeNewObject;
-    result.u.newObjectMaterializationData = data;
-    return result;
-}
-
-ExitValue ExitValue::withLocalsOffset(int offset) const
-{
-    if (!isInJSStackSomehow())
-        return *this;
-    if (!virtualRegister().isLocal())
-        return *this;
-    return withVirtualRegister(virtualRegister() + offset);
-}
-
-ValueFormat ExitValue::valueFormat() const
-{
-    switch (kind()) {
-    case InvalidExitValue:
-        RELEASE_ASSERT_NOT_REACHED();
-        return InvalidValueFormat;
-            
-    case ExitValueDead:
-    case ExitValueConstant:
-    case ExitValueInJSStack:
-    case ExitValueMaterializeNewObject:
-        return ValueFormatJSValue;
-            
-    case ExitValueArgument:
-        return exitArgument().format();
-            
-    case ExitValueInJSStackAsInt32:
-        return ValueFormatInt32;
-            
-    case ExitValueInJSStackAsInt52:
-        return ValueFormatInt52;
-            
-    case ExitValueInJSStackAsDouble:
-        return ValueFormatDouble;
-            
-    case ExitValueRecovery:
-        return recoveryFormat();
-    }
-        
-    RELEASE_ASSERT_NOT_REACHED();
-    return InvalidValueFormat;
-}
-
 void ExitValue::dumpInContext(PrintStream& out, DumpContext* context) const
 {
     switch (kind()) {
@@ -100,22 +48,16 @@ void ExitValue::dumpInContext(PrintStream& out, DumpContext* context) const
         out.print("Constant(", inContext(constant(), context), ")");
         return;
     case ExitValueInJSStack:
-        out.print("InJSStack:", virtualRegister());
+        out.print("InJSStack:r", virtualRegister());
         return;
     case ExitValueInJSStackAsInt32:
-        out.print("InJSStackAsInt32:", virtualRegister());
+        out.print("InJSStackAsInt32:r", virtualRegister());
         return;
     case ExitValueInJSStackAsInt52:
-        out.print("InJSStackAsInt52:", virtualRegister());
+        out.print("InJSStackAsInt52:r", virtualRegister());
         return;
     case ExitValueInJSStackAsDouble:
-        out.print("InJSStackAsDouble:", virtualRegister());
-        return;
-    case ExitValueRecovery:
-        out.print("Recovery(", recoveryOpcode(), ", arg", leftRecoveryArgument(), ", arg", rightRecoveryArgument(), ", ", recoveryFormat(), ")");
-        return;
-    case ExitValueMaterializeNewObject:
-        out.print("Materialize(", WTF::RawPointer(objectMaterialization()), ")");
+        out.print("InJSStackAsDouble:r", virtualRegister());
         return;
     }
     
@@ -127,12 +69,6 @@ void ExitValue::dump(PrintStream& out) const
     dumpInContext(out, 0);
 }
 
-void ExitValue::validateReferences(const TrackedReferences& trackedReferences) const
-{
-    if (isConstant())
-        trackedReferences.check(constant());
-}
-
 } } // namespace JSC::FTL
 
 #endif // ENABLE(FTL_JIT)
diff --git a/Source/JavaScriptCore/ftl/FTLExitValue.h b/Source/JavaScriptCore/ftl/FTLExitValue.h
index 13e6e09f4..7aaaedd8d 100644
--- a/Source/JavaScriptCore/ftl/FTLExitValue.h
+++ b/Source/JavaScriptCore/ftl/FTLExitValue.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,19 +26,16 @@
 #ifndef FTLExitValue_h
 #define FTLExitValue_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLExitArgument.h"
-#include "FTLRecoveryOpcode.h"
 #include "JSCJSValue.h"
 #include "VirtualRegister.h"
 #include <wtf/PrintStream.h>
 
-namespace JSC {
-
-class TrackedReferences;
-
-namespace FTL {
+namespace JSC { namespace FTL {
 
 // This is like ValueRecovery, but respects the way that the FTL does OSR
 // exit: the live non-constant non-flushed values are passed as arguments
@@ -54,13 +51,9 @@ enum ExitValueKind {
     ExitValueInJSStack,
     ExitValueInJSStackAsInt32,
     ExitValueInJSStackAsInt52,
-    ExitValueInJSStackAsDouble,
-    ExitValueRecovery,
-    ExitValueMaterializeNewObject
+    ExitValueInJSStackAsDouble
 };
 
-class ExitTimeObjectMaterialization;
-
 class ExitValue {
 public:
     ExitValue()
@@ -125,19 +118,6 @@ public:
         return result;
     }
     
-    static ExitValue recovery(RecoveryOpcode opcode, unsigned leftArgument, unsigned rightArgument, ValueFormat format)
-    {
-        ExitValue result;
-        result.m_kind = ExitValueRecovery;
-        result.u.recovery.opcode = opcode;
-        result.u.recovery.leftArgument = leftArgument;
-        result.u.recovery.rightArgument = rightArgument;
-        result.u.recovery.format = format;
-        return result;
-    }
-    
-    static ExitValue materializeNewObject(ExitTimeObjectMaterialization*);
-    
     ExitValueKind kind() const { return m_kind; }
     
     bool isDead() const { return kind() == ExitValueDead; }
@@ -155,8 +135,6 @@ public:
     }
     bool isConstant() const { return kind() == ExitValueConstant; }
     bool isArgument() const { return kind() == ExitValueArgument; }
-    bool isRecovery() const { return kind() == ExitValueRecovery; }
-    bool isObjectMaterialization() const { return kind() == ExitValueMaterializeNewObject; }
     
     ExitArgument exitArgument() const
     {
@@ -164,30 +142,6 @@ public:
         return ExitArgument(u.argument);
     }
     
-    unsigned leftRecoveryArgument() const
-    {
-        ASSERT(isRecovery());
-        return u.recovery.leftArgument;
-    }
-    
-    unsigned rightRecoveryArgument() const
-    {
-        ASSERT(isRecovery());
-        return u.recovery.rightArgument;
-    }
-    
-    ValueFormat recoveryFormat() const
-    {
-        ASSERT(isRecovery());
-        return static_cast<ValueFormat>(u.recovery.format);
-    }
-    
-    RecoveryOpcode recoveryOpcode() const
-    {
-        ASSERT(isRecovery());
-        return static_cast<RecoveryOpcode>(u.recovery.opcode);
-    }
-    
     JSValue constant() const
     {
         ASSERT(isConstant());
@@ -199,48 +153,49 @@ public:
         ASSERT(isInJSStackSomehow());
         return VirtualRegister(u.virtualRegister);
     }
-    
-    ExitTimeObjectMaterialization* objectMaterialization() const
-    {
-        ASSERT(isObjectMaterialization());
-        return u.newObjectMaterializationData;
-    }
 
-    ExitValue withVirtualRegister(VirtualRegister virtualRegister) const
-    {
-        ASSERT(isInJSStackSomehow());
-        ExitValue result;
-        result.m_kind = m_kind;
-        result.u.virtualRegister = virtualRegister.offset();
-        return result;
-    }
-    
-    ExitValue withLocalsOffset(int offset) const;
-    
     // If it's in the JSStack somehow, this will tell you what format it's in, in a manner
     // that is compatible with exitArgument().format(). If it's a constant or it's dead, it
     // will claim to be a JSValue. If it's an argument then it will tell you the argument's
     // format.
-    ValueFormat valueFormat() const;
+    ValueFormat valueFormat() const
+    {
+        switch (kind()) {
+        case InvalidExitValue:
+            RELEASE_ASSERT_NOT_REACHED();
+            return InvalidValueFormat;
+            
+        case ExitValueDead:
+        case ExitValueConstant:
+        case ExitValueInJSStack:
+            return ValueFormatJSValue;
+            
+        case ExitValueArgument:
+            return exitArgument().format();
+            
+        case ExitValueInJSStackAsInt32:
+            return ValueFormatInt32;
+            
+        case ExitValueInJSStackAsInt52:
+            return ValueFormatInt52;
+            
+        case ExitValueInJSStackAsDouble:
+            return ValueFormatDouble;
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+        return InvalidValueFormat;
+    }
 
     void dump(PrintStream&) const;
     void dumpInContext(PrintStream&, DumpContext*) const;
     
-    void validateReferences(const TrackedReferences&) const;
-    
 private:
     ExitValueKind m_kind;
     union {
         ExitArgumentRepresentation argument;
         EncodedJSValue constant;
         int virtualRegister;
-        struct {
-            uint16_t leftArgument;
-            uint16_t rightArgument;
-            uint16_t opcode;
-            uint16_t format;
-        } recovery;
-        ExitTimeObjectMaterialization* newObjectMaterializationData;
     } u;
 };
 
diff --git a/Source/JavaScriptCore/ftl/FTLFail.cpp b/Source/JavaScriptCore/ftl/FTLFail.cpp
index ac2fc07eb..1345c6fa1 100644
--- a/Source/JavaScriptCore/ftl/FTLFail.cpp
+++ b/Source/JavaScriptCore/ftl/FTLFail.cpp
@@ -38,7 +38,7 @@ using namespace DFG;
 
 void fail(State& state)
 {
-    state.graph.m_plan.finalizer = std::make_unique<FailedFinalizer>(state.graph.m_plan);
+    state.graph.m_plan.finalizer = adoptPtr(new FailedFinalizer(state.graph.m_plan));
     
     if (state.module)
         llvm->DisposeModule(state.module);
diff --git a/Source/JavaScriptCore/ftl/FTLFail.h b/Source/JavaScriptCore/ftl/FTLFail.h
index e99e1a4ae..1d6432cf3 100644
--- a/Source/JavaScriptCore/ftl/FTLFail.h
+++ b/Source/JavaScriptCore/ftl/FTLFail.h
@@ -26,6 +26,8 @@
 #ifndef FTLFail_h
 #define FTLFail_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLState.h"
diff --git a/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp b/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp
index 29f05e51d..708bedc38 100644
--- a/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp
+++ b/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.cpp
@@ -31,8 +31,6 @@
 namespace JSC { namespace FTL {
 
 ForOSREntryJITCode::ForOSREntryJITCode()
-    : m_bytecodeIndex(UINT_MAX)
-    , m_entryFailureCount(0)
 {
 }
 
diff --git a/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.h b/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.h
index 44af8f957..8d863a129 100644
--- a/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.h
+++ b/Source/JavaScriptCore/ftl/FTLForOSREntryJITCode.h
@@ -26,6 +26,8 @@
 #ifndef FTLForOSREntryJITCode_h
 #define FTLForOSREntryJITCode_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLJITCode.h"
diff --git a/Source/JavaScriptCore/ftl/FTLFormattedValue.h b/Source/JavaScriptCore/ftl/FTLFormattedValue.h
index e100f52ce..b7ab3616c 100644
--- a/Source/JavaScriptCore/ftl/FTLFormattedValue.h
+++ b/Source/JavaScriptCore/ftl/FTLFormattedValue.h
@@ -26,6 +26,8 @@
 #ifndef FTLFormattedValue_h
 #define FTLFormattedValue_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviations.h"
diff --git a/Source/JavaScriptCore/ftl/FTLGeneratedFunction.h b/Source/JavaScriptCore/ftl/FTLGeneratedFunction.h
index 6f56a3654..8226d0ac3 100644
--- a/Source/JavaScriptCore/ftl/FTLGeneratedFunction.h
+++ b/Source/JavaScriptCore/ftl/FTLGeneratedFunction.h
@@ -26,8 +26,6 @@
 #ifndef FTLGeneratedFunction_h
 #define FTLGeneratedFunction_h
 
-#if ENABLE(FTL_JIT)
-
 #include "CallFrame.h"
 
 namespace JSC { namespace FTL {
@@ -36,6 +34,4 @@ typedef EncodedJSValue (*GeneratedFunction)(ExecState*);
 
 } } // namespace JSC::FTL
 
-#endif // ENABLE(FTL_JIT)
-
 #endif // FTLGeneratedFunction_h
diff --git a/Source/JavaScriptCore/ftl/FTLInlineCacheDescriptor.h b/Source/JavaScriptCore/ftl/FTLInlineCacheDescriptor.h
deleted file mode 100644
index 6793e74b0..000000000
--- a/Source/JavaScriptCore/ftl/FTLInlineCacheDescriptor.h
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLInlineCacheDescriptor_h
-#define FTLInlineCacheDescriptor_h
-
-#if ENABLE(FTL_JIT)
-
-#include "CodeOrigin.h"
-#include "JITInlineCacheGenerator.h"
-#include "MacroAssembler.h"
-#include <wtf/text/UniquedStringImpl.h>
-
-namespace JSC { namespace FTL {
-
-class InlineCacheDescriptor {
-public:
-    InlineCacheDescriptor() { }
-    
-    InlineCacheDescriptor(unsigned stackmapID, CodeOrigin codeOrigin, UniquedStringImpl* uid)
-        : m_stackmapID(stackmapID)
-        , m_codeOrigin(codeOrigin)
-        , m_uid(uid)
-    {
-    }
-    
-    unsigned stackmapID() const { return m_stackmapID; }
-    CodeOrigin codeOrigin() const { return m_codeOrigin; }
-    UniquedStringImpl* uid() const { return m_uid; }
-    
-private:
-    unsigned m_stackmapID;
-    CodeOrigin m_codeOrigin;
-    UniquedStringImpl* m_uid;
-    
-public:
-    Vector<MacroAssembler::Jump> m_slowPathDone;
-};
-
-class GetByIdDescriptor : public InlineCacheDescriptor {
-public:
-    GetByIdDescriptor() { }
-    
-    GetByIdDescriptor(unsigned stackmapID, CodeOrigin codeOrigin, UniquedStringImpl* uid)
-        : InlineCacheDescriptor(stackmapID, codeOrigin, uid)
-    {
-    }
-    
-    Vector<JITGetByIdGenerator> m_generators;
-};
-
-class PutByIdDescriptor : public InlineCacheDescriptor {
-public:
-    PutByIdDescriptor() { }
-    
-    PutByIdDescriptor(
-        unsigned stackmapID, CodeOrigin codeOrigin, UniquedStringImpl* uid,
-        ECMAMode ecmaMode, PutKind putKind)
-        : InlineCacheDescriptor(stackmapID, codeOrigin, uid)
-        , m_ecmaMode(ecmaMode)
-        , m_putKind(putKind)
-    {
-    }
-    
-    Vector<JITPutByIdGenerator> m_generators;
-    
-    ECMAMode ecmaMode() const { return m_ecmaMode; }
-    PutKind putKind() const { return m_putKind; }
-
-private:
-    ECMAMode m_ecmaMode;
-    PutKind m_putKind;
-};
-
-struct CheckInGenerator {
-    StructureStubInfo* m_stub;
-    MacroAssembler::Call m_slowCall;
-    MacroAssembler::Label m_beginLabel;
-
-    CheckInGenerator(StructureStubInfo* stub, MacroAssembler::Call slowCall, MacroAssembler::Label beginLabel)
-        : m_stub(stub) 
-        , m_slowCall(slowCall)
-        , m_beginLabel(beginLabel)
-    {
-    }
-};
-
-class CheckInDescriptor : public InlineCacheDescriptor {
-public:
-    CheckInDescriptor() { }
-    
-    CheckInDescriptor(unsigned stackmapID, CodeOrigin codeOrigin, const UniquedStringImpl* uid)
-        : InlineCacheDescriptor(stackmapID, codeOrigin, nullptr)
-        , m_uid(uid)
-    {
-    }
-
-    
-    const UniquedStringImpl* m_uid;
-    Vector<CheckInGenerator> m_generators;
-};
-
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLInlineCacheDescriptor_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp b/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp
deleted file mode 100644
index 5cd637602..000000000
--- a/Source/JavaScriptCore/ftl/FTLInlineCacheSize.cpp
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLInlineCacheSize.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGNode.h"
-#include "JITInlineCacheGenerator.h"
-#include "MacroAssembler.h"
-
-namespace JSC { namespace FTL {
-
-using namespace DFG;
-
-// The default sizes are x86-64-specific, and were found empirically. They have to cover the worst
-// possible combination of registers leading to the largest possible encoding of each instruction in
-// the IC.
-//
-// FIXME: The ARM64 sizes are overestimates; if there is any branch compaction then we should be able
-// to get away with less. The branch compaction code currently validates the size of the IC before
-// doing any compaction, so we need to overestimate and give the uncompacted size. This would be
-// relatively easy to fix.
-// https://bugs.webkit.org/show_bug.cgi?id=129335
-
-size_t sizeOfGetById()
-{
-#if CPU(ARM64)
-    return 36;
-#else
-    return 30;
-#endif
-}
-
-size_t sizeOfPutById()
-{
-#if CPU(ARM64)
-    return 44;
-#else
-    return 32;
-#endif
-}
-
-size_t sizeOfCall()
-{
-#if CPU(ARM64)
-    return 56;
-#else
-    return 53;
-#endif
-}
-
-size_t sizeOfCallVarargs()
-{
-#if CPU(ARM64)
-    return 332;
-#else
-    return 275;
-#endif
-}
-
-size_t sizeOfCallForwardVarargs()
-{
-#if CPU(ARM64)
-    return 312;
-#else
-    return 262;
-#endif
-}
-
-size_t sizeOfConstructVarargs()
-{
-    return sizeOfCallVarargs(); // Should be the same size.
-}
-
-size_t sizeOfConstructForwardVarargs()
-{
-    return sizeOfCallForwardVarargs(); // Should be the same size.
-}
-
-size_t sizeOfIn()
-{
-#if CPU(ARM64)
-    return 4;
-#else
-    return 5; 
-#endif
-}
-
-size_t sizeOfICFor(Node* node)
-{
-    switch (node->op()) {
-    case GetById:
-        return sizeOfGetById();
-    case PutById:
-        return sizeOfPutById();
-    case Call:
-    case Construct:
-        return sizeOfCall();
-    case CallVarargs:
-        return sizeOfCallVarargs();
-    case CallForwardVarargs:
-        return sizeOfCallForwardVarargs();
-    case ConstructVarargs:
-        return sizeOfConstructVarargs();
-    case ConstructForwardVarargs:
-        return sizeOfConstructForwardVarargs();
-    case In:
-        return sizeOfIn();
-    default:
-        return 0;
-    }
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLInlineCacheSize.h b/Source/JavaScriptCore/ftl/FTLInlineCacheSize.h
deleted file mode 100644
index 82f3bbc74..000000000
--- a/Source/JavaScriptCore/ftl/FTLInlineCacheSize.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLInlineCacheSize_h
-#define FTLInlineCacheSize_h
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC {
-
-namespace DFG {
-struct Node;
-}
-
-namespace FTL {
-
-size_t sizeOfGetById();
-size_t sizeOfPutById();
-size_t sizeOfCall();
-size_t sizeOfCallVarargs();
-size_t sizeOfCallForwardVarargs();
-size_t sizeOfConstructVarargs();
-size_t sizeOfConstructForwardVarargs();
-size_t sizeOfIn();
-
-size_t sizeOfICFor(DFG::Node*);
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLInlineCacheSize_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h b/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h
index 9b3441417..7f560dd95 100644
--- a/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h
+++ b/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef FTLIntrinsicRepository_h
 #define FTLIntrinsicRepository_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGOperations.h"
@@ -35,91 +37,44 @@
 namespace JSC { namespace FTL {
 
 #define FOR_EACH_FTL_INTRINSIC(macro) \
-    macro(ceil64, "llvm.ceil.f64", functionType(doubleType, doubleType)) \
-    macro(ctlz32, "llvm.ctlz.i32", functionType(int32, int32, boolean)) \
     macro(addWithOverflow32, "llvm.sadd.with.overflow.i32", functionType(structType(m_context, int32, boolean), int32, int32)) \
     macro(addWithOverflow64, "llvm.sadd.with.overflow.i64", functionType(structType(m_context, int64, boolean), int64, int64)) \
     macro(doubleAbs, "llvm.fabs.f64", functionType(doubleType, doubleType)) \
-    macro(doubleSin, "llvm.sin.f64", functionType(doubleType, doubleType)) \
-    macro(doubleCos, "llvm.cos.f64", functionType(doubleType, doubleType)) \
-    macro(doublePow, "llvm.pow.f64", functionType(doubleType, doubleType, doubleType)) \
-    macro(doublePowi, "llvm.powi.f64", functionType(doubleType, doubleType, int32)) \
-    macro(doubleSqrt, "llvm.sqrt.f64", functionType(doubleType, doubleType)) \
-    macro(doubleLog, "llvm.log.f64", functionType(doubleType, doubleType)) \
-    macro(frameAddress, "llvm.frameaddress", functionType(pointerType(int8), int32)) \
     macro(mulWithOverflow32, "llvm.smul.with.overflow.i32", functionType(structType(m_context, int32, boolean), int32, int32)) \
     macro(mulWithOverflow64, "llvm.smul.with.overflow.i64", functionType(structType(m_context, int64, boolean), int64, int64)) \
-    macro(patchpointInt64, "llvm.experimental.patchpoint.i64", functionType(int64, int64, int32, ref8, int32, Variadic)) \
-    macro(patchpointVoid, "llvm.experimental.patchpoint.void", functionType(voidType, int64, int32, ref8, int32, Variadic)) \
-    macro(stackmap, "llvm.experimental.stackmap", functionType(voidType, int64, int32, Variadic)) \
+    macro(patchpointInt64, "llvm.experimental.patchpoint.i64", functionType(int64, int32, int32, ref8, int32, Variadic)) \
+    macro(patchpointVoid, "llvm.experimental.patchpoint.void", functionType(voidType, int32, int32, ref8, int32, Variadic)) \
+    macro(stackmap, "llvm.experimental.stackmap", functionType(voidType, int32, int32, Variadic)) \
     macro(subWithOverflow32, "llvm.ssub.with.overflow.i32", functionType(structType(m_context, int32, boolean), int32, int32)) \
     macro(subWithOverflow64, "llvm.ssub.with.overflow.i64", functionType(structType(m_context, int64, boolean), int64, int64)) \
     macro(trap, "llvm.trap", functionType(voidType)) \
     macro(x86SSE2CvtTSD2SI, "llvm.x86.sse2.cvttsd2si", functionType(int32, vectorType(doubleType, 2)))
 
 #define FOR_EACH_FUNCTION_TYPE(macro) \
-    macro(C_JITOperation_EC, functionType(intPtr, intPtr, intPtr)) \
-    macro(C_JITOperation_ECZ, functionType(intPtr, intPtr, intPtr, int32)) \
-    macro(C_JITOperation_ECZC, functionType(intPtr, intPtr, intPtr, int32, intPtr)) \
-    macro(C_JITOperation_EGC, functionType(intPtr, intPtr, intPtr, intPtr)) \
-    macro(C_JITOperation_EJ, functionType(intPtr, intPtr, int64)) \
-    macro(C_JITOperation_EJssJss, functionType(intPtr, intPtr, intPtr, intPtr)) \
-    macro(C_JITOperation_EJssJssJss, functionType(intPtr, intPtr, intPtr, intPtr, intPtr)) \
     macro(C_JITOperation_ESt, functionType(intPtr, intPtr, intPtr)) \
-    macro(C_JITOperation_EStJscSymtabJ, functionType(intPtr, intPtr, intPtr, intPtr, intPtr, intPtr)) \
-    macro(C_JITOperation_EStRZJsf, functionType(intPtr, intPtr, intPtr, intPtr, int32, intPtr)) \
-    macro(C_JITOperation_EStRZJsfL, functionType(intPtr, intPtr, intPtr, intPtr, int32, intPtr, intPtr)) \
-    macro(C_JITOperation_EStZ, functionType(intPtr, intPtr, intPtr, int32)) \
-    macro(C_JITOperation_EStZZ, functionType(intPtr, intPtr, intPtr, int32, int32)) \
-    macro(C_JITOperation_EZ, functionType(intPtr, intPtr, int32)) \
-    macro(D_JITOperation_D, functionType(doubleType, doubleType)) \
-    macro(T_JITOperation_EJss, functionType(intPtr, intPtr, intPtr)) \
+    macro(I_JITOperation_EJss, functionType(intPtr, intPtr, intPtr)) \
     macro(J_JITOperation_E, functionType(int64, intPtr)) \
-    macro(J_JITOperation_EA, functionType(int64, intPtr, intPtr)) \
     macro(J_JITOperation_EAZ, functionType(int64, intPtr, intPtr, int32)) \
-    macro(J_JITOperation_ECJ, functionType(int64, intPtr, intPtr, int64)) \
-    macro(J_JITOperation_ECZ, functionType(int64, intPtr, intPtr, int32)) \
-    macro(J_JITOperation_EDA, functionType(int64, intPtr, doubleType, intPtr)) \
-    macro(J_JITOperation_EJ, functionType(int64, intPtr, int64)) \
-    macro(J_JITOperation_EJA, functionType(int64, intPtr, int64, intPtr)) \
-    macro(J_JITOperation_EJC, functionType(int64, intPtr, int64, intPtr)) \
-    macro(J_JITOperation_EJI, functionType(int64, intPtr, int64, intPtr)) \
     macro(J_JITOperation_EJJ, functionType(int64, intPtr, int64, int64)) \
-    macro(J_JITOperation_EJscC, functionType(intPtr, intPtr, intPtr, intPtr)) \
     macro(J_JITOperation_EJssZ, functionType(int64, intPtr, intPtr, int32)) \
     macro(J_JITOperation_ESsiJI, functionType(int64, intPtr, intPtr, int64, intPtr)) \
     macro(Jss_JITOperation_EZ, functionType(intPtr, intPtr, int32)) \
     macro(P_JITOperation_E, functionType(intPtr, intPtr)) \
     macro(P_JITOperation_EC, functionType(intPtr, intPtr, intPtr)) \
     macro(P_JITOperation_EO, functionType(intPtr, intPtr, intPtr)) \
-    macro(P_JITOperation_ES, functionType(intPtr, intPtr, int64)) \
-    macro(P_JITOperation_EOS, functionType(intPtr, intPtr, intPtr, int64)) \
     macro(P_JITOperation_ESt, functionType(intPtr, intPtr, intPtr)) \
     macro(P_JITOperation_EStPS, functionType(intPtr, intPtr, intPtr, intPtr, intPtr)) \
     macro(P_JITOperation_EStSS, functionType(intPtr, intPtr, intPtr, intPtr, intPtr)) \
     macro(P_JITOperation_EStZ, functionType(intPtr, intPtr, intPtr, int32)) \
-    macro(Q_JITOperation_D, functionType(int64, doubleType)) \
-    macro(Q_JITOperation_J, functionType(int64, int64)) \
-    macro(S_JITOperation_EGC, functionType(intPtr, intPtr, intPtr, intPtr)) \
     macro(S_JITOperation_EJ, functionType(intPtr, intPtr, int64)) \
     macro(S_JITOperation_EJJ, functionType(intPtr, intPtr, int64, int64)) \
-    macro(S_JITOperation_J, functionType(intPtr, int64)) \
-    macro(V_JITOperation, functionType(voidType)) \
     macro(V_JITOperation_EJJJ, functionType(voidType, intPtr, int64, int64, int64)) \
     macro(V_JITOperation_EOZD, functionType(voidType, intPtr, intPtr, int32, doubleType)) \
     macro(V_JITOperation_EOZJ, functionType(voidType, intPtr, intPtr, int32, int64)) \
     macro(V_JITOperation_EC, functionType(voidType, intPtr, intPtr)) \
-    macro(V_JITOperation_ECb, functionType(voidType, intPtr, intPtr)) \
-    macro(V_JITOperation_EWs, functionType(voidType, intPtr, intPtr)) \
-    macro(V_JITOperation_EZJZZZ, functionType(voidType, intPtr, int32, int64, int32, int32, int32)) \
-    macro(V_JITOperation_J, functionType(voidType, int64)) \
-    macro(V_JITOperation_Z, functionType(voidType, int32)) \
-    macro(Z_JITOperation_D, functionType(int32, doubleType)) \
-    macro(Z_JITOperation_EC, functionType(int32, intPtr, intPtr)) \
-    macro(Z_JITOperation_EGC, functionType(int32, intPtr, intPtr, intPtr)) \
-    macro(Z_JITOperation_EJZ, functionType(int32, intPtr, int64, int32)) \
-    macro(Z_JITOperation_ESJss, functionType(int32, intPtr, intPtr, int64)) \
-    
+    macro(V_JITOperation_EVws, functionType(voidType, intPtr, intPtr)) \
+    macro(Z_JITOperation_D, functionType(int32, doubleType))
+
 class IntrinsicRepository : public CommonValues {
 public:
     IntrinsicRepository(LContext);
diff --git a/Source/JavaScriptCore/ftl/FTLJITCode.cpp b/Source/JavaScriptCore/ftl/FTLJITCode.cpp
index 66d38de6c..cdc7de0c3 100644
--- a/Source/JavaScriptCore/ftl/FTLJITCode.cpp
+++ b/Source/JavaScriptCore/ftl/FTLJITCode.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,8 +28,6 @@
 
 #if ENABLE(FTL_JIT)
 
-#include "FTLState.h"
-
 namespace JSC { namespace FTL {
 
 JITCode::JITCode()
@@ -39,15 +37,6 @@ JITCode::JITCode()
 
 JITCode::~JITCode()
 {
-    if (FTL::shouldShowDisassembly()) {
-        dataLog("Destroying FTL JIT code at ");
-        CommaPrinter comma;
-        for (auto& handle : m_handles)
-            dataLog(comma, pointerDump(handle.get()));
-        dataLog(comma, pointerDump(m_arityCheckEntrypoint.executableMemory()));
-        dataLog(comma, pointerDump(m_exitThunks.executableMemory()));
-        dataLog("\n");
-    }
 }
 
 void JITCode::initializeExitThunks(CodeRef exitThunks)
@@ -60,40 +49,32 @@ void JITCode::addHandle(PassRefPtr<ExecutableMemoryHandle> handle)
     m_handles.append(handle);
 }
 
-void JITCode::addDataSection(PassRefPtr<DataSection> dataSection)
+void JITCode::addDataSection(RefCountedArray<LSectionWord> dataSection)
 {
     m_dataSections.append(dataSection);
 }
 
-void JITCode::initializeArityCheckEntrypoint(CodeRef entrypoint)
-{
-    m_arityCheckEntrypoint = entrypoint;
-}
-
-void JITCode::initializeAddressForCall(CodePtr address)
+void JITCode::initializeCode(CodeRef entrypoint)
 {
-    m_addressForCall = address;
+    m_entrypoint = entrypoint;
 }
 
-JITCode::CodePtr JITCode::addressForCall(VM&, ExecutableBase*, ArityCheckMode arityCheck, RegisterPreservationMode)
+JITCode::CodePtr JITCode::addressForCall()
 {
-    switch (arityCheck) {
-    case ArityCheckNotRequired:
-        return m_addressForCall;
-    case MustCheckArity:
-        return m_arityCheckEntrypoint.code();
-    }
-    RELEASE_ASSERT_NOT_REACHED();
-    return CodePtr();
+    RELEASE_ASSERT(m_entrypoint);
+    return m_entrypoint.code();
 }
 
 void* JITCode::executableAddressAtOffset(size_t offset)
 {
-    return reinterpret_cast<char*>(m_addressForCall.executableAddress()) + offset;
+    RELEASE_ASSERT(m_entrypoint);
+    return reinterpret_cast<char*>(m_entrypoint.code().executableAddress()) + offset;
 }
 
 void* JITCode::dataAddressAtOffset(size_t)
 {
+    RELEASE_ASSERT(m_entrypoint);
+
     // We can't patch FTL code, yet. Even if we did, it's not clear that we would do so
     // through this API.
     RELEASE_ASSERT_NOT_REACHED();
@@ -102,6 +83,8 @@ void* JITCode::dataAddressAtOffset(size_t)
 
 unsigned JITCode::offsetOf(void*)
 {
+    RELEASE_ASSERT(m_entrypoint);
+
     // We currently don't have visibility into the FTL code.
     RELEASE_ASSERT_NOT_REACHED();
     return 0;
@@ -109,6 +92,8 @@ unsigned JITCode::offsetOf(void*)
 
 size_t JITCode::size()
 {
+    RELEASE_ASSERT(m_entrypoint);
+
     // We don't know the size of FTL code, yet. Make a wild guess. This is mostly used for
     // GC load estimates.
     return 1000;
@@ -116,6 +101,8 @@ size_t JITCode::size()
 
 bool JITCode::contains(void*)
 {
+    RELEASE_ASSERT(m_entrypoint);
+
     // We have no idea what addresses the FTL code contains, yet.
     RELEASE_ASSERT_NOT_REACHED();
     return false;
@@ -136,14 +123,6 @@ DFG::CommonData* JITCode::dfgCommon()
     return &common;
 }
 
-void JITCode::validateReferences(const TrackedReferences& trackedReferences)
-{
-    common.validateReferences(trackedReferences);
-    
-    for (OSRExit& exit : osrExit)
-        exit.validateReferences(trackedReferences);
-}
-
 } } // namespace JSC::FTL
 
 #endif // ENABLE(FTL_JIT)
diff --git a/Source/JavaScriptCore/ftl/FTLJITCode.h b/Source/JavaScriptCore/ftl/FTLJITCode.h
index 6a4d15205..3e7213983 100644
--- a/Source/JavaScriptCore/ftl/FTLJITCode.h
+++ b/Source/JavaScriptCore/ftl/FTLJITCode.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,71 +26,54 @@
 #ifndef FTLJITCode_h
 #define FTLJITCode_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGCommonData.h"
-#include "FTLDataSection.h"
 #include "FTLOSRExit.h"
 #include "FTLStackMaps.h"
-#include "FTLUnwindInfo.h"
 #include "JITCode.h"
 #include "LLVMAPI.h"
 #include <wtf/RefCountedArray.h>
 
-#if OS(DARWIN)
-#define SECTION_NAME_PREFIX "__"
-#elif OS(LINUX)
-#define SECTION_NAME_PREFIX "."
-#else
-#error "Unsupported platform"
-#endif
-
-#define SECTION_NAME(NAME) (SECTION_NAME_PREFIX NAME)
-
-namespace JSC {
+namespace JSC { namespace FTL {
 
-class TrackedReferences;
-
-namespace FTL {
+typedef int64_t LSectionWord; // We refer to LLVM data sections using LSectionWord*, just to be clear about our intended alignment restrictions.
 
 class JITCode : public JSC::JITCode {
 public:
     JITCode();
     ~JITCode();
     
-    CodePtr addressForCall(VM&, ExecutableBase*, ArityCheckMode, RegisterPreservationMode) override;
-    void* executableAddressAtOffset(size_t offset) override;
-    void* dataAddressAtOffset(size_t offset) override;
-    unsigned offsetOf(void* pointerIntoCode) override;
-    size_t size() override;
-    bool contains(void*) override;
+    CodePtr addressForCall();
+    void* executableAddressAtOffset(size_t offset);
+    void* dataAddressAtOffset(size_t offset);
+    unsigned offsetOf(void* pointerIntoCode);
+    size_t size();
+    bool contains(void*);
     
     void initializeExitThunks(CodeRef);
     void addHandle(PassRefPtr<ExecutableMemoryHandle>);
-    void addDataSection(PassRefPtr<DataSection>);
-    void initializeArityCheckEntrypoint(CodeRef);
-    void initializeAddressForCall(CodePtr);
-    
-    void validateReferences(const TrackedReferences&) override;
+    void addDataSection(RefCountedArray<LSectionWord>);
+    void initializeCode(CodeRef entrypoint);
     
     const Vector<RefPtr<ExecutableMemoryHandle>>& handles() const { return m_handles; }
-    const Vector<RefPtr<DataSection>>& dataSections() const { return m_dataSections; }
+    const Vector<RefCountedArray<LSectionWord>>& dataSections() const { return m_dataSections; }
     
     CodePtr exitThunks();
     
-    JITCode* ftl() override;
-    DFG::CommonData* dfgCommon() override;
+    JITCode* ftl();
+    DFG::CommonData* dfgCommon();
     
     DFG::CommonData common;
     SegmentedVector<OSRExit, 8> osrExit;
     StackMaps stackmaps;
-    UnwindInfo unwindInfo;
     
 private:
-    Vector<RefPtr<DataSection>> m_dataSections;
+    Vector<RefCountedArray<LSectionWord>> m_dataSections;
     Vector<RefPtr<ExecutableMemoryHandle>> m_handles;
-    CodePtr m_addressForCall;
-    CodeRef m_arityCheckEntrypoint;
+    CodeRef m_entrypoint;
     CodeRef m_exitThunks;
 };
 
diff --git a/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp b/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
index 3da48486a..a8a99b63a 100644
--- a/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
+++ b/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,7 +31,6 @@
 #include "CodeBlockWithJITType.h"
 #include "DFGPlan.h"
 #include "FTLThunks.h"
-#include "ProfilerDatabase.h"
 
 namespace JSC { namespace FTL {
 
@@ -46,25 +45,6 @@ JITFinalizer::~JITFinalizer()
 {
 }
 
-size_t JITFinalizer::codeSize()
-{
-    size_t result = 0;
-    
-    if (exitThunksLinkBuffer)
-        result += exitThunksLinkBuffer->size();
-    if (entrypointLinkBuffer)
-        result += entrypointLinkBuffer->size();
-    if (sideCodeLinkBuffer)
-        result += sideCodeLinkBuffer->size();
-    if (handleExceptionsLinkBuffer)
-        result += handleExceptionsLinkBuffer->size();
-    
-    for (unsigned i = jitCode->handles().size(); i--;)
-        result += jitCode->handles()[i]->sizeInBytes();
-    
-    return result;
-}
-
 bool JITFinalizer::finalize()
 {
     RELEASE_ASSERT_NOT_REACHED();
@@ -79,7 +59,7 @@ bool JITFinalizer::finalizeFunction()
     }
     
     if (exitThunksLinkBuffer) {
-        StackMaps::RecordMap recordMap = jitCode->stackmaps.computeRecordMap();
+        StackMaps::RecordMap recordMap = jitCode->stackmaps.getRecordMap();
         
         for (unsigned i = 0; i < osrExit.size(); ++i) {
             OSRExitCompilationInfo& info = osrExit[i];
@@ -93,7 +73,9 @@ bool JITFinalizer::finalizeFunction()
             exitThunksLinkBuffer->link(
                 info.m_thunkJump,
                 CodeLocationLabel(
-                    m_plan.vm.getCTIStub(osrExitGenerationThunkGenerator).code()));
+                    m_plan.vm.ftlThunks->getOSRExitGenerationThunk(
+                        m_plan.vm, Location::forStackmaps(
+                            &jitCode->stackmaps, iter->value.locations[0])).code()));
         }
         
         jitCode->initializeExitThunks(
@@ -120,31 +102,15 @@ bool JITFinalizer::finalizeFunction()
             .executableMemory());
     }
     
-    if (handleExceptionsLinkBuffer) {
-        jitCode->addHandle(FINALIZE_DFG_CODE(
-            *handleExceptionsLinkBuffer,
-            ("FTL exception handler for %s",
-                toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data()))
-            .executableMemory());
-    }
-
-    for (unsigned i = 0; i < outOfLineCodeInfos.size(); ++i) {
-        jitCode->addHandle(FINALIZE_DFG_CODE(
-            *outOfLineCodeInfos[i].m_linkBuffer,
-            ("FTL out of line code for %s", outOfLineCodeInfos[i].m_codeDescription)).executableMemory());
-    }
-
-    jitCode->initializeArityCheckEntrypoint(
+    MacroAssemblerCodePtr withArityCheck;
+    if (arityCheck.isSet())
+        withArityCheck = entrypointLinkBuffer->locationOf(arityCheck);
+    jitCode->initializeCode(
         FINALIZE_DFG_CODE(
             *entrypointLinkBuffer,
             ("FTL entrypoint thunk for %s with LLVM generated code at %p", toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data(), function)));
     
-    m_plan.codeBlock->setJITCode(jitCode);
-
-    m_plan.vm.updateFTLLargestStackSize(jitCode->stackmaps.stackSize());
-
-    if (m_plan.compilation)
-        m_plan.vm.m_perBytecodeProfiler->addCompilation(m_plan.compilation);
+    m_plan.codeBlock->setJITCode(jitCode, withArityCheck);
     
     return true;
 }
diff --git a/Source/JavaScriptCore/ftl/FTLJITFinalizer.h b/Source/JavaScriptCore/ftl/FTLJITFinalizer.h
index a1e0d034f..a7ecd9486 100644
--- a/Source/JavaScriptCore/ftl/FTLJITFinalizer.h
+++ b/Source/JavaScriptCore/ftl/FTLJITFinalizer.h
@@ -26,6 +26,8 @@
 #ifndef FTLJITFinalizer_h
 #define FTLJITFinalizer_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGFinalizer.h"
@@ -39,34 +41,20 @@
 
 namespace JSC { namespace FTL {
 
-class OutOfLineCodeInfo {
-public:
-    OutOfLineCodeInfo(std::unique_ptr<LinkBuffer> linkBuffer, const char* codeDescription)
-        : m_linkBuffer(WTF::move(linkBuffer))
-        , m_codeDescription(codeDescription)
-    {
-    }
-
-    std::unique_ptr<LinkBuffer> m_linkBuffer;
-    const char* m_codeDescription;
-};
-
 class JITFinalizer : public DFG::Finalizer {
 public:
     JITFinalizer(DFG::Plan&);
     virtual ~JITFinalizer();
+    
+    bool finalize();
+    bool finalizeFunction();
 
-    size_t codeSize() override;
-    bool finalize() override;
-    bool finalizeFunction() override;
-
-    std::unique_ptr<LinkBuffer> exitThunksLinkBuffer;
-    std::unique_ptr<LinkBuffer> entrypointLinkBuffer;
-    std::unique_ptr<LinkBuffer> sideCodeLinkBuffer;
-    std::unique_ptr<LinkBuffer> handleExceptionsLinkBuffer;
-    Vector<OutOfLineCodeInfo> outOfLineCodeInfos;
+    OwnPtr<LinkBuffer> exitThunksLinkBuffer;
+    OwnPtr<LinkBuffer> entrypointLinkBuffer;
+    OwnPtr<LinkBuffer> sideCodeLinkBuffer;
     Vector<SlowPathCall> slowPathCalls; // Calls inside the side code.
     Vector<OSRExitCompilationInfo> osrExit;
+    MacroAssembler::Label arityCheck;
     GeneratedFunction function;
     RefPtr<JITCode> jitCode;
 };
diff --git a/Source/JavaScriptCore/ftl/FTLJSCall.cpp b/Source/JavaScriptCore/ftl/FTLJSCall.cpp
deleted file mode 100644
index e6f6bda47..000000000
--- a/Source/JavaScriptCore/ftl/FTLJSCall.cpp
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLJSCall.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGNode.h"
-#include "LinkBuffer.h"
-
-namespace JSC { namespace FTL {
-
-using namespace DFG;
-
-JSCall::JSCall()
-    : m_stackmapID(UINT_MAX)
-    , m_instructionOffset(UINT_MAX)
-{
-}
-
-JSCall::JSCall(unsigned stackmapID, Node* node)
-    : JSCallBase(
-        node->op() == Construct ? CallLinkInfo::Construct : CallLinkInfo::Call,
-        node->origin.semantic)
-    , m_stackmapID(stackmapID)
-    , m_instructionOffset(0)
-{
-    ASSERT(node->op() == Call || node->op() == Construct);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLJSCall.h b/Source/JavaScriptCore/ftl/FTLJSCall.h
deleted file mode 100644
index 2f5e64aea..000000000
--- a/Source/JavaScriptCore/ftl/FTLJSCall.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLJSCall_h
-#define FTLJSCall_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLJSCallBase.h"
-
-namespace JSC {
-
-namespace DFG {
-struct Node;
-}
-
-namespace FTL {
-
-class JSCall : public JSCallBase {
-public:
-    JSCall();
-    JSCall(unsigned stackmapID, DFG::Node*);
-    
-    unsigned stackmapID() const { return m_stackmapID; }
-    
-    bool operator<(const JSCall& other) const
-    {
-        return m_instructionOffset < other.m_instructionOffset;
-    }
-    
-private:
-    unsigned m_stackmapID;
-
-public:
-    uint32_t m_instructionOffset;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLJSCall_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLJSCallBase.cpp b/Source/JavaScriptCore/ftl/FTLJSCallBase.cpp
deleted file mode 100644
index f200a9f6b..000000000
--- a/Source/JavaScriptCore/ftl/FTLJSCallBase.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLJSCallBase.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGNode.h"
-#include "LinkBuffer.h"
-
-namespace JSC { namespace FTL {
-
-using namespace DFG;
-
-JSCallBase::JSCallBase()
-    : m_type(CallLinkInfo::None)
-    , m_callLinkInfo(nullptr)
-{
-}
-
-JSCallBase::JSCallBase(CallLinkInfo::CallType type, CodeOrigin origin)
-    : m_type(type)
-    , m_origin(origin)
-    , m_callLinkInfo(nullptr)
-{
-}
-
-void JSCallBase::emit(CCallHelpers& jit)
-{
-    m_callLinkInfo = jit.codeBlock()->addCallLinkInfo();
-    
-    CCallHelpers::Jump slowPath = jit.branchPtrWithPatch(
-        CCallHelpers::NotEqual, GPRInfo::regT0, m_targetToCheck,
-        CCallHelpers::TrustedImmPtr(0));
-    
-    m_fastCall = jit.nearCall();
-    CCallHelpers::Jump done = jit.jump();
-    
-    slowPath.link(&jit);
-    
-    jit.move(CCallHelpers::TrustedImmPtr(m_callLinkInfo), GPRInfo::regT2);
-    m_slowCall = jit.nearCall();
-    
-    done.link(&jit);
-}
-
-void JSCallBase::link(VM& vm, LinkBuffer& linkBuffer)
-{
-    linkBuffer.link(
-        m_slowCall, FunctionPtr(vm.getCTIStub(linkCallThunkGenerator).code().executableAddress()));
-
-    m_callLinkInfo->setUpCallFromFTL(m_type, m_origin, linkBuffer.locationOfNearCall(m_slowCall),
-        linkBuffer.locationOf(m_targetToCheck), linkBuffer.locationOfNearCall(m_fastCall),
-        GPRInfo::regT0);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLJSCallBase.h b/Source/JavaScriptCore/ftl/FTLJSCallBase.h
deleted file mode 100644
index 595ac6943..000000000
--- a/Source/JavaScriptCore/ftl/FTLJSCallBase.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLJSCallBase_h
-#define FTLJSCallBase_h
-
-#if ENABLE(FTL_JIT)
-
-#include "CCallHelpers.h"
-#include "CallLinkInfo.h"
-#include "CodeOrigin.h"
-
-namespace JSC {
-
-class LinkBuffer;
-
-namespace DFG {
-struct Node;
-}
-
-namespace FTL {
-
-class JSCallBase {
-public:
-    JSCallBase();
-    JSCallBase(CallLinkInfo::CallType, CodeOrigin);
-    
-    void emit(CCallHelpers&);
-    void link(VM&, LinkBuffer&);
-    
-private:
-    CallLinkInfo::CallType m_type;
-    CodeOrigin m_origin;
-    CCallHelpers::DataLabelPtr m_targetToCheck;
-    CCallHelpers::Call m_fastCall;
-    CCallHelpers::Call m_slowCall;
-    CallLinkInfo* m_callLinkInfo;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLJSCallBase_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLJSCallVarargs.cpp b/Source/JavaScriptCore/ftl/FTLJSCallVarargs.cpp
deleted file mode 100644
index ac87a3c61..000000000
--- a/Source/JavaScriptCore/ftl/FTLJSCallVarargs.cpp
+++ /dev/null
@@ -1,220 +0,0 @@
-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLJSCallVarargs.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGNode.h"
-#include "DFGOperations.h"
-#include "JSCInlines.h"
-#include "LinkBuffer.h"
-#include "ScratchRegisterAllocator.h"
-#include "SetupVarargsFrame.h"
-
-namespace JSC { namespace FTL {
-
-using namespace DFG;
-
-JSCallVarargs::JSCallVarargs()
-    : m_stackmapID(UINT_MAX)
-    , m_node(nullptr)
-    , m_instructionOffset(UINT_MAX)
-{
-}
-
-JSCallVarargs::JSCallVarargs(unsigned stackmapID, Node* node)
-    : m_stackmapID(stackmapID)
-    , m_node(node)
-    , m_callBase(
-        (node->op() == ConstructVarargs || node->op() == ConstructForwardVarargs)
-        ? CallLinkInfo::ConstructVarargs : CallLinkInfo::CallVarargs,
-        node->origin.semantic)
-    , m_instructionOffset(0)
-{
-    ASSERT(
-        node->op() == CallVarargs || node->op() == CallForwardVarargs
-        || node->op() == ConstructVarargs || node->op() == ConstructForwardVarargs);
-}
-
-unsigned JSCallVarargs::numSpillSlotsNeeded()
-{
-    return 4;
-}
-
-void JSCallVarargs::emit(CCallHelpers& jit, int32_t spillSlotsOffset)
-{
-    // We are passed three pieces of information:
-    // - The callee.
-    // - The arguments object, if it's not a forwarding call.
-    // - The "this" value, if it's a constructor call.
-
-    CallVarargsData* data = m_node->callVarargsData();
-    
-    GPRReg calleeGPR = GPRInfo::argumentGPR0;
-    
-    GPRReg argumentsGPR = InvalidGPRReg;
-    GPRReg thisGPR = InvalidGPRReg;
-    
-    bool forwarding = false;
-    
-    switch (m_node->op()) {
-    case CallVarargs:
-    case ConstructVarargs:
-        argumentsGPR = GPRInfo::argumentGPR1;
-        thisGPR = GPRInfo::argumentGPR2;
-        break;
-    case CallForwardVarargs:
-    case ConstructForwardVarargs:
-        thisGPR = GPRInfo::argumentGPR1;
-        forwarding = true;
-        break;
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-        break;
-    }
-    
-    const unsigned calleeSpillSlot = 0;
-    const unsigned argumentsSpillSlot = 1;
-    const unsigned thisSpillSlot = 2;
-    const unsigned stackPointerSpillSlot = 3;
-    
-    // Get some scratch registers.
-    RegisterSet usedRegisters;
-    usedRegisters.merge(RegisterSet::stackRegisters());
-    usedRegisters.merge(RegisterSet::reservedHardwareRegisters());
-    usedRegisters.merge(RegisterSet::calleeSaveRegisters());
-    usedRegisters.set(calleeGPR);
-    if (argumentsGPR != InvalidGPRReg)
-        usedRegisters.set(argumentsGPR);
-    ASSERT(thisGPR);
-    usedRegisters.set(thisGPR);
-    ScratchRegisterAllocator allocator(usedRegisters);
-    GPRReg scratchGPR1 = allocator.allocateScratchGPR();
-    GPRReg scratchGPR2 = allocator.allocateScratchGPR();
-    GPRReg scratchGPR3 = allocator.allocateScratchGPR();
-
-    RELEASE_ASSERT(!allocator.numberOfReusedRegisters());
-    
-    auto computeUsedStack = [&] (GPRReg targetGPR, unsigned extra) {
-        if (isARM64()) {
-            // Have to do this the weird way because $sp on ARM64 means zero when used in a subtraction.
-            jit.move(CCallHelpers::stackPointerRegister, targetGPR);
-            jit.negPtr(targetGPR);
-            jit.addPtr(GPRInfo::callFrameRegister, targetGPR);
-        } else {
-            jit.move(GPRInfo::callFrameRegister, targetGPR);
-            jit.subPtr(CCallHelpers::stackPointerRegister, targetGPR);
-        }
-        if (extra)
-            jit.subPtr(CCallHelpers::TrustedImm32(extra), targetGPR);
-        jit.urshiftPtr(CCallHelpers::Imm32(3), targetGPR);
-    };
-    
-    auto callWithExceptionCheck = [&] (void* callee) {
-        jit.move(CCallHelpers::TrustedImmPtr(callee), GPRInfo::nonPreservedNonArgumentGPR);
-        jit.call(GPRInfo::nonPreservedNonArgumentGPR);
-        m_exceptions.append(jit.emitExceptionCheck(AssemblyHelpers::NormalExceptionCheck, AssemblyHelpers::FarJumpWidth));
-    };
-    
-    if (isARM64()) {
-        jit.move(CCallHelpers::stackPointerRegister, scratchGPR1);
-        jit.storePtr(scratchGPR1, CCallHelpers::addressFor(spillSlotsOffset + stackPointerSpillSlot));
-    } else
-        jit.storePtr(CCallHelpers::stackPointerRegister, CCallHelpers::addressFor(spillSlotsOffset + stackPointerSpillSlot));
-
-    unsigned extraStack = sizeof(CallerFrameAndPC) +
-        WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(void*));
-
-    if (forwarding) {
-        CCallHelpers::JumpList slowCase;
-        computeUsedStack(scratchGPR2, 0);
-        emitSetupVarargsFrameFastCase(jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, m_node->child2()->origin.semantic.inlineCallFrame, data->firstVarArgOffset, slowCase);
-        
-        CCallHelpers::Jump done = jit.jump();
-        slowCase.link(&jit);
-        jit.subPtr(CCallHelpers::TrustedImm32(extraStack), CCallHelpers::stackPointerRegister);
-        jit.setupArgumentsExecState();
-        callWithExceptionCheck(bitwise_cast<void*>(operationThrowStackOverflowForVarargs));
-        jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
-        
-        done.link(&jit);
-        jit.move(calleeGPR, GPRInfo::regT0);
-    } else {
-        // Gotta spill the callee, arguments, and this because we will need them later and we will have some
-        // calls that clobber them.
-        jit.store64(calleeGPR, CCallHelpers::addressFor(spillSlotsOffset + calleeSpillSlot));
-        jit.store64(argumentsGPR, CCallHelpers::addressFor(spillSlotsOffset + argumentsSpillSlot));
-        jit.store64(thisGPR, CCallHelpers::addressFor(spillSlotsOffset + thisSpillSlot));
-    
-        computeUsedStack(scratchGPR1, 0);
-        jit.subPtr(CCallHelpers::TrustedImm32(extraStack), CCallHelpers::stackPointerRegister);
-        jit.setupArgumentsWithExecState(argumentsGPR, scratchGPR1, CCallHelpers::TrustedImm32(data->firstVarArgOffset));
-        callWithExceptionCheck(bitwise_cast<void*>(operationSizeFrameForVarargs));
-    
-        jit.move(GPRInfo::returnValueGPR, scratchGPR1);
-        computeUsedStack(scratchGPR2, extraStack);
-        jit.load64(CCallHelpers::addressFor(spillSlotsOffset + argumentsSpillSlot), argumentsGPR);
-        emitSetVarargsFrame(jit, scratchGPR1, false, scratchGPR2, scratchGPR2);
-        jit.addPtr(CCallHelpers::TrustedImm32(-extraStack), scratchGPR2, CCallHelpers::stackPointerRegister);
-        jit.setupArgumentsWithExecState(scratchGPR2, argumentsGPR, CCallHelpers::TrustedImm32(data->firstVarArgOffset), scratchGPR1);
-        callWithExceptionCheck(bitwise_cast<void*>(operationSetupVarargsFrame));
-    
-        jit.move(GPRInfo::returnValueGPR, scratchGPR2);
-
-        jit.load64(CCallHelpers::addressFor(spillSlotsOffset + thisSpillSlot), thisGPR);
-        jit.load64(CCallHelpers::addressFor(spillSlotsOffset + calleeSpillSlot), GPRInfo::regT0);
-    }
-    
-    jit.addPtr(CCallHelpers::TrustedImm32(sizeof(CallerFrameAndPC)), scratchGPR2, CCallHelpers::stackPointerRegister);
-
-    jit.store64(thisGPR, CCallHelpers::calleeArgumentSlot(0));
-    
-    // Henceforth we make the call. The base FTL call machinery expects the callee in regT0 and for the
-    // stack frame to already be set up, which it is.
-    jit.store64(GPRInfo::regT0, CCallHelpers::calleeFrameSlot(JSStack::Callee));
-    
-    m_callBase.emit(jit);
-    
-    // Undo the damage we've done.
-    if (isARM64()) {
-        GPRReg scratchGPRAtReturn = CCallHelpers::selectScratchGPR(GPRInfo::returnValueGPR);
-        jit.loadPtr(CCallHelpers::addressFor(spillSlotsOffset + stackPointerSpillSlot), scratchGPRAtReturn);
-        jit.move(scratchGPRAtReturn, CCallHelpers::stackPointerRegister);
-    } else
-        jit.loadPtr(CCallHelpers::addressFor(spillSlotsOffset + stackPointerSpillSlot), CCallHelpers::stackPointerRegister);
-}
-
-void JSCallVarargs::link(VM& vm, LinkBuffer& linkBuffer, CodeLocationLabel exceptionHandler)
-{
-    m_callBase.link(vm, linkBuffer);
-    linkBuffer.link(m_exceptions, exceptionHandler);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLJSCallVarargs.h b/Source/JavaScriptCore/ftl/FTLJSCallVarargs.h
deleted file mode 100644
index 5128ff8c7..000000000
--- a/Source/JavaScriptCore/ftl/FTLJSCallVarargs.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLJSCallVarargs_h
-#define FTLJSCallVarargs_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLJSCallBase.h"
-
-namespace JSC {
-
-class LinkBuffer;
-
-namespace DFG {
-struct Node;
-}
-
-namespace FTL {
-
-class JSCallVarargs {
-public:
-    JSCallVarargs();
-    JSCallVarargs(unsigned stackmapID, DFG::Node*);
-    
-    DFG::Node* node() const { return m_node; }
-    
-    static unsigned numSpillSlotsNeeded();
-    
-    void emit(CCallHelpers&, int32_t spillSlotsOffset);
-    void link(VM&, LinkBuffer&, CodeLocationLabel exceptionHandler);
-    
-    unsigned stackmapID() const { return m_stackmapID; }
-    
-    bool operator<(const JSCallVarargs& other) const
-    {
-        return m_instructionOffset < other.m_instructionOffset;
-    }
-    
-private:
-    unsigned m_stackmapID;
-    DFG::Node* m_node;
-    JSCallBase m_callBase;
-    CCallHelpers::JumpList m_exceptions;
-
-public:
-    uint32_t m_instructionOffset;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLJSCallVarargs_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLLink.cpp b/Source/JavaScriptCore/ftl/FTLLink.cpp
index 188afe5f0..85050d151 100644
--- a/Source/JavaScriptCore/ftl/FTLLink.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLink.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,8 +28,8 @@
 
 #if ENABLE(FTL_JIT)
 
-#include "ArityCheckFailReturnThunks.h"
 #include "CCallHelpers.h"
+#include "CallFrameInlines.h"
 #include "CodeBlockWithJITType.h"
 #include "DFGCommon.h"
 #include "FTLJITCode.h"
@@ -37,156 +37,121 @@
 #include "JITStubs.h"
 #include "LLVMAPI.h"
 #include "LinkBuffer.h"
-#include "JSCInlines.h"
-#include "ProfilerCompilation.h"
 #include "VirtualRegister.h"
 
 namespace JSC { namespace FTL {
 
 using namespace DFG;
 
+static void compileEntry(CCallHelpers& jit)
+{
+    jit.preserveReturnAddressAfterCall(GPRInfo::regT2);
+    jit.emitPutReturnPCToCallFrameHeader(GPRInfo::regT2);
+    jit.emitPutImmediateToCallFrameHeader(jit.codeBlock(), JSStack::CodeBlock);
+}
+
 void link(State& state)
 {
-    Graph& graph = state.graph;
-    CodeBlock* codeBlock = graph.m_codeBlock;
-    VM& vm = graph.m_vm;
+    CodeBlock* codeBlock = state.graph.m_codeBlock;
     
     // LLVM will create its own jump tables as needed.
     codeBlock->clearSwitchJumpTables();
     
-    // FIXME: Need to know the real frame register count.
-    // https://bugs.webkit.org/show_bug.cgi?id=125727
-    state.jitCode->common.frameRegisterCount = 1000;
-    
-    state.jitCode->common.requiredRegisterCountForExit = graph.requiredRegisterCountForExit();
+    state.jitCode->common.frameRegisterCount = state.graph.frameRegisterCount();
+    state.jitCode->common.requiredRegisterCountForExit = state.graph.requiredRegisterCountForExit();
     
-    if (!graph.m_plan.inlineCallFrames->isEmpty())
-        state.jitCode->common.inlineCallFrames = graph.m_plan.inlineCallFrames;
+    if (!state.graph.m_inlineCallFrames->isEmpty())
+        state.jitCode->common.inlineCallFrames = std::move(state.graph.m_inlineCallFrames);
     
-    graph.registerFrozenValues();
-
     // Create the entrypoint. Note that we use this entrypoint totally differently
     // depending on whether we're doing OSR entry or not.
-    CCallHelpers jit(&vm, codeBlock);
+    // FIXME: Except for OSR entry, this is a total kludge - LLVM should just use our
+    // calling convention.
+    // https://bugs.webkit.org/show_bug.cgi?id=113621
+    CCallHelpers jit(&state.graph.m_vm, codeBlock);
     
-    std::unique_ptr<LinkBuffer> linkBuffer;
-
-    CCallHelpers::Address frame = CCallHelpers::Address(
-        CCallHelpers::stackPointerRegister, -static_cast<int32_t>(AssemblyHelpers::prologueStackPointerDelta()));
+    OwnPtr<LinkBuffer> linkBuffer;
+    CCallHelpers::Label arityCheck;
+    switch (state.graph.m_plan.mode) {
+    case FTLMode: {
+        compileEntry(jit);
     
-    if (Profiler::Compilation* compilation = graph.compilation()) {
-        compilation->addDescription(
-            Profiler::OriginStack(),
-            toCString("Generated FTL JIT code for ", CodeBlockWithJITType(codeBlock, JITCode::FTLJIT), ", instruction count = ", graph.m_codeBlock->instructionCount(), ":\n"));
+        // This part is only necessary for functions. We currently only compile functions.
         
-        graph.m_dominators.computeIfNecessary(graph);
-        graph.m_naturalLoops.computeIfNecessary(graph);
+        CCallHelpers::Label fromArityCheck = jit.label();
         
-        const char* prefix = "    ";
-        
-        DumpContext dumpContext;
-        StringPrintStream out;
-        Node* lastNode = 0;
-        for (size_t blockIndex = 0; blockIndex < graph.numBlocks(); ++blockIndex) {
-            BasicBlock* block = graph.block(blockIndex);
-            if (!block)
-                continue;
-            
-            graph.dumpBlockHeader(out, prefix, block, Graph::DumpLivePhisOnly, &dumpContext);
-            compilation->addDescription(Profiler::OriginStack(), out.toCString());
-            out.reset();
-            
-            for (size_t nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
-                Node* node = block->at(nodeIndex);
-                
-                Profiler::OriginStack stack;
-                
-                if (node->origin.semantic.isSet()) {
-                    stack = Profiler::OriginStack(
-                        *vm.m_perBytecodeProfiler, codeBlock, node->origin.semantic);
-                }
-                
-                if (graph.dumpCodeOrigin(out, prefix, lastNode, node, &dumpContext)) {
-                    compilation->addDescription(stack, out.toCString());
-                    out.reset();
-                }
-                
-                graph.dump(out, prefix, node, &dumpContext);
-                compilation->addDescription(stack, out.toCString());
-                out.reset();
-                
-                if (node->origin.semantic.isSet())
-                    lastNode = node;
-            }
-        }
+        // Plant a check that sufficient space is available in the JSStack.
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=56291
+        jit.addPtr(
+            CCallHelpers::TrustedImm32(virtualRegisterForLocal(state.jitCode->common.requiredRegisterCountForExit).offset() * sizeof(Register)),
+            GPRInfo::callFrameRegister, GPRInfo::regT1);
+        CCallHelpers::Jump stackCheck = jit.branchPtr(
+            CCallHelpers::Above,
+            CCallHelpers::AbsoluteAddress(state.graph.m_vm.addressOfJSStackLimit()),
+            GPRInfo::regT1);
+        CCallHelpers::Label fromStackCheck = jit.label();
         
-        dumpContext.dump(out, prefix);
-        compilation->addDescription(Profiler::OriginStack(), out.toCString());
-        out.reset();
+        jit.setupArgumentsExecState();
+        jit.move(
+            CCallHelpers::TrustedImmPtr(reinterpret_cast<void*>(state.generatedFunction)),
+            GPRInfo::nonArgGPR0);
+        jit.call(GPRInfo::nonArgGPR0);
+        jit.emitGetReturnPCFromCallFrameHeaderPtr(GPRInfo::regT1);
+        jit.emitGetCallerFrameFromCallFrameHeaderPtr(GPRInfo::callFrameRegister);
+        jit.restoreReturnAddressBeforeReturn(GPRInfo::regT1);
+        jit.ret();
         
-        out.print("    Disassembly:\n");
-        for (unsigned i = 0; i < state.jitCode->handles().size(); ++i) {
-            if (state.codeSectionNames[i] != SECTION_NAME("text"))
-                continue;
-            
-            ExecutableMemoryHandle* handle = state.jitCode->handles()[i].get();
-            disassemble(
-                MacroAssemblerCodePtr(handle->start()), handle->sizeInBytes(),
-                "      ", out, LLVMSubset);
-        }
-        compilation->addDescription(Profiler::OriginStack(), out.toCString());
-        out.reset();
+        stackCheck.link(&jit);
+        jit.move(CCallHelpers::TrustedImmPtr(codeBlock), GPRInfo::argumentGPR1);
+        jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+        jit.store32(
+            CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
+            CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
+        jit.storePtr(GPRInfo::callFrameRegister, &state.graph.m_vm.topCallFrame);
+        CCallHelpers::Call callStackCheck = jit.call();
+#if !ASSERT_DISABLED
+        // FIXME: need to make this call register with exception handling somehow. This is
+        // part of a bigger problem: FTL should be able to handle exceptions.
+        // https://bugs.webkit.org/show_bug.cgi?id=113622
+        // Until then, use a JIT ASSERT.
+        jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT0);
+        jit.jitAssertIsNull(GPRInfo::regT0);
+#endif
+        jit.jump(fromStackCheck);
         
-        state.jitCode->common.compilation = compilation;
-    }
-    
-    switch (graph.m_plan.mode) {
-    case FTLMode: {
-        CCallHelpers::JumpList mainPathJumps;
-    
+        arityCheck = jit.label();
+        compileEntry(jit);
         jit.load32(
-            frame.withOffset(sizeof(Register) * JSStack::ArgumentCount),
+            CCallHelpers::payloadFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)),
             GPRInfo::regT1);
-        mainPathJumps.append(jit.branch32(
+        jit.branch32(
             CCallHelpers::AboveOrEqual, GPRInfo::regT1,
-            CCallHelpers::TrustedImm32(codeBlock->numParameters())));
-        jit.emitFunctionPrologue();
+            CCallHelpers::TrustedImm32(codeBlock->numParameters()))
+            .linkTo(fromArityCheck, &jit);
         jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
         jit.store32(
             CCallHelpers::TrustedImm32(CallFrame::Location::encodeAsBytecodeOffset(0)),
-            CCallHelpers::tagFor(JSStack::ArgumentCount));
-        jit.storePtr(GPRInfo::callFrameRegister, &vm.topCallFrame);
+            CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
+        jit.storePtr(GPRInfo::callFrameRegister, &state.graph.m_vm.topCallFrame);
         CCallHelpers::Call callArityCheck = jit.call();
 #if !ASSERT_DISABLED
         // FIXME: need to make this call register with exception handling somehow. This is
         // part of a bigger problem: FTL should be able to handle exceptions.
         // https://bugs.webkit.org/show_bug.cgi?id=113622
         // Until then, use a JIT ASSERT.
-        jit.load64(vm.addressOfException(), GPRInfo::regT1);
+        jit.load64(state.graph.m_vm.addressOfException(), GPRInfo::regT1);
         jit.jitAssertIsNull(GPRInfo::regT1);
 #endif
-        jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
-        jit.emitFunctionEpilogue();
-        mainPathJumps.append(jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0));
-        jit.emitFunctionPrologue();
-        CodeLocationLabel* arityThunkLabels =
-            vm.arityCheckFailReturnThunks->returnPCsFor(vm, codeBlock->numParameters());
-        jit.move(CCallHelpers::TrustedImmPtr(arityThunkLabels), GPRInfo::regT7);
-        jit.loadPtr(CCallHelpers::BaseIndex(GPRInfo::regT7, GPRInfo::regT0, CCallHelpers::timesPtr()), GPRInfo::regT7);
+        if (GPRInfo::returnValueGPR != GPRInfo::regT0)
+            jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
+        jit.branchTest32(CCallHelpers::Zero, GPRInfo::regT0).linkTo(fromArityCheck, &jit);
         CCallHelpers::Call callArityFixup = jit.call();
-        jit.emitFunctionEpilogue();
-        mainPathJumps.append(jit.jump());
-
-        linkBuffer = std::make_unique<LinkBuffer>(vm, jit, codeBlock, JITCompilationCanFail);
-        if (linkBuffer->didFailToAllocate()) {
-            state.allocationFailed = true;
-            return;
-        }
+        jit.jump(fromArityCheck);
+        
+        linkBuffer = adoptPtr(new LinkBuffer(state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));
+        linkBuffer->link(callStackCheck, operationStackCheck);
         linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck);
-        linkBuffer->link(callArityFixup, FunctionPtr((vm.getCTIStub(arityFixupGenerator)).code().executableAddress()));
-        linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
-
-        state.jitCode->initializeAddressForCall(MacroAssemblerCodePtr(bitwise_cast<void*>(state.generatedFunction)));
+        linkBuffer->link(callArityFixup, FunctionPtr((state.graph.m_vm.getCTIStub(arityFixup)).code().executableAddress()));
         break;
     }
         
@@ -195,18 +160,18 @@ void link(State& state)
         // values into the scratch buffer. Everything should be good to go - at this
         // point we've even done the stack check. Basically we just have to make the
         // call to the LLVM-generated code.
-        CCallHelpers::Label start = jit.label();
-        jit.emitFunctionEpilogue();
-        CCallHelpers::Jump mainPathJump = jit.jump();
+        jit.setupArgumentsExecState();
+        jit.move(
+            CCallHelpers::TrustedImmPtr(reinterpret_cast<void*>(state.generatedFunction)),
+            GPRInfo::nonArgGPR0);
+        jit.call(GPRInfo::nonArgGPR0);
+        jit.emitGetReturnPCFromCallFrameHeaderPtr(GPRInfo::regT1);
+        jit.emitGetCallerFrameFromCallFrameHeaderPtr(GPRInfo::callFrameRegister);
+        jit.restoreReturnAddressBeforeReturn(GPRInfo::regT1);
+        jit.ret();
         
-        linkBuffer = std::make_unique<LinkBuffer>(vm, jit, codeBlock, JITCompilationCanFail);
-        if (linkBuffer->didFailToAllocate()) {
-            state.allocationFailed = true;
-            return;
-        }
-        linkBuffer->link(mainPathJump, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
-
-        state.jitCode->initializeAddressForCall(linkBuffer->locationOf(start));
+        linkBuffer = adoptPtr(new LinkBuffer(
+            state.graph.m_vm, &jit, codeBlock, JITCompilationMustSucceed));
         break;
     }
         
@@ -215,8 +180,9 @@ void link(State& state)
         break;
     }
     
-    state.finalizer->entrypointLinkBuffer = WTF::move(linkBuffer);
+    state.finalizer->entrypointLinkBuffer = linkBuffer.release();
     state.finalizer->function = state.generatedFunction;
+    state.finalizer->arityCheck = arityCheck;
     state.finalizer->jitCode = state.jitCode;
 }
 
diff --git a/Source/JavaScriptCore/ftl/FTLLink.h b/Source/JavaScriptCore/ftl/FTLLink.h
index 0103f2f73..d49e169fc 100644
--- a/Source/JavaScriptCore/ftl/FTLLink.h
+++ b/Source/JavaScriptCore/ftl/FTLLink.h
@@ -26,6 +26,8 @@
 #ifndef FTLLink_h
 #define FTLLink_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLState.h"
diff --git a/Source/JavaScriptCore/ftl/FTLLocation.cpp b/Source/JavaScriptCore/ftl/FTLLocation.cpp
deleted file mode 100644
index e00982527..000000000
--- a/Source/JavaScriptCore/ftl/FTLLocation.cpp
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLLocation.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLSaveRestore.h"
-#include "RegisterSet.h"
-#include <wtf/CommaPrinter.h>
-#include <wtf/DataLog.h>
-#include <wtf/ListDump.h>
-
-namespace JSC { namespace FTL {
-
-Location Location::forStackmaps(const StackMaps* stackmaps, const StackMaps::Location& location)
-{
-    switch (location.kind) {
-    case StackMaps::Location::Unprocessed:
-        RELEASE_ASSERT_NOT_REACHED();
-        break;
-        
-    case StackMaps::Location::Register:
-    case StackMaps::Location::Direct:
-        return forRegister(location.dwarfReg, location.offset);
-        
-    case StackMaps::Location::Indirect:
-        return forIndirect(location.dwarfReg, location.offset);
-        
-    case StackMaps::Location::Constant:
-        return forConstant(location.offset);
-        
-    case StackMaps::Location::ConstantIndex:
-        ASSERT(stackmaps);
-        return forConstant(stackmaps->constants[location.offset].integer);
-    }
-    
-    RELEASE_ASSERT_NOT_REACHED();
-
-    return Location();
-}
-
-void Location::dump(PrintStream& out) const
-{
-    out.print("(", kind());
-    if (hasDwarfReg())
-        out.print(", ", dwarfReg());
-    if (hasOffset())
-        out.print(", ", offset());
-    if (hasAddend())
-        out.print(", ", addend());
-    if (hasConstant())
-        out.print(", ", constant());
-    out.print(")");
-}
-
-bool Location::involvesGPR() const
-{
-    return isGPR() || kind() == Indirect;
-}
-
-bool Location::isGPR() const
-{
-    return kind() == Register && dwarfReg().reg().isGPR();
-}
-
-GPRReg Location::gpr() const
-{
-    return dwarfReg().reg().gpr();
-}
-
-bool Location::isFPR() const
-{
-    return kind() == Register && dwarfReg().reg().isFPR();
-}
-
-FPRReg Location::fpr() const
-{
-    return dwarfReg().reg().fpr();
-}
-
-void Location::restoreInto(MacroAssembler& jit, char* savedRegisters, GPRReg result, unsigned numFramesToPop) const
-{
-    if (involvesGPR() && RegisterSet::stackRegisters().get(gpr())) {
-        // Make the result GPR contain the appropriate stack register.
-        if (numFramesToPop) {
-            jit.move(MacroAssembler::framePointerRegister, result);
-            
-            for (unsigned i = numFramesToPop - 1; i--;)
-                jit.loadPtr(result, result);
-            
-            if (gpr() == MacroAssembler::framePointerRegister)
-                jit.loadPtr(result, result);
-            else
-                jit.addPtr(MacroAssembler::TrustedImmPtr(sizeof(void*) * 2), result);
-        } else
-            jit.move(gpr(), result);
-    }
-    
-    if (isGPR()) {
-        if (RegisterSet::stackRegisters().get(gpr())) {
-            // Already restored into result.
-        } else
-            jit.load64(savedRegisters + offsetOfGPR(gpr()), result);
-        
-        if (addend())
-            jit.add64(MacroAssembler::TrustedImm32(addend()), result);
-        return;
-    }
-    
-    if (isFPR()) {
-        jit.load64(savedRegisters + offsetOfFPR(fpr()), result);
-        ASSERT(!addend());
-        return;
-    }
-    
-    switch (kind()) {
-    case Register:
-        // LLVM used some register that we don't know about!
-        dataLog("Unrecognized location: ", *this, "\n");
-        RELEASE_ASSERT_NOT_REACHED();
-        return;
-        
-    case Indirect:
-        if (RegisterSet::stackRegisters().get(gpr())) {
-            // The stack register is already recovered into result.
-            jit.load64(MacroAssembler::Address(result, offset()), result);
-            return;
-        }
-        
-        jit.load64(savedRegisters + offsetOfGPR(gpr()), result);
-        jit.load64(MacroAssembler::Address(result, offset()), result);
-        return;
-        
-    case Constant:
-        jit.move(MacroAssembler::TrustedImm64(constant()), result);
-        return;
-        
-    case Unprocessed:
-        // Should never see this - it's an enumeration entry on LLVM's side that means that
-        // it hasn't processed this location.
-        RELEASE_ASSERT_NOT_REACHED();
-        return;
-    }
-    
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-GPRReg Location::directGPR() const
-{
-    RELEASE_ASSERT(!addend());
-    return gpr();
-}
-
-} } // namespace JSC::FTL
-
-namespace WTF {
-
-using namespace JSC::FTL;
-
-void printInternal(PrintStream& out, JSC::FTL::Location::Kind kind)
-{
-    switch (kind) {
-    case Location::Unprocessed:
-        out.print("Unprocessed");
-        return;
-    case Location::Register:
-        out.print("Register");
-        return;
-    case Location::Indirect:
-        out.print("Indirect");
-        return;
-    case Location::Constant:
-        out.print("Constant");
-        return;
-    }
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLLocation.h b/Source/JavaScriptCore/ftl/FTLLocation.h
deleted file mode 100644
index 72718bbd8..000000000
--- a/Source/JavaScriptCore/ftl/FTLLocation.h
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLLocation_h
-#define FTLLocation_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FPRInfo.h"
-#include "FTLDWARFRegister.h"
-#include "FTLStackMaps.h"
-#include "GPRInfo.h"
-#include <wtf/HashMap.h>
-
-namespace JSC { namespace FTL {
-
-class Location {
-public:
-    enum Kind {
-        Unprocessed,
-        Register,
-        Indirect,
-        Constant
-    };
-    
-    Location()
-        : m_kind(Unprocessed)
-    {
-        u.constant = 0;
-    }
-    
-    Location(WTF::HashTableDeletedValueType)
-        : m_kind(Unprocessed)
-    {
-        u.constant = 1;
-    }
-    
-    static Location forRegister(DWARFRegister dwarfReg, int32_t addend)
-    {
-        Location result;
-        result.m_kind = Register;
-        result.u.variable.dwarfRegNum = dwarfReg.dwarfRegNum();
-        result.u.variable.offset = addend;
-        return result;
-    }
-    
-    static Location forIndirect(DWARFRegister dwarfReg, int32_t offset)
-    {
-        Location result;
-        result.m_kind = Indirect;
-        result.u.variable.dwarfRegNum = dwarfReg.dwarfRegNum();
-        result.u.variable.offset = offset;
-        return result;
-    }
-    
-    static Location forConstant(int64_t constant)
-    {
-        Location result;
-        result.m_kind = Constant;
-        result.u.constant = constant;
-        return result;
-    }
-
-    // You can pass a null StackMaps if you are confident that the location doesn't
-    // involve a wide constant.
-    static Location forStackmaps(const StackMaps*, const StackMaps::Location&);
-    
-    Kind kind() const { return m_kind; }
-    
-    bool hasDwarfRegNum() const { return kind() == Register || kind() == Indirect; }
-    int16_t dwarfRegNum() const
-    {
-        ASSERT(hasDwarfRegNum());
-        return u.variable.dwarfRegNum;
-    }
-    
-    bool hasDwarfReg() const { return hasDwarfRegNum(); }
-    DWARFRegister dwarfReg() const { return DWARFRegister(dwarfRegNum()); }
-    
-    bool hasOffset() const { return kind() == Indirect; }
-    int32_t offset() const
-    {
-        ASSERT(hasOffset());
-        return u.variable.offset;
-    }
-    
-    bool hasAddend() const { return kind() == Register; }
-    int32_t addend() const
-    {
-        ASSERT(hasAddend());
-        return u.variable.offset;
-    }
-    
-    bool hasConstant() const { return kind() == Constant; }
-    int64_t constant() const
-    {
-        ASSERT(hasConstant());
-        return u.constant;
-    }
-    
-    bool operator!() const { return kind() == Unprocessed && !u.variable.offset; }
-    
-    bool isHashTableDeletedValue() const { return kind() == Unprocessed && u.variable.offset; }
-    
-    bool operator==(const Location& other) const
-    {
-        return m_kind == other.m_kind
-            && u.constant == other.u.constant;
-    }
-    
-    unsigned hash() const
-    {
-        unsigned result = m_kind;
-        
-        switch (kind()) {
-        case Unprocessed:
-            result ^= u.variable.offset;
-            break;
-
-        case Register:
-            result ^= u.variable.dwarfRegNum;
-            break;
-            
-        case Indirect:
-            result ^= u.variable.dwarfRegNum;
-            result ^= u.variable.offset;
-            break;
-            
-        case Constant:
-            result ^= WTF::IntHash<int64_t>::hash(u.constant);
-            break;
-        }
-        
-        return WTF::IntHash<unsigned>::hash(result);
-    }
-    
-    void dump(PrintStream&) const;
-    
-    bool isGPR() const;
-    bool involvesGPR() const;
-    GPRReg gpr() const;
-    GPRReg directGPR() const; // Get the GPR and assert that there is no addend.
-    
-    bool isFPR() const;
-    FPRReg fpr() const;
-    
-    // Assuming that all registers are saved to the savedRegisters buffer according
-    // to FTLSaveRestore convention, this loads the value into the given register.
-    // The code that this generates isn't exactly super fast. This assumes that FP
-    // and SP contain the same values that they would have contained in the original
-    // frame, or that you've done one or more canonically formed calls (i.e. can
-    // restore the FP by following the call frame linked list numFramesToPop times,
-    // and SP can be recovered by popping FP numFramesToPop-1 times and adding 16).
-    void restoreInto(MacroAssembler&, char* savedRegisters, GPRReg result, unsigned numFramesToPop = 0) const;
-    
-private:
-    Kind m_kind;
-    union {
-        int64_t constant;
-        struct {
-            int16_t dwarfRegNum;
-            int32_t offset;
-        } variable;
-    } u;
-};
-
-struct LocationHash {
-    static unsigned hash(const Location& key) { return key.hash(); }
-    static bool equal(const Location& a, const Location& b) { return a == b; }
-    static const bool safeToCompareToEmptyOrDeleted = true;
-};
-
-} } // namespace JSC::FTL
-
-namespace WTF {
-
-void printInternal(PrintStream&, JSC::FTL::Location::Kind);
-
-template<typename T> struct DefaultHash;
-template<> struct DefaultHash<JSC::FTL::Location> {
-    typedef JSC::FTL::LocationHash Hash;
-};
-
-template<typename T> struct HashTraits;
-template<> struct HashTraits<JSC::FTL::Location> : SimpleClassHashTraits<JSC::FTL::Location> { };
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLLocation_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
index 678629fd9..be2a40c7d 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,55 +31,25 @@
 #include "CodeBlockWithJITType.h"
 #include "DFGAbstractInterpreterInlines.h"
 #include "DFGInPlaceAbstractState.h"
-#include "DFGOSRAvailabilityAnalysisPhase.h"
-#include "DFGOSRExitFuzz.h"
-#include "DirectArguments.h"
 #include "FTLAbstractHeapRepository.h"
-#include "FTLAvailableRecovery.h"
 #include "FTLForOSREntryJITCode.h"
 #include "FTLFormattedValue.h"
 #include "FTLInlineCacheSize.h"
 #include "FTLLoweredNodeValue.h"
-#include "FTLOperations.h"
 #include "FTLOutput.h"
 #include "FTLThunks.h"
-#include "FTLWeightedTarget.h"
-#include "JSCInlines.h"
-#include "JSLexicalEnvironment.h"
+#include "LinkBuffer.h"
 #include "OperandsInlines.h"
-#include "ScopedArguments.h"
-#include "ScopedArgumentsTable.h"
+#include "Operations.h"
 #include "VirtualRegister.h"
 #include <atomic>
-#include <dlfcn.h>
-#include <llvm/InitializeLLVM.h>
-#include <unordered_set>
 #include <wtf/ProcessID.h>
 
 namespace JSC { namespace FTL {
 
 using namespace DFG;
 
-namespace {
-
-std::atomic<int> compileCounter;
-
-#if ASSERT_DISABLED
-NO_RETURN_DUE_TO_CRASH static void ftlUnreachable()
-{
-    CRASH();
-}
-#else
-NO_RETURN_DUE_TO_CRASH static void ftlUnreachable(
-    CodeBlock* codeBlock, BlockIndex blockIndex, unsigned nodeIndex)
-{
-    dataLog("Crashing in thought-to-be-unreachable FTL-generated code for ", pointerDump(codeBlock), " at basic block #", blockIndex);
-    if (nodeIndex != UINT_MAX)
-        dataLog(", node @", nodeIndex);
-    dataLog(".\n");
-    CRASH();
-}
-#endif
+static std::atomic<int> compileCounter;
 
 // Using this instead of typeCheck() helps to reduce the load on LLVM, by creating
 // significantly less dead code.
@@ -99,11 +69,10 @@ public:
         , m_ftlState(state)
         , m_heaps(state.context)
         , m_out(state.context)
+        , m_availability(OperandsLike, state.graph.block(0)->variablesAtHead)
         , m_state(state.graph)
         , m_interpreter(state.graph, m_state)
         , m_stackmapIDs(0)
-        , m_tbaaKind(mdKindID(state.context, "tbaa"))
-        , m_tbaaStructKind(mdKindID(state.context, "tbaa.struct"))
     {
     }
     
@@ -120,28 +89,22 @@ public:
         m_graph.m_dominators.computeIfNecessary(m_graph);
         
         m_ftlState.module =
-            moduleCreateWithNameInContext(name.data(), m_ftlState.context);
+            llvm->ModuleCreateWithNameInContext(name.data(), m_ftlState.context);
         
         m_ftlState.function = addFunction(
-            m_ftlState.module, name.data(), functionType(m_out.int64));
+            m_ftlState.module, name.data(), functionType(m_out.int64, m_out.intPtr));
         setFunctionCallingConv(m_ftlState.function, LLVMCCallConv);
-        if (isX86() && Options::llvmDisallowAVX()) {
-            // AVX makes V8/raytrace 80% slower. It makes Kraken/audio-oscillator 4.5x
-            // slower. It should be disabled.
-            addTargetDependentFunctionAttr(m_ftlState.function, "target-features", "-avx");
-        }
-        
-        if (verboseCompilationEnabled())
-            dataLog("Function ready, beginning lowering.\n");
         
         m_out.initialize(m_ftlState.module, m_ftlState.function, m_heaps);
         
-        m_prologue = FTL_NEW_BLOCK(m_out, ("Prologue"));
-        LBasicBlock stackOverflow = FTL_NEW_BLOCK(m_out, ("Stack overflow"));
-        m_handleExceptions = FTL_NEW_BLOCK(m_out, ("Handle Exceptions"));
+        m_prologue = appendBasicBlock(m_ftlState.context, m_ftlState.function);
+        m_out.appendTo(m_prologue);
+        createPhiVariables();
+        
+        m_callFrame = m_out.param(0);
+        m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
+        m_tagMask = m_out.constInt64(TagMask);
         
-        LBasicBlock checkArguments = FTL_NEW_BLOCK(m_out, ("Check arguments"));
-
         for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
             m_highBlock = m_graph.block(blockIndex);
             if (!m_highBlock)
@@ -149,122 +112,13 @@ public:
             m_blocks.add(m_highBlock, FTL_NEW_BLOCK(m_out, ("Block ", *m_highBlock)));
         }
         
-        m_out.appendTo(m_prologue, stackOverflow);
-        createPhiVariables();
-
-        auto preOrder = m_graph.blocksInPreOrder();
-
-        LValue capturedAlloca = m_out.alloca(arrayType(m_out.int64, m_graph.m_nextMachineLocal));
-        
-        m_captured = m_out.add(
-            m_out.ptrToInt(capturedAlloca, m_out.intPtr),
-            m_out.constIntPtr(m_graph.m_nextMachineLocal * sizeof(Register)));
-        
-        m_ftlState.capturedStackmapID = m_stackmapIDs++;
-        m_out.call(
-            m_out.stackmapIntrinsic(), m_out.constInt64(m_ftlState.capturedStackmapID),
-            m_out.int32Zero, capturedAlloca);
-        
-        // If we have any CallVarargs then we nee to have a spill slot for it.
-        bool hasVarargs = false;
-        for (BasicBlock* block : preOrder) {
-            for (Node* node : *block) {
-                switch (node->op()) {
-                case CallVarargs:
-                case CallForwardVarargs:
-                case ConstructVarargs:
-                case ConstructForwardVarargs:
-                    hasVarargs = true;
-                    break;
-                default:
-                    break;
-                }
-            }
-        }
-        if (hasVarargs) {
-            LValue varargsSpillSlots = m_out.alloca(
-                arrayType(m_out.int64, JSCallVarargs::numSpillSlotsNeeded()));
-            m_ftlState.varargsSpillSlotsStackmapID = m_stackmapIDs++;
-            m_out.call(
-                m_out.stackmapIntrinsic(), m_out.constInt64(m_ftlState.varargsSpillSlotsStackmapID),
-                m_out.int32Zero, varargsSpillSlots);
-        }
-        
-        // We should not create any alloca's after this point, since they will cease to
-        // be mem2reg candidates.
-        
-        m_callFrame = m_out.ptrToInt(
-            m_out.call(m_out.frameAddressIntrinsic(), m_out.int32Zero), m_out.intPtr);
-        m_tagTypeNumber = m_out.constInt64(TagTypeNumber);
-        m_tagMask = m_out.constInt64(TagMask);
-        
-        m_out.storePtr(m_out.constIntPtr(codeBlock()), addressFor(JSStack::CodeBlock));
-        
-        m_out.branch(
-            didOverflowStack(), rarely(stackOverflow), usually(checkArguments));
-        
-        m_out.appendTo(stackOverflow, m_handleExceptions);
-        m_out.call(m_out.operation(operationThrowStackOverflowError), m_callFrame, m_out.constIntPtr(codeBlock()));
-        m_ftlState.handleStackOverflowExceptionStackmapID = m_stackmapIDs++;
-        m_out.call(
-            m_out.stackmapIntrinsic(), m_out.constInt64(m_ftlState.handleStackOverflowExceptionStackmapID),
-            m_out.constInt32(MacroAssembler::maxJumpReplacementSize()));
-        m_out.unreachable();
-        
-        m_out.appendTo(m_handleExceptions, checkArguments);
-        m_ftlState.handleExceptionStackmapID = m_stackmapIDs++;
-        m_out.call(
-            m_out.stackmapIntrinsic(), m_out.constInt64(m_ftlState.handleExceptionStackmapID),
-            m_out.constInt32(MacroAssembler::maxJumpReplacementSize()));
-        m_out.unreachable();
-        
-        m_out.appendTo(checkArguments, lowBlock(m_graph.block(0)));
-        availabilityMap().clear();
-        availabilityMap().m_locals = Operands<Availability>(codeBlock()->numParameters(), 0);
-        for (unsigned i = codeBlock()->numParameters(); i--;) {
-            availabilityMap().m_locals.argument(i) =
-                Availability(FlushedAt(FlushedJSValue, virtualRegisterForArgument(i)));
-        }
-        m_codeOriginForExitTarget = CodeOrigin(0);
-        m_codeOriginForExitProfile = CodeOrigin(0);
-        m_node = nullptr;
-        for (unsigned i = codeBlock()->numParameters(); i--;) {
-            Node* node = m_graph.m_arguments[i];
-            VirtualRegister operand = virtualRegisterForArgument(i);
-            
-            LValue jsValue = m_out.load64(addressFor(operand));
-            
-            if (node) {
-                DFG_ASSERT(m_graph, node, operand == node->stackAccessData()->machineLocal);
-                
-                // This is a hack, but it's an effective one. It allows us to do CSE on the
-                // primordial load of arguments. This assumes that the GetLocal that got put in
-                // place of the original SetArgument doesn't have any effects before it. This
-                // should hold true.
-                m_loadedArgumentValues.add(node, jsValue);
-            }
-            
-            switch (m_graph.m_argumentFormats[i]) {
-            case FlushedInt32:
-                speculate(BadType, jsValueValue(jsValue), node, isNotInt32(jsValue));
-                break;
-            case FlushedBoolean:
-                speculate(BadType, jsValueValue(jsValue), node, isNotBoolean(jsValue));
-                break;
-            case FlushedCell:
-                speculate(BadType, jsValueValue(jsValue), node, isNotCell(jsValue));
-                break;
-            case FlushedJSValue:
-                break;
-            default:
-                DFG_CRASH(m_graph, node, "Bad flush format for argument");
-                break;
-            }
-        }
+        m_out.appendTo(m_prologue);
         m_out.jump(lowBlock(m_graph.block(0)));
         
-        for (BasicBlock* block : preOrder)
-            compileBlock(block);
+        Vector<BasicBlock*> depthFirst;
+        m_graph.getBlocksInDepthFirstOrder(depthFirst);
+        for (unsigned i = 0; i < depthFirst.size(); ++i)
+            compileBlock(depthFirst[i]);
         
         if (Options::dumpLLVMIR())
             dumpModule(m_ftlState.module);
@@ -289,7 +143,7 @@ private:
                     continue;
                 LType type;
                 switch (node->flags() & NodeResultMask) {
-                case NodeResultDouble:
+                case NodeResultNumber:
                     type = m_out.doubleType;
                     break;
                 case NodeResultInt32:
@@ -305,7 +159,7 @@ private:
                     type = m_out.int64;
                     break;
                 default:
-                    DFG_CRASH(m_graph, node, "Bad Phi node result type");
+                    RELEASE_ASSERT_NOT_REACHED();
                     break;
                 }
                 m_phis.add(node, buildAlloca(m_out.m_builder, type));
@@ -340,16 +194,14 @@ private:
         m_out.appendTo(lowBlock, m_nextLowBlock);
         
         if (Options::ftlCrashes())
-            m_out.trap();
+            m_out.crashNonTerminal();
         
         if (!m_highBlock->cfaHasVisited) {
-            if (verboseCompilationEnabled())
-                dataLog("Bailing because CFA didn't reach.\n");
-            crash(m_highBlock->index, UINT_MAX);
+            m_out.crash();
             return;
         }
         
-        m_availabilityCalculator.beginBlock(m_highBlock);
+        initializeOSRExitStateForBlock();
         
         m_state.reset();
         m_state.beginBasicBlock(m_highBlock);
@@ -359,47 +211,22 @@ private:
                 break;
         }
     }
-
-    void safelyInvalidateAfterTermination()
-    {
-        if (verboseCompilationEnabled())
-            dataLog("Bailing.\n");
-        crash();
-
-        // Invalidate dominated blocks. Under normal circumstances we would expect
-        // them to be invalidated already. But you can have the CFA become more
-        // precise over time because the structures of objects change on the main
-        // thread. Failing to do this would result in weird crashes due to a value
-        // being used but not defined. Race conditions FTW!
-        for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
-            BasicBlock* target = m_graph.block(blockIndex);
-            if (!target)
-                continue;
-            if (m_graph.m_dominators.dominates(m_highBlock, target)) {
-                if (verboseCompilationEnabled())
-                    dataLog("Block ", *target, " will bail also.\n");
-                target->cfaHasVisited = false;
-            }
-        }
-    }
-
+    
     bool compileNode(unsigned nodeIndex)
     {
         if (!m_state.isValid()) {
-            safelyInvalidateAfterTermination();
+            m_out.unreachable();
             return false;
         }
         
         m_node = m_highBlock->at(nodeIndex);
-        m_codeOriginForExitProfile = m_node->origin.semantic;
-        m_codeOriginForExitTarget = m_node->origin.forExit;
+        m_codeOriginForExitProfile = m_node->codeOrigin;
+        m_codeOriginForExitTarget = m_node->codeOriginForExitTarget;
         
         if (verboseCompilationEnabled())
             dataLog("Lowering ", m_node, "\n");
         
-        m_availableRecoveries.resize(0);
-        
-        m_interpreter.startExecuting();
+        bool shouldExecuteEffects = m_interpreter.startExecuting(m_node);
         
         switch (m_node->op()) {
         case Upsilon:
@@ -410,63 +237,47 @@ private:
             break;
         case JSConstant:
             break;
-        case DoubleConstant:
-            compileDoubleConstant();
+        case WeakJSConstant:
+            compileWeakJSConstant();
             break;
-        case Int52Constant:
-            compileInt52Constant();
-            break;
-        case DoubleRep:
-            compileDoubleRep();
-            break;
-        case DoubleAsInt32:
-            compileDoubleAsInt32();
-            break;
-        case ValueRep:
-            compileValueRep();
-            break;
-        case Int52Rep:
-            compileInt52Rep();
-            break;
-        case ValueToInt32:
-            compileValueToInt32();
-            break;
-        case BooleanToNumber:
-            compileBooleanToNumber();
+        case GetArgument:
+            compileGetArgument();
             break;
         case ExtractOSREntryLocal:
             compileExtractOSREntryLocal();
             break;
-        case GetStack:
-            compileGetStack();
+        case GetLocal:
+            compileGetLocal();
+            break;
+        case SetLocal:
+            compileSetLocal();
             break;
-        case PutStack:
-            compilePutStack();
+        case MovHint:
+            compileMovHint();
             break;
-        case Check:
-            compileNoOp();
+        case ZombieHint:
+            compileZombieHint();
             break;
-        case ToThis:
-            compileToThis();
+        case Phantom:
+            compilePhantom();
             break;
         case ValueAdd:
             compileValueAdd();
             break;
         case ArithAdd:
-        case ArithSub:
-            compileArithAddOrSub();
+            compileAddSub();
             break;
-        case ArithClz32:
-            compileArithClz32();
+        case ArithSub:
+            compileAddSub();
             break;
         case ArithMul:
             compileArithMul();
             break;
         case ArithDiv:
-            compileArithDiv();
+            compileArithDivMod();
             break;
         case ArithMod:
-            compileArithMod();
+            compileArithDivMod();
             break;
         case ArithMin:
         case ArithMax:
@@ -475,27 +286,6 @@ private:
         case ArithAbs:
             compileArithAbs();
             break;
-        case ArithSin:
-            compileArithSin();
-            break;
-        case ArithCos:
-            compileArithCos();
-            break;
-        case ArithPow:
-            compileArithPow();
-            break;
-        case ArithRound:
-            compileArithRound();
-            break;
-        case ArithSqrt:
-            compileArithSqrt();
-            break;
-        case ArithLog:
-            compileArithLog();
-            break;
-        case ArithFRound:
-            compileArithFRound();
-            break;
         case ArithNegate:
             compileArithNegate();
             break;
@@ -520,23 +310,17 @@ private:
         case UInt32ToNumber:
             compileUInt32ToNumber();
             break;
+        case Int32ToDouble:
+            compileInt32ToDouble();
+            break;
         case CheckStructure:
             compileCheckStructure();
             break;
-        case CheckCell:
-            compileCheckCell();
-            break;
-        case CheckNotEmpty:
-            compileCheckNotEmpty();
-            break;
-        case CheckBadCell:
-            compileCheckBadCell();
-            break;
-        case CheckIdent:
-            compileCheckIdent();
+        case StructureTransitionWatchpoint:
+            compileStructureTransitionWatchpoint();
             break;
-        case GetExecutable:
-            compileGetExecutable();
+        case CheckFunction:
+            compileCheckFunction();
             break;
         case ArrayifyToStructure:
             compileArrayifyToStructure();
@@ -544,14 +328,13 @@ private:
         case PutStructure:
             compilePutStructure();
             break;
+        case PhantomPutStructure:
+            compilePhantomPutStructure();
+            break;
         case GetById:
             compileGetById();
             break;
-        case In:
-            compileIn();
-            break;
         case PutById:
-        case PutByIdDirect:
             compilePutById();
             break;
         case GetButterfly:
@@ -575,35 +358,11 @@ private:
         case GetByVal:
             compileGetByVal();
             break;
-        case GetMyArgumentByVal:
-            compileGetMyArgumentByVal();
-            break;
         case PutByVal:
         case PutByValAlias:
         case PutByValDirect:
             compilePutByVal();
             break;
-        case ArrayPush:
-            compileArrayPush();
-            break;
-        case ArrayPop:
-            compileArrayPop();
-            break;
-        case CreateActivation:
-            compileCreateActivation();
-            break;
-        case NewFunction:
-            compileNewFunction();
-            break;
-        case CreateDirectArguments:
-            compileCreateDirectArguments();
-            break;
-        case CreateScopedArguments:
-            compileCreateScopedArguments();
-            break;
-        case CreateClonedArguments:
-            compileCreateClonedArguments();
-            break;
         case NewObject:
             compileNewObject();
             break;
@@ -613,28 +372,9 @@ private:
         case NewArrayBuffer:
             compileNewArrayBuffer();
             break;
-        case NewArrayWithSize:
-            compileNewArrayWithSize();
-            break;
-        case GetTypedArrayByteOffset:
-            compileGetTypedArrayByteOffset();
-            break;
         case AllocatePropertyStorage:
             compileAllocatePropertyStorage();
             break;
-        case ReallocatePropertyStorage:
-            compileReallocatePropertyStorage();
-            break;
-        case ToString:
-        case CallStringConstructor:
-            compileToStringOrCallStringConstructor();
-            break;
-        case ToPrimitive:
-            compileToPrimitive();
-            break;
-        case MakeRope:
-            compileMakeRope();
-            break;
         case StringCharAt:
             compileStringCharAt();
             break;
@@ -642,24 +382,11 @@ private:
             compileStringCharCodeAt();
             break;
         case GetByOffset:
-        case GetGetterSetterByOffset:
             compileGetByOffset();
             break;
-        case GetGetter:
-            compileGetGetter();
-            break;
-        case GetSetter:
-            compileGetSetter();
-            break;
-        case MultiGetByOffset:
-            compileMultiGetByOffset();
-            break;
         case PutByOffset:
             compilePutByOffset();
             break;
-        case MultiPutByOffset:
-            compileMultiPutByOffset();
-            break;
         case GetGlobalVar:
             compileGetGlobalVar();
             break;
@@ -669,30 +396,21 @@ private:
         case NotifyWrite:
             compileNotifyWrite();
             break;
-        case GetCallee:
-            compileGetCallee();
-            break;
-        case GetArgumentCount:
-            compileGetArgumentCount();
-            break;
-        case GetScope:
-            compileGetScope();
+        case GetMyScope:
+            compileGetMyScope();
             break;
         case SkipScope:
             compileSkipScope();
             break;
+        case GetClosureRegisters:
+            compileGetClosureRegisters();
+            break;
         case GetClosureVar:
             compileGetClosureVar();
             break;
         case PutClosureVar:
             compilePutClosureVar();
             break;
-        case GetFromArguments:
-            compileGetFromArguments();
-            break;
-        case PutToArguments:
-            compilePutToArguments();
-            break;
         case CompareEq:
             compileCompareEq();
             break;
@@ -702,6 +420,9 @@ private:
         case CompareStrictEq:
             compileCompareStrictEq();
             break;
+        case CompareStrictEqConstant:
+            compileCompareStrictEqConstant();
+            break;
         case CompareLess:
             compileCompareLess();
             break;
@@ -721,18 +442,6 @@ private:
         case Construct:
             compileCallOrConstruct();
             break;
-        case CallVarargs:
-        case CallForwardVarargs:
-        case ConstructVarargs:
-        case ConstructForwardVarargs:
-            compileCallOrConstructVarargs();
-            break;
-        case LoadVarargs:
-            compileLoadVarargs();
-            break;
-        case ForwardVarargs:
-            compileForwardVarargs();
-            break;
         case Jump:
             compileJump();
             break;
@@ -748,116 +457,168 @@ private:
         case ForceOSRExit:
             compileForceOSRExit();
             break;
-        case Throw:
-        case ThrowReferenceError:
-            compileThrow();
-            break;
         case InvalidationPoint:
             compileInvalidationPoint();
             break;
-        case IsUndefined:
-            compileIsUndefined();
-            break;
-        case IsBoolean:
-            compileIsBoolean();
-            break;
-        case IsNumber:
-            compileIsNumber();
-            break;
-        case IsString:
-            compileIsString();
-            break;
-        case IsObject:
-            compileIsObject();
-            break;
-        case IsObjectOrNull:
-            compileIsObjectOrNull();
-            break;
-        case IsFunction:
-            compileIsFunction();
-            break;
-        case TypeOf:
-            compileTypeOf();
-            break;
-        case CheckHasInstance:
-            compileCheckHasInstance();
-            break;
-        case InstanceOf:
-            compileInstanceOf();
+        case ValueToInt32:
+            compileValueToInt32();
             break;
-        case CountExecution:
-            compileCountExecution();
+        case Int52ToValue:
+            compileInt52ToValue();
             break;
         case StoreBarrier:
             compileStoreBarrier();
             break;
-        case HasIndexedProperty:
-            compileHasIndexedProperty();
-            break;
-        case HasGenericProperty:
-            compileHasGenericProperty();
-            break;
-        case HasStructureProperty:
-            compileHasStructureProperty();
+        case ConditionalStoreBarrier:
+            compileConditionalStoreBarrier();
             break;
-        case GetDirectPname:
-            compileGetDirectPname();
+        case StoreBarrierWithNullCheck:
+            compileStoreBarrierWithNullCheck();
             break;
-        case GetEnumerableLength:
-            compileGetEnumerableLength();
-            break;
-        case GetPropertyEnumerator:
-            compileGetPropertyEnumerator();
-            break;
-        case GetEnumeratorStructurePname:
-            compileGetEnumeratorStructurePname();
-            break;
-        case GetEnumeratorGenericPname:
-            compileGetEnumeratorGenericPname();
-            break;
-        case ToIndexString:
-            compileToIndexString();
-            break;
-        case CheckStructureImmediate:
-            compileCheckStructureImmediate();
-            break;
-        case MaterializeNewObject:
-            compileMaterializeNewObject();
-            break;
-        case MaterializeCreateActivation:
-            compileMaterializeCreateActivation();
-            break;
-
+        case Flush:
         case PhantomLocal:
+        case SetArgument:
         case LoopHint:
-        case MovHint:
-        case ZombieHint:
-        case PhantomNewObject:
-        case PhantomNewFunction:
-        case PhantomCreateActivation:
-        case PhantomDirectArguments:
-        case PhantomClonedArguments:
-        case PutHint:
-        case BottomValue:
-        case KillStack:
+        case VariableWatchpoint:
+        case FunctionReentryWatchpoint:
+        case TypedArrayWatchpoint:
             break;
         default:
-            DFG_CRASH(m_graph, m_node, "Unrecognized node in FTL backend");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
         
-        if (m_node->isTerminal())
-            return false;
+        if (shouldExecuteEffects)
+            m_interpreter.executeEffects(nodeIndex);
         
-        if (!m_state.isValid()) {
-            safelyInvalidateAfterTermination();
-            return false;
+        return true;
+    }
+
+    void compileValueToInt32()
+    {
+        switch (m_node->child1().useKind()) {
+        case Int32Use:
+            setInt32(lowInt32(m_node->child1()));
+            break;
+            
+        case MachineIntUse:
+            setInt32(m_out.castToInt32(lowStrictInt52(m_node->child1())));
+            break;
+            
+        case NumberUse:
+        case NotCellUse: {
+            LoweredNodeValue value = m_int32Values.get(m_node->child1().node());
+            if (isValid(value)) {
+                setInt32(value.value());
+                break;
+            }
+            
+            value = m_jsValueValues.get(m_node->child1().node());
+            if (isValid(value)) {
+                LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 int case"));
+                LBasicBlock notIntCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 not int case"));
+                LBasicBlock doubleCase = 0;
+                LBasicBlock notNumberCase = 0;
+                if (m_node->child1().useKind() == NotCellUse) {
+                    doubleCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 double case"));
+                    notNumberCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 not number case"));
+                }
+                LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ValueToInt32 continuation"));
+                
+                Vector<ValueFromBlock> results;
+                
+                m_out.branch(isNotInt32(value.value()), notIntCase, intCase);
+                
+                LBasicBlock lastNext = m_out.appendTo(intCase, notIntCase);
+                results.append(m_out.anchor(unboxInt32(value.value())));
+                m_out.jump(continuation);
+                
+                if (m_node->child1().useKind() == NumberUse) {
+                    m_out.appendTo(notIntCase, continuation);
+                    FTL_TYPE_CHECK(
+                        jsValueValue(value.value()), m_node->child1(), SpecFullNumber,
+                        isCellOrMisc(value.value()));
+                    results.append(m_out.anchor(doubleToInt32(unboxDouble(value.value()))));
+                    m_out.jump(continuation);
+                } else {
+                    m_out.appendTo(notIntCase, doubleCase);
+                    m_out.branch(isCellOrMisc(value.value()), notNumberCase, doubleCase);
+                    
+                    m_out.appendTo(doubleCase, notNumberCase);
+                    results.append(m_out.anchor(doubleToInt32(unboxDouble(value.value()))));
+                    m_out.jump(continuation);
+                    
+                    m_out.appendTo(notNumberCase, continuation);
+                    
+                    FTL_TYPE_CHECK(
+                        jsValueValue(value.value()), m_node->child1(), ~SpecCell,
+                        isCell(value.value()));
+                    
+                    LValue specialResult = m_out.select(
+                        m_out.equal(
+                            value.value(),
+                            m_out.constInt64(JSValue::encode(jsBoolean(true)))),
+                        m_out.int32One, m_out.int32Zero);
+                    results.append(m_out.anchor(specialResult));
+                    m_out.jump(continuation);
+                }
+                
+                m_out.appendTo(continuation, lastNext);
+                setInt32(m_out.phi(m_out.int32, results));
+                break;
+            }
+            
+            value = m_doubleValues.get(m_node->child1().node());
+            if (isValid(value)) {
+                setInt32(doubleToInt32(value.value()));
+                break;
+            }
+            
+            terminate(Uncountable);
+            break;
         }
+            
+        case BooleanUse:
+            setInt32(m_out.zeroExt(lowBoolean(m_node->child1()), m_out.int32));
+            break;
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+    }
 
-        m_availabilityCalculator.executeNode(m_node);
-        m_interpreter.executeEffects(nodeIndex);
-        
-        return true;
+    void compileInt52ToValue()
+    {
+        setJSValue(lowJSValue(m_node->child1()));
+    }
+
+    void compileStoreBarrier()
+    {
+        emitStoreBarrier(lowCell(m_node->child1()));
+    }
+
+    void compileConditionalStoreBarrier()
+    {
+        LValue base = lowCell(m_node->child1());
+        LValue value = lowJSValue(m_node->child2());
+        emitStoreBarrier(base, value, m_node->child2());
+    }
+
+    void compileStoreBarrierWithNullCheck()
+    {
+#if ENABLE(GGC)
+        LBasicBlock isNotNull = FTL_NEW_BLOCK(m_out, ("Store barrier with null check value not null"));
+        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Store barrier continuation"));
+
+        LValue base = lowJSValue(m_node->child1());
+        m_out.branch(m_out.isZero64(base), continuation, isNotNull);
+        LBasicBlock lastNext = m_out.appendTo(isNotNull, continuation);
+        emitStoreBarrier(base);
+        m_out.appendTo(continuation, lastNext);
+#else
+        speculate(m_node->child1());
+#endif
     }
 
     void compileUpsilon()
@@ -865,13 +626,13 @@ private:
         LValue destination = m_phis.get(m_node->phi());
         
         switch (m_node->child1().useKind()) {
-        case DoubleRepUse:
+        case NumberUse:
             m_out.set(lowDouble(m_node->child1()), destination);
             break;
         case Int32Use:
             m_out.set(lowInt32(m_node->child1()), destination);
             break;
-        case Int52RepUse:
+        case MachineIntUse:
             m_out.set(lowInt52(m_node->child1()), destination);
             break;
         case BooleanUse:
@@ -884,7 +645,7 @@ private:
             m_out.set(lowJSValue(m_node->child1()), destination);
             break;
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
@@ -894,7 +655,7 @@ private:
         LValue source = m_phis.get(m_node);
         
         switch (m_node->flags() & NodeResultMask) {
-        case NodeResultDouble:
+        case NodeResultNumber:
             setDouble(m_out.get(source));
             break;
         case NodeResultInt32:
@@ -910,282 +671,46 @@ private:
             setJSValue(m_out.get(source));
             break;
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
     
-    void compileDoubleConstant()
+    void compileWeakJSConstant()
     {
-        setDouble(m_out.constDouble(m_node->asNumber()));
+        setJSValue(weakPointer(m_node->weakConstant()));
     }
     
-    void compileInt52Constant()
+    void compileGetArgument()
     {
-        int64_t value = m_node->asMachineInt();
-        
-        setInt52(m_out.constInt64(value << JSValue::int52ShiftAmount));
-        setStrictInt52(m_out.constInt64(value));
-    }
+        VariableAccessData* variable = m_node->variableAccessData();
+        VirtualRegister operand = variable->machineLocal();
+        RELEASE_ASSERT(operand.isArgument());
 
-    void compileDoubleRep()
-    {
-        switch (m_node->child1().useKind()) {
-        case RealNumberUse: {
-            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
-            
-            LValue doubleValue = unboxDouble(value);
-            
-            LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("DoubleRep RealNumberUse int case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("DoubleRep continuation"));
-            
-            ValueFromBlock fastResult = m_out.anchor(doubleValue);
-            m_out.branch(
-                m_out.doubleEqual(doubleValue, doubleValue),
-                usually(continuation), rarely(intCase));
-            
-            LBasicBlock lastNext = m_out.appendTo(intCase, continuation);
-            
-            FTL_TYPE_CHECK(
-                jsValueValue(value), m_node->child1(), SpecBytecodeRealNumber,
-                isNotInt32(value, provenType(m_node->child1()) & ~SpecFullDouble));
-            ValueFromBlock slowResult = m_out.anchor(m_out.intToDouble(unboxInt32(value)));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            
-            setDouble(m_out.phi(m_out.doubleType, fastResult, slowResult));
-            return;
-        }
-            
-        case NotCellUse:
-        case NumberUse: {
-            bool shouldConvertNonNumber = m_node->child1().useKind() == NotCellUse;
-            
-            LValue value = lowJSValue(m_node->child1(), ManualOperandSpeculation);
-
-            LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble unboxing int case"));
-            LBasicBlock doubleTesting = FTL_NEW_BLOCK(m_out, ("jsValueToDouble testing double case"));
-            LBasicBlock doubleCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble unboxing double case"));
-            LBasicBlock nonDoubleCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble testing undefined case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("jsValueToDouble unboxing continuation"));
-            
-            m_out.branch(
-                isNotInt32(value, provenType(m_node->child1())),
-                unsure(doubleTesting), unsure(intCase));
-            
-            LBasicBlock lastNext = m_out.appendTo(intCase, doubleTesting);
-            
-            ValueFromBlock intToDouble = m_out.anchor(
-                m_out.intToDouble(unboxInt32(value)));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(doubleTesting, doubleCase);
-            LValue valueIsNumber = isNumber(value, provenType(m_node->child1()));
-            m_out.branch(valueIsNumber, usually(doubleCase), rarely(nonDoubleCase));
-
-            m_out.appendTo(doubleCase, nonDoubleCase);
-            ValueFromBlock unboxedDouble = m_out.anchor(unboxDouble(value));
-            m_out.jump(continuation);
-
-            if (shouldConvertNonNumber) {
-                LBasicBlock undefinedCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble converting undefined case"));
-                LBasicBlock testNullCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble testing null case"));
-                LBasicBlock nullCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble converting null case"));
-                LBasicBlock testBooleanTrueCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble testing boolean true case"));
-                LBasicBlock convertBooleanTrueCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble convert boolean true case"));
-                LBasicBlock convertBooleanFalseCase = FTL_NEW_BLOCK(m_out, ("jsValueToDouble convert boolean false case"));
-
-                m_out.appendTo(nonDoubleCase, undefinedCase);
-                LValue valueIsUndefined = m_out.equal(value, m_out.constInt64(ValueUndefined));
-                m_out.branch(valueIsUndefined, unsure(undefinedCase), unsure(testNullCase));
-
-                m_out.appendTo(undefinedCase, testNullCase);
-                ValueFromBlock convertedUndefined = m_out.anchor(m_out.constDouble(PNaN));
-                m_out.jump(continuation);
+        LValue jsValue = m_out.load64(addressFor(operand));
 
-                m_out.appendTo(testNullCase, nullCase);
-                LValue valueIsNull = m_out.equal(value, m_out.constInt64(ValueNull));
-                m_out.branch(valueIsNull, unsure(nullCase), unsure(testBooleanTrueCase));
-
-                m_out.appendTo(nullCase, testBooleanTrueCase);
-                ValueFromBlock convertedNull = m_out.anchor(m_out.constDouble(0));
-                m_out.jump(continuation);
-
-                m_out.appendTo(testBooleanTrueCase, convertBooleanTrueCase);
-                LValue valueIsBooleanTrue = m_out.equal(value, m_out.constInt64(ValueTrue));
-                m_out.branch(valueIsBooleanTrue, unsure(convertBooleanTrueCase), unsure(convertBooleanFalseCase));
-
-                m_out.appendTo(convertBooleanTrueCase, convertBooleanFalseCase);
-                ValueFromBlock convertedTrue = m_out.anchor(m_out.constDouble(1));
-                m_out.jump(continuation);
-
-                m_out.appendTo(convertBooleanFalseCase, continuation);
-
-                LValue valueIsNotBooleanFalse = m_out.notEqual(value, m_out.constInt64(ValueFalse));
-                FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), ~SpecCell, valueIsNotBooleanFalse);
-                ValueFromBlock convertedFalse = m_out.anchor(m_out.constDouble(0));
-                m_out.jump(continuation);
-
-                m_out.appendTo(continuation, lastNext);
-                setDouble(m_out.phi(m_out.doubleType, intToDouble, unboxedDouble, convertedUndefined, convertedNull, convertedTrue, convertedFalse));
-                return;
-            }
-            m_out.appendTo(nonDoubleCase, continuation);
-            FTL_TYPE_CHECK(jsValueValue(value), m_node->child1(), SpecBytecodeNumber, m_out.booleanTrue);
-            m_out.unreachable();
-
-            m_out.appendTo(continuation, lastNext);
-
-            setDouble(m_out.phi(m_out.doubleType, intToDouble, unboxedDouble));
-            return;
-        }
-            
-        case Int52RepUse: {
-            setDouble(strictInt52ToDouble(lowStrictInt52(m_node->child1())));
-            return;
-        }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
-        }
-    }
-
-    void compileDoubleAsInt32()
-    {
-        LValue integerValue = convertDoubleToInt32(lowDouble(m_node->child1()), shouldCheckNegativeZero(m_node->arithMode()));
-        setInt32(integerValue);
-    }
-
-    void compileValueRep()
-    {
-        switch (m_node->child1().useKind()) {
-        case DoubleRepUse: {
-            LValue value = lowDouble(m_node->child1());
-            
-            if (m_interpreter.needsTypeCheck(m_node->child1(), ~SpecDoubleImpureNaN)) {
-                value = m_out.select(
-                    m_out.doubleEqual(value, value), value, m_out.constDouble(PNaN));
-            }
-            
-            setJSValue(boxDouble(value));
-            return;
-        }
-            
-        case Int52RepUse: {
-            setJSValue(strictInt52ToJSValue(lowStrictInt52(m_node->child1())));
-            return;
-        }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
-        }
-    }
-    
-    void compileInt52Rep()
-    {
-        switch (m_node->child1().useKind()) {
+        switch (useKindFor(variable->flushFormat())) {
         case Int32Use:
-            setStrictInt52(m_out.signExt(lowInt32(m_node->child1()), m_out.int64));
-            return;
-            
-        case MachineIntUse:
-            setStrictInt52(
-                jsValueToStrictInt52(
-                    m_node->child1(), lowJSValue(m_node->child1(), ManualOperandSpeculation)));
-            return;
-            
-        case DoubleRepMachineIntUse:
-            setStrictInt52(
-                doubleToStrictInt52(
-                    m_node->child1(), lowDouble(m_node->child1())));
-            return;
-            
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-        }
-    }
-    
-    void compileValueToInt32()
-    {
-        switch (m_node->child1().useKind()) {
-        case Int52RepUse:
-            setInt32(m_out.castToInt32(lowStrictInt52(m_node->child1())));
+            speculate(BadType, jsValueValue(jsValue), m_node, isNotInt32(jsValue));
+            setInt32(unboxInt32(jsValue));
             break;
-            
-        case DoubleRepUse:
-            setInt32(doubleToInt32(lowDouble(m_node->child1())));
+        case CellUse:
+            speculate(BadType, jsValueValue(jsValue), m_node, isNotCell(jsValue));
+            setJSValue(jsValue);
             break;
-            
-        case NumberUse:
-        case NotCellUse: {
-            LoweredNodeValue value = m_int32Values.get(m_node->child1().node());
-            if (isValid(value)) {
-                setInt32(value.value());
-                break;
-            }
-            
-            value = m_jsValueValues.get(m_node->child1().node());
-            if (isValid(value)) {
-                setInt32(numberOrNotCellToInt32(m_node->child1(), value.value()));
-                break;
-            }
-            
-            // We'll basically just get here for constants. But it's good to have this
-            // catch-all since we often add new representations into the mix.
-            setInt32(
-                numberOrNotCellToInt32(
-                    m_node->child1(),
-                    lowJSValue(m_node->child1(), ManualOperandSpeculation)));
+        case BooleanUse:
+            speculate(BadType, jsValueValue(jsValue), m_node, isNotBoolean(jsValue));
+            setBoolean(unboxBoolean(jsValue));
             break;
-        }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+        case UntypedUse:
+            setJSValue(jsValue);
             break;
-        }
-    }
-    
-    void compileBooleanToNumber()
-    {
-        switch (m_node->child1().useKind()) {
-        case BooleanUse: {
-            setInt32(m_out.zeroExt(lowBoolean(m_node->child1()), m_out.int32));
-            return;
-        }
-            
-        case UntypedUse: {
-            LValue value = lowJSValue(m_node->child1());
-            
-            if (!m_interpreter.needsTypeCheck(m_node->child1(), SpecBoolInt32 | SpecBoolean)) {
-                setInt32(m_out.bitAnd(m_out.castToInt32(value), m_out.int32One));
-                return;
-            }
-            
-            LBasicBlock booleanCase = FTL_NEW_BLOCK(m_out, ("BooleanToNumber boolean case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("BooleanToNumber continuation"));
-            
-            ValueFromBlock notBooleanResult = m_out.anchor(value);
-            m_out.branch(
-                isBoolean(value, provenType(m_node->child1())),
-                unsure(booleanCase), unsure(continuation));
-            
-            LBasicBlock lastNext = m_out.appendTo(booleanCase, continuation);
-            ValueFromBlock booleanResult = m_out.anchor(m_out.bitOr(
-                m_out.zeroExt(unboxBoolean(value), m_out.int64), m_tagTypeNumber));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, booleanResult, notBooleanResult));
-            return;
-        }
-            
         default:
             RELEASE_ASSERT_NOT_REACHED();
-            return;
+            break;
         }
     }
-
+    
     void compileExtractOSREntryLocal()
     {
         EncodedJSValue* buffer = static_cast<EncodedJSValue*>(
@@ -1193,58 +718,52 @@ private:
         setJSValue(m_out.load64(m_out.absolute(buffer + m_node->unlinkedLocal().toLocal())));
     }
     
-    void compileGetStack()
+    void compileGetLocal()
     {
-        // GetLocals arise only for captured variables and arguments. For arguments, we might have
-        // already loaded it.
-        if (LValue value = m_loadedArgumentValues.get(m_node)) {
-            setJSValue(value);
-            return;
-        }
+        // GetLocals arise only for captured variables.
         
-        StackAccessData* data = m_node->stackAccessData();
-        AbstractValue& value = m_state.variables().operand(data->local);
+        VariableAccessData* variable = m_node->variableAccessData();
+        AbstractValue& value = m_state.variables().operand(variable->local());
         
-        DFG_ASSERT(m_graph, m_node, isConcrete(data->format));
-        DFG_ASSERT(m_graph, m_node, data->format != FlushedDouble); // This just happens to not arise for GetStacks, right now. It would be trivial to support.
+        RELEASE_ASSERT(variable->isCaptured());
         
         if (isInt32Speculation(value.m_type))
-            setInt32(m_out.load32(payloadFor(data->machineLocal)));
+            setInt32(m_out.load32(payloadFor(variable->machineLocal())));
         else
-            setJSValue(m_out.load64(addressFor(data->machineLocal)));
+            setJSValue(m_out.load64(addressFor(variable->machineLocal())));
     }
     
-    void compilePutStack()
+    void compileSetLocal()
     {
-        StackAccessData* data = m_node->stackAccessData();
-        switch (data->format) {
+        VariableAccessData* variable = m_node->variableAccessData();
+        switch (variable->flushFormat()) {
         case FlushedJSValue: {
             LValue value = lowJSValue(m_node->child1());
-            m_out.store64(value, addressFor(data->machineLocal));
+            m_out.store64(value, addressFor(variable->machineLocal()));
             break;
         }
             
         case FlushedDouble: {
             LValue value = lowDouble(m_node->child1());
-            m_out.storeDouble(value, addressFor(data->machineLocal));
+            m_out.storeDouble(value, addressFor(variable->machineLocal()));
             break;
         }
             
         case FlushedInt32: {
             LValue value = lowInt32(m_node->child1());
-            m_out.store32(value, payloadFor(data->machineLocal));
+            m_out.store32(value, payloadFor(variable->machineLocal()));
             break;
         }
             
         case FlushedInt52: {
             LValue value = lowInt52(m_node->child1());
-            m_out.store64(value, addressFor(data->machineLocal));
+            m_out.store64(value, addressFor(variable->machineLocal()));
             break;
         }
             
         case FlushedCell: {
             LValue value = lowCell(m_node->child1());
-            m_out.store64(value, addressFor(data->machineLocal));
+            m_out.store64(value, addressFor(variable->machineLocal()));
             break;
         }
             
@@ -1252,55 +771,42 @@ private:
             speculateBoolean(m_node->child1());
             m_out.store64(
                 lowJSValue(m_node->child1(), ManualOperandSpeculation),
-                addressFor(data->machineLocal));
+                addressFor(variable->machineLocal()));
             break;
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad flush format");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
+        
+        m_availability.operand(variable->local()) = Availability(variable->flushedAt());
     }
     
-    void compileNoOp()
+    void compileMovHint()
     {
-        DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, speculate);
+        ASSERT(m_node->containsMovHint());
+        ASSERT(m_node->op() != ZombieHint);
+        
+        VirtualRegister operand = m_node->unlinkedLocal();
+        m_availability.operand(operand) = Availability(m_node->child1().node());
     }
     
-    void compileToThis()
+    void compileZombieHint()
     {
-        LValue value = lowJSValue(m_node->child1());
-        
-        LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("ToThis is cell case"));
-        LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("ToThis slow case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ToThis continuation"));
-        
-        m_out.branch(
-            isCell(value, provenType(m_node->child1())), usually(isCellCase), rarely(slowCase));
-        
-        LBasicBlock lastNext = m_out.appendTo(isCellCase, slowCase);
-        ValueFromBlock fastResult = m_out.anchor(value);
-        m_out.branch(isType(value, FinalObjectType), usually(continuation), rarely(slowCase));
-        
-        m_out.appendTo(slowCase, continuation);
-        J_JITOperation_EJ function;
-        if (m_graph.isStrictModeFor(m_node->origin.semantic))
-            function = operationToThisStrict;
-        else
-            function = operationToThis;
-        ValueFromBlock slowResult = m_out.anchor(
-            vmCall(m_out.operation(function), m_callFrame, value));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, fastResult, slowResult));
+        m_availability.operand(m_node->unlinkedLocal()) = Availability::unavailable();
+    }
+    
+    void compilePhantom()
+    {
+        DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, speculate);
     }
     
     void compileValueAdd()
     {
         J_JITOperation_EJJ operation;
-        if (!(provenType(m_node->child1()) & SpecFullNumber)
-            && !(provenType(m_node->child2()) & SpecFullNumber))
+        if (!(m_state.forNode(m_node->child1()).m_type & SpecFullNumber)
+            && !(m_state.forNode(m_node->child2()).m_type & SpecFullNumber))
             operation = operationValueAddNotNumber;
         else
             operation = operationValueAdd;
@@ -1309,59 +815,30 @@ private:
             lowJSValue(m_node->child1()), lowJSValue(m_node->child2())));
     }
     
-    void compileArithAddOrSub()
+    void compileAddSub()
     {
         bool isSub =  m_node->op() == ArithSub;
         switch (m_node->binaryUseKind()) {
         case Int32Use: {
             LValue left = lowInt32(m_node->child1());
             LValue right = lowInt32(m_node->child2());
+            LValue result = isSub ? m_out.sub(left, right) : m_out.add(left, right);
 
             if (!shouldCheckOverflow(m_node->arithMode())) {
-                setInt32(isSub ? m_out.sub(left, right) : m_out.add(left, right));
+                setInt32(result);
                 break;
             }
 
-            LValue result;
-            if (!isSub) {
-                result = m_out.addWithOverflow32(left, right);
-                
-                if (doesKill(m_node->child2())) {
-                    addAvailableRecovery(
-                        m_node->child2(), SubRecovery,
-                        m_out.extractValue(result, 0), left, ValueFormatInt32);
-                } else if (doesKill(m_node->child1())) {
-                    addAvailableRecovery(
-                        m_node->child1(), SubRecovery,
-                        m_out.extractValue(result, 0), right, ValueFormatInt32);
-                }
-            } else {
-                result = m_out.subWithOverflow32(left, right);
-                
-                if (doesKill(m_node->child2())) {
-                    // result = left - right
-                    // result - left = -right
-                    // right = left - result
-                    addAvailableRecovery(
-                        m_node->child2(), SubRecovery,
-                        left, m_out.extractValue(result, 0), ValueFormatInt32);
-                } else if (doesKill(m_node->child1())) {
-                    // result = left - right
-                    // result + right = left
-                    addAvailableRecovery(
-                        m_node->child1(), AddRecovery,
-                        m_out.extractValue(result, 0), right, ValueFormatInt32);
-                }
-            }
+            LValue overflow = isSub ? m_out.subWithOverflow32(left, right) : m_out.addWithOverflow32(left, right);
 
-            speculate(Overflow, noValue(), 0, m_out.extractValue(result, 1));
-            setInt32(m_out.extractValue(result, 0));
+            speculate(Overflow, noValue(), 0, m_out.extractValue(overflow, 1));
+            setInt32(result);
             break;
         }
             
-        case Int52RepUse: {
-            if (!abstractValue(m_node->child1()).couldBeType(SpecInt52)
-                && !abstractValue(m_node->child2()).couldBeType(SpecInt52)) {
+        case MachineIntUse: {
+            if (!m_state.forNode(m_node->child1()).couldBeType(SpecInt52)
+                && !m_state.forNode(m_node->child2()).couldBeType(SpecInt52)) {
                 Int52Kind kind;
                 LValue left = lowWhicheverInt52(m_node->child1(), kind);
                 LValue right = lowInt52(m_node->child2(), kind);
@@ -1371,45 +848,15 @@ private:
             
             LValue left = lowInt52(m_node->child1());
             LValue right = lowInt52(m_node->child2());
+            LValue result = isSub ? m_out.sub(left, right) : m_out.add(left, right);
 
-            LValue result;
-            if (!isSub) {
-                result = m_out.addWithOverflow64(left, right);
-                
-                if (doesKill(m_node->child2())) {
-                    addAvailableRecovery(
-                        m_node->child2(), SubRecovery,
-                        m_out.extractValue(result, 0), left, ValueFormatInt52);
-                } else if (doesKill(m_node->child1())) {
-                    addAvailableRecovery(
-                        m_node->child1(), SubRecovery,
-                        m_out.extractValue(result, 0), right, ValueFormatInt52);
-                }
-            } else {
-                result = m_out.subWithOverflow64(left, right);
-                
-                if (doesKill(m_node->child2())) {
-                    // result = left - right
-                    // result - left = -right
-                    // right = left - result
-                    addAvailableRecovery(
-                        m_node->child2(), SubRecovery,
-                        left, m_out.extractValue(result, 0), ValueFormatInt52);
-                } else if (doesKill(m_node->child1())) {
-                    // result = left - right
-                    // result + right = left
-                    addAvailableRecovery(
-                        m_node->child1(), AddRecovery,
-                        m_out.extractValue(result, 0), right, ValueFormatInt52);
-                }
-            }
-
-            speculate(Int52Overflow, noValue(), 0, m_out.extractValue(result, 1));
-            setInt52(m_out.extractValue(result, 0));
+            LValue overflow = isSub ? m_out.subWithOverflow64(left, right) : m_out.addWithOverflow64(left, right);
+            speculate(Int52Overflow, noValue(), 0, m_out.extractValue(overflow, 1));
+            setInt52(result);
             break;
         }
             
-        case DoubleRepUse: {
+        case NumberUse: {
             LValue C1 = lowDouble(m_node->child1());
             LValue C2 = lowDouble(m_node->child2());
 
@@ -1418,17 +865,10 @@ private:
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
-
-    void compileArithClz32()
-    {
-        LValue operand = lowInt32(m_node->child1());
-        LValue isZeroUndef = m_out.booleanFalse;
-        setInt32(m_out.ctlz32(operand, isZeroUndef));
-    }
     
     void compileArithMul()
     {
@@ -1436,23 +876,18 @@ private:
         case Int32Use: {
             LValue left = lowInt32(m_node->child1());
             LValue right = lowInt32(m_node->child2());
-            
-            LValue result;
+            LValue result = m_out.mul(left, right);
 
-            if (!shouldCheckOverflow(m_node->arithMode()))
-                result = m_out.mul(left, right);
-            else {
+            if (shouldCheckOverflow(m_node->arithMode())) {
                 LValue overflowResult = m_out.mulWithOverflow32(left, right);
                 speculate(Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
-                result = m_out.extractValue(overflowResult, 0);
             }
             
             if (shouldCheckNegativeZero(m_node->arithMode())) {
                 LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("ArithMul slow case"));
                 LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithMul continuation"));
                 
-                m_out.branch(
-                    m_out.notZero32(result), usually(continuation), rarely(slowCase));
+                m_out.branch(m_out.notZero32(result), continuation, slowCase);
                 
                 LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);
                 LValue cond = m_out.bitOr(m_out.lessThan(left, m_out.int32Zero), m_out.lessThan(right, m_out.int32Zero));
@@ -1465,21 +900,21 @@ private:
             break;
         }
             
-        case Int52RepUse: {
+        case MachineIntUse: {
             Int52Kind kind;
             LValue left = lowWhicheverInt52(m_node->child1(), kind);
             LValue right = lowInt52(m_node->child2(), opposite(kind));
+            LValue result = m_out.mul(left, right);
+
 
             LValue overflowResult = m_out.mulWithOverflow64(left, right);
             speculate(Int52Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
-            LValue result = m_out.extractValue(overflowResult, 0);
 
             if (shouldCheckNegativeZero(m_node->arithMode())) {
                 LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("ArithMul slow case"));
                 LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithMul continuation"));
                 
-                m_out.branch(
-                    m_out.notZero64(result), usually(continuation), rarely(slowCase));
+                m_out.branch(m_out.notZero64(result), continuation, slowCase);
                 
                 LBasicBlock lastNext = m_out.appendTo(slowCase, continuation);
                 LValue cond = m_out.bitOr(m_out.lessThan(left, m_out.int64Zero), m_out.lessThan(right, m_out.int64Zero));
@@ -1492,36 +927,34 @@ private:
             break;
         }
             
-        case DoubleRepUse: {
+        case NumberUse: {
             setDouble(
                 m_out.doubleMul(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
             break;
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
 
-    void compileArithDiv()
+    void compileArithDivMod()
     {
         switch (m_node->binaryUseKind()) {
         case Int32Use: {
             LValue numerator = lowInt32(m_node->child1());
             LValue denominator = lowInt32(m_node->child2());
             
-            LBasicBlock unsafeDenominator = FTL_NEW_BLOCK(m_out, ("ArithDiv unsafe denominator"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithDiv continuation"));
-            LBasicBlock done = FTL_NEW_BLOCK(m_out, ("ArithDiv done"));
+            LBasicBlock unsafeDenominator = FTL_NEW_BLOCK(m_out, ("ArithDivMod unsafe denominator"));
+            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithDivMod continuation"));
+            LBasicBlock done = FTL_NEW_BLOCK(m_out, ("ArithDivMod done"));
             
             Vector<ValueFromBlock, 3> results;
             
             LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
             
-            m_out.branch(
-                m_out.above(adjustedDenominator, m_out.int32One),
-                usually(continuation), rarely(unsafeDenominator));
+            m_out.branch(m_out.above(adjustedDenominator, m_out.int32One), continuation, unsafeDenominator);
             
             LBasicBlock lastNext = m_out.appendTo(unsafeDenominator, continuation);
             
@@ -1541,17 +974,14 @@ private:
                 LBasicBlock notDivByZero = FTL_NEW_BLOCK(m_out, ("ArithDiv not divide by zero"));
                 LBasicBlock neg2ToThe31ByNeg1 = FTL_NEW_BLOCK(m_out, ("ArithDiv -2^31/-1"));
                 
-                m_out.branch(
-                    m_out.isZero32(denominator), rarely(divByZero), usually(notDivByZero));
+                m_out.branch(m_out.isZero32(denominator), divByZero, notDivByZero);
                 
                 m_out.appendTo(divByZero, notDivByZero);
                 results.append(m_out.anchor(m_out.int32Zero));
                 m_out.jump(done);
                 
                 m_out.appendTo(notDivByZero, neg2ToThe31ByNeg1);
-                m_out.branch(
-                    m_out.equal(numerator, neg2ToThe31),
-                    rarely(neg2ToThe31ByNeg1), usually(continuation));
+                m_out.branch(m_out.equal(numerator, neg2ToThe31), neg2ToThe31ByNeg1, continuation);
                 
                 m_out.appendTo(neg2ToThe31ByNeg1, continuation);
                 results.append(m_out.anchor(neg2ToThe31));
@@ -1561,12 +991,10 @@ private:
             m_out.appendTo(continuation, done);
             
             if (shouldCheckNegativeZero(m_node->arithMode())) {
-                LBasicBlock zeroNumerator = FTL_NEW_BLOCK(m_out, ("ArithDiv zero numerator"));
-                LBasicBlock numeratorContinuation = FTL_NEW_BLOCK(m_out, ("ArithDiv numerator continuation"));
+                LBasicBlock zeroNumerator = FTL_NEW_BLOCK(m_out, ("ArithDivMod zero numerator"));
+                LBasicBlock numeratorContinuation = FTL_NEW_BLOCK(m_out, ("ArithDivMod numerator continuation"));
                 
-                m_out.branch(
-                    m_out.isZero32(numerator),
-                    rarely(zeroNumerator), usually(numeratorContinuation));
+                m_out.branch(m_out.isZero32(numerator), zeroNumerator, numeratorContinuation);
                 
                 LBasicBlock innerLastNext = m_out.appendTo(zeroNumerator, numeratorContinuation);
                 
@@ -1578,15 +1006,17 @@ private:
                 m_out.appendTo(numeratorContinuation, innerLastNext);
             }
             
-            LValue result = m_out.div(numerator, denominator);
+            LValue divModResult = m_node->op() == ArithDiv
+                ? m_out.div(numerator, denominator)
+                : m_out.rem(numerator, denominator);
             
             if (shouldCheckOverflow(m_node->arithMode())) {
                 speculate(
                     Overflow, noValue(), 0,
-                    m_out.notEqual(m_out.mul(result, denominator), numerator));
+                    m_out.notEqual(m_out.mul(divModResult, denominator), numerator));
             }
             
-            results.append(m_out.anchor(result));
+            results.append(m_out.anchor(divModResult));
             m_out.jump(done);
             
             m_out.appendTo(done, lastNext);
@@ -1595,116 +1025,19 @@ private:
             break;
         }
             
-        case DoubleRepUse: {
-            setDouble(m_out.doubleDiv(
-                lowDouble(m_node->child1()), lowDouble(m_node->child2())));
+        case NumberUse: {
+            LValue C1 = lowDouble(m_node->child1());
+            LValue C2 = lowDouble(m_node->child2());
+            setDouble(m_node->op() == ArithDiv ? m_out.doubleDiv(C1, C2) : m_out.doubleRem(C1, C2));
             break;
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
     
-    void compileArithMod()
-    {
-        switch (m_node->binaryUseKind()) {
-        case Int32Use: {
-            LValue numerator = lowInt32(m_node->child1());
-            LValue denominator = lowInt32(m_node->child2());
-            
-            LBasicBlock unsafeDenominator = FTL_NEW_BLOCK(m_out, ("ArithMod unsafe denominator"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithMod continuation"));
-            LBasicBlock done = FTL_NEW_BLOCK(m_out, ("ArithMod done"));
-            
-            Vector<ValueFromBlock, 3> results;
-            
-            LValue adjustedDenominator = m_out.add(denominator, m_out.int32One);
-            
-            m_out.branch(
-                m_out.above(adjustedDenominator, m_out.int32One),
-                usually(continuation), rarely(unsafeDenominator));
-            
-            LBasicBlock lastNext = m_out.appendTo(unsafeDenominator, continuation);
-            
-            LValue neg2ToThe31 = m_out.constInt32(-2147483647-1);
-            
-            // FIXME: -2^31 / -1 will actually yield negative zero, so we could have a
-            // separate case for that. But it probably doesn't matter so much.
-            if (shouldCheckOverflow(m_node->arithMode())) {
-                LValue cond = m_out.bitOr(m_out.isZero32(denominator), m_out.equal(numerator, neg2ToThe31));
-                speculate(Overflow, noValue(), 0, cond);
-                m_out.jump(continuation);
-            } else {
-                // This is the case where we convert the result to an int after we're done. So,
-                // if the denominator is zero, then the result should be result should be zero.
-                // If the denominator is not zero (i.e. it's -1 because we're guarded by the
-                // check above) and the numerator is -2^31 then the result should be -2^31.
-                
-                LBasicBlock modByZero = FTL_NEW_BLOCK(m_out, ("ArithMod modulo by zero"));
-                LBasicBlock notModByZero = FTL_NEW_BLOCK(m_out, ("ArithMod not modulo by zero"));
-                LBasicBlock neg2ToThe31ByNeg1 = FTL_NEW_BLOCK(m_out, ("ArithMod -2^31/-1"));
-                
-                m_out.branch(
-                    m_out.isZero32(denominator), rarely(modByZero), usually(notModByZero));
-                
-                m_out.appendTo(modByZero, notModByZero);
-                results.append(m_out.anchor(m_out.int32Zero));
-                m_out.jump(done);
-                
-                m_out.appendTo(notModByZero, neg2ToThe31ByNeg1);
-                m_out.branch(
-                    m_out.equal(numerator, neg2ToThe31),
-                    rarely(neg2ToThe31ByNeg1), usually(continuation));
-                
-                m_out.appendTo(neg2ToThe31ByNeg1, continuation);
-                results.append(m_out.anchor(m_out.int32Zero));
-                m_out.jump(done);
-            }
-            
-            m_out.appendTo(continuation, done);
-            
-            LValue remainder = m_out.rem(numerator, denominator);
-            
-            if (shouldCheckNegativeZero(m_node->arithMode())) {
-                LBasicBlock negativeNumerator = FTL_NEW_BLOCK(m_out, ("ArithMod negative numerator"));
-                LBasicBlock numeratorContinuation = FTL_NEW_BLOCK(m_out, ("ArithMod numerator continuation"));
-                
-                m_out.branch(
-                    m_out.lessThan(numerator, m_out.int32Zero),
-                    unsure(negativeNumerator), unsure(numeratorContinuation));
-                
-                LBasicBlock innerLastNext = m_out.appendTo(negativeNumerator, numeratorContinuation);
-                
-                speculate(NegativeZero, noValue(), 0, m_out.isZero32(remainder));
-                
-                m_out.jump(numeratorContinuation);
-                
-                m_out.appendTo(numeratorContinuation, innerLastNext);
-            }
-            
-            results.append(m_out.anchor(remainder));
-            m_out.jump(done);
-            
-            m_out.appendTo(done, lastNext);
-            
-            setInt32(m_out.phi(m_out.int32, results));
-            break;
-        }
-            
-        case DoubleRepUse: {
-            setDouble(
-                m_out.doubleRem(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
-            break;
-        }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
-            break;
-        }
-    }
-
     void compileArithMinOrMax()
     {
         switch (m_node->binaryUseKind()) {
@@ -1721,7 +1054,7 @@ private:
             break;
         }
             
-        case DoubleRepUse: {
+        case NumberUse: {
             LValue left = lowDouble(m_node->child1());
             LValue right = lowDouble(m_node->child2());
             
@@ -1735,14 +1068,14 @@ private:
                 m_node->op() == ArithMin
                     ? m_out.doubleLessThan(left, right)
                     : m_out.doubleGreaterThan(left, right),
-                unsure(continuation), unsure(notLessThan));
+                continuation, notLessThan);
             
             LBasicBlock lastNext = m_out.appendTo(notLessThan, continuation);
             results.append(m_out.anchor(m_out.select(
                 m_node->op() == ArithMin
                     ? m_out.doubleGreaterThanOrEqual(left, right)
                     : m_out.doubleLessThanOrEqual(left, right),
-                right, m_out.constDouble(PNaN))));
+                right, m_out.constDouble(0.0 / 0.0))));
             m_out.jump(continuation);
             
             m_out.appendTo(continuation, lastNext);
@@ -1751,7 +1084,7 @@ private:
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
@@ -1771,124 +1104,16 @@ private:
             break;
         }
             
-        case DoubleRepUse: {
+        case NumberUse: {
             setDouble(m_out.doubleAbs(lowDouble(m_node->child1())));
             break;
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
-
-    void compileArithSin() { setDouble(m_out.doubleSin(lowDouble(m_node->child1()))); }
-
-    void compileArithCos() { setDouble(m_out.doubleCos(lowDouble(m_node->child1()))); }
-
-    void compileArithPow()
-    {
-        // FIXME: investigate llvm.powi to better understand its performance characteristics.
-        // It might be better to have the inline loop in DFG too.
-        if (m_node->child2().useKind() == Int32Use)
-            setDouble(m_out.doublePowi(lowDouble(m_node->child1()), lowInt32(m_node->child2())));
-        else {
-            LValue base = lowDouble(m_node->child1());
-            LValue exponent = lowDouble(m_node->child2());
-
-            LBasicBlock integerExponentIsSmallBlock = FTL_NEW_BLOCK(m_out, ("ArithPow test integer exponent is small."));
-            LBasicBlock integerExponentPowBlock = FTL_NEW_BLOCK(m_out, ("ArithPow pow(double, (int)double)."));
-            LBasicBlock doubleExponentPowBlockEntry = FTL_NEW_BLOCK(m_out, ("ArithPow pow(double, double)."));
-            LBasicBlock nanExceptionExponentIsInfinity = FTL_NEW_BLOCK(m_out, ("ArithPow NaN Exception, check exponent is infinity."));
-            LBasicBlock nanExceptionBaseIsOne = FTL_NEW_BLOCK(m_out, ("ArithPow NaN Exception, check base is one."));
-            LBasicBlock powBlock = FTL_NEW_BLOCK(m_out, ("ArithPow regular pow"));
-            LBasicBlock nanExceptionResultIsNaN = FTL_NEW_BLOCK(m_out, ("ArithPow NaN Exception, result is NaN."));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithPow continuation"));
-
-            LValue integerExponent = m_out.fpToInt32(exponent);
-            LValue integerExponentConvertedToDouble = m_out.intToDouble(integerExponent);
-            LValue exponentIsInteger = m_out.doubleEqual(exponent, integerExponentConvertedToDouble);
-            m_out.branch(exponentIsInteger, unsure(integerExponentIsSmallBlock), unsure(doubleExponentPowBlockEntry));
-
-            LBasicBlock lastNext = m_out.appendTo(integerExponentIsSmallBlock, integerExponentPowBlock);
-            LValue integerExponentBelow1000 = m_out.below(integerExponent, m_out.constInt32(1000));
-            m_out.branch(integerExponentBelow1000, usually(integerExponentPowBlock), rarely(doubleExponentPowBlockEntry));
-
-            m_out.appendTo(integerExponentPowBlock, doubleExponentPowBlockEntry);
-            ValueFromBlock powDoubleIntResult = m_out.anchor(m_out.doublePowi(base, integerExponent));
-            m_out.jump(continuation);
-
-            // If y is NaN, the result is NaN.
-            m_out.appendTo(doubleExponentPowBlockEntry, nanExceptionExponentIsInfinity);
-            LValue exponentIsNaN;
-            if (provenType(m_node->child2()) & SpecDoubleNaN)
-                exponentIsNaN = m_out.doubleNotEqualOrUnordered(exponent, exponent);
-            else
-                exponentIsNaN = m_out.booleanFalse;
-            m_out.branch(exponentIsNaN, rarely(nanExceptionResultIsNaN), usually(nanExceptionExponentIsInfinity));
-
-            // If abs(x) is 1 and y is +infinity, the result is NaN.
-            // If abs(x) is 1 and y is -infinity, the result is NaN.
-            m_out.appendTo(nanExceptionExponentIsInfinity, nanExceptionBaseIsOne);
-            LValue absoluteExponent = m_out.doubleAbs(exponent);
-            LValue absoluteExponentIsInfinity = m_out.doubleEqual(absoluteExponent, m_out.constDouble(std::numeric_limits<double>::infinity()));
-            m_out.branch(absoluteExponentIsInfinity, rarely(nanExceptionBaseIsOne), usually(powBlock));
-
-            m_out.appendTo(nanExceptionBaseIsOne, powBlock);
-            LValue absoluteBase = m_out.doubleAbs(base);
-            LValue absoluteBaseIsOne = m_out.doubleEqual(absoluteBase, m_out.constDouble(1));
-            m_out.branch(absoluteBaseIsOne, unsure(nanExceptionResultIsNaN), unsure(powBlock));
-
-            m_out.appendTo(powBlock, nanExceptionResultIsNaN);
-            ValueFromBlock powResult = m_out.anchor(m_out.doublePow(base, exponent));
-            m_out.jump(continuation);
-
-            m_out.appendTo(nanExceptionResultIsNaN, continuation);
-            ValueFromBlock pureNan = m_out.anchor(m_out.constDouble(PNaN));
-            m_out.jump(continuation);
-
-            m_out.appendTo(continuation, lastNext);
-            setDouble(m_out.phi(m_out.doubleType, powDoubleIntResult, powResult, pureNan));
-        }
-    }
-
-    void compileArithRound()
-    {
-        LBasicBlock realPartIsMoreThanHalf = FTL_NEW_BLOCK(m_out, ("ArithRound should round down"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArithRound continuation"));
-
-        LValue value = lowDouble(m_node->child1());
-        LValue integerValue = m_out.ceil64(value);
-        ValueFromBlock integerValueResult = m_out.anchor(integerValue);
-
-        LValue realPart = m_out.doubleSub(integerValue, value);
-
-        m_out.branch(m_out.doubleGreaterThanOrUnordered(realPart, m_out.constDouble(0.5)), unsure(realPartIsMoreThanHalf), unsure(continuation));
-
-        LBasicBlock lastNext = m_out.appendTo(realPartIsMoreThanHalf, continuation);
-        LValue integerValueRoundedDown = m_out.doubleSub(integerValue, m_out.constDouble(1));
-        ValueFromBlock integerValueRoundedDownResult = m_out.anchor(integerValueRoundedDown);
-        m_out.jump(continuation);
-        m_out.appendTo(continuation, lastNext);
-
-        LValue result = m_out.phi(m_out.doubleType, integerValueResult, integerValueRoundedDownResult);
-
-        if (producesInteger(m_node->arithRoundingMode())) {
-            LValue integerValue = convertDoubleToInt32(result, shouldCheckNegativeZero(m_node->arithRoundingMode()));
-            setInt32(integerValue);
-        } else
-            setDouble(result);
-    }
-
-    void compileArithSqrt() { setDouble(m_out.doubleSqrt(lowDouble(m_node->child1()))); }
-
-    void compileArithLog() { setDouble(m_out.doubleLog(lowDouble(m_node->child1()))); }
-    
-    void compileArithFRound()
-    {
-        LValue floatValue = m_out.fpCast(lowDouble(m_node->child1()), m_out.floatType);
-        setDouble(m_out.fpCast(floatValue, m_out.doubleType));
-    }
     
     void compileArithNegate()
     {
@@ -1896,26 +1121,24 @@ private:
         case Int32Use: {
             LValue value = lowInt32(m_node->child1());
             
-            LValue result;
-            if (!shouldCheckOverflow(m_node->arithMode()))
-                result = m_out.neg(value);
-            else if (!shouldCheckNegativeZero(m_node->arithMode())) {
-                // We don't have a negate-with-overflow intrinsic. Hopefully this
-                // does the trick, though.
-                LValue overflowResult = m_out.subWithOverflow32(m_out.int32Zero, value);
-                speculate(Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
-                result = m_out.extractValue(overflowResult, 0);
-            } else {
-                speculate(Overflow, noValue(), 0, m_out.testIsZero32(value, m_out.constInt32(0x7fffffff)));
-                result = m_out.neg(value);
+            LValue result = m_out.neg(value);
+            if (shouldCheckOverflow(m_node->arithMode())) {
+                if (!shouldCheckNegativeZero(m_node->arithMode())) {
+                    // We don't have a negate-with-overflow intrinsic. Hopefully this
+                    // does the trick, though.
+                    LValue overflowResult = m_out.subWithOverflow32(m_out.int32Zero, value);
+                    speculate(Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
+                } else
+                    speculate(Overflow, noValue(), 0, m_out.testIsZero32(value, m_out.constInt32(0x7fffffff)));
+
             }
 
             setInt32(result);
             break;
         }
             
-        case Int52RepUse: {
-            if (!abstractValue(m_node->child1()).couldBeType(SpecInt52)) {
+        case MachineIntUse: {
+            if (!m_state.forNode(m_node->child1()).couldBeType(SpecInt52)) {
                 Int52Kind kind;
                 LValue value = lowWhicheverInt52(m_node->child1(), kind);
                 LValue result = m_out.neg(value);
@@ -1928,19 +1151,19 @@ private:
             LValue value = lowInt52(m_node->child1());
             LValue overflowResult = m_out.subWithOverflow64(m_out.int64Zero, value);
             speculate(Int52Overflow, noValue(), 0, m_out.extractValue(overflowResult, 1));
-            LValue result = m_out.extractValue(overflowResult, 0);
+            LValue result = m_out.neg(value);
             speculate(NegativeZero, noValue(), 0, m_out.isZero64(result));
             setInt52(result);
             break;
         }
             
-        case DoubleRepUse: {
+        case NumberUse: {
             setDouble(m_out.doubleNeg(lowDouble(m_node->child1())));
             break;
         }
             
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
@@ -1994,63 +1217,62 @@ private:
         setInt32(value);
     }
     
+    void compileInt32ToDouble()
+    {
+        setDouble(lowDouble(m_node->child1()));
+    }
+    
     void compileCheckStructure()
     {
         LValue cell = lowCell(m_node->child1());
         
         ExitKind exitKind;
-        if (m_node->child1()->hasConstant())
-            exitKind = BadConstantCache;
+        if (m_node->child1()->op() == WeakJSConstant)
+            exitKind = BadWeakConstantCache;
         else
             exitKind = BadCache;
         
-        LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
+        LValue structure = m_out.loadPtr(cell, m_heaps.JSCell_structure);
         
-        checkStructure(
-            structureID, jsValueValue(cell), exitKind, m_node->structureSet(),
-            [this] (Structure* structure) {
-                return weakStructureID(structure);
-            });
-    }
-    
-    void compileCheckCell()
-    {
-        LValue cell = lowCell(m_node->child1());
+        if (m_node->structureSet().size() == 1) {
+            speculate(
+                exitKind, jsValueValue(cell), 0,
+                m_out.notEqual(structure, weakPointer(m_node->structureSet()[0])));
+            return;
+        }
+        
+        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CheckStructure continuation"));
+        
+        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
+        for (unsigned i = 0; i < m_node->structureSet().size() - 1; ++i) {
+            LBasicBlock nextStructure = FTL_NEW_BLOCK(m_out, ("CheckStructure nextStructure"));
+            m_out.branch(
+                m_out.equal(structure, weakPointer(m_node->structureSet()[i])),
+                continuation, nextStructure);
+            m_out.appendTo(nextStructure);
+        }
         
         speculate(
-            BadCell, jsValueValue(cell), m_node->child1().node(),
-            m_out.notEqual(cell, weakPointer(m_node->cellOperand()->cell())));
+            exitKind, jsValueValue(cell), 0,
+            m_out.notEqual(structure, weakPointer(m_node->structureSet().last())));
+        
+        m_out.jump(continuation);
+        m_out.appendTo(continuation, lastNext);
     }
     
-    void compileCheckBadCell()
+    void compileStructureTransitionWatchpoint()
     {
-        terminate(BadCell);
+        addWeakReference(m_node->structure());
+        speculateCell(m_node->child1());
     }
-
-    void compileCheckNotEmpty()
-    {
-        speculate(TDZFailure, noValue(), nullptr, m_out.isZero64(lowJSValue(m_node->child1())));
-    }
-
-    void compileCheckIdent()
-    {
-        UniquedStringImpl* uid = m_node->uidOperand();
-        if (uid->isSymbol()) {
-            LValue symbol = lowSymbol(m_node->child1());
-            LValue stringImpl = m_out.loadPtr(symbol, m_heaps.Symbol_privateName);
-            speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
-        } else {
-            LValue string = lowStringIdent(m_node->child1());
-            LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
-            speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
-        }
-    }
-
-    void compileGetExecutable()
+    
+    void compileCheckFunction()
     {
         LValue cell = lowCell(m_node->child1());
-        speculateFunction(m_node->child1(), cell);
-        setJSValue(m_out.loadPtr(cell, m_heaps.JSFunction_executable));
+        
+        speculate(
+            BadFunction, jsValueValue(cell), m_node->child1().node(),
+            m_out.notEqual(cell, weakPointer(m_node->function())));
     }
     
     void compileArrayifyToStructure()
@@ -2061,11 +1283,11 @@ private:
         LBasicBlock unexpectedStructure = FTL_NEW_BLOCK(m_out, ("ArrayifyToStructure unexpected structure"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArrayifyToStructure continuation"));
         
-        LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
+        LValue structure = m_out.loadPtr(cell, m_heaps.JSCell_structure);
         
         m_out.branch(
-            m_out.notEqual(structureID, weakStructureID(m_node->structure())),
-            rarely(unexpectedStructure), usually(continuation));
+            m_out.notEqual(structure, weakPointer(m_node->structure())),
+            unexpectedStructure, continuation);
         
         LBasicBlock lastNext = m_out.appendTo(unexpectedStructure, continuation);
         
@@ -2091,21 +1313,24 @@ private:
             vmCall(m_out.operation(operationEnsureDouble), m_callFrame, cell);
             break;
         case Array::Contiguous:
-            vmCall(m_out.operation(operationEnsureContiguous), m_callFrame, cell);
+            if (m_node->arrayMode().conversion() == Array::RageConvert)
+                vmCall(m_out.operation(operationRageEnsureContiguous), m_callFrame, cell);
+            else
+                vmCall(m_out.operation(operationEnsureContiguous), m_callFrame, cell);
             break;
         case Array::ArrayStorage:
         case Array::SlowPutArrayStorage:
             vmCall(m_out.operation(operationEnsureArrayStorage), m_callFrame, cell);
             break;
         default:
-            DFG_CRASH(m_graph, m_node, "Bad array type");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
         
-        structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
+        structure = m_out.loadPtr(cell, m_heaps.JSCell_structure);
         speculate(
             BadIndexingType, jsValueValue(cell), 0,
-            m_out.notEqual(structureID, weakStructureID(m_node->structure())));
+            m_out.notEqual(structure, weakPointer(m_node->structure())));
         m_out.jump(continuation);
         
         m_out.appendTo(continuation, lastNext);
@@ -2114,63 +1339,43 @@ private:
     void compilePutStructure()
     {
         m_ftlState.jitCode->common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
-
-        Structure* oldStructure = m_node->transition()->previous;
-        Structure* newStructure = m_node->transition()->next;
-        ASSERT_UNUSED(oldStructure, oldStructure->indexingType() == newStructure->indexingType());
-        ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
-        ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
-
-        LValue cell = lowCell(m_node->child1()); 
-        m_out.store32(
-            weakStructureID(newStructure),
-            cell, m_heaps.JSCell_structureID);
+        
+        m_out.store64(
+            m_out.constIntPtr(m_node->structureTransitionData().newStructure),
+            lowCell(m_node->child1()), m_heaps.JSCell_structure);
+    }
+    
+    void compilePhantomPutStructure()
+    {
+        m_ftlState.jitCode->common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
     }
     
     void compileGetById()
     {
-        // Pretty much the only reason why we don't also support GetByIdFlush is because:
-        // https://bugs.webkit.org/show_bug.cgi?id=125711
+        // UntypedUse is a bit harder to reason about and I'm not sure how best to do it, yet.
+        // Basically we need to emit a cell branch that takes you to the slow path, but the slow
+        // path is generated by the IC generator so we can't jump to it from here. And the IC
+        // generator currently doesn't know how to emit such a branch. So, for now, we just
+        // restrict this to CellUse.
+        ASSERT(m_node->child1().useKind() == CellUse);
+
+        LValue base = lowCell(m_node->child1());
+        StringImpl* uid = m_graph.identifiers()[m_node->identifierNumber()];
+
+        // Arguments: id, bytes, target, numArgs, args...
+        unsigned stackmapID = m_stackmapIDs++;
         
-        switch (m_node->child1().useKind()) {
-        case CellUse: {
-            setJSValue(getById(lowCell(m_node->child1())));
-            return;
-        }
-            
-        case UntypedUse: {
-            // This is pretty weird, since we duplicate the slow path both here and in the
-            // code generated by the IC. We should investigate making this less bad.
-            // https://bugs.webkit.org/show_bug.cgi?id=127830
-            LValue value = lowJSValue(m_node->child1());
-            
-            LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("GetById untyped cell case"));
-            LBasicBlock notCellCase = FTL_NEW_BLOCK(m_out, ("GetById untyped not cell case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("GetById untyped continuation"));
-            
-            m_out.branch(
-                isCell(value, provenType(m_node->child1())), unsure(cellCase), unsure(notCellCase));
-            
-            LBasicBlock lastNext = m_out.appendTo(cellCase, notCellCase);
-            ValueFromBlock cellResult = m_out.anchor(getById(value));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(notCellCase, continuation);
-            ValueFromBlock notCellResult = m_out.anchor(vmCall(
-                m_out.operation(operationGetByIdGeneric),
-                m_callFrame, value,
-                m_out.constIntPtr(m_graph.identifiers()[m_node->identifierNumber()])));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, cellResult, notCellResult));
-            return;
-        }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
-            return;
-        }
+        if (Options::verboseCompilation())
+            dataLog("    Emitting GetById patchpoint with stackmap #", stackmapID, "\n");
+        
+        LValue call = m_out.call(
+            m_out.patchpointInt64Intrinsic(),
+            m_out.constInt32(stackmapID), m_out.constInt32(sizeOfGetById()),
+            constNull(m_out.ref8), m_out.constInt32(2), m_callFrame, base);
+        setInstructionCallingConvention(call, LLVMAnyRegCallConv);
+        setJSValue(call);
+        
+        m_ftlState.getByIds.append(GetByIdDescriptor(stackmapID, m_node->codeOrigin, uid));
     }
     
     void compilePutById()
@@ -2180,23 +1385,23 @@ private:
         
         LValue base = lowCell(m_node->child1());
         LValue value = lowJSValue(m_node->child2());
-        auto uid = m_graph.identifiers()[m_node->identifierNumber()];
+        StringImpl* uid = m_graph.identifiers()[m_node->identifierNumber()];
 
         // Arguments: id, bytes, target, numArgs, args...
         unsigned stackmapID = m_stackmapIDs++;
 
-        if (verboseCompilationEnabled())
+        if (Options::verboseCompilation())
             dataLog("    Emitting PutById patchpoint with stackmap #", stackmapID, "\n");
         
         LValue call = m_out.call(
             m_out.patchpointVoidIntrinsic(),
-            m_out.constInt64(stackmapID), m_out.constInt32(sizeOfPutById()),
-            constNull(m_out.ref8), m_out.constInt32(2), base, value);
+            m_out.constInt32(stackmapID), m_out.constInt32(sizeOfPutById()),
+            constNull(m_out.ref8), m_out.constInt32(3), m_callFrame, base, value);
         setInstructionCallingConvention(call, LLVMAnyRegCallConv);
         
         m_ftlState.putByIds.append(PutByIdDescriptor(
-            stackmapID, m_node->origin.semantic, uid,
-            m_graph.executableFor(m_node->origin.semantic)->ecmaMode(),
+            stackmapID, m_node->codeOrigin, uid,
+            m_graph.executableFor(m_node->codeOrigin)->ecmaMode(),
             m_node->op() == PutByIdDirect ? Direct : NotDirect));
     }
     
@@ -2221,8 +1426,7 @@ private:
             ValueFromBlock fastResult = m_out.anchor(
                 m_out.loadPtr(cell, m_heaps.JSString_value));
             
-            m_out.branch(
-                m_out.notNull(fastResult.value()), usually(continuation), rarely(slowPath));
+            m_out.branch(m_out.notNull(fastResult.value()), continuation, slowPath);
             
             LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
             
@@ -2245,50 +1449,13 @@ private:
         Edge edge = m_node->child1();
         LValue cell = lowCell(edge);
         
-        if (m_node->arrayMode().alreadyChecked(m_graph, m_node, abstractValue(edge)))
+        if (m_node->arrayMode().alreadyChecked(m_graph, m_node, m_state.forNode(edge)))
             return;
         
         speculate(
             BadIndexingType, jsValueValue(cell), 0,
             m_out.bitNot(isArrayType(cell, m_node->arrayMode())));
     }
-
-    void compileGetTypedArrayByteOffset()
-    {
-        LValue basePtr = lowCell(m_node->child1());    
-
-        LBasicBlock simpleCase = FTL_NEW_BLOCK(m_out, ("wasteless typed array"));
-        LBasicBlock wastefulCase = FTL_NEW_BLOCK(m_out, ("wasteful typed array"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("continuation branch"));
-        
-        LValue mode = m_out.load32(basePtr, m_heaps.JSArrayBufferView_mode);
-        m_out.branch(
-            m_out.notEqual(mode, m_out.constInt32(WastefulTypedArray)),
-            unsure(simpleCase), unsure(wastefulCase));
-
-        // begin simple case        
-        LBasicBlock lastNext = m_out.appendTo(simpleCase, wastefulCase);
-
-        ValueFromBlock simpleOut = m_out.anchor(m_out.constIntPtr(0));
-
-        m_out.jump(continuation);
-
-        // begin wasteful case
-        m_out.appendTo(wastefulCase, continuation);
-
-        LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
-        LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);
-        LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
-        LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);
-
-        ValueFromBlock wastefulOut = m_out.anchor(m_out.sub(vectorPtr, dataPtr));
-
-        m_out.jump(continuation);
-        m_out.appendTo(continuation, lastNext);
-
-        // output
-        setInt32(m_out.castToInt32(m_out.phi(m_out.intPtr, simpleOut, wastefulOut)));
-    }
     
     void compileGetArrayLength()
     {
@@ -2296,42 +1463,24 @@ private:
         case Array::Int32:
         case Array::Double:
         case Array::Contiguous: {
-            setInt32(m_out.load32NonNegative(lowStorage(m_node->child2()), m_heaps.Butterfly_publicLength));
+            setInt32(m_out.load32(lowStorage(m_node->child2()), m_heaps.Butterfly_publicLength));
             return;
         }
             
         case Array::String: {
             LValue string = lowCell(m_node->child1());
-            setInt32(m_out.load32NonNegative(string, m_heaps.JSString_length));
-            return;
-        }
-            
-        case Array::DirectArguments: {
-            LValue arguments = lowCell(m_node->child1());
-            speculate(
-                ExoticObjectMode, noValue(), nullptr,
-                m_out.notNull(m_out.loadPtr(arguments, m_heaps.DirectArguments_overrides)));
-            setInt32(m_out.load32NonNegative(arguments, m_heaps.DirectArguments_length));
-            return;
-        }
-            
-        case Array::ScopedArguments: {
-            LValue arguments = lowCell(m_node->child1());
-            speculate(
-                ExoticObjectMode, noValue(), nullptr,
-                m_out.notZero8(m_out.load8(arguments, m_heaps.ScopedArguments_overrodeThings)));
-            setInt32(m_out.load32NonNegative(arguments, m_heaps.ScopedArguments_totalLength));
+            setInt32(m_out.load32(string, m_heaps.JSString_length));
             return;
         }
             
         default:
             if (isTypedView(m_node->arrayMode().typedArrayType())) {
                 setInt32(
-                    m_out.load32NonNegative(lowCell(m_node->child1()), m_heaps.JSArrayBufferView_length));
+                    m_out.load32(lowCell(m_node->child1()), m_heaps.JSArrayBufferView_length));
                 return;
             }
             
-            DFG_CRASH(m_graph, m_node, "Bad array type");
+            RELEASE_ASSERT_NOT_REACHED();
             return;
         }
     }
@@ -2356,14 +1505,7 @@ private:
             
             if (m_node->arrayMode().isInBounds()) {
                 LValue result = m_out.load64(baseIndex(heap, storage, index, m_node->child2()));
-                LValue isHole = m_out.isZero64(result);
-                if (m_node->arrayMode().isSaneChain()) {
-                    DFG_ASSERT(
-                        m_graph, m_node, m_node->arrayMode().type() == Array::Contiguous);
-                    result = m_out.select(
-                        isHole, m_out.constInt64(JSValue::encode(jsUndefined())), result);
-                } else
-                    speculate(LoadFromHole, noValue(), 0, isHole);
+                speculate(LoadFromHole, noValue(), 0, m_out.isZero64(result));
                 setJSValue(result);
                 return;
             }
@@ -2376,15 +1518,14 @@ private:
             
             m_out.branch(
                 m_out.aboveOrEqual(
-                    index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
-                rarely(slowCase), usually(fastCase));
+                    index, m_out.load32(storage, m_heaps.Butterfly_publicLength)),
+                slowCase, fastCase);
             
             LBasicBlock lastNext = m_out.appendTo(fastCase, slowCase);
             
             ValueFromBlock fastResult = m_out.anchor(
                 m_out.load64(baseIndex(heap, storage, index, m_node->child2())));
-            m_out.branch(
-                m_out.isZero64(fastResult.value()), rarely(slowCase), usually(continuation));
+            m_out.branch(m_out.isZero64(fastResult.value()), slowCase, continuation);
             
             m_out.appendTo(slowCase, continuation);
             ValueFromBlock slowResult = m_out.anchor(
@@ -2424,15 +1565,14 @@ private:
             
             m_out.branch(
                 m_out.aboveOrEqual(
-                    index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
-                rarely(slowCase), usually(inBounds));
+                    index, m_out.load32(storage, m_heaps.Butterfly_publicLength)),
+                slowCase, inBounds);
             
             LBasicBlock lastNext = m_out.appendTo(inBounds, boxPath);
             LValue doubleValue = m_out.loadDouble(
                 baseIndex(heap, storage, index, m_node->child2()));
             m_out.branch(
-                m_out.doubleNotEqualOrUnordered(doubleValue, doubleValue),
-                rarely(slowCase), usually(boxPath));
+                m_out.doubleNotEqualOrUnordered(doubleValue, doubleValue), slowCase, boxPath);
             
             m_out.appendTo(boxPath, slowCase);
             ValueFromBlock fastResult = m_out.anchor(boxDouble(doubleValue));
@@ -2447,86 +1587,6 @@ private:
             setJSValue(m_out.phi(m_out.int64, fastResult, slowResult));
             return;
         }
-
-        case Array::Undecided: {
-            LValue index = lowInt32(m_node->child2());
-
-            speculate(OutOfBounds, noValue(), m_node, m_out.lessThan(index, m_out.int32Zero));
-            setJSValue(m_out.constInt64(ValueUndefined));
-            return;
-        }
-            
-        case Array::DirectArguments: {
-            LValue base = lowCell(m_node->child1());
-            LValue index = lowInt32(m_node->child2());
-            
-            speculate(
-                ExoticObjectMode, noValue(), nullptr,
-                m_out.notNull(m_out.loadPtr(base, m_heaps.DirectArguments_overrides)));
-            speculate(
-                ExoticObjectMode, noValue(), nullptr,
-                m_out.aboveOrEqual(
-                    index,
-                    m_out.load32NonNegative(base, m_heaps.DirectArguments_length)));
-
-            TypedPointer address = m_out.baseIndex(
-                m_heaps.DirectArguments_storage, base, m_out.zeroExtPtr(index));
-            setJSValue(m_out.load64(address));
-            return;
-        }
-            
-        case Array::ScopedArguments: {
-            LValue base = lowCell(m_node->child1());
-            LValue index = lowInt32(m_node->child2());
-            
-            speculate(
-                ExoticObjectMode, noValue(), nullptr,
-                m_out.aboveOrEqual(
-                    index,
-                    m_out.load32NonNegative(base, m_heaps.ScopedArguments_totalLength)));
-            
-            LValue table = m_out.loadPtr(base, m_heaps.ScopedArguments_table);
-            LValue namedLength = m_out.load32(table, m_heaps.ScopedArgumentsTable_length);
-            
-            LBasicBlock namedCase = FTL_NEW_BLOCK(m_out, ("GetByVal ScopedArguments named case"));
-            LBasicBlock overflowCase = FTL_NEW_BLOCK(m_out, ("GetByVal ScopedArguments overflow case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("GetByVal ScopedArguments continuation"));
-            
-            m_out.branch(
-                m_out.aboveOrEqual(index, namedLength), unsure(overflowCase), unsure(namedCase));
-            
-            LBasicBlock lastNext = m_out.appendTo(namedCase, overflowCase);
-            
-            LValue scope = m_out.loadPtr(base, m_heaps.ScopedArguments_scope);
-            LValue arguments = m_out.loadPtr(table, m_heaps.ScopedArgumentsTable_arguments);
-            
-            TypedPointer address = m_out.baseIndex(
-                m_heaps.scopedArgumentsTableArguments, arguments, m_out.zeroExtPtr(index));
-            LValue scopeOffset = m_out.load32(address);
-            
-            speculate(
-                ExoticObjectMode, noValue(), nullptr,
-                m_out.equal(scopeOffset, m_out.constInt32(ScopeOffset::invalidOffset)));
-            
-            address = m_out.baseIndex(
-                m_heaps.JSEnvironmentRecord_variables, scope, m_out.zeroExtPtr(scopeOffset));
-            ValueFromBlock namedResult = m_out.anchor(m_out.load64(address));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(overflowCase, continuation);
-            
-            address = m_out.baseIndex(
-                m_heaps.ScopedArguments_overflowStorage, base,
-                m_out.zeroExtPtr(m_out.sub(index, namedLength)));
-            LValue overflowValue = m_out.load64(address);
-            speculate(ExoticObjectMode, noValue(), nullptr, m_out.isZero64(overflowValue));
-            ValueFromBlock overflowResult = m_out.anchor(overflowValue);
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, namedResult, overflowResult));
-            return;
-        }
             
         case Array::Generic: {
             setJSValue(vmCall(
@@ -2552,7 +1612,7 @@ private:
                     m_out.add(
                         storage,
                         m_out.shl(
-                            m_out.zeroExtPtr(index),
+                            m_out.zeroExt(index, m_out.intPtr),
                             m_out.constIntPtr(logElementSize(type)))));
                 
                 if (isInt(type)) {
@@ -2568,7 +1628,7 @@ private:
                         result = m_out.load32(pointer);
                         break;
                     default:
-                        DFG_CRASH(m_graph, m_node, "Bad element size");
+                        RELEASE_ASSERT_NOT_REACHED();
                     }
                     
                     if (elementSize(type) < 4) {
@@ -2592,11 +1652,6 @@ private:
                         return;
                     }
                     
-                    if (m_node->shouldSpeculateMachineInt()) {
-                        setStrictInt52(m_out.zeroExt(result, m_out.int64));
-                        return;
-                    }
-                    
                     setDouble(m_out.unsignedToFP(result, m_out.doubleType));
                     return;
                 }
@@ -2612,76 +1667,37 @@ private:
                     result = m_out.loadDouble(pointer);
                     break;
                 default:
-                    DFG_CRASH(m_graph, m_node, "Bad typed array type");
+                    RELEASE_ASSERT_NOT_REACHED();
                 }
                 
+                result = m_out.select(
+                    m_out.doubleEqual(result, result), result, m_out.constDouble(QNaN));
                 setDouble(result);
                 return;
             }
             
-            DFG_CRASH(m_graph, m_node, "Bad array type");
+            RELEASE_ASSERT_NOT_REACHED();
             return;
         } }
     }
     
-    void compileGetMyArgumentByVal()
-    {
-        InlineCallFrame* inlineCallFrame = m_node->child1()->origin.semantic.inlineCallFrame;
-        
-        LValue index = lowInt32(m_node->child2());
-        
-        LValue limit;
-        if (inlineCallFrame && !inlineCallFrame->isVarargs())
-            limit = m_out.constInt32(inlineCallFrame->arguments.size() - 1);
-        else {
-            VirtualRegister argumentCountRegister;
-            if (!inlineCallFrame)
-                argumentCountRegister = VirtualRegister(JSStack::ArgumentCount);
-            else
-                argumentCountRegister = inlineCallFrame->argumentCountRegister;
-            limit = m_out.sub(m_out.load32(payloadFor(argumentCountRegister)), m_out.int32One);
-        }
-        
-        speculate(ExoticObjectMode, noValue(), 0, m_out.aboveOrEqual(index, limit));
-        
-        TypedPointer base;
-        if (inlineCallFrame) {
-            if (inlineCallFrame->arguments.size() <= 1) {
-                // We should have already exited due to the bounds check, above. Just tell the
-                // compiler that anything dominated by this instruction is not reachable, so
-                // that we don't waste time generating such code. This will also plant some
-                // kind of crashing instruction so that if by some fluke the bounds check didn't
-                // work, we'll crash in an easy-to-see way.
-                didAlreadyTerminate();
-                return;
-            }
-            base = addressFor(inlineCallFrame->arguments[1].virtualRegister());
-        } else
-            base = addressFor(virtualRegisterForArgument(1));
-        
-        LValue pointer = m_out.baseIndex(
-            base.value(), m_out.zeroExt(index, m_out.intPtr), ScaleEight);
-        setJSValue(m_out.load64(TypedPointer(m_heaps.variables.atAnyIndex(), pointer)));
-    }
-    
     void compilePutByVal()
     {
         Edge child1 = m_graph.varArgChild(m_node, 0);
         Edge child2 = m_graph.varArgChild(m_node, 1);
         Edge child3 = m_graph.varArgChild(m_node, 2);
         Edge child4 = m_graph.varArgChild(m_node, 3);
-        Edge child5 = m_graph.varArgChild(m_node, 4);
         
         switch (m_node->arrayMode().type()) {
         case Array::Generic: {
             V_JITOperation_EJJJ operation;
             if (m_node->op() == PutByValDirect) {
-                if (m_graph.isStrictModeFor(m_node->origin.semantic))
+                if (m_graph.isStrictModeFor(m_node->codeOrigin))
                     operation = operationPutByValDirectStrict;
                 else
                     operation = operationPutByValDirectNonStrict;
             } else {
-                if (m_graph.isStrictModeFor(m_node->origin.semantic))
+                if (m_graph.isStrictModeFor(m_node->codeOrigin))
                     operation = operationPutByValStrict;
                 else
                     operation = operationPutByValNonStrict;
@@ -2719,7 +1735,8 @@ private:
                 TypedPointer elementPointer = m_out.baseIndex(
                     m_node->arrayMode().type() == Array::Int32 ?
                     m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties,
-                    storage, m_out.zeroExtPtr(index), provenValue(child2));
+                    storage, m_out.zeroExt(index, m_out.intPtr),
+                    m_state.forNode(child2).m_value);
                 
                 if (m_node->op() == PutByValAlias) {
                     m_out.store64(value, elementPointer);
@@ -2740,12 +1757,13 @@ private:
                 LValue value = lowDouble(child3);
                 
                 FTL_TYPE_CHECK(
-                    doubleValue(value), child3, SpecDoubleReal,
+                    doubleValue(value), child3, SpecFullRealNumber,
                     m_out.doubleNotEqualOrUnordered(value, value));
                 
                 TypedPointer elementPointer = m_out.baseIndex(
-                    m_heaps.indexedDoubleProperties, storage, m_out.zeroExtPtr(index),
-                    provenValue(child2));
+                    m_heaps.indexedDoubleProperties,
+                    storage, m_out.zeroExt(index, m_out.intPtr),
+                    m_state.forNode(child2).m_value);
                 
                 if (m_node->op() == PutByValAlias) {
                     m_out.storeDouble(value, elementPointer);
@@ -2763,7 +1781,7 @@ private:
             }
                 
             default:
-                DFG_CRASH(m_graph, m_node, "Bad array type");
+                RELEASE_ASSERT_NOT_REACHED();
             }
 
             m_out.jump(continuation);
@@ -2783,13 +1801,10 @@ private:
                             m_out.zeroExt(index, m_out.intPtr),
                             m_out.constIntPtr(logElementSize(type)))));
                 
-                LType refType;
-                LValue valueToStore;
-                
                 if (isInt(type)) {
                     LValue intValue;
                     switch (child3.useKind()) {
-                    case Int52RepUse:
+                    case MachineIntUse:
                     case Int32Use: {
                         if (child3.useKind() == Int32Use)
                             intValue = lowInt32(child3);
@@ -2806,7 +1821,7 @@ private:
                             intValues.append(m_out.anchor(m_out.int32Zero));
                             m_out.branch(
                                 m_out.lessThan(intValue, m_out.int32Zero),
-                                unsure(continuation), unsure(atLeastZero));
+                                continuation, atLeastZero);
                             
                             LBasicBlock lastNext = m_out.appendTo(atLeastZero, continuation);
                             
@@ -2822,7 +1837,7 @@ private:
                         break;
                     }
                         
-                    case DoubleRepUse: {
+                    case NumberUse: {
                         LValue doubleValue = lowDouble(child3);
                         
                         if (isClamped(type)) {
@@ -2836,13 +1851,13 @@ private:
                             intValues.append(m_out.anchor(m_out.int32Zero));
                             m_out.branch(
                                 m_out.doubleLessThanOrUnordered(doubleValue, m_out.doubleZero),
-                                unsure(continuation), unsure(atLeastZero));
+                                continuation, atLeastZero);
                             
                             LBasicBlock lastNext = m_out.appendTo(atLeastZero, withinRange);
                             intValues.append(m_out.anchor(m_out.constInt32(255)));
                             m_out.branch(
                                 m_out.doubleGreaterThan(doubleValue, m_out.constDouble(255)),
-                                unsure(continuation), unsure(withinRange));
+                                continuation, withinRange);
                             
                             m_out.appendTo(withinRange, continuation);
                             intValues.append(m_out.anchor(m_out.fpToInt32(doubleValue)));
@@ -2856,408 +1871,73 @@ private:
                     }
                         
                     default:
-                        DFG_CRASH(m_graph, m_node, "Bad use kind");
+                        RELEASE_ASSERT_NOT_REACHED();
                     }
                     
                     switch (elementSize(type)) {
                     case 1:
-                        valueToStore = m_out.intCast(intValue, m_out.int8);
-                        refType = m_out.ref8;
+                        m_out.store8(m_out.intCast(intValue, m_out.int8), pointer);
                         break;
                     case 2:
-                        valueToStore = m_out.intCast(intValue, m_out.int16);
-                        refType = m_out.ref16;
+                        m_out.store16(m_out.intCast(intValue, m_out.int16), pointer);
                         break;
                     case 4:
-                        valueToStore = intValue;
-                        refType = m_out.ref32;
+                        m_out.store32(intValue, pointer);
                         break;
                     default:
-                        DFG_CRASH(m_graph, m_node, "Bad element size");
+                        RELEASE_ASSERT_NOT_REACHED();
                     }
-                } else /* !isInt(type) */ {
-                    LValue value = lowDouble(child3);
-                    switch (type) {
-                    case TypeFloat32:
-                        valueToStore = m_out.fpCast(value, m_out.floatType);
-                        refType = m_out.refFloat;
-                        break;
-                    case TypeFloat64:
-                        valueToStore = value;
-                        refType = m_out.refDouble;
-                        break;
-                    default:
-                        DFG_CRASH(m_graph, m_node, "Bad typed array type");
-                    }
-                }
-                
-                if (m_node->arrayMode().isInBounds() || m_node->op() == PutByValAlias)
-                    m_out.store(valueToStore, pointer, refType);
-                else {
-                    LBasicBlock isInBounds = FTL_NEW_BLOCK(m_out, ("PutByVal typed array in bounds case"));
-                    LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("PutByVal typed array continuation"));
-                    
-                    m_out.branch(
-                        m_out.aboveOrEqual(index, lowInt32(child5)),
-                        unsure(continuation), unsure(isInBounds));
                     
-                    LBasicBlock lastNext = m_out.appendTo(isInBounds, continuation);
-                    m_out.store(valueToStore, pointer, refType);
-                    m_out.jump(continuation);
-                    
-                    m_out.appendTo(continuation, lastNext);
+                    return;
                 }
                 
+                ASSERT(isFloat(type));
+                
+                LValue value = lowDouble(child3);
+                switch (type) {
+                case TypeFloat32:
+                    m_out.storeFloat(m_out.fpCast(value, m_out.floatType), pointer);
+                    break;
+                case TypeFloat64:
+                    m_out.storeDouble(value, pointer);
+                    break;
+                default:
+                    RELEASE_ASSERT_NOT_REACHED();
+                }
                 return;
             }
             
-            DFG_CRASH(m_graph, m_node, "Bad array type");
+            RELEASE_ASSERT_NOT_REACHED();
             break;
         }
     }
     
-    void compileArrayPush()
-    {
-        LValue base = lowCell(m_node->child1());
-        LValue storage = lowStorage(m_node->child3());
-        
-        switch (m_node->arrayMode().type()) {
-        case Array::Int32:
-        case Array::Contiguous:
-        case Array::Double: {
-            LValue value;
-            LType refType;
-            
-            if (m_node->arrayMode().type() != Array::Double) {
-                value = lowJSValue(m_node->child2(), ManualOperandSpeculation);
-                if (m_node->arrayMode().type() == Array::Int32) {
-                    FTL_TYPE_CHECK(
-                        jsValueValue(value), m_node->child2(), SpecInt32, isNotInt32(value));
-                }
-                refType = m_out.ref64;
-            } else {
-                value = lowDouble(m_node->child2());
-                FTL_TYPE_CHECK(
-                    doubleValue(value), m_node->child2(), SpecDoubleReal,
-                    m_out.doubleNotEqualOrUnordered(value, value));
-                refType = m_out.refDouble;
-            }
-            
-            IndexedAbstractHeap& heap = m_heaps.forArrayType(m_node->arrayMode().type());
-
-            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
-            
-            LBasicBlock fastPath = FTL_NEW_BLOCK(m_out, ("ArrayPush fast path"));
-            LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("ArrayPush slow path"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArrayPush continuation"));
-            
-            m_out.branch(
-                m_out.aboveOrEqual(
-                    prevLength, m_out.load32(storage, m_heaps.Butterfly_vectorLength)),
-                rarely(slowPath), usually(fastPath));
-            
-            LBasicBlock lastNext = m_out.appendTo(fastPath, slowPath);
-            m_out.store(
-                value, m_out.baseIndex(heap, storage, m_out.zeroExtPtr(prevLength)), refType);
-            LValue newLength = m_out.add(prevLength, m_out.int32One);
-            m_out.store32(newLength, storage, m_heaps.Butterfly_publicLength);
-            
-            ValueFromBlock fastResult = m_out.anchor(boxInt32(newLength));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(slowPath, continuation);
-            LValue operation;
-            if (m_node->arrayMode().type() != Array::Double)
-                operation = m_out.operation(operationArrayPush);
-            else
-                operation = m_out.operation(operationArrayPushDouble);
-            ValueFromBlock slowResult = m_out.anchor(
-                vmCall(operation, m_callFrame, value, base));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, fastResult, slowResult));
-            return;
-        }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad array type");
-            return;
-        }
-    }
-    
-    void compileArrayPop()
-    {
-        LValue base = lowCell(m_node->child1());
-        LValue storage = lowStorage(m_node->child2());
-        
-        switch (m_node->arrayMode().type()) {
-        case Array::Int32:
-        case Array::Double:
-        case Array::Contiguous: {
-            IndexedAbstractHeap& heap = m_heaps.forArrayType(m_node->arrayMode().type());
-            
-            LBasicBlock fastCase = FTL_NEW_BLOCK(m_out, ("ArrayPop fast case"));
-            LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("ArrayPop slow case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ArrayPop continuation"));
-            
-            LValue prevLength = m_out.load32(storage, m_heaps.Butterfly_publicLength);
-            
-            Vector<ValueFromBlock, 3> results;
-            results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
-            m_out.branch(
-                m_out.isZero32(prevLength), rarely(continuation), usually(fastCase));
-            
-            LBasicBlock lastNext = m_out.appendTo(fastCase, slowCase);
-            LValue newLength = m_out.sub(prevLength, m_out.int32One);
-            m_out.store32(newLength, storage, m_heaps.Butterfly_publicLength);
-            TypedPointer pointer = m_out.baseIndex(heap, storage, m_out.zeroExtPtr(newLength));
-            if (m_node->arrayMode().type() != Array::Double) {
-                LValue result = m_out.load64(pointer);
-                m_out.store64(m_out.int64Zero, pointer);
-                results.append(m_out.anchor(result));
-                m_out.branch(
-                    m_out.notZero64(result), usually(continuation), rarely(slowCase));
-            } else {
-                LValue result = m_out.loadDouble(pointer);
-                m_out.store64(m_out.constInt64(bitwise_cast<int64_t>(PNaN)), pointer);
-                results.append(m_out.anchor(boxDouble(result)));
-                m_out.branch(
-                    m_out.doubleEqual(result, result),
-                    usually(continuation), rarely(slowCase));
-            }
-            
-            m_out.appendTo(slowCase, continuation);
-            results.append(m_out.anchor(vmCall(
-                m_out.operation(operationArrayPopAndRecoverLength), m_callFrame, base)));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, results));
-            return;
-        }
-
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad array type");
-            return;
-        }
-    }
-    
-    void compileCreateActivation()
+    void compileNewObject()
     {
-        LValue scope = lowCell(m_node->child1());
-        SymbolTable* table = m_node->castOperand<SymbolTable*>();
-        Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure();
-        JSValue initializationValue = m_node->initializationValueForActivation();
-        ASSERT(initializationValue.isUndefined() || initializationValue == jsTDZValue());
-        if (table->singletonScope()->isStillValid()) {
-            LValue callResult = vmCall(
-                m_out.operation(operationCreateActivationDirect), m_callFrame, weakPointer(structure),
-                scope, weakPointer(table), m_out.constInt64(JSValue::encode(initializationValue)));
-            setJSValue(callResult);
-            return;
-        }
+        Structure* structure = m_node->structure();
+        size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
+        MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
         
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("CreateActivation slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CreateActivation continuation"));
+        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("NewObject slow path"));
+        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NewObject continuation"));
         
         LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
         
-        LValue fastObject = allocateObject<JSLexicalEnvironment>(
-            JSLexicalEnvironment::allocationSize(table), structure, m_out.intPtrZero, slowPath);
-        
-        // We don't need memory barriers since we just fast-created the activation, so the
-        // activation must be young.
-        m_out.storePtr(scope, fastObject, m_heaps.JSScope_next);
-        m_out.storePtr(weakPointer(table), fastObject, m_heaps.JSSymbolTableObject_symbolTable);
-        
-        for (unsigned i = 0; i < table->scopeSize(); ++i) {
-            m_out.store64(
-                m_out.constInt64(JSValue::encode(initializationValue)),
-                fastObject, m_heaps.JSEnvironmentRecord_variables[i]);
-        }
+        ValueFromBlock fastResult = m_out.anchor(allocateObject(
+            m_out.constIntPtr(allocator), m_out.constIntPtr(structure), m_out.intPtrZero, slowPath));
         
-        ValueFromBlock fastResult = m_out.anchor(fastObject);
         m_out.jump(continuation);
         
         m_out.appendTo(slowPath, continuation);
-        LValue callResult = vmCall(
-            m_out.operation(operationCreateActivationDirect), m_callFrame, weakPointer(structure),
-            scope, weakPointer(table), m_out.constInt64(JSValue::encode(initializationValue)));
-        ValueFromBlock slowResult = m_out.anchor(callResult);
-        m_out.jump(continuation);
         
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.intPtr, fastResult, slowResult));
-    }
-    
-    void compileNewFunction()
-    {
-        LValue scope = lowCell(m_node->child1());
-        FunctionExecutable* executable = m_node->castOperand<FunctionExecutable*>();
-        if (executable->singletonFunction()->isStillValid()) {
-            LValue callResult = vmCall(
-                m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable));
-            setJSValue(callResult);
-            return;
-        }
-        
-        Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
-        
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("NewFunction slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NewFunction continuation"));
-        
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-        
-        LValue fastObject = allocateObject<JSFunction>(
-            structure, m_out.intPtrZero, slowPath);
-        
-        // We don't need memory barriers since we just fast-created the function, so it
-        // must be young.
-        m_out.storePtr(scope, fastObject, m_heaps.JSFunction_scope);
-        m_out.storePtr(weakPointer(executable), fastObject, m_heaps.JSFunction_executable);
-        m_out.storePtr(m_out.intPtrZero, fastObject, m_heaps.JSFunction_rareData);
-        
-        ValueFromBlock fastResult = m_out.anchor(fastObject);
-        m_out.jump(continuation);
-        
-        m_out.appendTo(slowPath, continuation);
-        LValue callResult = vmCall(
-            m_out.operation(operationNewFunctionWithInvalidatedReallocationWatchpoint),
-            m_callFrame, scope, weakPointer(executable));
-        ValueFromBlock slowResult = m_out.anchor(callResult);
+        ValueFromBlock slowResult = m_out.anchor(vmCall(
+            m_out.operation(operationNewObject), m_callFrame, m_out.constIntPtr(structure)));
         m_out.jump(continuation);
         
         m_out.appendTo(continuation, lastNext);
         setJSValue(m_out.phi(m_out.intPtr, fastResult, slowResult));
     }
     
-    void compileCreateDirectArguments()
-    {
-        // FIXME: A more effective way of dealing with the argument count and callee is to have
-        // them be explicit arguments to this node.
-        // https://bugs.webkit.org/show_bug.cgi?id=142207
-        
-        Structure* structure =
-            m_graph.globalObjectFor(m_node->origin.semantic)->directArgumentsStructure();
-        
-        unsigned minCapacity = m_graph.baselineCodeBlockFor(m_node->origin.semantic)->numParameters() - 1;
-        
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("CreateDirectArguments slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CreateDirectArguments continuation"));
-        
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-        
-        ArgumentsLength length = getArgumentsLength();
-        
-        LValue fastObject;
-        if (length.isKnown) {
-            fastObject = allocateObject<DirectArguments>(
-                DirectArguments::allocationSize(std::max(length.known, minCapacity)), structure,
-                m_out.intPtrZero, slowPath);
-        } else {
-            LValue size = m_out.add(
-                m_out.shl(length.value, m_out.constInt32(3)),
-                m_out.constInt32(DirectArguments::storageOffset()));
-            
-            size = m_out.select(
-                m_out.aboveOrEqual(length.value, m_out.constInt32(minCapacity)),
-                size, m_out.constInt32(DirectArguments::allocationSize(minCapacity)));
-            
-            fastObject = allocateVariableSizedObject<DirectArguments>(
-                size, structure, m_out.intPtrZero, slowPath);
-        }
-        
-        m_out.store32(length.value, fastObject, m_heaps.DirectArguments_length);
-        m_out.store32(m_out.constInt32(minCapacity), fastObject, m_heaps.DirectArguments_minCapacity);
-        m_out.storePtr(m_out.intPtrZero, fastObject, m_heaps.DirectArguments_overrides);
-        
-        ValueFromBlock fastResult = m_out.anchor(fastObject);
-        m_out.jump(continuation);
-        
-        m_out.appendTo(slowPath, continuation);
-        LValue callResult = vmCall(
-            m_out.operation(operationCreateDirectArguments), m_callFrame, weakPointer(structure),
-            length.value, m_out.constInt32(minCapacity));
-        ValueFromBlock slowResult = m_out.anchor(callResult);
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        LValue result = m_out.phi(m_out.intPtr, fastResult, slowResult);
-
-        m_out.storePtr(getCurrentCallee(), result, m_heaps.DirectArguments_callee);
-        
-        if (length.isKnown) {
-            VirtualRegister start = AssemblyHelpers::argumentsStart(m_node->origin.semantic);
-            for (unsigned i = 0; i < std::max(length.known, minCapacity); ++i) {
-                m_out.store64(
-                    m_out.load64(addressFor(start + i)),
-                    result, m_heaps.DirectArguments_storage[i]);
-            }
-        } else {
-            LValue stackBase = getArgumentsStart();
-            
-            LBasicBlock loop = FTL_NEW_BLOCK(m_out, ("CreateDirectArguments loop body"));
-            LBasicBlock end = FTL_NEW_BLOCK(m_out, ("CreateDirectArguments loop end"));
-            
-            ValueFromBlock originalLength;
-            if (minCapacity) {
-                LValue capacity = m_out.select(
-                    m_out.aboveOrEqual(length.value, m_out.constInt32(minCapacity)),
-                    length.value,
-                    m_out.constInt32(minCapacity));
-                originalLength = m_out.anchor(m_out.zeroExtPtr(capacity));
-                m_out.jump(loop);
-            } else {
-                originalLength = m_out.anchor(m_out.zeroExtPtr(length.value));
-                m_out.branch(m_out.isNull(originalLength.value()), unsure(end), unsure(loop));
-            }
-            
-            lastNext = m_out.appendTo(loop, end);
-            LValue previousIndex = m_out.phi(m_out.intPtr, originalLength);
-            LValue index = m_out.sub(previousIndex, m_out.intPtrOne);
-            m_out.store64(
-                m_out.load64(m_out.baseIndex(m_heaps.variables, stackBase, index)),
-                m_out.baseIndex(m_heaps.DirectArguments_storage, result, index));
-            ValueFromBlock nextIndex = m_out.anchor(index);
-            addIncoming(previousIndex, nextIndex);
-            m_out.branch(m_out.isNull(index), unsure(end), unsure(loop));
-            
-            m_out.appendTo(end, lastNext);
-        }
-        
-        setJSValue(result);
-    }
-    
-    void compileCreateScopedArguments()
-    {
-        LValue scope = lowCell(m_node->child1());
-        
-        LValue result = vmCall(
-            m_out.operation(operationCreateScopedArguments), m_callFrame,
-            weakPointer(
-                m_graph.globalObjectFor(m_node->origin.semantic)->scopedArgumentsStructure()),
-            getArgumentsStart(), getArgumentsLength().value, getCurrentCallee(), scope);
-        
-        setJSValue(result);
-    }
-    
-    void compileCreateClonedArguments()
-    {
-        LValue result = vmCall(
-            m_out.operation(operationCreateClonedArguments), m_callFrame,
-            weakPointer(
-                m_graph.globalObjectFor(m_node->origin.semantic)->outOfBandArgumentsStructure()),
-            getArgumentsStart(), getArgumentsLength().value, getCurrentCallee());
-        
-        setJSValue(result);
-    }
-    
-    void compileNewObject()
-    {
-        setJSValue(allocateObject(m_node->structure()));
-    }
-    
     void compileNewArray()
     {
         // First speculate appropriately on all of the children. Do this unconditionally up here
@@ -3268,13 +1948,13 @@ private:
         for (unsigned operandIndex = 0; operandIndex < m_node->numChildren(); ++operandIndex)
             speculate(m_graph.varArgChild(m_node, operandIndex));
         
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->codeOrigin);
         Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(
             m_node->indexingType());
         
-        DFG_ASSERT(m_graph, m_node, structure->indexingType() == m_node->indexingType());
+        RELEASE_ASSERT(structure->indexingType() == m_node->indexingType());
         
-        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
+        if (!globalObject->isHavingABadTime() && !hasArrayStorage(m_node->indexingType())) {
             unsigned numElements = m_node->numChildren();
             
             ArrayValues arrayValues = allocateJSArray(structure, numElements);
@@ -3285,7 +1965,7 @@ private:
                 switch (m_node->indexingType()) {
                 case ALL_BLANK_INDEXING_TYPES:
                 case ALL_UNDECIDED_INDEXING_TYPES:
-                    DFG_CRASH(m_graph, m_node, "Bad indexing type");
+                    CRASH();
                     break;
                     
                 case ALL_DOUBLE_INDEXING_TYPES:
@@ -3303,8 +1983,7 @@ private:
                     break;
                     
                 default:
-                    DFG_CRASH(m_graph, m_node, "Corrupt indexing type");
-                    break;
+                    CRASH();
                 }
             }
             
@@ -3346,13 +2025,13 @@ private:
     
     void compileNewArrayBuffer()
     {
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->codeOrigin);
         Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(
             m_node->indexingType());
         
-        DFG_ASSERT(m_graph, m_node, structure->indexingType() == m_node->indexingType());
+        RELEASE_ASSERT(structure->indexingType() == m_node->indexingType());
         
-        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
+        if (!globalObject->isHavingABadTime() && !hasArrayStorage(m_node->indexingType())) {
             unsigned numElements = m_node->numConstants();
             
             ArrayValues arrayValues = allocateJSArray(structure, numElements);
@@ -3381,310 +2060,46 @@ private:
             m_out.constIntPtr(m_node->numConstants())));
     }
     
-    void compileNewArrayWithSize()
-    {
-        LValue publicLength = lowInt32(m_node->child1());
-        
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
-        Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(
-            m_node->indexingType());
-        
-        if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
-            ASSERT(
-                hasUndecided(structure->indexingType())
-                || hasInt32(structure->indexingType())
-                || hasDouble(structure->indexingType())
-                || hasContiguous(structure->indexingType()));
-
-            LBasicBlock fastCase = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize fast case"));
-            LBasicBlock largeCase = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize large case"));
-            LBasicBlock failCase = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize fail case"));
-            LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize slow case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize continuation"));
-            
-            m_out.branch(
-                m_out.aboveOrEqual(publicLength, m_out.constInt32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)),
-                rarely(largeCase), usually(fastCase));
-
-            LBasicBlock lastNext = m_out.appendTo(fastCase, largeCase);
-            
-            // We don't round up to BASE_VECTOR_LEN for new Array(blah).
-            LValue vectorLength = publicLength;
-            
-            LValue payloadSize =
-                m_out.shl(m_out.zeroExt(vectorLength, m_out.intPtr), m_out.constIntPtr(3));
-            
-            LValue butterflySize = m_out.add(
-                payloadSize, m_out.constIntPtr(sizeof(IndexingHeader)));
-            
-            LValue endOfStorage = allocateBasicStorageAndGetEnd(butterflySize, failCase);
-            
-            LValue butterfly = m_out.sub(endOfStorage, payloadSize);
-            
-            LValue object = allocateObject<JSArray>(
-                structure, butterfly, failCase);
-            
-            m_out.store32(publicLength, butterfly, m_heaps.Butterfly_publicLength);
-            m_out.store32(vectorLength, butterfly, m_heaps.Butterfly_vectorLength);
-            
-            if (hasDouble(m_node->indexingType())) {
-                LBasicBlock initLoop = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize double init loop"));
-                LBasicBlock initDone = FTL_NEW_BLOCK(m_out, ("NewArrayWithSize double init done"));
-                
-                ValueFromBlock originalIndex = m_out.anchor(vectorLength);
-                ValueFromBlock originalPointer = m_out.anchor(butterfly);
-                m_out.branch(
-                    m_out.notZero32(vectorLength), unsure(initLoop), unsure(initDone));
-                
-                LBasicBlock initLastNext = m_out.appendTo(initLoop, initDone);
-                LValue index = m_out.phi(m_out.int32, originalIndex);
-                LValue pointer = m_out.phi(m_out.intPtr, originalPointer);
-                
-                m_out.store64(
-                    m_out.constInt64(bitwise_cast<int64_t>(PNaN)),
-                    TypedPointer(m_heaps.indexedDoubleProperties.atAnyIndex(), pointer));
-                
-                LValue nextIndex = m_out.sub(index, m_out.int32One);
-                addIncoming(index, m_out.anchor(nextIndex));
-                addIncoming(pointer, m_out.anchor(m_out.add(pointer, m_out.intPtrEight)));
-                m_out.branch(
-                    m_out.notZero32(nextIndex), unsure(initLoop), unsure(initDone));
-                
-                m_out.appendTo(initDone, initLastNext);
-            }
-            
-            ValueFromBlock fastResult = m_out.anchor(object);
-            m_out.jump(continuation);
-            
-            m_out.appendTo(largeCase, failCase);
-            ValueFromBlock largeStructure = m_out.anchor(m_out.constIntPtr(
-                globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)));
-            m_out.jump(slowCase);
-            
-            m_out.appendTo(failCase, slowCase);
-            ValueFromBlock failStructure = m_out.anchor(m_out.constIntPtr(structure));
-            m_out.jump(slowCase);
-            
-            m_out.appendTo(slowCase, continuation);
-            LValue structureValue = m_out.phi(
-                m_out.intPtr, largeStructure, failStructure);
-            ValueFromBlock slowResult = m_out.anchor(vmCall(
-                m_out.operation(operationNewArrayWithSize),
-                m_callFrame, structureValue, publicLength));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.intPtr, fastResult, slowResult));
-            return;
-        }
-        
-        LValue structureValue = m_out.select(
-            m_out.aboveOrEqual(publicLength, m_out.constInt32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)),
-            m_out.constIntPtr(
-                globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)),
-            m_out.constIntPtr(structure));
-        setJSValue(vmCall(m_out.operation(operationNewArrayWithSize), m_callFrame, structureValue, publicLength));
-    }
-    
     void compileAllocatePropertyStorage()
     {
+        StructureTransitionData& data = m_node->structureTransitionData();
+        
         LValue object = lowCell(m_node->child1());
-        setStorage(allocatePropertyStorage(object, m_node->transition()->previous));
-    }
-
-    void compileReallocatePropertyStorage()
-    {
-        Transition* transition = m_node->transition();
-        LValue object = lowCell(m_node->child1());
-        LValue oldStorage = lowStorage(m_node->child2());
         
-        setStorage(
-            reallocatePropertyStorage(
-                object, oldStorage, transition->previous, transition->next));
-    }
-    
-    void compileToStringOrCallStringConstructor()
-    {
-        switch (m_node->child1().useKind()) {
-        case StringObjectUse: {
-            LValue cell = lowCell(m_node->child1());
-            speculateStringObjectForCell(m_node->child1(), cell);
-            m_interpreter.filter(m_node->child1(), SpecStringObject);
-            
-            setJSValue(m_out.loadPtr(cell, m_heaps.JSWrapperObject_internalValue));
-            return;
-        }
-            
-        case StringOrStringObjectUse: {
-            LValue cell = lowCell(m_node->child1());
-            LValue structureID = m_out.load32(cell, m_heaps.JSCell_structureID);
-            
-            LBasicBlock notString = FTL_NEW_BLOCK(m_out, ("ToString StringOrStringObject not string case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ToString StringOrStringObject continuation"));
-            
-            ValueFromBlock simpleResult = m_out.anchor(cell);
-            m_out.branch(
-                m_out.equal(structureID, m_out.constInt32(vm().stringStructure->id())),
-                unsure(continuation), unsure(notString));
-            
-            LBasicBlock lastNext = m_out.appendTo(notString, continuation);
-            speculateStringObjectForStructureID(m_node->child1(), structureID);
-            ValueFromBlock unboxedResult = m_out.anchor(
-                m_out.loadPtr(cell, m_heaps.JSWrapperObject_internalValue));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, simpleResult, unboxedResult));
-            
-            m_interpreter.filter(m_node->child1(), SpecString | SpecStringObject);
-            return;
-        }
-            
-        case CellUse:
-        case UntypedUse: {
-            LValue value;
-            if (m_node->child1().useKind() == CellUse)
-                value = lowCell(m_node->child1());
-            else
-                value = lowJSValue(m_node->child1());
-            
-            LBasicBlock isCell = FTL_NEW_BLOCK(m_out, ("ToString CellUse/UntypedUse is cell"));
-            LBasicBlock notString = FTL_NEW_BLOCK(m_out, ("ToString CellUse/UntypedUse not string"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ToString CellUse/UntypedUse continuation"));
-            
-            LValue isCellPredicate;
-            if (m_node->child1().useKind() == CellUse)
-                isCellPredicate = m_out.booleanTrue;
-            else
-                isCellPredicate = this->isCell(value, provenType(m_node->child1()));
-            m_out.branch(isCellPredicate, unsure(isCell), unsure(notString));
-            
-            LBasicBlock lastNext = m_out.appendTo(isCell, notString);
-            ValueFromBlock simpleResult = m_out.anchor(value);
-            LValue isStringPredicate;
-            if (m_node->child1()->prediction() & SpecString) {
-                isStringPredicate = isString(value, provenType(m_node->child1()));
-            } else
-                isStringPredicate = m_out.booleanFalse;
-            m_out.branch(isStringPredicate, unsure(continuation), unsure(notString));
-            
-            m_out.appendTo(notString, continuation);
-            LValue operation;
-            if (m_node->child1().useKind() == CellUse)
-                operation = m_out.operation(m_node->op() == ToString ? operationToStringOnCell : operationCallStringConstructorOnCell);
-            else
-                operation = m_out.operation(m_node->op() == ToString ? operationToString : operationCallStringConstructor);
-            ValueFromBlock convertedResult = m_out.anchor(vmCall(operation, m_callFrame, value));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, simpleResult, convertedResult));
+        if (data.previousStructure->couldHaveIndexingHeader()) {
+            setStorage(vmCall(
+                m_out.operation(
+                    operationReallocateButterflyToHavePropertyStorageWithInitialCapacity),
+                m_callFrame, object));
             return;
         }
-            
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
-            break;
-        }
-    }
-    
-    void compileToPrimitive()
-    {
-        LValue value = lowJSValue(m_node->child1());
-        
-        LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("ToPrimitive cell case"));
-        LBasicBlock isObjectCase = FTL_NEW_BLOCK(m_out, ("ToPrimitive object case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ToPrimitive continuation"));
-        
-        Vector<ValueFromBlock, 3> results;
-        
-        results.append(m_out.anchor(value));
-        m_out.branch(
-            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
-        
-        LBasicBlock lastNext = m_out.appendTo(isCellCase, isObjectCase);
-        results.append(m_out.anchor(value));
-        m_out.branch(
-            isObject(value, provenType(m_node->child1())),
-            unsure(isObjectCase), unsure(continuation));
-        
-        m_out.appendTo(isObjectCase, continuation);
-        results.append(m_out.anchor(vmCall(
-            m_out.operation(operationToPrimitive), m_callFrame, value)));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, results));
-    }
-    
-    void compileMakeRope()
-    {
-        LValue kids[3];
-        unsigned numKids;
-        kids[0] = lowCell(m_node->child1());
-        kids[1] = lowCell(m_node->child2());
-        if (m_node->child3()) {
-            kids[2] = lowCell(m_node->child3());
-            numKids = 3;
-        } else {
-            kids[2] = 0;
-            numKids = 2;
-        }
         
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("MakeRope slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MakeRope continuation"));
+        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("AllocatePropertyStorage slow path"));
+        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("AllocatePropertyStorage continuation"));
         
         LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
         
-        MarkedAllocator& allocator =
-            vm().heap.allocatorForObjectWithDestructor(sizeof(JSRopeString));
-        
-        LValue result = allocateCell(
-            m_out.constIntPtr(&allocator),
-            vm().stringStructure.get(),
-            slowPath);
+        LValue endOfStorage = allocateBasicStorageAndGetEnd(
+            m_out.constIntPtr(initialOutOfLineCapacity * sizeof(JSValue)), slowPath);
         
-        m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSString_value);
-        for (unsigned i = 0; i < numKids; ++i)
-            m_out.storePtr(kids[i], result, m_heaps.JSRopeString_fibers[i]);
-        for (unsigned i = numKids; i < JSRopeString::s_maxInternalRopeLength; ++i)
-            m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSRopeString_fibers[i]);
-        LValue flags = m_out.load32(kids[0], m_heaps.JSString_flags);
-        LValue length = m_out.load32(kids[0], m_heaps.JSString_length);
-        for (unsigned i = 1; i < numKids; ++i) {
-            flags = m_out.bitAnd(flags, m_out.load32(kids[i], m_heaps.JSString_flags));
-            LValue lengthAndOverflow = m_out.addWithOverflow32(
-                length, m_out.load32(kids[i], m_heaps.JSString_length));
-            speculate(Uncountable, noValue(), 0, m_out.extractValue(lengthAndOverflow, 1));
-            length = m_out.extractValue(lengthAndOverflow, 0);
-        }
-        m_out.store32(
-            m_out.bitAnd(m_out.constInt32(JSString::Is8Bit), flags),
-            result, m_heaps.JSString_flags);
-        m_out.store32(length, result, m_heaps.JSString_length);
+        ValueFromBlock fastButterfly = m_out.anchor(
+            m_out.add(m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage));
         
-        ValueFromBlock fastResult = m_out.anchor(result);
         m_out.jump(continuation);
         
         m_out.appendTo(slowPath, continuation);
-        ValueFromBlock slowResult;
-        switch (numKids) {
-        case 2:
-            slowResult = m_out.anchor(vmCall(
-                m_out.operation(operationMakeRope2), m_callFrame, kids[0], kids[1]));
-            break;
-        case 3:
-            slowResult = m_out.anchor(vmCall(
-                m_out.operation(operationMakeRope3), m_callFrame, kids[0], kids[1], kids[2]));
-            break;
-        default:
-            DFG_CRASH(m_graph, m_node, "Bad number of children");
-            break;
-        }
+        
+        ValueFromBlock slowButterfly = m_out.anchor(vmCall(
+            m_out.operation(operationAllocatePropertyStorageWithInitialCapacity), m_callFrame));
+        
         m_out.jump(continuation);
         
         m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, fastResult, slowResult));
+        
+        LValue result = m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);
+        m_out.storePtr(result, object, m_heaps.JSObject_butterfly);
+        
+        setStorage(result);
     }
     
     void compileStringCharAt()
@@ -3699,8 +2114,8 @@ private:
             
         m_out.branch(
             m_out.aboveOrEqual(
-                index, m_out.load32NonNegative(base, m_heaps.JSString_length)),
-            rarely(slowPath), usually(fastPath));
+                index, m_out.load32(base, m_heaps.JSString_length)),
+            slowPath, fastPath);
             
         LBasicBlock lastNext = m_out.appendTo(fastPath, slowPath);
             
@@ -3715,14 +2130,15 @@ private:
             m_out.testIsZero32(
                 m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
                 m_out.constInt32(StringImpl::flagIs8Bit())),
-            unsure(is16Bit), unsure(is8Bit));
+            is16Bit, is8Bit);
             
         m_out.appendTo(is8Bit, is16Bit);
             
         ValueFromBlock char8Bit = m_out.anchor(m_out.zeroExt(
             m_out.load8(m_out.baseIndex(
-                m_heaps.characters8, storage, m_out.zeroExtPtr(index),
-                provenValue(m_node->child2()))),
+                m_heaps.characters8,
+                storage, m_out.zeroExt(index, m_out.intPtr),
+                m_state.forNode(m_node->child2()).m_value)),
             m_out.int32));
         m_out.jump(bitsContinuation);
             
@@ -3730,12 +2146,11 @@ private:
             
         ValueFromBlock char16Bit = m_out.anchor(m_out.zeroExt(
             m_out.load16(m_out.baseIndex(
-                m_heaps.characters16, storage, m_out.zeroExtPtr(index),
-                provenValue(m_node->child2()))),
+                m_heaps.characters16,
+                storage, m_out.zeroExt(index, m_out.intPtr),
+                m_state.forNode(m_node->child2()).m_value)),
             m_out.int32));
-        m_out.branch(
-            m_out.aboveOrEqual(char16Bit.value(), m_out.constInt32(0x100)),
-            rarely(bigCharacter), usually(bitsContinuation));
+        m_out.branch(m_out.aboveOrEqual(char16Bit.value(), m_out.constInt32(0x100)), bigCharacter, bitsContinuation);
             
         m_out.appendTo(bigCharacter, bitsContinuation);
             
@@ -3752,7 +2167,8 @@ private:
         LValue smallStrings = m_out.constIntPtr(vm().smallStrings.singleCharacterStrings());
             
         results.append(m_out.anchor(m_out.loadPtr(m_out.baseIndex(
-            m_heaps.singleCharacterStrings, smallStrings, m_out.zeroExtPtr(character)))));
+            m_heaps.singleCharacterStrings, smallStrings,
+            m_out.zeroExt(character, m_out.intPtr)))));
         m_out.jump(continuation);
             
         m_out.appendTo(slowPath, continuation);
@@ -3761,23 +2177,13 @@ private:
             speculate(OutOfBounds, noValue(), 0, m_out.booleanTrue);
             results.append(m_out.anchor(m_out.intPtrZero));
         } else {
-            JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->codeOrigin);
                 
             if (globalObject->stringPrototypeChainIsSane()) {
-                // FIXME: This could be captured using a Speculation mode that means
-                // "out-of-bounds loads return a trivial value", something like
-                // SaneChainOutOfBounds.
-                // https://bugs.webkit.org/show_bug.cgi?id=144668
-                
-                m_graph.watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
-                m_graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
-                
                 LBasicBlock negativeIndex = FTL_NEW_BLOCK(m_out, ("GetByVal String negative index"));
                     
                 results.append(m_out.anchor(m_out.constInt64(JSValue::encode(jsUndefined()))));
-                m_out.branch(
-                    m_out.lessThan(index, m_out.int32Zero),
-                    rarely(negativeIndex), usually(continuation));
+                m_out.branch(m_out.lessThan(index, m_out.int32Zero), negativeIndex, continuation);
                     
                 m_out.appendTo(negativeIndex, continuation);
             }
@@ -3804,8 +2210,7 @@ private:
         
         speculate(
             Uncountable, noValue(), 0,
-            m_out.aboveOrEqual(
-                index, m_out.load32NonNegative(base, m_heaps.JSString_length)));
+            m_out.aboveOrEqual(index, m_out.load32(base, m_heaps.JSString_length)));
         
         LValue stringImpl = m_out.loadPtr(base, m_heaps.JSString_value);
         
@@ -3813,14 +2218,15 @@ private:
             m_out.testIsZero32(
                 m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
                 m_out.constInt32(StringImpl::flagIs8Bit())),
-            unsure(is16Bit), unsure(is8Bit));
+            is16Bit, is8Bit);
             
         LBasicBlock lastNext = m_out.appendTo(is8Bit, is16Bit);
             
         ValueFromBlock char8Bit = m_out.anchor(m_out.zeroExt(
             m_out.load8(m_out.baseIndex(
-                m_heaps.characters8, storage, m_out.zeroExtPtr(index),
-                provenValue(m_node->child2()))),
+                m_heaps.characters8,
+                storage, m_out.zeroExt(index, m_out.intPtr),
+                m_state.forNode(m_node->child2()).m_value)),
             m_out.int32));
         m_out.jump(continuation);
             
@@ -3828,8 +2234,9 @@ private:
             
         ValueFromBlock char16Bit = m_out.anchor(m_out.zeroExt(
             m_out.load16(m_out.baseIndex(
-                m_heaps.characters16, storage, m_out.zeroExtPtr(index),
-                provenValue(m_node->child2()))),
+                m_heaps.characters16,
+                storage, m_out.zeroExt(index, m_out.intPtr),
+                m_state.forNode(m_node->child2()).m_value)),
             m_out.int32));
         m_out.jump(continuation);
         
@@ -3840,220 +2247,108 @@ private:
     
     void compileGetByOffset()
     {
-        StorageAccessData& data = m_node->storageAccessData();
+        StorageAccessData& data =
+            m_graph.m_storageAccessData[m_node->storageAccessDataIndex()];
         
-        setJSValue(loadProperty(
-            lowStorage(m_node->child1()), data.identifierNumber, data.offset));
-    }
-    
-    void compileGetGetter()
-    {
-        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.GetterSetter_getter));
-    }
-    
-    void compileGetSetter()
-    {
-        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.GetterSetter_setter));
-    }
-    
-    void compileMultiGetByOffset()
-    {
-        LValue base = lowCell(m_node->child1());
-        
-        MultiGetByOffsetData& data = m_node->multiGetByOffsetData();
-
-        if (data.cases.isEmpty()) {
-            // Protect against creating a Phi function with zero inputs. LLVM doesn't like that.
-            terminate(BadCache);
-            return;
-        }
-        
-        Vector<LBasicBlock, 2> blocks(data.cases.size());
-        for (unsigned i = data.cases.size(); i--;)
-            blocks[i] = FTL_NEW_BLOCK(m_out, ("MultiGetByOffset case ", i));
-        LBasicBlock exit = FTL_NEW_BLOCK(m_out, ("MultiGetByOffset fail"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MultiGetByOffset continuation"));
-        
-        Vector<SwitchCase, 2> cases;
-        StructureSet baseSet;
-        for (unsigned i = data.cases.size(); i--;) {
-            MultiGetByOffsetCase getCase = data.cases[i];
-            for (unsigned j = getCase.set().size(); j--;) {
-                Structure* structure = getCase.set()[j];
-                baseSet.add(structure);
-                cases.append(SwitchCase(weakStructureID(structure), blocks[i], Weight(1)));
-            }
-        }
-        m_out.switchInstruction(
-            m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
-        
-        LBasicBlock lastNext = m_out.m_nextBlock;
-        
-        Vector<ValueFromBlock, 2> results;
-        for (unsigned i = data.cases.size(); i--;) {
-            MultiGetByOffsetCase getCase = data.cases[i];
-            GetByOffsetMethod method = getCase.method();
-            
-            m_out.appendTo(blocks[i], i + 1 < data.cases.size() ? blocks[i + 1] : exit);
-            
-            LValue result;
-            
-            switch (method.kind()) {
-            case GetByOffsetMethod::Invalid:
-                RELEASE_ASSERT_NOT_REACHED();
-                break;
-                
-            case GetByOffsetMethod::Constant:
-                result = m_out.constInt64(JSValue::encode(method.constant()->value()));
-                break;
-                
-            case GetByOffsetMethod::Load:
-            case GetByOffsetMethod::LoadFromPrototype: {
-                LValue propertyBase;
-                if (method.kind() == GetByOffsetMethod::Load)
-                    propertyBase = base;
-                else
-                    propertyBase = weakPointer(method.prototype()->value().asCell());
-                if (!isInlineOffset(method.offset()))
-                    propertyBase = m_out.loadPtr(propertyBase, m_heaps.JSObject_butterfly);
-                result = loadProperty(
-                    propertyBase, data.identifierNumber, method.offset());
-                break;
-            } }
-            
-            results.append(m_out.anchor(result));
-            m_out.jump(continuation);
-        }
-        
-        m_out.appendTo(exit, continuation);
-        if (!m_interpreter.forNode(m_node->child1()).m_structure.isSubsetOf(baseSet))
-            speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
-        m_out.unreachable();
-        
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, results));
+        setJSValue(
+            m_out.load64(
+                m_out.address(
+                    m_heaps.properties[data.identifierNumber],
+                    lowStorage(m_node->child1()),
+                    offsetRelativeToBase(data.offset))));
     }
     
     void compilePutByOffset()
     {
-        StorageAccessData& data = m_node->storageAccessData();
+        StorageAccessData& data =
+            m_graph.m_storageAccessData[m_node->storageAccessDataIndex()];
         
-        storeProperty(
+        m_out.store64(
             lowJSValue(m_node->child3()),
-            lowStorage(m_node->child1()), data.identifierNumber, data.offset);
-    }
-    
-    void compileMultiPutByOffset()
-    {
-        LValue base = lowCell(m_node->child1());
-        LValue value = lowJSValue(m_node->child2());
-        
-        MultiPutByOffsetData& data = m_node->multiPutByOffsetData();
-        
-        Vector<LBasicBlock, 2> blocks(data.variants.size());
-        for (unsigned i = data.variants.size(); i--;)
-            blocks[i] = FTL_NEW_BLOCK(m_out, ("MultiPutByOffset case ", i));
-        LBasicBlock exit = FTL_NEW_BLOCK(m_out, ("MultiPutByOffset fail"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MultiPutByOffset continuation"));
-        
-        Vector<SwitchCase, 2> cases;
-        StructureSet baseSet;
-        for (unsigned i = data.variants.size(); i--;) {
-            PutByIdVariant variant = data.variants[i];
-            for (unsigned j = variant.oldStructure().size(); j--;) {
-                Structure* structure = variant.oldStructure()[j];
-                baseSet.add(structure);
-                cases.append(SwitchCase(weakStructureID(structure), blocks[i], Weight(1)));
-            }
-        }
-        m_out.switchInstruction(
-            m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
-        
-        LBasicBlock lastNext = m_out.m_nextBlock;
-        
-        for (unsigned i = data.variants.size(); i--;) {
-            m_out.appendTo(blocks[i], i + 1 < data.variants.size() ? blocks[i + 1] : exit);
-            
-            PutByIdVariant variant = data.variants[i];
-            
-            LValue storage;
-            if (variant.kind() == PutByIdVariant::Replace) {
-                if (isInlineOffset(variant.offset()))
-                    storage = base;
-                else
-                    storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
-            } else {
-                m_graph.m_plan.transitions.addLazily(
-                    codeBlock(), m_node->origin.semantic.codeOriginOwner(),
-                    variant.oldStructureForTransition(), variant.newStructure());
-                
-                storage = storageForTransition(
-                    base, variant.offset(),
-                    variant.oldStructureForTransition(), variant.newStructure());
-
-                ASSERT(variant.oldStructureForTransition()->indexingType() == variant.newStructure()->indexingType());
-                ASSERT(variant.oldStructureForTransition()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
-                ASSERT(variant.oldStructureForTransition()->typeInfo().type() == variant.newStructure()->typeInfo().type());
-                m_out.store32(
-                    weakStructureID(variant.newStructure()), base, m_heaps.JSCell_structureID);
-            }
-            
-            storeProperty(value, storage, data.identifierNumber, variant.offset());
-            m_out.jump(continuation);
-        }
-        
-        m_out.appendTo(exit, continuation);
-        if (!m_interpreter.forNode(m_node->child1()).m_structure.isSubsetOf(baseSet))
-            speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
-        m_out.unreachable();
-        
-        m_out.appendTo(continuation, lastNext);
+            m_out.address(
+                m_heaps.properties[data.identifierNumber],
+                lowStorage(m_node->child1()),
+                offsetRelativeToBase(data.offset)));
     }
     
     void compileGetGlobalVar()
     {
-        setJSValue(m_out.load64(m_out.absolute(m_node->variablePointer())));
+        setJSValue(m_out.load64(m_out.absolute(m_node->registerPointer())));
     }
     
     void compilePutGlobalVar()
     {
         m_out.store64(
-            lowJSValue(m_node->child2()), m_out.absolute(m_node->variablePointer()));
+            lowJSValue(m_node->child1()), m_out.absolute(m_node->registerPointer()));
     }
     
     void compileNotifyWrite()
     {
-        WatchpointSet* set = m_node->watchpointSet();
+        VariableWatchpointSet* set = m_node->variableWatchpointSet();
+        
+        LValue value = lowJSValue(m_node->child1());
         
         LBasicBlock isNotInvalidated = FTL_NEW_BLOCK(m_out, ("NotifyWrite not invalidated case"));
+        LBasicBlock isClear = FTL_NEW_BLOCK(m_out, ("NotifyWrite clear case"));
+        LBasicBlock isWatched = FTL_NEW_BLOCK(m_out, ("NotifyWrite watched case"));
+        LBasicBlock invalidate = FTL_NEW_BLOCK(m_out, ("NotifyWrite invalidate case"));
+        LBasicBlock invalidateFast = FTL_NEW_BLOCK(m_out, ("NotifyWrite invalidate fast case"));
+        LBasicBlock invalidateSlow = FTL_NEW_BLOCK(m_out, ("NotifyWrite invalidate slow case"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NotifyWrite continuation"));
         
         LValue state = m_out.load8(m_out.absolute(set->addressOfState()));
+        
         m_out.branch(
             m_out.equal(state, m_out.constInt8(IsInvalidated)),
-            usually(continuation), rarely(isNotInvalidated));
+            continuation, isNotInvalidated);
         
-        LBasicBlock lastNext = m_out.appendTo(isNotInvalidated, continuation);
+        LBasicBlock lastNext = m_out.appendTo(isNotInvalidated, isClear);
 
-        vmCall(m_out.operation(operationNotifyWrite), m_callFrame, m_out.constIntPtr(set));
+        LValue isClearValue;
+        if (set->state() == ClearWatchpoint)
+            isClearValue = m_out.equal(state, m_out.constInt8(ClearWatchpoint));
+        else
+            isClearValue = m_out.booleanFalse;
+        m_out.branch(isClearValue, isClear, isWatched);
+        
+        m_out.appendTo(isClear, isWatched);
+        
+        m_out.store64(value, m_out.absolute(set->addressOfInferredValue()));
+        m_out.store8(m_out.constInt8(IsWatched), m_out.absolute(set->addressOfState()));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(isWatched, invalidate);
+        
+        m_out.branch(
+            m_out.equal(value, m_out.load64(m_out.absolute(set->addressOfInferredValue()))),
+            continuation, invalidate);
+        
+        m_out.appendTo(invalidate, invalidateFast);
+        
+        m_out.branch(
+            m_out.notZero8(m_out.load8(m_out.absolute(set->addressOfSetIsNotEmpty()))),
+            invalidateSlow, invalidateFast);
+        
+        m_out.appendTo(invalidateFast, invalidateSlow);
+        
+        m_out.store64(
+            m_out.constInt64(JSValue::encode(JSValue())),
+            m_out.absolute(set->addressOfInferredValue()));
+        m_out.store8(m_out.constInt8(IsInvalidated), m_out.absolute(set->addressOfState()));
+        m_out.jump(continuation);
+        
+        m_out.appendTo(invalidateSlow, continuation);
+        
+        vmCall(m_out.operation(operationInvalidate), m_callFrame, m_out.constIntPtr(set));
         m_out.jump(continuation);
         
         m_out.appendTo(continuation, lastNext);
     }
     
-    void compileGetCallee()
+    void compileGetMyScope()
     {
-        setJSValue(m_out.loadPtr(addressFor(JSStack::Callee)));
-    }
-    
-    void compileGetArgumentCount()
-    {
-        setInt32(m_out.load32(payloadFor(JSStack::ArgumentCount)));
-    }
-    
-    void compileGetScope()
-    {
-        setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSFunction_scope));
+        setJSValue(m_out.loadPtr(addressFor(
+            m_node->codeOrigin.stackOffset() + JSStack::ScopeChain)));
     }
     
     void compileSkipScope()
@@ -4061,71 +2356,51 @@ private:
         setJSValue(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSScope_next));
     }
     
-    void compileGetClosureVar()
+    void compileGetClosureRegisters()
     {
-        setJSValue(
-            m_out.load64(
-                lowCell(m_node->child1()),
-                m_heaps.JSEnvironmentRecord_variables[m_node->scopeOffset().offset()]));
+        if (WriteBarrierBase<Unknown>* registers = m_graph.tryGetRegisters(m_node->child1().node())) {
+            setStorage(m_out.constIntPtr(registers));
+            return;
+        }
+        
+        setStorage(m_out.loadPtr(
+            lowCell(m_node->child1()), m_heaps.JSVariableObject_registers));
     }
     
-    void compilePutClosureVar()
+    void compileGetClosureVar()
     {
-        m_out.store64(
-            lowJSValue(m_node->child2()),
-            lowCell(m_node->child1()),
-            m_heaps.JSEnvironmentRecord_variables[m_node->scopeOffset().offset()]);
+        setJSValue(m_out.load64(
+            addressFor(lowStorage(m_node->child1()), m_node->varNumber())));
     }
     
-    void compileGetFromArguments()
-    {
-        setJSValue(
-            m_out.load64(
-                lowCell(m_node->child1()),
-                m_heaps.DirectArguments_storage[m_node->capturedArgumentsOffset().offset()]));
-    }
-    
-    void compilePutToArguments()
+    void compilePutClosureVar()
     {
         m_out.store64(
-            lowJSValue(m_node->child2()),
-            lowCell(m_node->child1()),
-            m_heaps.DirectArguments_storage[m_node->capturedArgumentsOffset().offset()]);
+            lowJSValue(m_node->child3()),
+            addressFor(lowStorage(m_node->child2()), m_node->varNumber()));
     }
     
     void compileCompareEq()
     {
         if (m_node->isBinaryUseKind(Int32Use)
-            || m_node->isBinaryUseKind(Int52RepUse)
-            || m_node->isBinaryUseKind(DoubleRepUse)
-            || m_node->isBinaryUseKind(ObjectUse)
-            || m_node->isBinaryUseKind(BooleanUse)
-            || m_node->isBinaryUseKind(StringIdentUse)) {
+            || m_node->isBinaryUseKind(MachineIntUse)
+            || m_node->isBinaryUseKind(NumberUse)
+            || m_node->isBinaryUseKind(ObjectUse)) {
             compileCompareStrictEq();
             return;
         }
         
-        if (m_node->isBinaryUseKind(ObjectUse, ObjectOrOtherUse)) {
-            compareEqObjectOrOtherToObject(m_node->child2(), m_node->child1());
-            return;
-        }
-        
-        if (m_node->isBinaryUseKind(ObjectOrOtherUse, ObjectUse)) {
-            compareEqObjectOrOtherToObject(m_node->child1(), m_node->child2());
-            return;
-        }
-        
         if (m_node->isBinaryUseKind(UntypedUse)) {
             nonSpeculativeCompare(LLVMIntEQ, operationCompareEq);
             return;
         }
         
-        DFG_CRASH(m_graph, m_node, "Bad use kinds");
+        RELEASE_ASSERT_NOT_REACHED();
     }
     
     void compileCompareEqConstant()
     {
-        ASSERT(m_node->child2()->asJSValue().isNull());
+        ASSERT(m_graph.valueOfJSConstant(m_node->child2().node()).isNull());
         setBoolean(
             equalNullOrUndefined(
                 m_node->child1(), AllCellsAreFalse, EqualNullOrUndefined));
@@ -4139,7 +2414,7 @@ private:
             return;
         }
         
-        if (m_node->isBinaryUseKind(Int52RepUse)) {
+        if (m_node->isBinaryUseKind(MachineIntUse)) {
             Int52Kind kind;
             LValue left = lowWhicheverInt52(m_node->child1(), kind);
             LValue right = lowInt52(m_node->child2(), kind);
@@ -4147,34 +2422,12 @@ private:
             return;
         }
         
-        if (m_node->isBinaryUseKind(DoubleRepUse)) {
+        if (m_node->isBinaryUseKind(NumberUse)) {
             setBoolean(
                 m_out.doubleEqual(lowDouble(m_node->child1()), lowDouble(m_node->child2())));
             return;
         }
         
-        if (m_node->isBinaryUseKind(StringIdentUse)) {
-            setBoolean(
-                m_out.equal(lowStringIdent(m_node->child1()), lowStringIdent(m_node->child2())));
-            return;
-        }
-
-        if (m_node->isBinaryUseKind(ObjectUse, UntypedUse)) {
-            setBoolean(
-                m_out.equal(
-                    lowNonNullObject(m_node->child1()),
-                    lowJSValue(m_node->child2())));
-            return;
-        }
-        
-        if (m_node->isBinaryUseKind(UntypedUse, ObjectUse)) {
-            setBoolean(
-                m_out.equal(
-                    lowNonNullObject(m_node->child2()),
-                    lowJSValue(m_node->child1())));
-            return;
-        }
-
         if (m_node->isBinaryUseKind(ObjectUse)) {
             setBoolean(
                 m_out.equal(
@@ -4183,63 +2436,25 @@ private:
             return;
         }
         
-        if (m_node->isBinaryUseKind(BooleanUse)) {
-            setBoolean(
-                m_out.equal(lowBoolean(m_node->child1()), lowBoolean(m_node->child2())));
-            return;
-        }
-        
-        if (m_node->isBinaryUseKind(MiscUse, UntypedUse)
-            || m_node->isBinaryUseKind(UntypedUse, MiscUse)) {
-            speculate(m_node->child1());
-            speculate(m_node->child2());
-            LValue left = lowJSValue(m_node->child1(), ManualOperandSpeculation);
-            LValue right = lowJSValue(m_node->child2(), ManualOperandSpeculation);
-            setBoolean(m_out.equal(left, right));
-            return;
-        }
-        
-        if (m_node->isBinaryUseKind(StringIdentUse, NotStringVarUse)
-            || m_node->isBinaryUseKind(NotStringVarUse, StringIdentUse)) {
-            Edge leftEdge = m_node->childFor(StringIdentUse);
-            Edge rightEdge = m_node->childFor(NotStringVarUse);
-            
-            LValue left = lowStringIdent(leftEdge);
-            LValue rightValue = lowJSValue(rightEdge, ManualOperandSpeculation);
-            
-            LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("CompareStrictEq StringIdent to NotStringVar is cell case"));
-            LBasicBlock isStringCase = FTL_NEW_BLOCK(m_out, ("CompareStrictEq StringIdent to NotStringVar is string case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CompareStrictEq StringIdent to NotStringVar continuation"));
-            
-            ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
-            m_out.branch(
-                isCell(rightValue, provenType(rightEdge)),
-                unsure(isCellCase), unsure(continuation));
-            
-            LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
-            ValueFromBlock notStringResult = m_out.anchor(m_out.booleanFalse);
-            m_out.branch(
-                isString(rightValue, provenType(rightEdge)),
-                unsure(isStringCase), unsure(continuation));
-            
-            m_out.appendTo(isStringCase, continuation);
-            LValue right = m_out.loadPtr(rightValue, m_heaps.JSString_value);
-            speculateStringIdent(rightEdge, rightValue, right);
-            ValueFromBlock isStringResult = m_out.anchor(m_out.equal(left, right));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setBoolean(m_out.phi(m_out.boolean, notCellResult, notStringResult, isStringResult));
-            return;
-        }
-        
-        DFG_CRASH(m_graph, m_node, "Bad use kinds");
+        RELEASE_ASSERT_NOT_REACHED();
     }
     
     void compileCompareStrictEqConstant()
     {
-        JSValue constant = m_node->child2()->asJSValue();
+        JSValue constant = m_graph.valueOfJSConstant(m_node->child2().node());
 
+        if (constant.isUndefinedOrNull()
+            && !masqueradesAsUndefinedWatchpointIsStillValid()) {
+            if (constant.isNull()) {
+                setBoolean(equalNullOrUndefined(m_node->child1(), AllCellsAreFalse, EqualNull));
+                return;
+            }
+        
+            ASSERT(constant.isUndefined());
+            setBoolean(equalNullOrUndefined(m_node->child1(), AllCellsAreFalse, EqualUndefined));
+            return;
+        }
+        
         setBoolean(
             m_out.equal(
                 lowJSValue(m_node->child1()),
@@ -4270,188 +2485,51 @@ private:
     {
         setBoolean(m_out.bitNot(boolify(m_node->child1())));
     }
-
+    
     void compileCallOrConstruct()
     {
-        int numPassedArgs = m_node->numChildren() - 1;
-        int numArgs = numPassedArgs;
-
-        LValue jsCallee = lowJSValue(m_graph.varArgChild(m_node, 0));
-
-        unsigned stackmapID = m_stackmapIDs++;
+        // FIXME: This is unacceptably slow.
+        // https://bugs.webkit.org/show_bug.cgi?id=113621
         
-        Vector<LValue> arguments;
-        arguments.append(m_out.constInt64(stackmapID));
-        arguments.append(m_out.constInt32(sizeOfCall()));
-        arguments.append(constNull(m_out.ref8));
-        arguments.append(m_out.constInt32(1 + JSStack::CallFrameHeaderSize - JSStack::CallerFrameAndPCSize + numArgs));
-        arguments.append(jsCallee); // callee -> %rax
-        arguments.append(getUndef(m_out.int64)); // code block
-        arguments.append(jsCallee); // callee -> stack
-        arguments.append(m_out.constInt64(numArgs)); // argument count and zeros for the tag
-        for (int i = 0; i < numPassedArgs; ++i)
-            arguments.append(lowJSValue(m_graph.varArgChild(m_node, 1 + i)));
+        J_JITOperation_E function =
+            m_node->op() == Call ? operationFTLCall : operationFTLConstruct;
         
-        callPreflight();
+        int dummyThisArgument = m_node->op() == Call ? 0 : 1;
         
-        LValue call = m_out.call(m_out.patchpointInt64Intrinsic(), arguments);
-        setInstructionCallingConvention(call, LLVMWebKitJSCallConv);
+        int numPassedArgs = m_node->numChildren() - 1;
         
-        m_ftlState.jsCalls.append(JSCall(stackmapID, m_node));
+        LValue calleeFrame = m_out.add(
+            m_callFrame,
+            m_out.constIntPtr(sizeof(Register) * virtualRegisterForLocal(m_graph.frameRegisterCount()).offset()));
         
-        setJSValue(call);
-    }
-    
-    void compileCallOrConstructVarargs()
-    {
-        LValue jsCallee = lowJSValue(m_node->child1());
-        LValue thisArg = lowJSValue(m_node->child3());
-        
-        LValue jsArguments = nullptr;
+        m_out.store32(
+            m_out.constInt32(numPassedArgs + dummyThisArgument),
+            payloadFor(calleeFrame, JSStack::ArgumentCount));
+        m_out.store64(m_callFrame, calleeFrame, m_heaps.CallFrame_callerFrame);
+        m_out.store64(
+            lowJSValue(m_graph.varArgChild(m_node, 0)),
+            addressFor(calleeFrame, JSStack::Callee));
         
-        switch (m_node->op()) {
-        case CallVarargs:
-        case ConstructVarargs:
-            jsArguments = lowJSValue(m_node->child2());
-            break;
-        case CallForwardVarargs:
-        case ConstructForwardVarargs:
-            break;
-        default:
-            DFG_CRASH(m_graph, m_node, "bad node type");
-            break;
+        for (int i = 0; i < numPassedArgs; ++i) {
+            m_out.store64(
+                lowJSValue(m_graph.varArgChild(m_node, 1 + i)),
+                addressFor(calleeFrame, virtualRegisterForArgument(i + dummyThisArgument).offset()));
         }
         
-        unsigned stackmapID = m_stackmapIDs++;
-        
-        Vector<LValue> arguments;
-        arguments.append(m_out.constInt64(stackmapID));
-        arguments.append(m_out.constInt32(sizeOfICFor(m_node)));
-        arguments.append(constNull(m_out.ref8));
-        arguments.append(m_out.constInt32(2 + !!jsArguments));
-        arguments.append(jsCallee);
-        if (jsArguments)
-            arguments.append(jsArguments);
-        ASSERT(thisArg);
-        arguments.append(thisArg);
-        
-        callPreflight();
-        
-        LValue call = m_out.call(m_out.patchpointInt64Intrinsic(), arguments);
-        setInstructionCallingConvention(call, LLVMCCallConv);
-        
-        m_ftlState.jsCallVarargses.append(JSCallVarargs(stackmapID, m_node));
-        
-        setJSValue(call);
-    }
-    
-    void compileLoadVarargs()
-    {
-        LoadVarargsData* data = m_node->loadVarargsData();
-        LValue jsArguments = lowJSValue(m_node->child1());
-        
-        LValue length = vmCall(
-            m_out.operation(operationSizeOfVarargs), m_callFrame, jsArguments,
-            m_out.constInt32(data->offset));
-        
-        // FIXME: There is a chance that we will call an effectful length property twice. This is safe
-        // from the standpoint of the VM's integrity, but it's subtly wrong from a spec compliance
-        // standpoint. The best solution would be one where we can exit *into* the op_call_varargs right
-        // past the sizing.
-        // https://bugs.webkit.org/show_bug.cgi?id=141448
-        
-        LValue lengthIncludingThis = m_out.add(length, m_out.int32One);
-        speculate(
-            VarargsOverflow, noValue(), nullptr,
-            m_out.above(lengthIncludingThis, m_out.constInt32(data->limit)));
-        
-        m_out.store32(lengthIncludingThis, payloadFor(data->machineCount));
-        
-        // FIXME: This computation is rather silly. If operationLaodVarargs just took a pointer instead
-        // of a VirtualRegister, we wouldn't have to do this.
-        // https://bugs.webkit.org/show_bug.cgi?id=141660
-        LValue machineStart = m_out.lShr(
-            m_out.sub(addressFor(data->machineStart.offset()).value(), m_callFrame),
-            m_out.constIntPtr(3));
-        
-        vmCall(
-            m_out.operation(operationLoadVarargs), m_callFrame,
-            m_out.castToInt32(machineStart), jsArguments, m_out.constInt32(data->offset),
-            length, m_out.constInt32(data->mandatoryMinimum));
+        setJSValue(vmCall(m_out.operation(function), calleeFrame));
     }
     
-    void compileForwardVarargs()
-    {
-        LoadVarargsData* data = m_node->loadVarargsData();
-        InlineCallFrame* inlineCallFrame = m_node->child1()->origin.semantic.inlineCallFrame;
-        
-        LValue length = getArgumentsLength(inlineCallFrame).value;
-        LValue lengthIncludingThis = m_out.add(length, m_out.constInt32(1 - data->offset));
-        
-        speculate(
-            VarargsOverflow, noValue(), nullptr,
-            m_out.above(lengthIncludingThis, m_out.constInt32(data->limit)));
-        
-        m_out.store32(lengthIncludingThis, payloadFor(data->machineCount));
-        
-        LValue sourceStart = getArgumentsStart(inlineCallFrame);
-        LValue targetStart = addressFor(data->machineStart).value();
-
-        LBasicBlock undefinedLoop = FTL_NEW_BLOCK(m_out, ("ForwardVarargs undefined loop body"));
-        LBasicBlock mainLoopEntry = FTL_NEW_BLOCK(m_out, ("ForwardVarargs main loop entry"));
-        LBasicBlock mainLoop = FTL_NEW_BLOCK(m_out, ("ForwardVarargs main loop body"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ForwardVarargs continuation"));
-        
-        LValue lengthAsPtr = m_out.zeroExtPtr(length);
-        ValueFromBlock loopBound = m_out.anchor(m_out.constIntPtr(data->mandatoryMinimum));
-        m_out.branch(
-            m_out.above(loopBound.value(), lengthAsPtr), unsure(undefinedLoop), unsure(mainLoopEntry));
-        
-        LBasicBlock lastNext = m_out.appendTo(undefinedLoop, mainLoopEntry);
-        LValue previousIndex = m_out.phi(m_out.intPtr, loopBound);
-        LValue currentIndex = m_out.sub(previousIndex, m_out.intPtrOne);
-        m_out.store64(
-            m_out.constInt64(JSValue::encode(jsUndefined())),
-            m_out.baseIndex(m_heaps.variables, targetStart, currentIndex));
-        ValueFromBlock nextIndex = m_out.anchor(currentIndex);
-        addIncoming(previousIndex, nextIndex);
-        m_out.branch(
-            m_out.above(currentIndex, lengthAsPtr), unsure(undefinedLoop), unsure(mainLoopEntry));
-        
-        m_out.appendTo(mainLoopEntry, mainLoop);
-        loopBound = m_out.anchor(lengthAsPtr);
-        m_out.branch(m_out.notNull(loopBound.value()), unsure(mainLoop), unsure(continuation));
-        
-        m_out.appendTo(mainLoop, continuation);
-        previousIndex = m_out.phi(m_out.intPtr, loopBound);
-        currentIndex = m_out.sub(previousIndex, m_out.intPtrOne);
-        LValue value = m_out.load64(
-            m_out.baseIndex(
-                m_heaps.variables, sourceStart,
-                m_out.add(currentIndex, m_out.constIntPtr(data->offset))));
-        m_out.store64(value, m_out.baseIndex(m_heaps.variables, targetStart, currentIndex));
-        nextIndex = m_out.anchor(currentIndex);
-        addIncoming(previousIndex, nextIndex);
-        m_out.branch(m_out.isNull(currentIndex), unsure(continuation), unsure(mainLoop));
-        
-        m_out.appendTo(continuation, lastNext);
-    }
-
     void compileJump()
     {
-        m_out.jump(lowBlock(m_node->targetBlock()));
+        m_out.jump(lowBlock(m_node->takenBlock()));
     }
     
     void compileBranch()
     {
         m_out.branch(
             boolify(m_node->child1()),
-            WeightedTarget(
-                lowBlock(m_node->branchData()->taken.block),
-                m_node->branchData()->taken.count),
-            WeightedTarget(
-                lowBlock(m_node->branchData()->notTaken.block),
-                m_node->branchData()->notTaken.count));
+            lowBlock(m_node->takenBlock()),
+            lowBlock(m_node->notTakenBlock()));
     }
     
     void compileSwitch()
@@ -4477,7 +2555,7 @@ private:
                 LBasicBlock isDouble = FTL_NEW_BLOCK(m_out, ("Switch/SwitchImm is double"));
                 
                 LValue boxedValue = lowJSValue(m_node->child1());
-                m_out.branch(isNotInt32(boxedValue), unsure(isNotInt), unsure(isInt));
+                m_out.branch(isNotInt32(boxedValue), isNotInt, isInt);
                 
                 LBasicBlock innerLastNext = m_out.appendTo(isInt, isNotInt);
                 
@@ -4486,8 +2564,7 @@ private:
                 
                 m_out.appendTo(isNotInt, isDouble);
                 m_out.branch(
-                    isCellOrMisc(boxedValue, provenType(m_node->child1())),
-                    usually(lowBlock(data->fallThrough.block)), rarely(isDouble));
+                    isCellOrMisc(boxedValue), lowBlock(data->fallThrough), isDouble);
                 
                 m_out.appendTo(isDouble, innerLastNext);
                 LValue doubleValue = unboxDouble(boxedValue);
@@ -4495,12 +2572,12 @@ private:
                 intValues.append(m_out.anchor(intInDouble));
                 m_out.branch(
                     m_out.doubleEqual(m_out.intToDouble(intInDouble), doubleValue),
-                    unsure(switchOnInts), unsure(lowBlock(data->fallThrough.block)));
+                    switchOnInts, lowBlock(data->fallThrough));
                 break;
             }
                 
             default:
-                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                RELEASE_ASSERT_NOT_REACHED();
                 break;
             }
             
@@ -4512,12 +2589,6 @@ private:
         case SwitchChar: {
             LValue stringValue;
             
-            // FIXME: We should use something other than unsure() for the branch weight
-            // of the fallThrough block. The main challenge is just that we have multiple
-            // branches to fallThrough but a single count, so we would need to divvy it up
-            // among the different lowered branches.
-            // https://bugs.webkit.org/show_bug.cgi?id=129082
-            
             switch (m_node->child1().useKind()) {
             case StringUse: {
                 stringValue = lowString(m_node->child1());
@@ -4531,14 +2602,11 @@ private:
                 LBasicBlock isStringCase = FTL_NEW_BLOCK(m_out, ("Switch/SwitchChar is string"));
                 
                 m_out.branch(
-                    isNotCell(unboxedValue, provenType(m_node->child1())),
-                    unsure(lowBlock(data->fallThrough.block)), unsure(isCellCase));
+                    isNotCell(unboxedValue), lowBlock(data->fallThrough), isCellCase);
                 
                 LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
                 LValue cellValue = unboxedValue;
-                m_out.branch(
-                    isNotString(cellValue, provenType(m_node->child1())),
-                    unsure(lowBlock(data->fallThrough.block)), unsure(isStringCase));
+                m_out.branch(isNotString(cellValue), lowBlock(data->fallThrough), isStringCase);
                 
                 m_out.appendTo(isStringCase, lastNext);
                 stringValue = cellValue;
@@ -4546,7 +2614,7 @@ private:
             }
                 
             default:
-                DFG_CRASH(m_graph, m_node, "Bad use kind");
+                RELEASE_ASSERT_NOT_REACHED();
                 break;
             }
             
@@ -4559,15 +2627,15 @@ private:
             
             m_out.branch(
                 m_out.notEqual(
-                    m_out.load32NonNegative(stringValue, m_heaps.JSString_length),
+                    m_out.load32(stringValue, m_heaps.JSString_length),
                     m_out.int32One),
-                unsure(lowBlock(data->fallThrough.block)), unsure(lengthIs1));
+                lowBlock(data->fallThrough), lengthIs1);
             
             LBasicBlock lastNext = m_out.appendTo(lengthIs1, needResolution);
             Vector<ValueFromBlock, 2> values;
             LValue fastValue = m_out.loadPtr(stringValue, m_heaps.JSString_value);
             values.append(m_out.anchor(fastValue));
-            m_out.branch(m_out.isNull(fastValue), rarely(needResolution), usually(resolved));
+            m_out.branch(m_out.isNull(fastValue), needResolution, resolved);
             
             m_out.appendTo(needResolution, resolved);
             values.append(m_out.anchor(
@@ -4581,7 +2649,7 @@ private:
                 m_out.testNonZero32(
                     m_out.load32(value, m_heaps.StringImpl_hashAndFlags),
                     m_out.constInt32(StringImpl::flagIs8Bit())),
-                unsure(is8Bit), unsure(is16Bit));
+                is8Bit, is16Bit);
             
             Vector<ValueFromBlock, 2> characters;
             m_out.appendTo(is8Bit, is16Bit);
@@ -4598,92 +2666,18 @@ private:
             return;
         }
         
-        case SwitchString: {
-            switch (m_node->child1().useKind()) {
-            case StringIdentUse: {
-                LValue stringImpl = lowStringIdent(m_node->child1());
-                
-                Vector<SwitchCase> cases;
-                for (unsigned i = 0; i < data->cases.size(); ++i) {
-                    LValue value = m_out.constIntPtr(data->cases[i].value.stringImpl());
-                    LBasicBlock block = lowBlock(data->cases[i].target.block);
-                    Weight weight = Weight(data->cases[i].target.count);
-                    cases.append(SwitchCase(value, block, weight));
-                }
-                
-                m_out.switchInstruction(
-                    stringImpl, cases, lowBlock(data->fallThrough.block),
-                    Weight(data->fallThrough.count));
-                return;
-            }
-                
-            case StringUse: {
-                switchString(data, lowString(m_node->child1()));
-                return;
-            }
-                
-            case UntypedUse: {
-                LValue value = lowJSValue(m_node->child1());
-                
-                LBasicBlock isCellBlock = FTL_NEW_BLOCK(m_out, ("Switch/SwitchString Untyped cell case"));
-                LBasicBlock isStringBlock = FTL_NEW_BLOCK(m_out, ("Switch/SwitchString Untyped string case"));
-                
-                m_out.branch(
-                    isCell(value, provenType(m_node->child1())),
-                    unsure(isCellBlock), unsure(lowBlock(data->fallThrough.block)));
-                
-                LBasicBlock lastNext = m_out.appendTo(isCellBlock, isStringBlock);
-                
-                m_out.branch(
-                    isString(value, provenType(m_node->child1())),
-                    unsure(isStringBlock), unsure(lowBlock(data->fallThrough.block)));
-                
-                m_out.appendTo(isStringBlock, lastNext);
-                
-                switchString(data, value);
-                return;
-            }
-                
-            default:
-                DFG_CRASH(m_graph, m_node, "Bad use kind");
-                return;
-            }
-            return;
+        case SwitchString:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
         }
-            
-        case SwitchCell: {
-            LValue cell;
-            switch (m_node->child1().useKind()) {
-            case CellUse: {
-                cell = lowCell(m_node->child1());
-                break;
-            }
-                
-            case UntypedUse: {
-                LValue value = lowJSValue(m_node->child1());
-                LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("Switch/SwitchCell cell case"));
-                m_out.branch(
-                    isCell(value, provenType(m_node->child1())),
-                    unsure(cellCase), unsure(lowBlock(data->fallThrough.block)));
-                m_out.appendTo(cellCase);
-                cell = value;
-                break;
-            }
-                
-            default:
-                DFG_CRASH(m_graph, m_node, "Bad use kind");
-                return;
-            }
-            
-            buildSwitch(m_node->switchData(), m_out.intPtr, cell);
-            return;
-        } }
         
-        DFG_CRASH(m_graph, m_node, "Bad switch kind");
+        RELEASE_ASSERT_NOT_REACHED();
     }
     
     void compileReturn()
     {
+        // FIXME: have a real epilogue when we switch to using our calling convention.
+        // https://bugs.webkit.org/show_bug.cgi?id=113621
         m_out.ret(lowJSValue(m_node->child1()));
     }
     
@@ -4692,21 +2686,15 @@ private:
         terminate(InadequateCoverage);
     }
     
-    void compileThrow()
-    {
-        terminate(Uncountable);
-    }
-    
     void compileInvalidationPoint()
     {
         if (verboseCompilationEnabled())
-            dataLog("    Invalidation point with availability: ", availabilityMap(), "\n");
+            dataLog("    Invalidation point with availability: ", m_availability, "\n");
         
         m_ftlState.jitCode->osrExit.append(OSRExit(
             UncountableInvalidation, InvalidValueFormat, MethodOfGettingAValueProfile(),
             m_codeOriginForExitTarget, m_codeOriginForExitProfile,
-            availabilityMap().m_locals.numberOfArguments(),
-            availabilityMap().m_locals.numberOfLocals()));
+            m_availability.numberOfArguments(), m_availability.numberOfLocals()));
         m_ftlState.finalizer->osrExit.append(OSRExitCompilationInfo());
         
         OSRExit& exit = m_ftlState.jitCode->osrExit.last();
@@ -4720,1022 +2708,11 @@ private:
         info.m_isInvalidationPoint = true;
     }
     
-    void compileIsUndefined()
-    {
-        setBoolean(equalNullOrUndefined(m_node->child1(), AllCellsAreFalse, EqualUndefined));
-    }
-    
-    void compileIsBoolean()
-    {
-        setBoolean(isBoolean(lowJSValue(m_node->child1()), provenType(m_node->child1())));
-    }
-    
-    void compileIsNumber()
-    {
-        setBoolean(isNumber(lowJSValue(m_node->child1()), provenType(m_node->child1())));
-    }
-    
-    void compileIsString()
-    {
-        LValue value = lowJSValue(m_node->child1());
-        
-        LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("IsString cell case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("IsString continuation"));
-        
-        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(
-            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
-        
-        LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
-        ValueFromBlock cellResult = m_out.anchor(isString(value, provenType(m_node->child1())));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        setBoolean(m_out.phi(m_out.boolean, notCellResult, cellResult));
-    }
-
-    void compileIsObject()
-    {
-        LValue value = lowJSValue(m_node->child1());
-
-        LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("IsObject cell case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("IsObject continuation"));
-
-        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(
-            isCell(value, provenType(m_node->child1())), unsure(isCellCase), unsure(continuation));
-
-        LBasicBlock lastNext = m_out.appendTo(isCellCase, continuation);
-        ValueFromBlock cellResult = m_out.anchor(isObject(value, provenType(m_node->child1())));
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
-        setBoolean(m_out.phi(m_out.boolean, notCellResult, cellResult));
-    }
-
-    void compileIsObjectOrNull()
-    {
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
-        
-        Edge child = m_node->child1();
-        LValue value = lowJSValue(child);
-        
-        LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("IsObjectOrNull cell case"));
-        LBasicBlock notFunctionCase = FTL_NEW_BLOCK(m_out, ("IsObjectOrNull not function case"));
-        LBasicBlock objectCase = FTL_NEW_BLOCK(m_out, ("IsObjectOrNull object case"));
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("IsObjectOrNull slow path"));
-        LBasicBlock notCellCase = FTL_NEW_BLOCK(m_out, ("IsObjectOrNull not cell case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("IsObjectOrNull continuation"));
-        
-        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
-        
-        LBasicBlock lastNext = m_out.appendTo(cellCase, notFunctionCase);
-        ValueFromBlock isFunctionResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(
-            isFunction(value, provenType(child)),
-            unsure(continuation), unsure(notFunctionCase));
-        
-        m_out.appendTo(notFunctionCase, objectCase);
-        ValueFromBlock notObjectResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(
-            isObject(value, provenType(child)),
-            unsure(objectCase), unsure(continuation));
-        
-        m_out.appendTo(objectCase, slowPath);
-        ValueFromBlock objectResult = m_out.anchor(m_out.booleanTrue);
-        m_out.branch(
-            isExoticForTypeof(value, provenType(child)),
-            rarely(slowPath), usually(continuation));
-        
-        m_out.appendTo(slowPath, notCellCase);
-        LValue slowResultValue = vmCall(
-            m_out.operation(operationObjectIsObject), m_callFrame, weakPointer(globalObject),
-            value);
-        ValueFromBlock slowResult = m_out.anchor(m_out.notNull(slowResultValue));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(notCellCase, continuation);
-        LValue notCellResultValue = m_out.equal(value, m_out.constInt64(JSValue::encode(jsNull())));
-        ValueFromBlock notCellResult = m_out.anchor(notCellResultValue);
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        LValue result = m_out.phi(
-            m_out.boolean,
-            isFunctionResult, notObjectResult, objectResult, slowResult, notCellResult);
-        setBoolean(result);
-    }
-    
-    void compileIsFunction()
-    {
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
-        
-        Edge child = m_node->child1();
-        LValue value = lowJSValue(child);
-        
-        LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("IsFunction cell case"));
-        LBasicBlock notFunctionCase = FTL_NEW_BLOCK(m_out, ("IsFunction not function case"));
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("IsFunction slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("IsFunction continuation"));
-        
-        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(
-            isCell(value, provenType(child)), unsure(cellCase), unsure(continuation));
-        
-        LBasicBlock lastNext = m_out.appendTo(cellCase, notFunctionCase);
-        ValueFromBlock functionResult = m_out.anchor(m_out.booleanTrue);
-        m_out.branch(
-            isFunction(value, provenType(child)),
-            unsure(continuation), unsure(notFunctionCase));
-        
-        m_out.appendTo(notFunctionCase, slowPath);
-        ValueFromBlock objectResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(
-            isExoticForTypeof(value, provenType(child)),
-            rarely(slowPath), usually(continuation));
-        
-        m_out.appendTo(slowPath, continuation);
-        LValue slowResultValue = vmCall(
-            m_out.operation(operationObjectIsFunction), m_callFrame, weakPointer(globalObject),
-            value);
-        ValueFromBlock slowResult = m_out.anchor(m_out.notNull(slowResultValue));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        LValue result = m_out.phi(
-            m_out.boolean, notCellResult, functionResult, objectResult, slowResult);
-        setBoolean(result);
-    }
-    
-    void compileTypeOf()
-    {
-        Edge child = m_node->child1();
-        LValue value = lowJSValue(child);
-        
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("TypeOf continuation"));
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
-        
-        Vector<ValueFromBlock> results;
-        
-        buildTypeOf(
-            child, value,
-            [&] (TypeofType type) {
-                results.append(m_out.anchor(weakPointer(vm().smallStrings.typeString(type))));
-                m_out.jump(continuation);
-            });
-        
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, results));
-    }
-    
-    void compileIn()
-    {
-        Edge base = m_node->child2();
-        LValue cell = lowCell(base);
-        speculateObject(base, cell);
-        if (JSString* string = m_node->child1()->dynamicCastConstant<JSString*>()) {
-            if (string->tryGetValueImpl() && string->tryGetValueImpl()->isAtomic()) {
-
-                const auto str = static_cast<const AtomicStringImpl*>(string->tryGetValueImpl());
-                unsigned stackmapID = m_stackmapIDs++;
-            
-                LValue call = m_out.call(
-                    m_out.patchpointInt64Intrinsic(),
-                    m_out.constInt64(stackmapID), m_out.constInt32(sizeOfIn()),
-                    constNull(m_out.ref8), m_out.constInt32(1), cell);
-
-                setInstructionCallingConvention(call, LLVMAnyRegCallConv);
-
-                m_ftlState.checkIns.append(CheckInDescriptor(stackmapID, m_node->origin.semantic, str));
-                setJSValue(call);
-                return;
-            }
-        } 
-
-        setJSValue(vmCall(m_out.operation(operationGenericIn), m_callFrame, cell, lowJSValue(m_node->child1())));
-    }
-
-    void compileCheckHasInstance()
-    {
-        speculate(
-            Uncountable, noValue(), 0,
-            m_out.testIsZero8(
-                m_out.load8(lowCell(m_node->child1()), m_heaps.JSCell_typeInfoFlags),
-                m_out.constInt8(ImplementsDefaultHasInstance)));
-    }
-    
-    void compileInstanceOf()
-    {
-        LValue cell;
-        
-        if (m_node->child1().useKind() == UntypedUse)
-            cell = lowJSValue(m_node->child1());
-        else
-            cell = lowCell(m_node->child1());
-        
-        LValue prototype = lowCell(m_node->child2());
-        
-        LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("InstanceOf cell case"));
-        LBasicBlock loop = FTL_NEW_BLOCK(m_out, ("InstanceOf loop"));
-        LBasicBlock notYetInstance = FTL_NEW_BLOCK(m_out, ("InstanceOf not yet instance"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("InstanceOf continuation"));
-        
-        LValue condition;
-        if (m_node->child1().useKind() == UntypedUse)
-            condition = isCell(cell, provenType(m_node->child1()));
-        else
-            condition = m_out.booleanTrue;
-        
-        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
-        m_out.branch(condition, unsure(isCellCase), unsure(continuation));
-        
-        LBasicBlock lastNext = m_out.appendTo(isCellCase, loop);
-        
-        speculate(BadType, noValue(), 0, isNotObject(prototype, provenType(m_node->child2())));
-        
-        ValueFromBlock originalValue = m_out.anchor(cell);
-        m_out.jump(loop);
-        
-        m_out.appendTo(loop, notYetInstance);
-        LValue value = m_out.phi(m_out.int64, originalValue);
-        LValue structure = loadStructure(value);
-        LValue currentPrototype = m_out.load64(structure, m_heaps.Structure_prototype);
-        ValueFromBlock isInstanceResult = m_out.anchor(m_out.booleanTrue);
-        m_out.branch(
-            m_out.equal(currentPrototype, prototype),
-            unsure(continuation), unsure(notYetInstance));
-        
-        m_out.appendTo(notYetInstance, continuation);
-        ValueFromBlock notInstanceResult = m_out.anchor(m_out.booleanFalse);
-        addIncoming(value, m_out.anchor(currentPrototype));
-        m_out.branch(isCell(currentPrototype), unsure(loop), unsure(continuation));
-        
-        m_out.appendTo(continuation, lastNext);
-        setBoolean(
-            m_out.phi(m_out.boolean, notCellResult, isInstanceResult, notInstanceResult));
-    }
-    
-    void compileCountExecution()
-    {
-        TypedPointer counter = m_out.absolute(m_node->executionCounter()->address());
-        m_out.store64(m_out.add(m_out.load64(counter), m_out.constInt64(1)), counter);
-    }
-    
-    void compileStoreBarrier()
-    {
-        emitStoreBarrier(lowCell(m_node->child1()));
-    }
-
-    void compileHasIndexedProperty()
-    {
-        switch (m_node->arrayMode().type()) {
-        case Array::Int32:
-        case Array::Contiguous: {
-            LValue base = lowCell(m_node->child1());
-            LValue index = lowInt32(m_node->child2());
-            LValue storage = lowStorage(m_node->child3());
-
-            IndexedAbstractHeap& heap = m_node->arrayMode().type() == Array::Int32 ?
-                m_heaps.indexedInt32Properties : m_heaps.indexedContiguousProperties;
-
-            LBasicBlock checkHole = FTL_NEW_BLOCK(m_out, ("HasIndexedProperty int/contiguous check hole"));
-            LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("HasIndexedProperty int/contiguous slow case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("HasIndexedProperty int/contiguous continuation"));
-
-            if (!m_node->arrayMode().isInBounds()) {
-                m_out.branch(
-                    m_out.aboveOrEqual(
-                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
-                    rarely(slowCase), usually(checkHole));
-            } else
-                m_out.jump(checkHole);
-
-            LBasicBlock lastNext = m_out.appendTo(checkHole, slowCase); 
-            ValueFromBlock checkHoleResult = m_out.anchor(
-                m_out.notZero64(m_out.load64(baseIndex(heap, storage, index, m_node->child2()))));
-            m_out.branch(checkHoleResult.value(), usually(continuation), rarely(slowCase));
-
-            m_out.appendTo(slowCase, continuation);
-            ValueFromBlock slowResult = m_out.anchor(m_out.equal(
-                m_out.constInt64(JSValue::encode(jsBoolean(true))), 
-                vmCall(m_out.operation(operationHasIndexedProperty), m_callFrame, base, index)));
-            m_out.jump(continuation);
-
-            m_out.appendTo(continuation, lastNext);
-            setBoolean(m_out.phi(m_out.boolean, checkHoleResult, slowResult));
-            return;
-        }
-        case Array::Double: {
-            LValue base = lowCell(m_node->child1());
-            LValue index = lowInt32(m_node->child2());
-            LValue storage = lowStorage(m_node->child3());
-            
-            IndexedAbstractHeap& heap = m_heaps.indexedDoubleProperties;
-            
-            LBasicBlock checkHole = FTL_NEW_BLOCK(m_out, ("HasIndexedProperty double check hole"));
-            LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("HasIndexedProperty double slow case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("HasIndexedProperty double continuation"));
-            
-            if (!m_node->arrayMode().isInBounds()) {
-                m_out.branch(
-                    m_out.aboveOrEqual(
-                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
-                    rarely(slowCase), usually(checkHole));
-            } else
-                m_out.jump(checkHole);
-
-            LBasicBlock lastNext = m_out.appendTo(checkHole, slowCase);
-            LValue doubleValue = m_out.loadDouble(baseIndex(heap, storage, index, m_node->child2()));
-            ValueFromBlock checkHoleResult = m_out.anchor(m_out.doubleEqual(doubleValue, doubleValue));
-            m_out.branch(checkHoleResult.value(), usually(continuation), rarely(slowCase));
-            
-            m_out.appendTo(slowCase, continuation);
-            ValueFromBlock slowResult = m_out.anchor(m_out.equal(
-                m_out.constInt64(JSValue::encode(jsBoolean(true))), 
-                vmCall(m_out.operation(operationHasIndexedProperty), m_callFrame, base, index)));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(continuation, lastNext);
-            setBoolean(m_out.phi(m_out.boolean, checkHoleResult, slowResult));
-            return;
-        }
-            
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-            return;
-        }
-    }
-
-    void compileHasGenericProperty()
-    {
-        LValue base = lowJSValue(m_node->child1());
-        LValue property = lowCell(m_node->child2());
-        setJSValue(vmCall(m_out.operation(operationHasGenericProperty), m_callFrame, base, property));
-    }
-
-    void compileHasStructureProperty()
-    {
-        LValue base = lowJSValue(m_node->child1());
-        LValue property = lowString(m_node->child2());
-        LValue enumerator = lowCell(m_node->child3());
-
-        LBasicBlock correctStructure = FTL_NEW_BLOCK(m_out, ("HasStructureProperty correct structure"));
-        LBasicBlock wrongStructure = FTL_NEW_BLOCK(m_out, ("HasStructureProperty wrong structure"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("HasStructureProperty continuation"));
-
-        m_out.branch(m_out.notEqual(
-            m_out.load32(base, m_heaps.JSCell_structureID),
-            m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedStructureID)),
-            rarely(wrongStructure), usually(correctStructure));
-
-        LBasicBlock lastNext = m_out.appendTo(correctStructure, wrongStructure);
-        ValueFromBlock correctStructureResult = m_out.anchor(m_out.booleanTrue);
-        m_out.jump(continuation);
-
-        m_out.appendTo(wrongStructure, continuation);
-        ValueFromBlock wrongStructureResult = m_out.anchor(
-            m_out.equal(
-                m_out.constInt64(JSValue::encode(jsBoolean(true))), 
-                vmCall(m_out.operation(operationHasGenericProperty), m_callFrame, base, property)));
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
-        setBoolean(m_out.phi(m_out.boolean, correctStructureResult, wrongStructureResult));
-    }
-
-    void compileGetDirectPname()
-    {
-        LValue base = lowCell(m_graph.varArgChild(m_node, 0));
-        LValue property = lowCell(m_graph.varArgChild(m_node, 1));
-        LValue index = lowInt32(m_graph.varArgChild(m_node, 2));
-        LValue enumerator = lowCell(m_graph.varArgChild(m_node, 3));
-
-        LBasicBlock checkOffset = FTL_NEW_BLOCK(m_out, ("GetDirectPname check offset"));
-        LBasicBlock inlineLoad = FTL_NEW_BLOCK(m_out, ("GetDirectPname inline load"));
-        LBasicBlock outOfLineLoad = FTL_NEW_BLOCK(m_out, ("GetDirectPname out-of-line load"));
-        LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("GetDirectPname slow case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("GetDirectPname continuation"));
-
-        m_out.branch(m_out.notEqual(
-            m_out.load32(base, m_heaps.JSCell_structureID),
-            m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedStructureID)),
-            rarely(slowCase), usually(checkOffset));
-
-        LBasicBlock lastNext = m_out.appendTo(checkOffset, inlineLoad);
-        m_out.branch(m_out.aboveOrEqual(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity)),
-            unsure(outOfLineLoad), unsure(inlineLoad));
-
-        m_out.appendTo(inlineLoad, outOfLineLoad);
-        ValueFromBlock inlineResult = m_out.anchor(
-            m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), 
-                base, m_out.zeroExt(index, m_out.int64), ScaleEight, JSObject::offsetOfInlineStorage())));
-        m_out.jump(continuation);
-
-        m_out.appendTo(outOfLineLoad, slowCase);
-        LValue storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
-        LValue realIndex = m_out.signExt(
-            m_out.neg(m_out.sub(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity))), 
-            m_out.int64);
-        int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
-        ValueFromBlock outOfLineResult = m_out.anchor(
-            m_out.load64(m_out.baseIndex(m_heaps.properties.atAnyNumber(), storage, realIndex, ScaleEight, offsetOfFirstProperty)));
-        m_out.jump(continuation);
-
-        m_out.appendTo(slowCase, continuation);
-        ValueFromBlock slowCaseResult = m_out.anchor(
-            vmCall(m_out.operation(operationGetByVal), m_callFrame, base, property));
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, inlineResult, outOfLineResult, slowCaseResult));
-    }
-
-    void compileGetEnumerableLength()
-    {
-        LValue enumerator = lowCell(m_node->child1());
-        setInt32(m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_indexLength));
-    }
-
-    void compileGetPropertyEnumerator()
-    {
-        LValue base = lowCell(m_node->child1());
-        setJSValue(vmCall(m_out.operation(operationGetPropertyEnumerator), m_callFrame, base));
-    }
-
-    void compileGetEnumeratorStructurePname()
-    {
-        LValue enumerator = lowCell(m_node->child1());
-        LValue index = lowInt32(m_node->child2());
-
-        LBasicBlock inBounds = FTL_NEW_BLOCK(m_out, ("GetEnumeratorStructurePname in bounds"));
-        LBasicBlock outOfBounds = FTL_NEW_BLOCK(m_out, ("GetEnumeratorStructurePname out of bounds"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("GetEnumeratorStructurePname continuation"));
-
-        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endStructurePropertyIndex)),
-            usually(inBounds), rarely(outOfBounds));
-
-        LBasicBlock lastNext = m_out.appendTo(inBounds, outOfBounds);
-        LValue storage = m_out.loadPtr(enumerator, m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVector);
-        ValueFromBlock inBoundsResult = m_out.anchor(
-            m_out.loadPtr(m_out.baseIndex(m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVectorContents, storage, m_out.zeroExtPtr(index))));
-        m_out.jump(continuation);
-
-        m_out.appendTo(outOfBounds, continuation);
-        ValueFromBlock outOfBoundsResult = m_out.anchor(m_out.constInt64(ValueNull));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, inBoundsResult, outOfBoundsResult));
-    }
-
-    void compileGetEnumeratorGenericPname()
-    {
-        LValue enumerator = lowCell(m_node->child1());
-        LValue index = lowInt32(m_node->child2());
-
-        LBasicBlock inBounds = FTL_NEW_BLOCK(m_out, ("GetEnumeratorGenericPname in bounds"));
-        LBasicBlock outOfBounds = FTL_NEW_BLOCK(m_out, ("GetEnumeratorGenericPname out of bounds"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("GetEnumeratorGenericPname continuation"));
-
-        m_out.branch(m_out.below(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_endGenericPropertyIndex)),
-            usually(inBounds), rarely(outOfBounds));
-
-        LBasicBlock lastNext = m_out.appendTo(inBounds, outOfBounds);
-        LValue storage = m_out.loadPtr(enumerator, m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVector);
-        ValueFromBlock inBoundsResult = m_out.anchor(
-            m_out.loadPtr(m_out.baseIndex(m_heaps.JSPropertyNameEnumerator_cachedPropertyNamesVectorContents, storage, m_out.zeroExtPtr(index))));
-        m_out.jump(continuation);
-
-        m_out.appendTo(outOfBounds, continuation);
-        ValueFromBlock outOfBoundsResult = m_out.anchor(m_out.constInt64(ValueNull));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.int64, inBoundsResult, outOfBoundsResult));
-    }
-    
-    void compileToIndexString()
-    {
-        LValue index = lowInt32(m_node->child1());
-        setJSValue(vmCall(m_out.operation(operationToIndexString), m_callFrame, index));
-    }
-    
-    void compileCheckStructureImmediate()
-    {
-        LValue structure = lowCell(m_node->child1());
-        checkStructure(
-            structure, noValue(), BadCache, m_node->structureSet(),
-            [this] (Structure* structure) {
-                return weakStructure(structure);
-            });
-    }
-    
-    void compileMaterializeNewObject()
-    {
-        ObjectMaterializationData& data = m_node->objectMaterializationData();
-        
-        // Lower the values first, to avoid creating values inside a control flow diamond.
-        
-        Vector<LValue, 8> values;
-        for (unsigned i = 0; i < data.m_properties.size(); ++i)
-            values.append(lowJSValue(m_graph.varArgChild(m_node, 1 + i)));
-        
-        const StructureSet& set = m_node->structureSet();
-        
-        Vector<LBasicBlock, 1> blocks(set.size());
-        for (unsigned i = set.size(); i--;)
-            blocks[i] = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject case ", i));
-        LBasicBlock dummyDefault = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject default case"));
-        LBasicBlock outerContinuation = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject continuation"));
-        
-        Vector<SwitchCase, 1> cases(set.size());
-        for (unsigned i = set.size(); i--;)
-            cases[i] = SwitchCase(weakStructure(set[i]), blocks[i], Weight(1));
-        m_out.switchInstruction(
-            lowCell(m_graph.varArgChild(m_node, 0)), cases, dummyDefault, Weight(0));
-        
-        LBasicBlock outerLastNext = m_out.m_nextBlock;
-        
-        Vector<ValueFromBlock, 1> results;
-        
-        for (unsigned i = set.size(); i--;) {
-            m_out.appendTo(blocks[i], i + 1 < set.size() ? blocks[i + 1] : dummyDefault);
-            
-            Structure* structure = set[i];
-            
-            LValue object;
-            LValue butterfly;
-            
-            if (structure->outOfLineCapacity()) {
-                size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
-                MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
-                
-                LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject complex object allocation slow path"));
-                LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MaterializeNewObject complex object allocation continuation"));
-                
-                LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-                
-                LValue endOfStorage = allocateBasicStorageAndGetEnd(
-                    m_out.constIntPtr(structure->outOfLineCapacity() * sizeof(JSValue)),
-                    slowPath);
-                
-                LValue fastButterflyValue = m_out.add(
-                    m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage);
-                
-                LValue fastObjectValue = allocateObject(
-                    m_out.constIntPtr(allocator), structure, fastButterflyValue, slowPath);
-
-                ValueFromBlock fastObject = m_out.anchor(fastObjectValue);
-                ValueFromBlock fastButterfly = m_out.anchor(fastButterflyValue);
-                m_out.jump(continuation);
-                
-                m_out.appendTo(slowPath, continuation);
-                
-                ValueFromBlock slowObject = m_out.anchor(vmCall(
-                    m_out.operation(operationNewObjectWithButterfly),
-                    m_callFrame, m_out.constIntPtr(structure)));
-                ValueFromBlock slowButterfly = m_out.anchor(
-                    m_out.loadPtr(slowObject.value(), m_heaps.JSObject_butterfly));
-                
-                m_out.jump(continuation);
-                
-                m_out.appendTo(continuation, lastNext);
-                
-                object = m_out.phi(m_out.intPtr, fastObject, slowObject);
-                butterfly = m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);
-            } else {
-                // In the easy case where we can do a one-shot allocation, we simply allocate the
-                // object to directly have the desired structure.
-                object = allocateObject(structure);
-                butterfly = nullptr; // Don't have one, don't need one.
-            }
-            
-            for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
-                for (unsigned i = data.m_properties.size(); i--;) {
-                    PhantomPropertyValue value = data.m_properties[i];
-                    if (m_graph.identifiers()[value.m_identifierNumber] != entry.key)
-                        continue;
-                    
-                    LValue base = isInlineOffset(entry.offset) ? object : butterfly;
-                    storeProperty(values[i], base, value.m_identifierNumber, entry.offset);
-                    break;
-                }
-            }
-            
-            results.append(m_out.anchor(object));
-            m_out.jump(outerContinuation);
-        }
-        
-        m_out.appendTo(dummyDefault, outerContinuation);
-        m_out.unreachable();
-        
-        m_out.appendTo(outerContinuation, outerLastNext);
-        setJSValue(m_out.phi(m_out.intPtr, results));
-    }
-
-    void compileMaterializeCreateActivation()
-    {
-        ObjectMaterializationData& data = m_node->objectMaterializationData();
-
-        Vector<LValue, 8> values;
-        for (unsigned i = 0; i < data.m_properties.size(); ++i)
-            values.append(lowJSValue(m_graph.varArgChild(m_node, 2 + i)));
-
-        LValue scope = lowCell(m_graph.varArgChild(m_node, 1));
-        SymbolTable* table = m_node->castOperand<SymbolTable*>();
-        ASSERT(table == m_graph.varArgChild(m_node, 0)->castConstant<SymbolTable*>());
-        Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->activationStructure();
-
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("MaterializeCreateActivation slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("MaterializeCreateActivation continuation"));
-
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-
-        LValue fastObject = allocateObject<JSLexicalEnvironment>(
-            JSLexicalEnvironment::allocationSize(table), structure, m_out.intPtrZero, slowPath);
-
-        m_out.storePtr(scope, fastObject, m_heaps.JSScope_next);
-        m_out.storePtr(weakPointer(table), fastObject, m_heaps.JSSymbolTableObject_symbolTable);
-
-
-        ValueFromBlock fastResult = m_out.anchor(fastObject);
-        m_out.jump(continuation);
-
-        m_out.appendTo(slowPath, continuation);
-        // We ensure allocation sinking explictly sets bottom values for all field members. 
-        // Therefore, it doesn't matter what JSValue we pass in as the initialization value
-        // because all fields will be overwritten.
-        // FIXME: It may be worth creating an operation that calls a constructor on JSLexicalEnvironment that 
-        // doesn't initialize every slot because we are guaranteed to do that here.
-        LValue callResult = vmCall(
-            m_out.operation(operationCreateActivationDirect), m_callFrame, weakPointer(structure),
-            scope, weakPointer(table), m_out.constInt64(JSValue::encode(jsUndefined())));
-        ValueFromBlock slowResult =  m_out.anchor(callResult);
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
-        LValue activation = m_out.phi(m_out.intPtr, fastResult, slowResult);
-        RELEASE_ASSERT(data.m_properties.size() == table->scopeSize());
-        for (unsigned i = 0; i < data.m_properties.size(); ++i) {
-            m_out.store64(values[i],
-                activation,
-                m_heaps.JSEnvironmentRecord_variables[data.m_properties[i].m_identifierNumber]);
-        }
-
-        if (validationEnabled()) {
-            // Validate to make sure every slot in the scope has one value.
-            ConcurrentJITLocker locker(table->m_lock);
-            for (auto iter = table->begin(locker), end = table->end(locker); iter != end; ++iter) {
-                bool found = false;
-                for (unsigned i = 0; i < data.m_properties.size(); ++i) {
-                    if (iter->value.scopeOffset().offset() == data.m_properties[i].m_identifierNumber) {
-                        found = true;
-                        break;
-                    }
-                }
-                ASSERT_UNUSED(found, found);
-            }
-        }
-
-        setJSValue(activation);
-    }
-
-    bool isInlinableSize(LValue function)
-    {
-        size_t instructionCount = 0;
-        size_t maxSize = Options::maximumLLVMInstructionCountForNativeInlining();
-        for (LBasicBlock basicBlock = getFirstBasicBlock(function); basicBlock; basicBlock = getNextBasicBlock(basicBlock)) {
-            for (LValue instruction = getFirstInstruction(basicBlock); instruction; instruction = getNextInstruction(instruction)) {
-                if (++instructionCount >= maxSize)
-                    return false;
-            }
-        }
-        return true;
-    }
-
-    LValue didOverflowStack()
-    {
-        // This does a very simple leaf function analysis. The invariant of FTL call
-        // frames is that the caller had already done enough of a stack check to
-        // prove that this call frame has enough stack to run, and also enough stack
-        // to make runtime calls. So, we only need to stack check when making calls
-        // to other JS functions. If we don't find such calls then we don't need to
-        // do any stack checks.
-        
-        for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
-            BasicBlock* block = m_graph.block(blockIndex);
-            if (!block)
-                continue;
-            
-            for (unsigned nodeIndex = block->size(); nodeIndex--;) {
-                Node* node = block->at(nodeIndex);
-                
-                switch (node->op()) {
-                case GetById:
-                case PutById:
-                case Call:
-                case Construct:
-                    return m_out.below(
-                        m_callFrame,
-                        m_out.loadPtr(
-                            m_out.absolute(vm().addressOfFTLStackLimit())));
-                    
-                default:
-                    break;
-                }
-            }
-        }
-        
-        return m_out.booleanFalse;
-    }
-    
-    struct ArgumentsLength {
-        ArgumentsLength()
-            : isKnown(false)
-            , known(UINT_MAX)
-            , value(nullptr)
-        {
-        }
-        
-        bool isKnown;
-        unsigned known;
-        LValue value;
-    };
-    ArgumentsLength getArgumentsLength(InlineCallFrame* inlineCallFrame)
-    {
-        ArgumentsLength length;
-
-        if (inlineCallFrame && !inlineCallFrame->isVarargs()) {
-            length.known = inlineCallFrame->arguments.size() - 1;
-            length.isKnown = true;
-            length.value = m_out.constInt32(length.known);
-        } else {
-            length.known = UINT_MAX;
-            length.isKnown = false;
-            
-            VirtualRegister argumentCountRegister;
-            if (!inlineCallFrame)
-                argumentCountRegister = VirtualRegister(JSStack::ArgumentCount);
-            else
-                argumentCountRegister = inlineCallFrame->argumentCountRegister;
-            length.value = m_out.sub(m_out.load32(payloadFor(argumentCountRegister)), m_out.int32One);
-        }
-        
-        return length;
-    }
-    
-    ArgumentsLength getArgumentsLength()
-    {
-        return getArgumentsLength(m_node->origin.semantic.inlineCallFrame);
-    }
-    
-    LValue getCurrentCallee()
-    {
-        if (InlineCallFrame* frame = m_node->origin.semantic.inlineCallFrame) {
-            if (frame->isClosureCall)
-                return m_out.loadPtr(addressFor(frame->calleeRecovery.virtualRegister()));
-            return weakPointer(frame->calleeRecovery.constant().asCell());
-        }
-        return m_out.loadPtr(addressFor(JSStack::Callee));
-    }
-    
-    LValue getArgumentsStart(InlineCallFrame* inlineCallFrame)
-    {
-        VirtualRegister start = AssemblyHelpers::argumentsStart(inlineCallFrame);
-        return addressFor(start).value();
-    }
-    
-    LValue getArgumentsStart()
-    {
-        return getArgumentsStart(m_node->origin.semantic.inlineCallFrame);
-    }
-    
-    template<typename Functor>
-    void checkStructure(
-        LValue structureDiscriminant, const FormattedValue& formattedValue, ExitKind exitKind,
-        const StructureSet& set, const Functor& weakStructureDiscriminant)
-    {
-        if (set.size() == 1) {
-            speculate(
-                exitKind, formattedValue, 0,
-                m_out.notEqual(structureDiscriminant, weakStructureDiscriminant(set[0])));
-            return;
-        }
-        
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("checkStructure continuation"));
-        
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
-        for (unsigned i = 0; i < set.size() - 1; ++i) {
-            LBasicBlock nextStructure = FTL_NEW_BLOCK(m_out, ("checkStructure nextStructure"));
-            m_out.branch(
-                m_out.equal(structureDiscriminant, weakStructureDiscriminant(set[i])),
-                unsure(continuation), unsure(nextStructure));
-            m_out.appendTo(nextStructure);
-        }
-        
-        speculate(
-            exitKind, formattedValue, 0,
-            m_out.notEqual(structureDiscriminant, weakStructureDiscriminant(set.last())));
-        
-        m_out.jump(continuation);
-        m_out.appendTo(continuation, lastNext);
-    }
-    
-    LValue numberOrNotCellToInt32(Edge edge, LValue value)
-    {
-        LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 int case"));
-        LBasicBlock notIntCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 not int case"));
-        LBasicBlock doubleCase = 0;
-        LBasicBlock notNumberCase = 0;
-        if (edge.useKind() == NotCellUse) {
-            doubleCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 double case"));
-            notNumberCase = FTL_NEW_BLOCK(m_out, ("ValueToInt32 not number case"));
-        }
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ValueToInt32 continuation"));
-        
-        Vector<ValueFromBlock> results;
-        
-        m_out.branch(isNotInt32(value), unsure(notIntCase), unsure(intCase));
-        
-        LBasicBlock lastNext = m_out.appendTo(intCase, notIntCase);
-        results.append(m_out.anchor(unboxInt32(value)));
-        m_out.jump(continuation);
-        
-        if (edge.useKind() == NumberUse) {
-            m_out.appendTo(notIntCase, continuation);
-            FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isCellOrMisc(value));
-            results.append(m_out.anchor(doubleToInt32(unboxDouble(value))));
-            m_out.jump(continuation);
-        } else {
-            m_out.appendTo(notIntCase, doubleCase);
-            m_out.branch(
-                isCellOrMisc(value, provenType(edge)), unsure(notNumberCase), unsure(doubleCase));
-            
-            m_out.appendTo(doubleCase, notNumberCase);
-            results.append(m_out.anchor(doubleToInt32(unboxDouble(value))));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(notNumberCase, continuation);
-            
-            FTL_TYPE_CHECK(jsValueValue(value), edge, ~SpecCell, isCell(value));
-            
-            LValue specialResult = m_out.select(
-                m_out.equal(value, m_out.constInt64(JSValue::encode(jsBoolean(true)))),
-                m_out.int32One, m_out.int32Zero);
-            results.append(m_out.anchor(specialResult));
-            m_out.jump(continuation);
-        }
-        
-        m_out.appendTo(continuation, lastNext);
-        return m_out.phi(m_out.int32, results);
-    }
-    
-    LValue loadProperty(LValue storage, unsigned identifierNumber, PropertyOffset offset)
-    {
-        return m_out.load64(addressOfProperty(storage, identifierNumber, offset));
-    }
-    
-    void storeProperty(
-        LValue value, LValue storage, unsigned identifierNumber, PropertyOffset offset)
-    {
-        m_out.store64(value, addressOfProperty(storage, identifierNumber, offset));
-    }
-    
-    TypedPointer addressOfProperty(
-        LValue storage, unsigned identifierNumber, PropertyOffset offset)
-    {
-        return m_out.address(
-            m_heaps.properties[identifierNumber], storage, offsetRelativeToBase(offset));
-    }
-    
-    LValue storageForTransition(
-        LValue object, PropertyOffset offset,
-        Structure* previousStructure, Structure* nextStructure)
-    {
-        if (isInlineOffset(offset))
-            return object;
-        
-        if (previousStructure->outOfLineCapacity() == nextStructure->outOfLineCapacity())
-            return m_out.loadPtr(object, m_heaps.JSObject_butterfly);
-        
-        LValue result;
-        if (!previousStructure->outOfLineCapacity())
-            result = allocatePropertyStorage(object, previousStructure);
-        else {
-            result = reallocatePropertyStorage(
-                object, m_out.loadPtr(object, m_heaps.JSObject_butterfly),
-                previousStructure, nextStructure);
-        }
-        
-        emitStoreBarrier(object);
-        
-        return result;
-    }
-    
-    LValue allocatePropertyStorage(LValue object, Structure* previousStructure)
-    {
-        if (previousStructure->couldHaveIndexingHeader()) {
-            return vmCall(
-                m_out.operation(
-                    operationReallocateButterflyToHavePropertyStorageWithInitialCapacity),
-                m_callFrame, object);
-        }
-        
-        LValue result = allocatePropertyStorageWithSizeImpl(initialOutOfLineCapacity);
-        m_out.storePtr(result, object, m_heaps.JSObject_butterfly);
-        return result;
-    }
-    
-    LValue reallocatePropertyStorage(
-        LValue object, LValue oldStorage, Structure* previous, Structure* next)
-    {
-        size_t oldSize = previous->outOfLineCapacity();
-        size_t newSize = oldSize * outOfLineGrowthFactor; 
-
-        ASSERT_UNUSED(next, newSize == next->outOfLineCapacity());
-        
-        if (previous->couldHaveIndexingHeader()) {
-            LValue newAllocSize = m_out.constIntPtr(newSize);                    
-            return vmCall(m_out.operation(operationReallocateButterflyToGrowPropertyStorage), m_callFrame, object, newAllocSize);
-        }
-        
-        LValue result = allocatePropertyStorageWithSizeImpl(newSize);
-
-        ptrdiff_t headerSize = -sizeof(IndexingHeader) - sizeof(void*);
-        ptrdiff_t endStorage = headerSize - static_cast<ptrdiff_t>(oldSize * sizeof(JSValue));
-
-        for (ptrdiff_t offset = headerSize; offset > endStorage; offset -= sizeof(void*)) {
-            LValue loaded = 
-                m_out.loadPtr(m_out.address(m_heaps.properties.atAnyNumber(), oldStorage, offset));
-            m_out.storePtr(loaded, m_out.address(m_heaps.properties.atAnyNumber(), result, offset));
-        }
-        
-        m_out.storePtr(result, m_out.address(object, m_heaps.JSObject_butterfly));
-        
-        return result;
-    }
-    
-    LValue allocatePropertyStorageWithSizeImpl(size_t sizeInValues)
-    {
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("allocatePropertyStorageWithSizeImpl slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("allocatePropertyStorageWithSizeImpl continuation"));
-        
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-        
-        LValue endOfStorage = allocateBasicStorageAndGetEnd(
-            m_out.constIntPtr(sizeInValues * sizeof(JSValue)), slowPath);
-        
-        ValueFromBlock fastButterfly = m_out.anchor(
-            m_out.add(m_out.constIntPtr(sizeof(IndexingHeader)), endOfStorage));
-        
-        m_out.jump(continuation);
-        
-        m_out.appendTo(slowPath, continuation);
-        
-        LValue slowButterflyValue;
-        if (sizeInValues == initialOutOfLineCapacity) {
-            slowButterflyValue = vmCall(
-                m_out.operation(operationAllocatePropertyStorageWithInitialCapacity),
-                m_callFrame);
-        } else {
-            slowButterflyValue = vmCall(
-                m_out.operation(operationAllocatePropertyStorage),
-                m_callFrame, m_out.constIntPtr(sizeInValues));
-        }
-        ValueFromBlock slowButterfly = m_out.anchor(slowButterflyValue);
-        
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        
-        return m_out.phi(m_out.intPtr, fastButterfly, slowButterfly);
-    }
-    
-    LValue getById(LValue base)
-    {
-        auto uid = m_graph.identifiers()[m_node->identifierNumber()];
-
-        // Arguments: id, bytes, target, numArgs, args...
-        unsigned stackmapID = m_stackmapIDs++;
-        
-        if (Options::verboseCompilation())
-            dataLog("    Emitting GetById patchpoint with stackmap #", stackmapID, "\n");
-        
-        LValue call = m_out.call(
-            m_out.patchpointInt64Intrinsic(),
-            m_out.constInt64(stackmapID), m_out.constInt32(sizeOfGetById()),
-            constNull(m_out.ref8), m_out.constInt32(1), base);
-        setInstructionCallingConvention(call, LLVMAnyRegCallConv);
-        
-        m_ftlState.getByIds.append(GetByIdDescriptor(stackmapID, m_node->origin.semantic, uid));
-        
-        return call;
-    }
-    
-    TypedPointer baseIndex(IndexedAbstractHeap& heap, LValue storage, LValue index, Edge edge, ptrdiff_t offset = 0)
+    TypedPointer baseIndex(IndexedAbstractHeap& heap, LValue storage, LValue index, Edge edge)
     {
         return m_out.baseIndex(
-            heap, storage, m_out.zeroExtPtr(index), provenValue(edge), offset);
+            heap, storage, m_out.zeroExt(index, m_out.intPtr),
+            m_state.forNode(edge).m_value);
     }
     
     void compare(
@@ -5749,7 +2726,7 @@ private:
             return;
         }
         
-        if (m_node->isBinaryUseKind(Int52RepUse)) {
+        if (m_node->isBinaryUseKind(MachineIntUse)) {
             Int52Kind kind;
             LValue left = lowWhicheverInt52(m_node->child1(), kind);
             LValue right = lowInt52(m_node->child2(), kind);
@@ -5757,7 +2734,7 @@ private:
             return;
         }
         
-        if (m_node->isBinaryUseKind(DoubleRepUse)) {
+        if (m_node->isBinaryUseKind(NumberUse)) {
             LValue left = lowDouble(m_node->child1());
             LValue right = lowDouble(m_node->child2());
             setBoolean(m_out.fcmp(realCondition, left, right));
@@ -5769,52 +2746,7 @@ private:
             return;
         }
         
-        DFG_CRASH(m_graph, m_node, "Bad use kinds");
-    }
-    
-    void compareEqObjectOrOtherToObject(Edge leftChild, Edge rightChild)
-    {
-        LValue rightCell = lowCell(rightChild);
-        LValue leftValue = lowJSValue(leftChild, ManualOperandSpeculation);
-        
-        speculateTruthyObject(rightChild, rightCell, SpecObject);
-        
-        LBasicBlock leftCellCase = FTL_NEW_BLOCK(m_out, ("CompareEqObjectOrOtherToObject left cell case"));
-        LBasicBlock leftNotCellCase = FTL_NEW_BLOCK(m_out, ("CompareEqObjectOrOtherToObject left not cell case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CompareEqObjectOrOtherToObject continuation"));
-        
-        m_out.branch(
-            isCell(leftValue, provenType(leftChild)),
-            unsure(leftCellCase), unsure(leftNotCellCase));
-        
-        LBasicBlock lastNext = m_out.appendTo(leftCellCase, leftNotCellCase);
-        speculateTruthyObject(leftChild, leftValue, SpecObject | (~SpecCell));
-        ValueFromBlock cellResult = m_out.anchor(m_out.equal(rightCell, leftValue));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(leftNotCellCase, continuation);
-        FTL_TYPE_CHECK(
-            jsValueValue(leftValue), leftChild, SpecOther | SpecCell, isNotOther(leftValue));
-        ValueFromBlock notCellResult = m_out.anchor(m_out.booleanFalse);
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        setBoolean(m_out.phi(m_out.boolean, cellResult, notCellResult));
-    }
-    
-    void speculateTruthyObject(Edge edge, LValue cell, SpeculatedType filter)
-    {
-        if (masqueradesAsUndefinedWatchpointIsStillValid()) {
-            FTL_TYPE_CHECK(jsValueValue(cell), edge, filter, isNotObject(cell));
-            return;
-        }
-        
-        FTL_TYPE_CHECK(jsValueValue(cell), edge, filter, isNotObject(cell));
-        speculate(
-            BadType, jsValueValue(cell), edge.node(),
-            m_out.testNonZero8(
-                m_out.load8(cell, m_heaps.JSCell_typeInfoFlags),
-                m_out.constInt8(MasqueradesAsUndefined)));
+        RELEASE_ASSERT_NOT_REACHED();
     }
     
     void nonSpeculativeCompare(LIntPredicate intCondition, S_JITOperation_EJJ helperFunction)
@@ -5827,10 +2759,10 @@ private:
         LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("CompareEq untyped slow path"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("CompareEq untyped continuation"));
         
-        m_out.branch(isNotInt32(left), rarely(slowPath), usually(leftIsInt));
+        m_out.branch(isNotInt32(left), slowPath, leftIsInt);
         
         LBasicBlock lastNext = m_out.appendTo(leftIsInt, fastPath);
-        m_out.branch(isNotInt32(right), rarely(slowPath), usually(fastPath));
+        m_out.branch(isNotInt32(right), slowPath, fastPath);
         
         m_out.appendTo(fastPath, slowPath);
         ValueFromBlock fastResult = m_out.anchor(
@@ -5845,15 +2777,15 @@ private:
         m_out.appendTo(continuation, lastNext);
         setBoolean(m_out.phi(m_out.boolean, fastResult, slowResult));
     }
-
-    LValue allocateCell(LValue allocator, LBasicBlock slowPath)
+    
+    LValue allocateCell(LValue allocator, LValue structure, LBasicBlock slowPath)
     {
         LBasicBlock success = FTL_NEW_BLOCK(m_out, ("object allocation success"));
         
         LValue result = m_out.loadPtr(
             allocator, m_heaps.MarkedAllocator_freeListHead);
         
-        m_out.branch(m_out.notNull(result), usually(success), rarely(slowPath));
+        m_out.branch(m_out.notNull(result), success, slowPath);
         
         m_out.appendTo(success);
         
@@ -5861,26 +2793,13 @@ private:
             m_out.loadPtr(result, m_heaps.JSCell_freeListNext),
             allocator, m_heaps.MarkedAllocator_freeListHead);
         
+        m_out.storePtr(structure, result, m_heaps.JSCell_structure);
+        
         return result;
     }
     
-    void storeStructure(LValue object, Structure* structure)
-    {
-        m_out.store32(m_out.constInt32(structure->id()), object, m_heaps.JSCell_structureID);
-        m_out.store32(
-            m_out.constInt32(structure->objectInitializationBlob()),
-            object, m_heaps.JSCell_usefulBytes);
-    }
-
-    LValue allocateCell(LValue allocator, Structure* structure, LBasicBlock slowPath)
-    {
-        LValue result = allocateCell(allocator, slowPath);
-        storeStructure(result, structure);
-        return result;
-    }
-
     LValue allocateObject(
-        LValue allocator, Structure* structure, LValue butterfly, LBasicBlock slowPath)
+        LValue allocator, LValue structure, LValue butterfly, LBasicBlock slowPath)
     {
         LValue result = allocateCell(allocator, structure, slowPath);
         m_out.storePtr(butterfly, result, m_heaps.JSObject_butterfly);
@@ -5888,63 +2807,19 @@ private:
     }
     
     template<typename ClassType>
-    LValue allocateObject(
-        size_t size, Structure* structure, LValue butterfly, LBasicBlock slowPath)
-    {
-        MarkedAllocator* allocator = &vm().heap.allocatorForObjectOfType<ClassType>(size);
+    LValue allocateObject(LValue structure, LValue butterfly, LBasicBlock slowPath)
+    {
+        MarkedAllocator* allocator;
+        size_t size = ClassType::allocationSize(0);
+        if (ClassType::needsDestruction && ClassType::hasImmortalStructure)
+            allocator = &vm().heap.allocatorForObjectWithImmortalStructureDestructor(size);
+        else if (ClassType::needsDestruction)
+            allocator = &vm().heap.allocatorForObjectWithNormalDestructor(size);
+        else
+            allocator = &vm().heap.allocatorForObjectWithoutDestructor(size);
         return allocateObject(m_out.constIntPtr(allocator), structure, butterfly, slowPath);
     }
     
-    template<typename ClassType>
-    LValue allocateObject(Structure* structure, LValue butterfly, LBasicBlock slowPath)
-    {
-        return allocateObject<ClassType>(
-            ClassType::allocationSize(0), structure, butterfly, slowPath);
-    }
-    
-    template<typename ClassType>
-    LValue allocateVariableSizedObject(
-        LValue size, Structure* structure, LValue butterfly, LBasicBlock slowPath)
-    {
-        static_assert(!(MarkedSpace::preciseStep & (MarkedSpace::preciseStep - 1)), "MarkedSpace::preciseStep must be a power of two.");
-        static_assert(!(MarkedSpace::impreciseStep & (MarkedSpace::impreciseStep - 1)), "MarkedSpace::impreciseStep must be a power of two.");
-
-        LValue subspace = m_out.constIntPtr(&vm().heap.subspaceForObjectOfType<ClassType>());
-        
-        LBasicBlock smallCaseBlock = FTL_NEW_BLOCK(m_out, ("allocateVariableSizedObject small case"));
-        LBasicBlock largeOrOversizeCaseBlock = FTL_NEW_BLOCK(m_out, ("allocateVariableSizedObject large or oversize case"));
-        LBasicBlock largeCaseBlock = FTL_NEW_BLOCK(m_out, ("allocateVariableSizedObject large case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("allocateVariableSizedObject continuation"));
-        
-        LValue uproundedSize = m_out.add(size, m_out.constInt32(MarkedSpace::preciseStep - 1));
-        LValue isSmall = m_out.below(uproundedSize, m_out.constInt32(MarkedSpace::preciseCutoff));
-        m_out.branch(isSmall, unsure(smallCaseBlock), unsure(largeOrOversizeCaseBlock));
-        
-        LBasicBlock lastNext = m_out.appendTo(smallCaseBlock, largeOrOversizeCaseBlock);
-        TypedPointer address = m_out.baseIndex(
-            m_heaps.MarkedSpace_Subspace_preciseAllocators, subspace,
-            m_out.zeroExtPtr(m_out.lShr(uproundedSize, m_out.constInt32(getLSBSet(MarkedSpace::preciseStep)))));
-        ValueFromBlock smallAllocator = m_out.anchor(address.value());
-        m_out.jump(continuation);
-        
-        m_out.appendTo(largeOrOversizeCaseBlock, largeCaseBlock);
-        m_out.branch(
-            m_out.below(uproundedSize, m_out.constInt32(MarkedSpace::impreciseCutoff)),
-            usually(largeCaseBlock), rarely(slowPath));
-        
-        m_out.appendTo(largeCaseBlock, continuation);
-        address = m_out.baseIndex(
-            m_heaps.MarkedSpace_Subspace_impreciseAllocators, subspace,
-            m_out.zeroExtPtr(m_out.lShr(uproundedSize, m_out.constInt32(getLSBSet(MarkedSpace::impreciseStep)))));
-        ValueFromBlock largeAllocator = m_out.anchor(address.value());
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        LValue allocator = m_out.phi(m_out.intPtr, smallAllocator, largeAllocator);
-        
-        return allocateObject(allocator, structure, butterfly, slowPath);
-    }
-    
     // Returns a pointer to the end of the allocation.
     LValue allocateBasicStorageAndGetEnd(LValue size, LBasicBlock slowPath)
     {
@@ -5955,9 +2830,7 @@ private:
         LValue remaining = m_out.loadPtr(m_out.absolute(&allocator.m_currentRemaining));
         LValue newRemaining = m_out.sub(remaining, size);
         
-        m_out.branch(
-            m_out.lessThan(newRemaining, m_out.intPtrZero),
-            rarely(slowPath), usually(success));
+        m_out.branch(m_out.lessThan(newRemaining, m_out.intPtrZero), slowPath, success);
         
         m_out.appendTo(success);
         
@@ -5966,31 +2839,6 @@ private:
             m_out.loadPtr(m_out.absolute(&allocator.m_currentPayloadEnd)), newRemaining);
     }
     
-    LValue allocateObject(Structure* structure)
-    {
-        size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
-        MarkedAllocator* allocator = &vm().heap.allocatorForObjectWithoutDestructor(allocationSize);
-        
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("allocateObject slow path"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("allocateObject continuation"));
-        
-        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-        
-        ValueFromBlock fastResult = m_out.anchor(allocateObject(
-            m_out.constIntPtr(allocator), structure, m_out.intPtrZero, slowPath));
-        
-        m_out.jump(continuation);
-        
-        m_out.appendTo(slowPath, continuation);
-        
-        ValueFromBlock slowResult = m_out.anchor(vmCall(
-            m_out.operation(operationNewObject), m_callFrame, m_out.constIntPtr(structure)));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        return m_out.phi(m_out.intPtr, fastResult, slowResult);
-    }
-    
     struct ArrayValues {
         ArrayValues()
             : array(0)
@@ -6026,7 +2874,7 @@ private:
             endOfStorage, m_out.constIntPtr(sizeof(JSValue) * vectorLength));
         
         LValue object = allocateObject<JSArray>(
-            structure, butterfly, slowPath);
+            m_out.constIntPtr(structure), butterfly, slowPath);
         
         m_out.store32(m_out.constInt32(numElements), butterfly, m_heaps.Butterfly_publicLength);
         m_out.store32(m_out.constInt32(vectorLength), butterfly, m_heaps.Butterfly_vectorLength);
@@ -6034,7 +2882,7 @@ private:
         if (hasDouble(structure->indexingType())) {
             for (unsigned i = numElements; i < vectorLength; ++i) {
                 m_out.store64(
-                    m_out.constInt64(bitwise_cast<int64_t>(PNaN)),
+                    m_out.constInt64(bitwise_cast<int64_t>(QNaN)),
                     butterfly, m_heaps.indexedDoubleProperties[i]);
             }
         }
@@ -6072,15 +2920,26 @@ private:
             m_out.phi(m_out.intPtr, fastButterfly, slowButterfly));
     }
     
+    LValue typedArrayLength(Edge baseEdge, ArrayMode arrayMode, LValue base)
+    {
+        if (JSArrayBufferView* view = m_graph.tryGetFoldableView(baseEdge.node(), arrayMode))
+            return m_out.constInt32(view->length());
+        return m_out.load32(base, m_heaps.JSArrayBufferView_length);
+    }
+    
+    LValue typedArrayLength(Edge baseEdge, ArrayMode arrayMode)
+    {
+        return typedArrayLength(baseEdge, arrayMode, lowCell(baseEdge));
+    }
+    
     LValue boolify(Edge edge)
     {
         switch (edge.useKind()) {
         case BooleanUse:
-        case KnownBooleanUse:
-            return lowBoolean(edge);
+            return lowBoolean(m_node->child1());
         case Int32Use:
-            return m_out.notZero32(lowInt32(edge));
-        case DoubleRepUse:
+            return m_out.notZero32(lowInt32(m_node->child1()));
+        case NumberUse:
             return m_out.doubleNotEqual(lowDouble(edge), m_out.doubleZero);
         case ObjectOrOtherUse:
             return m_out.bitNot(
@@ -6088,111 +2947,33 @@ private:
                     edge, CellCaseSpeculatesObject, SpeculateNullOrUndefined,
                     ManualOperandSpeculation));
         case StringUse: {
-            LValue stringValue = lowString(edge);
-            LValue length = m_out.load32NonNegative(stringValue, m_heaps.JSString_length);
+            LValue stringValue = lowString(m_node->child1());
+            LValue length = m_out.load32(stringValue, m_heaps.JSString_length);
             return m_out.notEqual(length, m_out.int32Zero);
         }
         case UntypedUse: {
-            LValue value = lowJSValue(edge);
-            
-            // Implements the following control flow structure:
-            // if (value is cell) {
-            //     if (value is string)
-            //         result = !!value->length
-            //     else {
-            //         do evil things for masquerades-as-undefined
-            //         result = true
-            //     }
-            // } else if (value is int32) {
-            //     result = !!unboxInt32(value)
-            // } else if (value is number) {
-            //     result = !!unboxDouble(value)
-            // } else {
-            //     result = value == jsTrue
-            // }
-            
-            LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped cell case"));
-            LBasicBlock stringCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped string case"));
-            LBasicBlock notStringCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped not string case"));
-            LBasicBlock notCellCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped not cell case"));
-            LBasicBlock int32Case = FTL_NEW_BLOCK(m_out, ("Boolify untyped int32 case"));
-            LBasicBlock notInt32Case = FTL_NEW_BLOCK(m_out, ("Boolify untyped not int32 case"));
-            LBasicBlock doubleCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped double case"));
-            LBasicBlock notDoubleCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped not double case"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Boolify untyped continuation"));
-            
-            Vector<ValueFromBlock> results;
-            
-            m_out.branch(isCell(value, provenType(edge)), unsure(cellCase), unsure(notCellCase));
-            
-            LBasicBlock lastNext = m_out.appendTo(cellCase, stringCase);
-            m_out.branch(
-                isString(value, provenType(edge) & SpecCell),
-                unsure(stringCase), unsure(notStringCase));
-            
-            m_out.appendTo(stringCase, notStringCase);
-            LValue nonEmptyString = m_out.notZero32(
-                m_out.load32NonNegative(value, m_heaps.JSString_length));
-            results.append(m_out.anchor(nonEmptyString));
-            m_out.jump(continuation);
-            
-            m_out.appendTo(notStringCase, notCellCase);
-            LValue isTruthyObject;
-            if (masqueradesAsUndefinedWatchpointIsStillValid())
-                isTruthyObject = m_out.booleanTrue;
-            else {
-                LBasicBlock masqueradesCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped masquerades case"));
-                
-                results.append(m_out.anchor(m_out.booleanTrue));
-                
-                m_out.branch(
-                    m_out.testIsZero8(
-                        m_out.load8(value, m_heaps.JSCell_typeInfoFlags),
-                        m_out.constInt8(MasqueradesAsUndefined)),
-                    usually(continuation), rarely(masqueradesCase));
-                
-                m_out.appendTo(masqueradesCase);
-                
-                isTruthyObject = m_out.notEqual(
-                    m_out.constIntPtr(m_graph.globalObjectFor(m_node->origin.semantic)),
-                    m_out.loadPtr(loadStructure(value), m_heaps.Structure_globalObject));
-            }
-            results.append(m_out.anchor(isTruthyObject));
-            m_out.jump(continuation);
+            LValue value = lowJSValue(m_node->child1());
             
-            m_out.appendTo(notCellCase, int32Case);
-            m_out.branch(
-                isInt32(value, provenType(edge) & ~SpecCell),
-                unsure(int32Case), unsure(notInt32Case));
+            LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped slow case"));
+            LBasicBlock fastCase = FTL_NEW_BLOCK(m_out, ("Boolify untyped fast case"));
+            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Boolify untyped continuation"));
             
-            m_out.appendTo(int32Case, notInt32Case);
-            results.append(m_out.anchor(m_out.notZero32(unboxInt32(value))));
-            m_out.jump(continuation);
+            m_out.branch(isNotBoolean(value), slowCase, fastCase);
             
-            m_out.appendTo(notInt32Case, doubleCase);
-            m_out.branch(
-                isNumber(value, provenType(edge) & ~SpecCell),
-                unsure(doubleCase), unsure(notDoubleCase));
-            
-            m_out.appendTo(doubleCase, notDoubleCase);
-            // Note that doubleNotEqual() really means not-equal-and-ordered. It will return false
-            // if value is NaN.
-            LValue doubleIsTruthy = m_out.doubleNotEqual(
-                unboxDouble(value), m_out.constDouble(0));
-            results.append(m_out.anchor(doubleIsTruthy));
+            LBasicBlock lastNext = m_out.appendTo(fastCase, slowCase);
+            ValueFromBlock fastResult = m_out.anchor(unboxBoolean(value));
             m_out.jump(continuation);
             
-            m_out.appendTo(notDoubleCase, continuation);
-            LValue miscIsTruthy = m_out.equal(
-                value, m_out.constInt64(JSValue::encode(jsBoolean(true))));
-            results.append(m_out.anchor(miscIsTruthy));
+            m_out.appendTo(slowCase, continuation);
+            ValueFromBlock slowResult = m_out.anchor(m_out.notNull(vmCall(
+                m_out.operation(operationConvertJSValueToBoolean), m_callFrame, value)));
             m_out.jump(continuation);
             
             m_out.appendTo(continuation, lastNext);
-            return m_out.phi(m_out.boolean, results);
+            return m_out.phi(m_out.boolean, fastResult, slowResult);
         }
         default:
-            DFG_CRASH(m_graph, m_node, "Bad use kind");
+            RELEASE_ASSERT_NOT_REACHED();
             return 0;
         }
     }
@@ -6219,7 +3000,7 @@ private:
         LBasicBlock primitiveCase = FTL_NEW_BLOCK(m_out, ("EqualNullOrUndefined primitive case"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("EqualNullOrUndefined continuation"));
         
-        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
+        m_out.branch(isNotCell(value), primitiveCase, cellCase);
         
         LBasicBlock lastNext = m_out.appendTo(cellCase, primitiveCase);
         
@@ -6230,7 +3011,10 @@ private:
             break;
         case CellCaseSpeculatesObject:
             FTL_TYPE_CHECK(
-                jsValueValue(value), edge, (~SpecCell) | SpecObject, isNotObject(value));
+                jsValueValue(value), edge, (~SpecCell) | SpecObject,
+                m_out.equal(
+                    m_out.loadPtr(value, m_heaps.JSCell_structure),
+                    m_out.constIntPtr(vm().stringStructure.get())));
             break;
         }
         
@@ -6241,21 +3025,21 @@ private:
             LBasicBlock masqueradesCase =
                 FTL_NEW_BLOCK(m_out, ("EqualNullOrUndefined masquerades case"));
                 
+            LValue structure = m_out.loadPtr(value, m_heaps.JSCell_structure);
+            
             results.append(m_out.anchor(m_out.booleanFalse));
             
             m_out.branch(
                 m_out.testNonZero8(
-                    m_out.load8(value, m_heaps.JSCell_typeInfoFlags),
+                    m_out.load8(structure, m_heaps.Structure_typeInfoFlags),
                     m_out.constInt8(MasqueradesAsUndefined)),
-                rarely(masqueradesCase), usually(continuation));
+                masqueradesCase, continuation);
             
             m_out.appendTo(masqueradesCase, primitiveCase);
             
-            LValue structure = loadStructure(value);
-            
             results.append(m_out.anchor(
                 m_out.equal(
-                    m_out.constIntPtr(m_graph.globalObjectFor(m_node->origin.semantic)),
+                    m_out.constIntPtr(m_graph.globalObjectFor(m_node->codeOrigin)),
                     m_out.loadPtr(structure, m_heaps.Structure_globalObject))));
             m_out.jump(continuation);
         }
@@ -6271,11 +3055,16 @@ private:
             primitiveResult = m_out.equal(value, m_out.constInt64(ValueUndefined));
             break;
         case EqualNullOrUndefined:
-            primitiveResult = isOther(value, provenType(edge));
+            primitiveResult = m_out.equal(
+                m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
+                m_out.constInt64(ValueNull));
             break;
         case SpeculateNullOrUndefined:
             FTL_TYPE_CHECK(
-                jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+                jsValueValue(value), edge, SpecCell | SpecOther,
+                m_out.notEqual(
+                    m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
+                    m_out.constInt64(ValueNull)));
             primitiveResult = m_out.booleanTrue;
             break;
         }
@@ -6293,19 +3082,19 @@ private:
         LBasicBlock continuation)
     {
         LValue isNotInBounds = m_out.aboveOrEqual(
-            index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength));
+            index, m_out.load32(storage, m_heaps.Butterfly_publicLength));
         if (!m_node->arrayMode().isInBounds()) {
             LBasicBlock notInBoundsCase =
                 FTL_NEW_BLOCK(m_out, ("PutByVal not in bounds"));
             LBasicBlock performStore =
                 FTL_NEW_BLOCK(m_out, ("PutByVal perform store"));
                 
-            m_out.branch(isNotInBounds, unsure(notInBoundsCase), unsure(performStore));
+            m_out.branch(isNotInBounds, notInBoundsCase, performStore);
                 
             LBasicBlock lastNext = m_out.appendTo(notInBoundsCase, performStore);
                 
             LValue isOutOfBounds = m_out.aboveOrEqual(
-                index, m_out.load32NonNegative(storage, m_heaps.Butterfly_vectorLength));
+                index, m_out.load32(storage, m_heaps.Butterfly_vectorLength));
                 
             if (!m_node->arrayMode().isOutOfBounds())
                 speculate(OutOfBounds, noValue(), 0, isOutOfBounds);
@@ -6315,7 +3104,7 @@ private:
                 LBasicBlock holeCase =
                     FTL_NEW_BLOCK(m_out, ("PutByVal hole case"));
                     
-                m_out.branch(isOutOfBounds, unsure(outOfBoundsCase), unsure(holeCase));
+                m_out.branch(isOutOfBounds, outOfBoundsCase, holeCase);
                     
                 LBasicBlock innerLastNext = m_out.appendTo(outOfBoundsCase, holeCase);
                     
@@ -6342,445 +3131,18 @@ private:
         Vector<SwitchCase> cases;
         for (unsigned i = 0; i < data->cases.size(); ++i) {
             cases.append(SwitchCase(
-                constInt(type, data->cases[i].value.switchLookupValue(data->kind)),
-                lowBlock(data->cases[i].target.block), Weight(data->cases[i].target.count)));
-        }
-        
-        m_out.switchInstruction(
-            switchValue, cases,
-            lowBlock(data->fallThrough.block), Weight(data->fallThrough.count));
-    }
-    
-    void switchString(SwitchData* data, LValue string)
-    {
-        bool canDoBinarySwitch = true;
-        unsigned totalLength = 0;
-        
-        for (DFG::SwitchCase myCase : data->cases) {
-            StringImpl* string = myCase.value.stringImpl();
-            if (!string->is8Bit()) {
-                canDoBinarySwitch = false;
-                break;
-            }
-            if (string->length() > Options::maximumBinaryStringSwitchCaseLength()) {
-                canDoBinarySwitch = false;
-                break;
-            }
-            totalLength += string->length();
-        }
-        
-        if (!canDoBinarySwitch || totalLength > Options::maximumBinaryStringSwitchTotalLength()) {
-            switchStringSlow(data, string);
-            return;
-        }
-        
-        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
-        LValue length = m_out.load32(string, m_heaps.JSString_length);
-        
-        LBasicBlock hasImplBlock = FTL_NEW_BLOCK(m_out, ("Switch/SwitchString has impl case"));
-        LBasicBlock is8BitBlock = FTL_NEW_BLOCK(m_out, ("Switch/SwitchString is 8 bit case"));
-        LBasicBlock slowBlock = FTL_NEW_BLOCK(m_out, ("Switch/SwitchString slow case"));
-        
-        m_out.branch(m_out.isNull(stringImpl), unsure(slowBlock), unsure(hasImplBlock));
-        
-        LBasicBlock lastNext = m_out.appendTo(hasImplBlock, is8BitBlock);
-        
-        m_out.branch(
-            m_out.testIsZero32(
-                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
-                m_out.constInt32(StringImpl::flagIs8Bit())),
-            unsure(slowBlock), unsure(is8BitBlock));
-        
-        m_out.appendTo(is8BitBlock, slowBlock);
-        
-        LValue buffer = m_out.loadPtr(stringImpl, m_heaps.StringImpl_data);
-        
-        // FIXME: We should propagate branch weight data to the cases of this switch.
-        // https://bugs.webkit.org/show_bug.cgi?id=144368
-        
-        Vector<StringSwitchCase> cases;
-        for (DFG::SwitchCase myCase : data->cases)
-            cases.append(StringSwitchCase(myCase.value.stringImpl(), lowBlock(myCase.target.block)));
-        std::sort(cases.begin(), cases.end());
-        switchStringRecurse(data, buffer, length, cases, 0, 0, cases.size(), 0, false);
-
-        m_out.appendTo(slowBlock, lastNext);
-        switchStringSlow(data, string);
-    }
-    
-    // The code for string switching is based closely on the same code in the DFG backend. While it
-    // would be nice to reduce the amount of similar-looking code, it seems like this is one of
-    // those algorithms where factoring out the common bits would result in more code than just
-    // duplicating.
-    
-    struct StringSwitchCase {
-        StringSwitchCase() { }
-        
-        StringSwitchCase(StringImpl* string, LBasicBlock target)
-            : string(string)
-            , target(target)
-        {
-        }
-
-        bool operator<(const StringSwitchCase& other) const
-        {
-            return stringLessThan(*string, *other.string);
-        }
-        
-        StringImpl* string;
-        LBasicBlock target;
-    };
-    
-    struct CharacterCase {
-        CharacterCase()
-            : character(0)
-            , begin(0)
-            , end(0)
-        {
-        }
-        
-        CharacterCase(LChar character, unsigned begin, unsigned end)
-            : character(character)
-            , begin(begin)
-            , end(end)
-        {
-        }
-        
-        bool operator<(const CharacterCase& other) const
-        {
-            return character < other.character;
-        }
-        
-        LChar character;
-        unsigned begin;
-        unsigned end;
-    };
-    
-    void switchStringRecurse(
-        SwitchData* data, LValue buffer, LValue length, const Vector<StringSwitchCase>& cases,
-        unsigned numChecked, unsigned begin, unsigned end, unsigned alreadyCheckedLength,
-        unsigned checkedExactLength)
-    {
-        LBasicBlock fallThrough = lowBlock(data->fallThrough.block);
-        
-        if (begin == end) {
-            m_out.jump(fallThrough);
-            return;
-        }
-        
-        unsigned minLength = cases[begin].string->length();
-        unsigned commonChars = minLength;
-        bool allLengthsEqual = true;
-        for (unsigned i = begin + 1; i < end; ++i) {
-            unsigned myCommonChars = numChecked;
-            unsigned limit = std::min(cases[begin].string->length(), cases[i].string->length());
-            for (unsigned j = numChecked; j < limit; ++j) {
-                if (cases[begin].string->at(j) != cases[i].string->at(j))
-                    break;
-                myCommonChars++;
-            }
-            commonChars = std::min(commonChars, myCommonChars);
-            if (minLength != cases[i].string->length())
-                allLengthsEqual = false;
-            minLength = std::min(minLength, cases[i].string->length());
-        }
-        
-        if (checkedExactLength) {
-            DFG_ASSERT(m_graph, m_node, alreadyCheckedLength == minLength);
-            DFG_ASSERT(m_graph, m_node, allLengthsEqual);
-        }
-        
-        DFG_ASSERT(m_graph, m_node, minLength >= commonChars);
-        
-        if (!allLengthsEqual && alreadyCheckedLength < minLength)
-            m_out.check(m_out.below(length, m_out.constInt32(minLength)), unsure(fallThrough));
-        if (allLengthsEqual && (alreadyCheckedLength < minLength || !checkedExactLength))
-            m_out.check(m_out.notEqual(length, m_out.constInt32(minLength)), unsure(fallThrough));
-        
-        for (unsigned i = numChecked; i < commonChars; ++i) {
-            m_out.check(
-                m_out.notEqual(
-                    m_out.load8(buffer, m_heaps.characters8[i]),
-                    m_out.constInt8(cases[begin].string->at(i))),
-                unsure(fallThrough));
-        }
-        
-        if (minLength == commonChars) {
-            // This is the case where one of the cases is a prefix of all of the other cases.
-            // We've already checked that the input string is a prefix of all of the cases,
-            // so we just check length to jump to that case.
-            
-            DFG_ASSERT(m_graph, m_node, cases[begin].string->length() == commonChars);
-            for (unsigned i = begin + 1; i < end; ++i)
-                DFG_ASSERT(m_graph, m_node, cases[i].string->length() > commonChars);
-            
-            if (allLengthsEqual) {
-                DFG_ASSERT(m_graph, m_node, end == begin + 1);
-                m_out.jump(cases[begin].target);
-                return;
-            }
-            
-            m_out.check(
-                m_out.equal(length, m_out.constInt32(commonChars)),
-                unsure(cases[begin].target));
-            
-            // We've checked if the length is >= minLength, and then we checked if the length is
-            // == commonChars. We get to this point if it is >= minLength but not == commonChars.
-            // Hence we know that it now must be > minLength, i.e. that it's >= minLength + 1.
-            switchStringRecurse(
-                data, buffer, length, cases, commonChars, begin + 1, end, minLength + 1, false);
-            return;
-        }
-        
-        // At this point we know that the string is longer than commonChars, and we've only verified
-        // commonChars. Use a binary switch on the next unchecked character, i.e.
-        // string[commonChars].
-        
-        DFG_ASSERT(m_graph, m_node, end >= begin + 2);
-        
-        LValue uncheckedChar = m_out.load8(buffer, m_heaps.characters8[commonChars]);
-        
-        Vector<CharacterCase> characterCases;
-        CharacterCase currentCase(cases[begin].string->at(commonChars), begin, begin + 1);
-        for (unsigned i = begin + 1; i < end; ++i) {
-            LChar currentChar = cases[i].string->at(commonChars);
-            if (currentChar != currentCase.character) {
-                currentCase.end = i;
-                characterCases.append(currentCase);
-                currentCase = CharacterCase(currentChar, i, i + 1);
-            } else
-                currentCase.end = i + 1;
-        }
-        characterCases.append(currentCase);
-        
-        Vector<LBasicBlock> characterBlocks;
-        for (CharacterCase& myCase : characterCases)
-            characterBlocks.append(FTL_NEW_BLOCK(m_out, ("Switch/SwitchString case for ", myCase.character, " at index ", commonChars)));
-        
-        Vector<SwitchCase> switchCases;
-        for (unsigned i = 0; i < characterCases.size(); ++i) {
-            if (i)
-                DFG_ASSERT(m_graph, m_node, characterCases[i - 1].character < characterCases[i].character);
-            switchCases.append(SwitchCase(
-                m_out.constInt8(characterCases[i].character), characterBlocks[i], Weight()));
-        }
-        m_out.switchInstruction(uncheckedChar, switchCases, fallThrough, Weight());
-        
-        LBasicBlock lastNext = m_out.m_nextBlock;
-        characterBlocks.append(lastNext); // Makes it convenient to set nextBlock.
-        for (unsigned i = 0; i < characterCases.size(); ++i) {
-            m_out.appendTo(characterBlocks[i], characterBlocks[i + 1]);
-            switchStringRecurse(
-                data, buffer, length, cases, commonChars + 1,
-                characterCases[i].begin, characterCases[i].end, minLength, allLengthsEqual);
-        }
-        
-        DFG_ASSERT(m_graph, m_node, m_out.m_nextBlock == lastNext);
-    }
-    
-    void switchStringSlow(SwitchData* data, LValue string)
-    {
-        // FIXME: We ought to be able to use computed gotos here. We would save the labels of the
-        // blocks we want to jump to, and then request their addresses after compilation completes.
-        // https://bugs.webkit.org/show_bug.cgi?id=144369
-        
-        LValue branchOffset = vmCall(
-            m_out.operation(operationSwitchStringAndGetBranchOffset),
-            m_callFrame, m_out.constIntPtr(data->switchTableIndex), string);
-        
-        StringJumpTable& table = codeBlock()->stringSwitchJumpTable(data->switchTableIndex);
-        
-        Vector<SwitchCase> cases;
-        std::unordered_set<int32_t> alreadyHandled; // These may be negative, or zero, or probably other stuff, too. We don't want to mess with HashSet's corner cases and we don't really care about throughput here.
-        for (unsigned i = 0; i < data->cases.size(); ++i) {
-            // FIXME: The fact that we're using the bytecode's switch table means that the
-            // following DFG IR transformation would be invalid.
-            //
-            // Original code:
-            //     switch (v) {
-            //     case "foo":
-            //     case "bar":
-            //         things();
-            //         break;
-            //     default:
-            //         break;
-            //     }
-            //
-            // New code:
-            //     switch (v) {
-            //     case "foo":
-            //         instrumentFoo();
-            //         goto _things;
-            //     case "bar":
-            //         instrumentBar();
-            //     _things:
-            //         things();
-            //         break;
-            //     default:
-            //         break;
-            //     }
-            //
-            // Luckily, we don't currently do any such transformation. But it's kind of silly that
-            // this is an issue.
-            // https://bugs.webkit.org/show_bug.cgi?id=144635
-            
-            DFG::SwitchCase myCase = data->cases[i];
-            StringJumpTable::StringOffsetTable::iterator iter =
-                table.offsetTable.find(myCase.value.stringImpl());
-            DFG_ASSERT(m_graph, m_node, iter != table.offsetTable.end());
-            
-            if (!alreadyHandled.insert(iter->value.branchOffset).second)
-                continue;
-
-            cases.append(SwitchCase(
-                m_out.constInt32(iter->value.branchOffset),
-                lowBlock(myCase.target.block), Weight(myCase.target.count)));
+                constInt(type, data->cases[i].value.switchLookupValue()),
+                lowBlock(data->cases[i].target)));
         }
         
-        m_out.switchInstruction(
-            branchOffset, cases, lowBlock(data->fallThrough.block),
-            Weight(data->fallThrough.count));
-    }
-    
-    // Calls the functor at the point of code generation where we know what the result type is.
-    // You can emit whatever code you like at that point. Expects you to terminate the basic block.
-    // When buildTypeOf() returns, it will have terminated all basic blocks that it created. So, if
-    // you aren't using this as the terminator of a high-level block, you should create your own
-    // contination and set it as the nextBlock (m_out.insertNewBlocksBefore(continuation)) before
-    // calling this. For example:
-    //
-    // LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("My continuation"));
-    // LBasicBlock lastNext = m_out.insertNewBlocksBefore(continuation);
-    // buildTypeOf(
-    //     child, value,
-    //     [&] (TypeofType type) {
-    //          do things;
-    //          m_out.jump(continuation);
-    //     });
-    // m_out.appendTo(continuation, lastNext);
-    template<typename Functor>
-    void buildTypeOf(Edge child, LValue value, const Functor& functor)
-    {
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
-        
-        // Implements the following branching structure:
-        //
-        // if (is cell) {
-        //     if (is object) {
-        //         if (is function) {
-        //             return function;
-        //         } else if (doesn't have call trap and doesn't masquerade as undefined) {
-        //             return object
-        //         } else {
-        //             return slowPath();
-        //         }
-        //     } else if (is string) {
-        //         return string
-        //     } else {
-        //         return symbol
-        //     }
-        // } else if (is number) {
-        //     return number
-        // } else if (is null) {
-        //     return object
-        // } else if (is boolean) {
-        //     return boolean
-        // } else {
-        //     return undefined
-        // }
-        
-        LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf cell case"));
-        LBasicBlock objectCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf object case"));
-        LBasicBlock functionCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf function case"));
-        LBasicBlock notFunctionCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf not function case"));
-        LBasicBlock reallyObjectCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf really object case"));
-        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("buildTypeOf slow path"));
-        LBasicBlock unreachable = FTL_NEW_BLOCK(m_out, ("buildTypeOf unreachable"));
-        LBasicBlock notObjectCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf not object case"));
-        LBasicBlock stringCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf string case"));
-        LBasicBlock symbolCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf symbol case"));
-        LBasicBlock notCellCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf not cell case"));
-        LBasicBlock numberCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf number case"));
-        LBasicBlock notNumberCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf not number case"));
-        LBasicBlock notNullCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf not null case"));
-        LBasicBlock booleanCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf boolean case"));
-        LBasicBlock undefinedCase = FTL_NEW_BLOCK(m_out, ("buildTypeOf undefined case"));
-        
-        m_out.branch(isCell(value, provenType(child)), unsure(cellCase), unsure(notCellCase));
-        
-        LBasicBlock lastNext = m_out.appendTo(cellCase, objectCase);
-        m_out.branch(isObject(value, provenType(child)), unsure(objectCase), unsure(notObjectCase));
-        
-        m_out.appendTo(objectCase, functionCase);
-        m_out.branch(
-            isFunction(value, provenType(child) & SpecObject),
-            unsure(functionCase), unsure(notFunctionCase));
-        
-        m_out.appendTo(functionCase, notFunctionCase);
-        functor(TypeofType::Function);
-        
-        m_out.appendTo(notFunctionCase, reallyObjectCase);
-        m_out.branch(
-            isExoticForTypeof(value, provenType(child) & (SpecObject - SpecFunction)),
-            rarely(slowPath), usually(reallyObjectCase));
-        
-        m_out.appendTo(reallyObjectCase, slowPath);
-        functor(TypeofType::Object);
-        
-        m_out.appendTo(slowPath, unreachable);
-        LValue result = vmCall(
-            m_out.operation(operationTypeOfObjectAsTypeofType), m_callFrame,
-            weakPointer(globalObject), value);
-        Vector<SwitchCase, 3> cases;
-        cases.append(SwitchCase(m_out.constInt32(static_cast<int32_t>(TypeofType::Undefined)), undefinedCase));
-        cases.append(SwitchCase(m_out.constInt32(static_cast<int32_t>(TypeofType::Object)), reallyObjectCase));
-        cases.append(SwitchCase(m_out.constInt32(static_cast<int32_t>(TypeofType::Function)), functionCase));
-        m_out.switchInstruction(result, cases, unreachable, Weight());
-        
-        m_out.appendTo(unreachable, notObjectCase);
-        m_out.unreachable();
-        
-        m_out.appendTo(notObjectCase, stringCase);
-        m_out.branch(
-            isString(value, provenType(child) & (SpecCell - SpecObject)),
-            unsure(stringCase), unsure(symbolCase));
-        
-        m_out.appendTo(stringCase, symbolCase);
-        functor(TypeofType::String);
-        
-        m_out.appendTo(symbolCase, notCellCase);
-        functor(TypeofType::Symbol);
-        
-        m_out.appendTo(notCellCase, numberCase);
-        m_out.branch(
-            isNumber(value, provenType(child) & ~SpecCell),
-            unsure(numberCase), unsure(notNumberCase));
-        
-        m_out.appendTo(numberCase, notNumberCase);
-        functor(TypeofType::Number);
-        
-        m_out.appendTo(notNumberCase, notNullCase);
-        LValue isNull;
-        if (provenType(child) & SpecOther)
-            isNull = m_out.equal(value, m_out.constInt64(ValueNull));
-        else
-            isNull = m_out.booleanFalse;
-        m_out.branch(isNull, unsure(reallyObjectCase), unsure(notNullCase));
-        
-        m_out.appendTo(notNullCase, booleanCase);
-        m_out.branch(
-            isBoolean(value, provenType(child) & ~(SpecCell | SpecFullNumber)),
-            unsure(booleanCase), unsure(undefinedCase));
-        
-        m_out.appendTo(booleanCase, undefinedCase);
-        functor(TypeofType::Boolean);
-        
-        m_out.appendTo(undefinedCase, lastNext);
-        functor(TypeofType::Undefined);
+        m_out.switchInstruction(switchValue, cases, lowBlock(data->fallThrough));
     }
     
     LValue doubleToInt32(LValue doubleValue, double low, double high, bool isSigned = true)
     {
+        // FIXME: Optimize double-to-int conversions.
+        // <rdar://problem/14938465>
+        
         LBasicBlock greatEnough = FTL_NEW_BLOCK(m_out, ("doubleToInt32 greatEnough"));
         LBasicBlock withinRange = FTL_NEW_BLOCK(m_out, ("doubleToInt32 withinRange"));
         LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("doubleToInt32 slowPath"));
@@ -6790,12 +3152,12 @@ private:
         
         m_out.branch(
             m_out.doubleGreaterThanOrEqual(doubleValue, m_out.constDouble(low)),
-            unsure(greatEnough), unsure(slowPath));
+            greatEnough, slowPath);
         
         LBasicBlock lastNext = m_out.appendTo(greatEnough, withinRange);
         m_out.branch(
             m_out.doubleLessThanOrEqual(doubleValue, m_out.constDouble(high)),
-            unsure(withinRange), unsure(slowPath));
+            withinRange, slowPath);
         
         m_out.appendTo(withinRange, slowPath);
         LValue fastResult;
@@ -6832,7 +3194,7 @@ private:
             m_out.sensibleDoubleToInt(doubleValue));
         m_out.branch(
             m_out.equal(fastResult.value(), m_out.constInt32(0x80000000)),
-            rarely(slowPath), usually(continuation));
+            slowPath, continuation);
         
         LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
         ValueFromBlock slowResult = m_out.anchor(
@@ -6851,13 +3213,7 @@ private:
     
     void terminate(ExitKind kind)
     {
-        speculate(kind, noValue(), nullptr, m_out.booleanTrue);
-        didAlreadyTerminate();
-    }
-    
-    void didAlreadyTerminate()
-    {
-        m_state.setIsValid(false);
+        speculate(kind, noValue(), 0, m_out.booleanTrue);
     }
     
     void typeCheck(
@@ -6883,7 +3239,7 @@ private:
         ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || (edge.useKind() == Int32Use || edge.useKind() == KnownInt32Use));
         
         if (edge->hasConstant()) {
-            JSValue value = edge->asJSValue();
+            JSValue value = m_graph.valueOfJSConstant(edge.node());
             if (!value.isInt32()) {
                 terminate(Uncountable);
                 return m_out.int32Zero;
@@ -6913,15 +3269,27 @@ private:
             return result;
         }
 
-        DFG_ASSERT(m_graph, m_node, !(provenType(edge) & SpecInt32));
+        RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecInt32));
         terminate(Uncountable);
         return m_out.int32Zero;
     }
     
     enum Int52Kind { StrictInt52, Int52 };
-    LValue lowInt52(Edge edge, Int52Kind kind)
+    LValue lowInt52(Edge edge, Int52Kind kind, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        DFG_ASSERT(m_graph, m_node, edge.useKind() == Int52RepUse);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == MachineIntUse);
+        
+        if (edge->hasConstant()) {
+            JSValue value = m_graph.valueOfJSConstant(edge.node());
+            if (!value.isMachineInt()) {
+                terminate(Uncountable);
+                return m_out.int64Zero;
+            }
+            int64_t result = value.asMachineInt();
+            if (kind == Int52)
+                result <<= JSValue::int52ShiftAmount;
+            return m_out.constInt64(result);
+        }
         
         LoweredNodeValue value;
         
@@ -6946,20 +3314,37 @@ private:
                 return int52ToStrictInt52(value.value());
             break;
         }
-
-        DFG_ASSERT(m_graph, m_node, !provenType(edge));
+        
+        value = m_int32Values.get(edge.node());
+        if (isValid(value)) {
+            return setInt52WithStrictValue(
+                edge.node(), m_out.signExt(value.value(), m_out.int64), kind);
+        }
+        
+        RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecInt52));
+        
+        value = m_jsValueValues.get(edge.node());
+        if (isValid(value)) {
+            LValue boxedResult = value.value();
+            FTL_TYPE_CHECK(
+                jsValueValue(boxedResult), edge, SpecMachineInt, isNotInt32(boxedResult));
+            return setInt52WithStrictValue(
+                edge.node(), m_out.signExt(unboxInt32(boxedResult), m_out.int64), kind);
+        }
+        
+        RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecMachineInt));
         terminate(Uncountable);
         return m_out.int64Zero;
     }
     
-    LValue lowInt52(Edge edge)
+    LValue lowInt52(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        return lowInt52(edge, Int52);
+        return lowInt52(edge, Int52, mode);
     }
     
-    LValue lowStrictInt52(Edge edge)
+    LValue lowStrictInt52(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        return lowInt52(edge, StrictInt52);
+        return lowInt52(edge, StrictInt52, mode);
     }
     
     bool betterUseStrictInt52(Node* node)
@@ -6983,22 +3368,21 @@ private:
         case StrictInt52:
             return Int52;
         }
-        DFG_CRASH(m_graph, m_node, "Bad use kind");
-        return Int52;
+        RELEASE_ASSERT_NOT_REACHED();
     }
     
-    LValue lowWhicheverInt52(Edge edge, Int52Kind& kind)
+    LValue lowWhicheverInt52(Edge edge, Int52Kind& kind, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
         kind = bestInt52Kind(edge);
-        return lowInt52(edge, kind);
+        return lowInt52(edge, kind, mode);
     }
     
     LValue lowCell(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        DFG_ASSERT(m_graph, m_node, mode == ManualOperandSpeculation || DFG::isCell(edge.useKind()));
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || DFG::isCell(edge.useKind()));
         
         if (edge->op() == JSConstant) {
-            JSValue value = edge->asJSValue();
+            JSValue value = m_graph.valueOfJSConstant(edge.node());
             if (!value.isCell()) {
                 terminate(Uncountable);
                 return m_out.intPtrZero;
@@ -7014,7 +3398,7 @@ private:
             return uncheckedValue;
         }
         
-        DFG_ASSERT(m_graph, m_node, !(provenType(edge) & SpecCell));
+        RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecCell));
         terminate(Uncountable);
         return m_out.intPtrZero;
     }
@@ -7030,32 +3414,13 @@ private:
     
     LValue lowString(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == StringUse || edge.useKind() == KnownStringUse || edge.useKind() == StringIdentUse);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == StringUse || edge.useKind() == KnownStringUse);
         
         LValue result = lowCell(edge, mode);
         speculateString(edge, result);
         return result;
     }
     
-    LValue lowStringIdent(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
-    {
-        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == StringIdentUse);
-        
-        LValue string = lowString(edge, mode);
-        LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
-        speculateStringIdent(edge, string, stringImpl);
-        return stringImpl;
-    }
-
-    LValue lowSymbol(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
-    {
-        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == SymbolUse);
-
-        LValue result = lowCell(edge, mode);
-        speculateSymbol(edge, result);
-        return result;
-    }
-
     LValue lowNonNullObject(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
         ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == ObjectUse);
@@ -7067,10 +3432,10 @@ private:
     
     LValue lowBoolean(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse || edge.useKind() == KnownBooleanUse);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == BooleanUse);
         
         if (edge->hasConstant()) {
-            JSValue value = edge->asJSValue();
+            JSValue value = m_graph.valueOfJSConstant(edge.node());
             if (!value.isBoolean()) {
                 terminate(Uncountable);
                 return m_out.booleanFalse;
@@ -7092,32 +3457,87 @@ private:
             return result;
         }
         
-        DFG_ASSERT(m_graph, m_node, !(provenType(edge) & SpecBoolean));
+        RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecBoolean));
         terminate(Uncountable);
         return m_out.booleanFalse;
     }
     
-    LValue lowDouble(Edge edge)
+    LValue lowDouble(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        DFG_ASSERT(m_graph, m_node, isDouble(edge.useKind()));
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || isDouble(edge.useKind()));
+        
+        if (edge->hasConstant()) {
+            JSValue value = m_graph.valueOfJSConstant(edge.node());
+            if (!value.isNumber()) {
+                terminate(Uncountable);
+                return m_out.doubleZero;
+            }
+            return m_out.constDouble(value.asNumber());
+        }
         
         LoweredNodeValue value = m_doubleValues.get(edge.node());
         if (isValid(value))
             return value.value();
-        DFG_ASSERT(m_graph, m_node, !provenType(edge));
+        
+        value = m_int32Values.get(edge.node());
+        if (isValid(value)) {
+            LValue result = m_out.intToDouble(value.value());
+            setDouble(edge.node(), result);
+            return result;
+        }
+        
+        value = m_strictInt52Values.get(edge.node());
+        if (isValid(value))
+            return strictInt52ToDouble(edge, value.value());
+        
+        value = m_int52Values.get(edge.node());
+        if (isValid(value))
+            return strictInt52ToDouble(edge, int52ToStrictInt52(value.value()));
+        
+        value = m_jsValueValues.get(edge.node());
+        if (isValid(value)) {
+            LValue boxedResult = value.value();
+            
+            LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("Double unboxing int case"));
+            LBasicBlock doubleCase = FTL_NEW_BLOCK(m_out, ("Double unboxing double case"));
+            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Double unboxing continuation"));
+            
+            m_out.branch(isNotInt32(boxedResult), doubleCase, intCase);
+            
+            LBasicBlock lastNext = m_out.appendTo(intCase, doubleCase);
+            
+            ValueFromBlock intToDouble = m_out.anchor(
+                m_out.intToDouble(unboxInt32(boxedResult)));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(doubleCase, continuation);
+            
+            FTL_TYPE_CHECK(
+                jsValueValue(boxedResult), edge, SpecFullNumber, isCellOrMisc(boxedResult));
+            
+            ValueFromBlock unboxedDouble = m_out.anchor(unboxDouble(boxedResult));
+            m_out.jump(continuation);
+            
+            m_out.appendTo(continuation, lastNext);
+            
+            LValue result = m_out.phi(m_out.doubleType, intToDouble, unboxedDouble);
+            
+            setDouble(edge.node(), result);
+            return result;
+        }
+        
+        RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecFullNumber));
         terminate(Uncountable);
         return m_out.doubleZero;
     }
     
     LValue lowJSValue(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
     {
-        DFG_ASSERT(m_graph, m_node, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);
-        DFG_ASSERT(m_graph, m_node, !isDouble(edge.useKind()));
-        DFG_ASSERT(m_graph, m_node, edge.useKind() != Int52RepUse);
+        ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);
         
         if (edge->hasConstant())
-            return m_out.constInt64(JSValue::encode(edge->asJSValue()));
-
+            return m_out.constInt64(JSValue::encode(m_graph.valueOfJSConstant(edge.node())));
+        
         LoweredNodeValue value = m_jsValueValues.get(edge.node());
         if (isValid(value))
             return value.value();
@@ -7129,6 +3549,14 @@ private:
             return result;
         }
         
+        value = m_strictInt52Values.get(edge.node());
+        if (isValid(value))
+            return strictInt52ToJSValue(value.value());
+        
+        value = m_int52Values.get(edge.node());
+        if (isValid(value))
+            return strictInt52ToJSValue(int52ToStrictInt52(value.value()));
+        
         value = m_booleanValues.get(edge.node());
         if (isValid(value)) {
             LValue result = boxBoolean(value.value());
@@ -7136,7 +3564,14 @@ private:
             return result;
         }
         
-        DFG_CRASH(m_graph, m_node, "Value not defined");
+        value = m_doubleValues.get(edge.node());
+        if (isValid(value)) {
+            LValue result = boxDouble(value.value());
+            setJSValue(edge.node(), result);
+            return result;
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
         return 0;
     }
     
@@ -7161,9 +3596,11 @@ private:
         return result;
     }
     
-    LValue strictInt52ToDouble(LValue value)
+    LValue strictInt52ToDouble(Edge edge, LValue value)
     {
-        return m_out.intToDouble(value);
+        LValue result = m_out.intToDouble(value);
+        setDouble(edge.node(), result);
+        return result;
     }
     
     LValue strictInt52ToJSValue(LValue value)
@@ -7177,7 +3614,7 @@ private:
         LValue int32Value = m_out.castToInt32(value);
         m_out.branch(
             m_out.equal(m_out.signExt(int32Value, m_out.int64), value),
-            unsure(isInt32), unsure(isDouble));
+            isInt32, isDouble);
         
         LBasicBlock lastNext = m_out.appendTo(isInt32, isDouble);
         
@@ -7193,6 +3630,23 @@ private:
         return m_out.phi(m_out.int64, results);
     }
     
+    LValue setInt52WithStrictValue(Node* node, LValue value, Int52Kind kind)
+    {
+        switch (kind) {
+        case StrictInt52:
+            setStrictInt52(node, value);
+            return value;
+            
+        case Int52:
+            value = strictInt52ToInt52(value);
+            setInt52(node, value);
+            return value;
+        }
+        
+        RELEASE_ASSERT_NOT_REACHED();
+        return 0;
+    }
+
     LValue strictInt52ToInt52(LValue value)
     {
         return m_out.shl(value, m_out.constInt64(JSValue::int52ShiftAmount));
@@ -7203,16 +3657,8 @@ private:
         return m_out.aShr(value, m_out.constInt64(JSValue::int52ShiftAmount));
     }
     
-    LValue isInt32(LValue jsValue, SpeculatedType type = SpecFullTop)
+    LValue isNotInt32(LValue jsValue)
     {
-        if (LValue proven = isProvenValue(type, SpecInt32))
-            return proven;
-        return m_out.aboveOrEqual(jsValue, m_tagTypeNumber);
-    }
-    LValue isNotInt32(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~SpecInt32))
-            return proven;
         return m_out.below(jsValue, m_tagTypeNumber);
     }
     LValue unboxInt32(LValue jsValue)
@@ -7224,19 +3670,10 @@ private:
         return m_out.add(m_out.zeroExt(value, m_out.int64), m_tagTypeNumber);
     }
     
-    LValue isCellOrMisc(LValue jsValue, SpeculatedType type = SpecFullTop)
+    LValue isCellOrMisc(LValue jsValue)
     {
-        if (LValue proven = isProvenValue(type, SpecCell | SpecMisc))
-            return proven;
         return m_out.testIsZero64(jsValue, m_tagTypeNumber);
     }
-    LValue isNotCellOrMisc(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~(SpecCell | SpecMisc)))
-            return proven;
-        return m_out.testNonZero64(jsValue, m_tagTypeNumber);
-    }
-    
     LValue unboxDouble(LValue jsValue)
     {
         return m_out.bitCast(m_out.add(jsValue, m_tagTypeNumber), m_out.doubleType);
@@ -7246,133 +3683,22 @@ private:
         return m_out.sub(m_out.bitCast(doubleValue, m_out.int64), m_tagTypeNumber);
     }
     
-    LValue jsValueToStrictInt52(Edge edge, LValue boxedValue)
-    {
-        LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("jsValueToInt52 unboxing int case"));
-        LBasicBlock doubleCase = FTL_NEW_BLOCK(m_out, ("jsValueToInt52 unboxing double case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("jsValueToInt52 unboxing continuation"));
-            
-        LValue isNotInt32;
-        if (!m_interpreter.needsTypeCheck(edge, SpecInt32))
-            isNotInt32 = m_out.booleanFalse;
-        else if (!m_interpreter.needsTypeCheck(edge, ~SpecInt32))
-            isNotInt32 = m_out.booleanTrue;
-        else
-            isNotInt32 = this->isNotInt32(boxedValue);
-        m_out.branch(isNotInt32, unsure(doubleCase), unsure(intCase));
-            
-        LBasicBlock lastNext = m_out.appendTo(intCase, doubleCase);
-            
-        ValueFromBlock intToInt52 = m_out.anchor(
-            m_out.signExt(unboxInt32(boxedValue), m_out.int64));
-        m_out.jump(continuation);
-            
-        m_out.appendTo(doubleCase, continuation);
-        
-        LValue possibleResult = m_out.call(
-            m_out.operation(operationConvertBoxedDoubleToInt52), boxedValue);
-        FTL_TYPE_CHECK(
-            jsValueValue(boxedValue), edge, SpecInt32 | SpecInt52AsDouble,
-            m_out.equal(possibleResult, m_out.constInt64(JSValue::notInt52)));
-            
-        ValueFromBlock doubleToInt52 = m_out.anchor(possibleResult);
-        m_out.jump(continuation);
-            
-        m_out.appendTo(continuation, lastNext);
-            
-        return m_out.phi(m_out.int64, intToInt52, doubleToInt52);
-    }
-    
-    LValue doubleToStrictInt52(Edge edge, LValue value)
-    {
-        LValue possibleResult = m_out.call(
-            m_out.operation(operationConvertDoubleToInt52), value);
-        FTL_TYPE_CHECK(
-            doubleValue(value), edge, SpecInt52AsDouble,
-            m_out.equal(possibleResult, m_out.constInt64(JSValue::notInt52)));
-        
-        return possibleResult;
-    }
-
-    LValue convertDoubleToInt32(LValue value, bool shouldCheckNegativeZero)
+    LValue isNotCell(LValue jsValue)
     {
-        LValue integerValue = m_out.fpToInt32(value);
-        LValue integerValueConvertedToDouble = m_out.intToDouble(integerValue);
-        LValue valueNotConvertibleToInteger = m_out.doubleNotEqualOrUnordered(value, integerValueConvertedToDouble);
-        speculate(Overflow, FormattedValue(ValueFormatDouble, value), m_node, valueNotConvertibleToInteger);
-
-        if (shouldCheckNegativeZero) {
-            LBasicBlock valueIsZero = FTL_NEW_BLOCK(m_out, ("ConvertDoubleToInt32 on zero"));
-            LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("ConvertDoubleToInt32 continuation"));
-            m_out.branch(m_out.isZero32(integerValue), unsure(valueIsZero), unsure(continuation));
-
-            LBasicBlock lastNext = m_out.appendTo(valueIsZero, continuation);
-
-            LValue doubleBitcastToInt64 = m_out.bitCast(value, m_out.int64);
-            LValue signBitSet = m_out.lessThan(doubleBitcastToInt64, m_out.constInt64(0));
-
-            speculate(NegativeZero, FormattedValue(ValueFormatDouble, value), m_node, signBitSet);
-            m_out.jump(continuation);
-            m_out.appendTo(continuation, lastNext);
-        }
-        return integerValue;
-    }
-
-    LValue isNumber(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, SpecFullNumber))
-            return proven;
-        return isNotCellOrMisc(jsValue);
-    }
-    LValue isNotNumber(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~SpecFullNumber))
-            return proven;
-        return isCellOrMisc(jsValue);
-    }
-    
-    LValue isNotCell(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~SpecCell))
-            return proven;
         return m_out.testNonZero64(jsValue, m_tagMask);
     }
     
-    LValue isCell(LValue jsValue, SpeculatedType type = SpecFullTop)
+    LValue isCell(LValue jsValue)
     {
-        if (LValue proven = isProvenValue(type, SpecCell))
-            return proven;
         return m_out.testIsZero64(jsValue, m_tagMask);
     }
     
-    LValue isNotMisc(LValue value, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~SpecMisc))
-            return proven;
-        return m_out.above(value, m_out.constInt64(TagBitTypeOther | TagBitBool | TagBitUndefined));
-    }
-    
-    LValue isMisc(LValue value, SpeculatedType type = SpecFullTop)
+    LValue isNotBoolean(LValue jsValue)
     {
-        if (LValue proven = isProvenValue(type, SpecMisc))
-            return proven;
-        return m_out.bitNot(isNotMisc(value));
-    }
-    
-    LValue isNotBoolean(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~SpecBoolean))
-            return proven;
         return m_out.testNonZero64(
             m_out.bitXor(jsValue, m_out.constInt64(ValueFalse)),
             m_out.constInt64(~1));
     }
-    LValue isBoolean(LValue jsValue, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, SpecBoolean))
-            return proven;
-        return m_out.bitNot(isNotBoolean(jsValue));
-    }
     LValue unboxBoolean(LValue jsValue)
     {
         // We want to use a cast that guarantees that LLVM knows that even the integer
@@ -7384,32 +3710,6 @@ private:
         return m_out.select(
             value, m_out.constInt64(ValueTrue), m_out.constInt64(ValueFalse));
     }
-    
-    LValue isNotOther(LValue value, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, ~SpecOther))
-            return proven;
-        return m_out.notEqual(
-            m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
-            m_out.constInt64(ValueNull));
-    }
-    LValue isOther(LValue value, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type, SpecOther))
-            return proven;
-        return m_out.equal(
-            m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
-            m_out.constInt64(ValueNull));
-    }
-    
-    LValue isProvenValue(SpeculatedType provenType, SpeculatedType wantedType)
-    {
-        if (!(provenType & ~wantedType))
-            return m_out.booleanTrue;
-        if (!(provenType & wantedType))
-            return m_out.booleanFalse;
-        return nullptr;
-    }
 
     void speculate(Edge edge)
     {
@@ -7417,9 +3717,7 @@ private:
         case UntypedUse:
             break;
         case KnownInt32Use:
-        case KnownStringUse:
-        case DoubleRepUse:
-        case Int52RepUse:
+        case KnownNumberUse:
             ASSERT(!m_interpreter.needsTypeCheck(edge));
             break;
         case Int32Use:
@@ -7431,15 +3729,9 @@ private:
         case KnownCellUse:
             ASSERT(!m_interpreter.needsTypeCheck(edge));
             break;
-        case MachineIntUse:
-            speculateMachineInt(edge);
-            break;
         case ObjectUse:
             speculateObject(edge);
             break;
-        case FunctionUse:
-            speculateFunction(edge);
-            break;
         case ObjectOrOtherUse:
             speculateObjectOrOther(edge);
             break;
@@ -7449,47 +3741,21 @@ private:
         case StringUse:
             speculateString(edge);
             break;
-        case StringIdentUse:
-            speculateStringIdent(edge);
-            break;
-        case SymbolUse:
-            speculateSymbol(edge);
-            break;
-        case StringObjectUse:
-            speculateStringObject(edge);
-            break;
-        case StringOrStringObjectUse:
-            speculateStringOrStringObject(edge);
-            break;
-        case NumberUse:
-            speculateNumber(edge);
-            break;
         case RealNumberUse:
             speculateRealNumber(edge);
             break;
-        case DoubleRepRealUse:
-            speculateDoubleRepReal(edge);
+        case NumberUse:
+            speculateNumber(edge);
             break;
-        case DoubleRepMachineIntUse:
-            speculateDoubleRepMachineInt(edge);
+        case MachineIntUse:
+            speculateMachineInt(edge);
             break;
         case BooleanUse:
             speculateBoolean(edge);
             break;
-        case NotStringVarUse:
-            speculateNotStringVar(edge);
-            break;
-        case NotCellUse:
-            speculateNotCell(edge);
-            break;
-        case OtherUse:
-            speculateOther(edge);
-            break;
-        case MiscUse:
-            speculateMisc(edge);
-            break;
         default:
-            DFG_CRASH(m_graph, m_node, "Unsupported speculation use kind");
+            dataLog("Unsupported speculation use kind: ", edge.useKind(), "\n");
+            RELEASE_ASSERT_NOT_REACHED();
         }
     }
     
@@ -7508,70 +3774,43 @@ private:
         lowCell(edge);
     }
     
-    void speculateMachineInt(Edge edge)
+    LValue isObject(LValue cell)
     {
-        if (!m_interpreter.needsTypeCheck(edge))
-            return;
-        
-        jsValueToStrictInt52(edge, lowJSValue(edge, ManualOperandSpeculation));
+        return m_out.notEqual(
+            m_out.loadPtr(cell, m_heaps.JSCell_structure),
+            m_out.constIntPtr(vm().stringStructure.get()));
     }
     
-    LValue isObject(LValue cell, SpeculatedType type = SpecFullTop)
+    LValue isNotString(LValue cell)
     {
-        if (LValue proven = isProvenValue(type & SpecCell, SpecObject))
-            return proven;
-        return m_out.aboveOrEqual(
-            m_out.load8(cell, m_heaps.JSCell_typeInfoType),
-            m_out.constInt8(ObjectType));
-    }
-
-    LValue isNotObject(LValue cell, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type & SpecCell, ~SpecObject))
-            return proven;
-        return m_out.below(
-            m_out.load8(cell, m_heaps.JSCell_typeInfoType),
-            m_out.constInt8(ObjectType));
-    }
-
-    LValue isNotString(LValue cell, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type & SpecCell, ~SpecString))
-            return proven;
-        return m_out.notEqual(
-            m_out.load32(cell, m_heaps.JSCell_structureID),
-            m_out.constInt32(vm().stringStructure->id()));
+        return isObject(cell);
     }
     
-    LValue isString(LValue cell, SpeculatedType type = SpecFullTop)
+    LValue isString(LValue cell)
     {
-        if (LValue proven = isProvenValue(type & SpecCell, SpecString))
-            return proven;
         return m_out.equal(
-            m_out.load32(cell, m_heaps.JSCell_structureID),
-            m_out.constInt32(vm().stringStructure->id()));
+            m_out.loadPtr(cell, m_heaps.JSCell_structure),
+            m_out.constIntPtr(vm().stringStructure.get()));
     }
-
-    LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop)
+    
+    LValue isNotObject(LValue cell)
     {
-        if (LValue proven = isProvenValue(type & SpecCell, ~SpecSymbol))
-            return proven;
-        return m_out.notEqual(
-            m_out.load32(cell, m_heaps.JSCell_structureID),
-            m_out.constInt32(vm().symbolStructure->id()));
+        return isString(cell);
     }
-
+    
     LValue isArrayType(LValue cell, ArrayMode arrayMode)
     {
         switch (arrayMode.type()) {
         case Array::Int32:
         case Array::Double:
         case Array::Contiguous: {
-            LValue indexingType = m_out.load8(cell, m_heaps.JSCell_indexingType);
+            LValue indexingType = m_out.load8(
+                m_out.loadPtr(cell, m_heaps.JSCell_structure),
+                m_heaps.Structure_indexingType);
             
             switch (arrayMode.arrayClass()) {
             case Array::OriginalArray:
-                DFG_CRASH(m_graph, m_node, "Unexpected original array");
+                RELEASE_ASSERT_NOT_REACHED();
                 return 0;
                 
             case Array::Array:
@@ -7591,52 +3830,29 @@ private:
                     m_out.constInt8(arrayMode.shapeMask()));
             }
             
-            DFG_CRASH(m_graph, m_node, "Corrupt array class");
+            RELEASE_ASSERT_NOT_REACHED();
         }
             
-        case Array::DirectArguments:
-            return m_out.equal(
-                m_out.load8(cell, m_heaps.JSCell_typeInfoType),
-                m_out.constInt8(DirectArgumentsType));
-            
-        case Array::ScopedArguments:
-            return m_out.equal(
-                m_out.load8(cell, m_heaps.JSCell_typeInfoType),
-                m_out.constInt8(ScopedArgumentsType));
-            
         default:
-            return m_out.equal(
-                m_out.load8(cell, m_heaps.JSCell_typeInfoType), 
-                m_out.constInt8(typeForTypedArrayType(arrayMode.typedArrayType())));
+            return hasClassInfo(cell, classInfoForType(arrayMode.typedArrayType()));
         }
     }
     
-    LValue isFunction(LValue cell, SpeculatedType type = SpecFullTop)
-    {
-        if (LValue proven = isProvenValue(type & SpecCell, SpecFunction))
-            return proven;
-        return isType(cell, JSFunctionType);
-    }
-    LValue isNotFunction(LValue cell, SpeculatedType type = SpecFullTop)
+    LValue hasClassInfo(LValue cell, const ClassInfo* classInfo)
     {
-        if (LValue proven = isProvenValue(type & SpecCell, ~SpecFunction))
-            return proven;
-        return isNotType(cell, JSFunctionType);
-    }
-            
-    LValue isExoticForTypeof(LValue cell, SpeculatedType type = SpecFullTop)
-    {
-        if (!(type & SpecObjectOther))
-            return m_out.booleanFalse;
-        return m_out.testNonZero8(
-            m_out.load8(cell, m_heaps.JSCell_typeInfoFlags),
-            m_out.constInt8(MasqueradesAsUndefined | TypeOfShouldCallGetCallData));
+        return m_out.equal(
+            m_out.loadPtr(
+                m_out.loadPtr(cell, m_heaps.JSCell_structure),
+                m_heaps.Structure_classInfo),
+            m_out.constIntPtr(classInfo));
     }
     
     LValue isType(LValue cell, JSType type)
     {
         return m_out.equal(
-            m_out.load8(cell, m_heaps.JSCell_typeInfoType),
+            m_out.load8(
+                m_out.loadPtr(cell, m_heaps.JSCell_structure),
+                m_heaps.Structure_typeInfoType),
             m_out.constInt8(type));
     }
     
@@ -7655,40 +3871,36 @@ private:
         speculateObject(edge, lowCell(edge));
     }
     
-    void speculateFunction(Edge edge, LValue cell)
-    {
-        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecFunction, isNotFunction(cell));
-    }
-    
-    void speculateFunction(Edge edge)
-    {
-        speculateFunction(edge, lowCell(edge));
-    }
-    
     void speculateObjectOrOther(Edge edge)
     {
         if (!m_interpreter.needsTypeCheck(edge))
             return;
         
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
+        LValue value = lowJSValue(edge);
         
         LBasicBlock cellCase = FTL_NEW_BLOCK(m_out, ("speculateObjectOrOther cell case"));
         LBasicBlock primitiveCase = FTL_NEW_BLOCK(m_out, ("speculateObjectOrOther primitive case"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("speculateObjectOrOther continuation"));
         
-        m_out.branch(isNotCell(value, provenType(edge)), unsure(primitiveCase), unsure(cellCase));
+        m_out.branch(isNotCell(value), primitiveCase, cellCase);
         
         LBasicBlock lastNext = m_out.appendTo(cellCase, primitiveCase);
         
         FTL_TYPE_CHECK(
-            jsValueValue(value), edge, (~SpecCell) | SpecObject, isNotObject(value));
+            jsValueValue(value), edge, (~SpecCell) | SpecObject,
+            m_out.equal(
+                m_out.loadPtr(value, m_heaps.JSCell_structure),
+                m_out.constIntPtr(vm().stringStructure.get())));
         
         m_out.jump(continuation);
         
         m_out.appendTo(primitiveCase, continuation);
         
         FTL_TYPE_CHECK(
-            jsValueValue(value), edge, SpecCell | SpecOther, isNotOther(value));
+            jsValueValue(value), edge, SpecCell | SpecOther,
+            m_out.notEqual(
+                m_out.bitAnd(value, m_out.constInt64(~TagBitUndefined)),
+                m_out.constInt64(ValueNull)));
         
         m_out.jump(continuation);
         
@@ -7708,7 +3920,7 @@ private:
     
     void speculateString(Edge edge, LValue cell)
     {
-        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecString | ~SpecCell, isNotString(cell));
+        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecString, isNotString(cell));
     }
     
     void speculateString(Edge edge)
@@ -7716,130 +3928,32 @@ private:
         speculateString(edge, lowCell(edge));
     }
     
-    void speculateStringIdent(Edge edge, LValue string, LValue stringImpl)
-    {
-        if (!m_interpreter.needsTypeCheck(edge, SpecStringIdent | ~SpecString))
-            return;
-        
-        speculate(BadType, jsValueValue(string), edge.node(), m_out.isNull(stringImpl));
-        speculate(
-            BadType, jsValueValue(string), edge.node(),
-            m_out.testIsZero32(
-                m_out.load32(stringImpl, m_heaps.StringImpl_hashAndFlags),
-                m_out.constInt32(StringImpl::flagIsAtomic())));
-        m_interpreter.filter(edge, SpecStringIdent | ~SpecString);
-    }
-    
-    void speculateStringIdent(Edge edge)
-    {
-        lowStringIdent(edge);
-    }
-    
-    void speculateStringObject(Edge edge)
-    {
-        if (!m_interpreter.needsTypeCheck(edge, SpecStringObject))
-            return;
-        
-        speculateStringObjectForCell(edge, lowCell(edge));
-        m_interpreter.filter(edge, SpecStringObject);
-    }
-    
-    void speculateStringOrStringObject(Edge edge)
-    {
-        if (!m_interpreter.needsTypeCheck(edge, SpecString | SpecStringObject))
-            return;
-        
-        LBasicBlock notString = FTL_NEW_BLOCK(m_out, ("Speculate StringOrStringObject not string case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Speculate StringOrStringObject continuation"));
-        
-        LValue structureID = m_out.load32(lowCell(edge), m_heaps.JSCell_structureID);
-        m_out.branch(
-            m_out.equal(structureID, m_out.constInt32(vm().stringStructure->id())),
-            unsure(continuation), unsure(notString));
-        
-        LBasicBlock lastNext = m_out.appendTo(notString, continuation);
-        speculateStringObjectForStructureID(edge, structureID);
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-        
-        m_interpreter.filter(edge, SpecString | SpecStringObject);
-    }
-    
-    void speculateStringObjectForCell(Edge edge, LValue cell)
-    {
-        speculateStringObjectForStructureID(edge, m_out.load32(cell, m_heaps.JSCell_structureID));
-    }
-    
-    void speculateStringObjectForStructureID(Edge edge, LValue structureID)
-    {
-        Structure* stringObjectStructure =
-            m_graph.globalObjectFor(m_node->origin.semantic)->stringObjectStructure();
-        
-        if (abstractStructure(edge).isSubsetOf(StructureSet(stringObjectStructure)))
-            return;
-        
-        speculate(
-            NotStringObject, noValue(), 0,
-            m_out.notEqual(structureID, weakStructureID(stringObjectStructure)));
-    }
-
-    void speculateSymbol(Edge edge, LValue cell)
-    {
-        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecSymbol | ~SpecCell, isNotSymbol(cell));
-    }
-
-    void speculateSymbol(Edge edge)
-    {
-        speculateSymbol(edge, lowCell(edge));
-    }
-
     void speculateNonNullObject(Edge edge, LValue cell)
     {
-        FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecObject, isNotObject(cell));
+        LValue structure = m_out.loadPtr(cell, m_heaps.JSCell_structure);
+        FTL_TYPE_CHECK(
+            jsValueValue(cell), edge, SpecObject, 
+            m_out.equal(structure, m_out.constIntPtr(vm().stringStructure.get())));
         if (masqueradesAsUndefinedWatchpointIsStillValid())
             return;
         
         speculate(
             BadType, jsValueValue(cell), edge.node(),
             m_out.testNonZero8(
-                m_out.load8(cell, m_heaps.JSCell_typeInfoFlags),
+                m_out.load8(structure, m_heaps.Structure_typeInfoFlags),
                 m_out.constInt8(MasqueradesAsUndefined)));
     }
     
     void speculateNumber(Edge edge)
     {
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
-        FTL_TYPE_CHECK(jsValueValue(value), edge, SpecBytecodeNumber, isNotNumber(value));
-    }
-    
-    void speculateRealNumber(Edge edge)
-    {
         // Do an early return here because lowDouble() can create a lot of control flow.
         if (!m_interpreter.needsTypeCheck(edge))
             return;
         
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
-        LValue doubleValue = unboxDouble(value);
-        
-        LBasicBlock intCase = FTL_NEW_BLOCK(m_out, ("speculateRealNumber int case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("speculateRealNumber continuation"));
-        
-        m_out.branch(
-            m_out.doubleEqual(doubleValue, doubleValue),
-            usually(continuation), rarely(intCase));
-        
-        LBasicBlock lastNext = m_out.appendTo(intCase, continuation);
-        
-        typeCheck(
-            jsValueValue(value), m_node->child1(), SpecBytecodeRealNumber,
-            isNotInt32(value, provenType(m_node->child1()) & ~SpecFullDouble));
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
+        lowDouble(edge);
     }
     
-    void speculateDoubleRepReal(Edge edge)
+    void speculateRealNumber(Edge edge)
     {
         // Do an early return here because lowDouble() can create a lot of control flow.
         if (!m_interpreter.needsTypeCheck(edge))
@@ -7847,16 +3961,17 @@ private:
         
         LValue value = lowDouble(edge);
         FTL_TYPE_CHECK(
-            doubleValue(value), edge, SpecDoubleReal,
+            doubleValue(value), edge, SpecFullRealNumber,
             m_out.doubleNotEqualOrUnordered(value, value));
     }
     
-    void speculateDoubleRepMachineInt(Edge edge)
+    void speculateMachineInt(Edge edge)
     {
         if (!m_interpreter.needsTypeCheck(edge))
             return;
         
-        doubleToStrictInt52(edge, lowDouble(edge));
+        Int52Kind kind;
+        lowWhicheverInt52(edge, kind);
     }
     
     void speculateBoolean(Edge edge)
@@ -7864,96 +3979,69 @@ private:
         lowBoolean(edge);
     }
     
-    void speculateNotStringVar(Edge edge)
-    {
-        if (!m_interpreter.needsTypeCheck(edge, ~SpecStringVar))
-            return;
-        
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
-        
-        LBasicBlock isCellCase = FTL_NEW_BLOCK(m_out, ("Speculate NotStringVar is cell case"));
-        LBasicBlock isStringCase = FTL_NEW_BLOCK(m_out, ("Speculate NotStringVar is string case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Speculate NotStringVar continuation"));
-        
-        m_out.branch(isCell(value, provenType(edge)), unsure(isCellCase), unsure(continuation));
-        
-        LBasicBlock lastNext = m_out.appendTo(isCellCase, isStringCase);
-        m_out.branch(isString(value, provenType(edge)), unsure(isStringCase), unsure(continuation));
-        
-        m_out.appendTo(isStringCase, continuation);
-        speculateStringIdent(edge, value, m_out.loadPtr(value, m_heaps.JSString_value));
-        m_out.jump(continuation);
-        
-        m_out.appendTo(continuation, lastNext);
-    }
-    
-    void speculateNotCell(Edge edge)
-    {
-        if (!m_interpreter.needsTypeCheck(edge))
-            return;
-        
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
-        typeCheck(jsValueValue(value), edge, ~SpecCell, isCell(value));
-    }
-    
-    void speculateOther(Edge edge)
-    {
-        if (!m_interpreter.needsTypeCheck(edge))
-            return;
-        
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
-        typeCheck(jsValueValue(value), edge, SpecOther, isNotOther(value));
-    }
-    
-    void speculateMisc(Edge edge)
-    {
-        if (!m_interpreter.needsTypeCheck(edge))
-            return;
-        
-        LValue value = lowJSValue(edge, ManualOperandSpeculation);
-        typeCheck(jsValueValue(value), edge, SpecMisc, isNotMisc(value));
-    }
-    
     bool masqueradesAsUndefinedWatchpointIsStillValid()
     {
-        return m_graph.masqueradesAsUndefinedWatchpointIsStillValid(m_node->origin.semantic);
+        return m_graph.masqueradesAsUndefinedWatchpointIsStillValid(m_node->codeOrigin);
     }
     
     LValue loadMarkByte(LValue base)
     {
-        return m_out.load8(base, m_heaps.JSCell_gcData);
+        LValue markedBlock = m_out.bitAnd(base, m_out.constInt64(MarkedBlock::blockMask));
+        LValue baseOffset = m_out.bitAnd(base, m_out.constInt64(~MarkedBlock::blockMask));
+        LValue markByteIndex = m_out.lShr(baseOffset, m_out.constInt64(MarkedBlock::atomShiftAmount + MarkedBlock::markByteShiftAmount));
+        return m_out.load8(m_out.baseIndex(m_heaps.MarkedBlock_markBits, markedBlock, markByteIndex, ScaleOne, MarkedBlock::offsetOfMarks()));
+    }
+
+    void emitStoreBarrier(LValue base, LValue value, Edge& valueEdge)
+    {
+#if ENABLE(GGC)
+        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Store barrier continuation"));
+        LBasicBlock isCell = FTL_NEW_BLOCK(m_out, ("Store barrier is cell block"));
+
+        if (m_state.forNode(valueEdge.node()).couldBeType(SpecCell))
+            m_out.branch(isNotCell(value), continuation, isCell);
+        else
+            m_out.jump(isCell);
+
+        LBasicBlock lastNext = m_out.appendTo(isCell, continuation);
+        emitStoreBarrier(base);
+        m_out.jump(continuation);
+
+        m_out.appendTo(continuation, lastNext);
+#else
+        UNUSED_PARAM(base);
+        UNUSED_PARAM(value);
+        UNUSED_PARAM(valueEdge);
+#endif
     }
 
     void emitStoreBarrier(LValue base)
     {
 #if ENABLE(GGC)
-        LBasicBlock isMarkedAndNotRemembered = FTL_NEW_BLOCK(m_out, ("Store barrier is marked block"));
-        LBasicBlock bufferHasSpace = FTL_NEW_BLOCK(m_out, ("Store barrier buffer has space"));
-        LBasicBlock bufferIsFull = FTL_NEW_BLOCK(m_out, ("Store barrier buffer is full"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Store barrier continuation"));
+        LBasicBlock isMarked = FTL_NEW_BLOCK(m_out, ("Store barrier is marked block"));
+        LBasicBlock bufferHasSpace = FTL_NEW_BLOCK(m_out, ("Store barrier buffer is full"));
+        LBasicBlock bufferIsFull = FTL_NEW_BLOCK(m_out, ("Store barrier buffer is full"));
 
         // Check the mark byte. 
-        m_out.branch(
-            m_out.notZero8(loadMarkByte(base)), usually(continuation), rarely(isMarkedAndNotRemembered));
+        m_out.branch(m_out.isZero8(loadMarkByte(base)), continuation, isMarked);
 
         // Append to the write barrier buffer.
-        LBasicBlock lastNext = m_out.appendTo(isMarkedAndNotRemembered, bufferHasSpace);
-        LValue currentBufferIndex = m_out.load32(m_out.absolute(vm().heap.writeBarrierBuffer().currentIndexAddress()));
-        LValue bufferCapacity = m_out.constInt32(vm().heap.writeBarrierBuffer().capacity());
-        m_out.branch(
-            m_out.lessThan(currentBufferIndex, bufferCapacity),
-            usually(bufferHasSpace), rarely(bufferIsFull));
+        LBasicBlock lastNext = m_out.appendTo(isMarked, bufferHasSpace);
+        LValue currentBufferIndex = m_out.load32(m_out.absolute(&vm().heap.writeBarrierBuffer().m_currentIndex));
+        LValue bufferCapacity = m_out.load32(m_out.absolute(&vm().heap.writeBarrierBuffer().m_capacity));
+        m_out.branch(m_out.lessThan(currentBufferIndex, bufferCapacity), bufferHasSpace, bufferIsFull);
 
         // Buffer has space, store to it.
         m_out.appendTo(bufferHasSpace, bufferIsFull);
-        LValue writeBarrierBufferBase = m_out.constIntPtr(vm().heap.writeBarrierBuffer().buffer());
-        m_out.storePtr(base, m_out.baseIndex(m_heaps.WriteBarrierBuffer_bufferContents, writeBarrierBufferBase, m_out.zeroExtPtr(currentBufferIndex)));
-        m_out.store32(m_out.add(currentBufferIndex, m_out.constInt32(1)), m_out.absolute(vm().heap.writeBarrierBuffer().currentIndexAddress()));
+        LValue writeBarrierBufferBase = m_out.loadPtr(m_out.absolute(&vm().heap.writeBarrierBuffer().m_buffer));
+        m_out.storePtr(base, m_out.baseIndex(m_heaps.WriteBarrierBuffer_bufferContents, writeBarrierBufferBase, m_out.zeroExt(currentBufferIndex, m_out.intPtr), ScalePtr));
+        m_out.store32(m_out.add(currentBufferIndex, m_out.constInt32(1)), m_out.absolute(&vm().heap.writeBarrierBuffer().m_currentIndex));
         m_out.jump(continuation);
 
         // Buffer is out of space, flush it.
         m_out.appendTo(bufferIsFull, continuation);
-        vmCallNoExceptions(m_out.operation(operationFlushWriteBarrierBuffer), m_callFrame, base);
+        vmCall(m_out.operation(operationFlushWriteBarrierBuffer), m_callFrame, base);
         m_out.jump(continuation);
 
         m_out.appendTo(continuation, lastNext);
@@ -7962,23 +4050,44 @@ private:
 #endif
     }
 
-    template<typename... Args>
-    LValue vmCall(LValue function, Args... args)
+    enum ExceptionCheckMode { NoExceptions, CheckExceptions };
+    
+    LValue vmCall(LValue function, ExceptionCheckMode mode = CheckExceptions)
     {
         callPreflight();
-        LValue result = m_out.call(function, args...);
-        callCheck();
+        LValue result = m_out.call(function);
+        callCheck(mode);
         return result;
     }
-    
-    template<typename... Args>
-    LValue vmCallNoExceptions(LValue function, Args... args)
+    LValue vmCall(LValue function, LValue arg1, ExceptionCheckMode mode = CheckExceptions)
     {
         callPreflight();
-        LValue result = m_out.call(function, args...);
+        LValue result = m_out.call(function, arg1);
+        callCheck(mode);
         return result;
     }
-
+    LValue vmCall(LValue function, LValue arg1, LValue arg2, ExceptionCheckMode mode = CheckExceptions)
+    {
+        callPreflight();
+        LValue result = m_out.call(function, arg1, arg2);
+        callCheck(mode);
+        return result;
+    }
+    LValue vmCall(LValue function, LValue arg1, LValue arg2, LValue arg3, ExceptionCheckMode mode = CheckExceptions)
+    {
+        callPreflight();
+        LValue result = m_out.call(function, arg1, arg2, arg3);
+        callCheck(mode);
+        return result;
+    }
+    LValue vmCall(LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, ExceptionCheckMode mode = CheckExceptions)
+    {
+        callPreflight();
+        LValue result = m_out.call(function, arg1, arg2, arg3, arg4);
+        callCheck(mode);
+        return result;
+    }
+    
     void callPreflight(CodeOrigin codeOrigin)
     {
         m_out.store32(
@@ -7989,22 +4098,26 @@ private:
     }
     void callPreflight()
     {
-        callPreflight(m_node->origin.semantic);
+        callPreflight(m_node->codeOrigin);
     }
     
-    void callCheck()
+    void callCheck(ExceptionCheckMode mode = CheckExceptions)
     {
-        if (Options::enableExceptionFuzz())
-            m_out.call(m_out.operation(operationExceptionFuzz));
+        if (mode == NoExceptions)
+            return;
         
+        LBasicBlock didHaveException = FTL_NEW_BLOCK(m_out, ("Did have exception"));
         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Exception check continuation"));
         
-        LValue exception = m_out.load64(m_out.absolute(vm().addressOfException()));
-        
         m_out.branch(
-            m_out.notZero64(exception), rarely(m_handleExceptions), usually(continuation));
+            m_out.notZero64(m_out.load64(m_out.absolute(vm().addressOfException()))),
+            didHaveException, continuation);
+        
+        LBasicBlock lastNext = m_out.appendTo(didHaveException, continuation);
+        // FIXME: Handle exceptions. https://bugs.webkit.org/show_bug.cgi?id=113622
+        m_out.crash();
         
-        m_out.appendTo(continuation);
+        m_out.appendTo(continuation, lastNext);
     }
     
     LBasicBlock lowBlock(BasicBlock* block)
@@ -8012,52 +4125,34 @@ private:
         return m_blocks.get(block);
     }
     
+    void initializeOSRExitStateForBlock()
+    {
+        m_availability = m_highBlock->ssa->availabilityAtHead;
+    }
+    
     void appendOSRExit(
         ExitKind kind, FormattedValue lowValue, Node* highValue, LValue failCondition)
     {
-        if (verboseCompilationEnabled()) {
-            dataLog("    OSR exit #", m_ftlState.jitCode->osrExit.size(), " with availability: ", availabilityMap(), "\n");
-            if (!m_availableRecoveries.isEmpty())
-                dataLog("        Available recoveries: ", listDump(m_availableRecoveries), "\n");
-        }
-        
-        if (doOSRExitFuzzing()) {
-            LValue numberOfFuzzChecks = m_out.add(
-                m_out.load32(m_out.absolute(&g_numberOfOSRExitFuzzChecks)),
-                m_out.int32One);
-            
-            m_out.store32(numberOfFuzzChecks, m_out.absolute(&g_numberOfOSRExitFuzzChecks));
-            
-            if (unsigned atOrAfter = Options::fireOSRExitFuzzAtOrAfter()) {
-                failCondition = m_out.bitOr(
-                    failCondition,
-                    m_out.aboveOrEqual(numberOfFuzzChecks, m_out.constInt32(atOrAfter)));
-            }
-            if (unsigned at = Options::fireOSRExitFuzzAt()) {
-                failCondition = m_out.bitOr(
-                    failCondition,
-                    m_out.equal(numberOfFuzzChecks, m_out.constInt32(at)));
-            }
-        }
+        if (verboseCompilationEnabled())
+            dataLog("    OSR exit #", m_ftlState.jitCode->osrExit.size(), " with availability: ", m_availability, "\n");
 
         ASSERT(m_ftlState.jitCode->osrExit.size() == m_ftlState.finalizer->osrExit.size());
         
         m_ftlState.jitCode->osrExit.append(OSRExit(
             kind, lowValue.format(), m_graph.methodOfGettingAValueProfileFor(highValue),
             m_codeOriginForExitTarget, m_codeOriginForExitProfile,
-            availabilityMap().m_locals.numberOfArguments(),
-            availabilityMap().m_locals.numberOfLocals()));
+            m_availability.numberOfArguments(), m_availability.numberOfLocals()));
         m_ftlState.finalizer->osrExit.append(OSRExitCompilationInfo());
         
         OSRExit& exit = m_ftlState.jitCode->osrExit.last();
 
-        LBasicBlock lastNext = nullptr;
-        LBasicBlock continuation = nullptr;
+        LBasicBlock lastNext = 0;
+        LBasicBlock continuation = 0;
         
         LBasicBlock failCase = FTL_NEW_BLOCK(m_out, ("OSR exit failCase for ", m_node));
         continuation = FTL_NEW_BLOCK(m_out, ("OSR exit continuation for ", m_node));
         
-        m_out.branch(failCondition, rarely(failCase), usually(continuation));
+        m_out.branch(failCondition, failCase, continuation);
         
         lastNext = m_out.appendTo(failCase, continuation);
         
@@ -8083,202 +4178,155 @@ private:
         OSRExit& exit, ExitArgumentList& arguments, FormattedValue lowValue,
         CodeOrigin codeOrigin)
     {
+        arguments.append(m_callFrame);
         if (!!lowValue)
             arguments.append(lowValue.value());
         
-        AvailabilityMap availabilityMap = this->availabilityMap();
-        availabilityMap.pruneByLiveness(m_graph, codeOrigin);
-        
-        HashMap<Node*, ExitTimeObjectMaterialization*> map;
-        availabilityMap.forEachAvailability(
-            [&] (Availability availability) {
-                if (!availability.shouldUseNode())
-                    return;
-                
-                Node* node = availability.node();
-                if (!node->isPhantomAllocation())
-                    return;
-                
-                auto result = map.add(node, nullptr);
-                if (result.isNewEntry) {
-                    result.iterator->value =
-                        exit.m_materializations.add(node->op(), node->origin.semantic);
-                }
-            });
-        
         for (unsigned i = 0; i < exit.m_values.size(); ++i) {
             int operand = exit.m_values.operandForIndex(i);
-            
-            Availability availability = availabilityMap.m_locals[i];
-            
-            if (Options::validateFTLOSRExitLiveness()) {
-                DFG_ASSERT(
-                    m_graph, m_node,
-                    (!(availability.isDead() && m_graph.isLiveInBytecode(VirtualRegister(operand), codeOrigin))) || m_graph.m_plan.mode == FTLForOSREntryMode);
+            bool isLive = m_graph.isLiveInBytecode(VirtualRegister(operand), codeOrigin);
+            if (!isLive) {
+                exit.m_values[i] = ExitValue::dead();
+                continue;
             }
             
-            exit.m_values[i] = exitValueForAvailability(arguments, map, availability);
-        }
-        
-        for (auto heapPair : availabilityMap.m_heap) {
-            Node* node = heapPair.key.base();
-            ExitTimeObjectMaterialization* materialization = map.get(node);
-            materialization->add(
-                heapPair.key.descriptor(),
-                exitValueForAvailability(arguments, map, heapPair.value));
+            Availability availability = m_availability[i];
+            FlushedAt flush = availability.flushedAt();
+            switch (flush.format()) {
+            case DeadFlush:
+            case ConflictingFlush:
+                if (availability.hasNode()) {
+                    addExitArgumentForNode(exit, arguments, i, availability.node());
+                    break;
+                }
+                
+                if (Options::validateFTLOSRExitLiveness()) {
+                    dataLog("Expected r", operand, " to be available but it wasn't.\n");
+                    RELEASE_ASSERT_NOT_REACHED();
+                }
+                
+                // This means that the DFG's DCE proved that the value is dead in bytecode
+                // even though the bytecode liveness analysis thinks it's live. This is
+                // acceptable since the DFG's DCE is by design more aggressive while still
+                // being sound.
+                exit.m_values[i] = ExitValue::dead();
+                break;
+
+            case FlushedJSValue:
+            case FlushedCell:
+            case FlushedBoolean:
+                exit.m_values[i] = ExitValue::inJSStack(flush.virtualRegister());
+                break;
+                
+            case FlushedInt32:
+                exit.m_values[i] = ExitValue::inJSStackAsInt32(flush.virtualRegister());
+                break;
+                
+            case FlushedInt52:
+                exit.m_values[i] = ExitValue::inJSStackAsInt52(flush.virtualRegister());
+                break;
+                
+            case FlushedDouble:
+                exit.m_values[i] = ExitValue::inJSStackAsDouble(flush.virtualRegister());
+                break;
+                
+            case FlushedArguments:
+                // FIXME: implement PhantomArguments.
+                // https://bugs.webkit.org/show_bug.cgi?id=113986
+                RELEASE_ASSERT_NOT_REACHED();
+                break;
+            }
         }
         
-        if (verboseCompilationEnabled()) {
+        if (verboseCompilationEnabled())
             dataLog("        Exit values: ", exit.m_values, "\n");
-            if (!exit.m_materializations.isEmpty()) {
-                dataLog("        Materializations: \n");
-                for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
-                    dataLog("            ", pointerDump(materialization), "\n");
-            }
-        }
     }
     
     void callStackmap(OSRExit& exit, ExitArgumentList& arguments)
     {
         exit.m_stackmapID = m_stackmapIDs++;
         arguments.insert(0, m_out.constInt32(MacroAssembler::maxJumpReplacementSize()));
-        arguments.insert(0, m_out.constInt64(exit.m_stackmapID));
+        arguments.insert(0, m_out.constInt32(exit.m_stackmapID));
         
         m_out.call(m_out.stackmapIntrinsic(), arguments);
     }
     
-    ExitValue exitValueForAvailability(
-        ExitArgumentList& arguments, const HashMap<Node*, ExitTimeObjectMaterialization*>& map,
-        Availability availability)
-    {
-        FlushedAt flush = availability.flushedAt();
-        switch (flush.format()) {
-        case DeadFlush:
-        case ConflictingFlush:
-            if (availability.hasNode())
-                return exitValueForNode(arguments, map, availability.node());
-            
-            // This means that the value is dead. It could be dead in bytecode or it could have
-            // been killed by our DCE, which can sometimes kill things even if they were live in
-            // bytecode.
-            return ExitValue::dead();
-
-        case FlushedJSValue:
-        case FlushedCell:
-        case FlushedBoolean:
-            return ExitValue::inJSStack(flush.virtualRegister());
-                
-        case FlushedInt32:
-            return ExitValue::inJSStackAsInt32(flush.virtualRegister());
-                
-        case FlushedInt52:
-            return ExitValue::inJSStackAsInt52(flush.virtualRegister());
-                
-        case FlushedDouble:
-            return ExitValue::inJSStackAsDouble(flush.virtualRegister());
-        }
-        
-        DFG_CRASH(m_graph, m_node, "Invalid flush format");
-        return ExitValue::dead();
-    }
-    
-    ExitValue exitValueForNode(
-        ExitArgumentList& arguments, const HashMap<Node*, ExitTimeObjectMaterialization*>& map,
-        Node* node)
+    void addExitArgumentForNode(
+        OSRExit& exit, ExitArgumentList& arguments, unsigned index, Node* node)
     {
         ASSERT(node->shouldGenerate());
         ASSERT(node->hasResult());
 
-        if (node) {
-            switch (node->op()) {
-            case BottomValue:
-                // This might arise in object materializations. I actually doubt that it would,
-                // but it seems worthwhile to be conservative.
-                return ExitValue::dead();
-                
-            case JSConstant:
-            case Int52Constant:
-            case DoubleConstant:
-                return ExitValue::constant(node->asJSValue());
-                
-            default:
-                if (node->isPhantomAllocation())
-                    return ExitValue::materializeNewObject(map.get(node));
-                break;
-            }
-        }
-        
-        for (unsigned i = 0; i < m_availableRecoveries.size(); ++i) {
-            AvailableRecovery recovery = m_availableRecoveries[i];
-            if (recovery.node() != node)
-                continue;
-            
-            ExitValue result = ExitValue::recovery(
-                recovery.opcode(), arguments.size(), arguments.size() + 1,
-                recovery.format());
-            arguments.append(recovery.left());
-            arguments.append(recovery.right());
-            return result;
-        }
+        if (tryToSetConstantExitArgument(exit, index, node))
+            return;
         
         LoweredNodeValue value = m_int32Values.get(node);
-        if (isValid(value))
-            return exitArgument(arguments, ValueFormatInt32, value.value());
+        if (isValid(value)) {
+            addExitArgument(exit, arguments, index, ValueFormatInt32, value.value());
+            return;
+        }
         
         value = m_int52Values.get(node);
-        if (isValid(value))
-            return exitArgument(arguments, ValueFormatInt52, value.value());
+        if (isValid(value)) {
+            addExitArgument(exit, arguments, index, ValueFormatInt52, value.value());
+            return;
+        }
         
         value = m_strictInt52Values.get(node);
-        if (isValid(value))
-            return exitArgument(arguments, ValueFormatStrictInt52, value.value());
+        if (isValid(value)) {
+            addExitArgument(exit, arguments, index, ValueFormatStrictInt52, value.value());
+            return;
+        }
         
         value = m_booleanValues.get(node);
         if (isValid(value)) {
             LValue valueToPass = m_out.zeroExt(value.value(), m_out.int32);
-            return exitArgument(arguments, ValueFormatBoolean, valueToPass);
+            addExitArgument(exit, arguments, index, ValueFormatBoolean, valueToPass);
+            return;
         }
         
         value = m_jsValueValues.get(node);
-        if (isValid(value))
-            return exitArgument(arguments, ValueFormatJSValue, value.value());
+        if (isValid(value)) {
+            addExitArgument(exit, arguments, index, ValueFormatJSValue, value.value());
+            return;
+        }
         
         value = m_doubleValues.get(node);
-        if (isValid(value))
-            return exitArgument(arguments, ValueFormatDouble, value.value());
+        if (isValid(value)) {
+            addExitArgument(exit, arguments, index, ValueFormatDouble, value.value());
+            return;
+        }
 
-        DFG_CRASH(m_graph, m_node, toCString("Cannot find value for node: ", node).data());
-        return ExitValue::dead();
-    }
-    
-    ExitValue exitArgument(ExitArgumentList& arguments, ValueFormat format, LValue value)
-    {
-        ExitValue result = ExitValue::exitArgument(ExitArgument(format, arguments.size()));
-        arguments.append(value);
-        return result;
+        dataLog("Cannot find value for node: ", node, "\n");
+        RELEASE_ASSERT_NOT_REACHED();
     }
     
-    bool doesKill(Edge edge)
+    bool tryToSetConstantExitArgument(OSRExit& exit, unsigned index, Node* node)
     {
-        if (edge.doesNotKill())
+        if (!node)
             return false;
         
-        if (edge->hasConstant())
+        switch (node->op()) {
+        case JSConstant:
+        case WeakJSConstant:
+            exit.m_values[index] = ExitValue::constant(m_graph.valueOfJSConstant(node));
+            return true;
+        case PhantomArguments:
+            // FIXME: implement PhantomArguments.
+            // https://bugs.webkit.org/show_bug.cgi?id=113986
+            RELEASE_ASSERT_NOT_REACHED();
+            return true;
+        default:
             return false;
-        
-        return true;
-    }
-
-    void addAvailableRecovery(
-        Node* node, RecoveryOpcode opcode, LValue left, LValue right, ValueFormat format)
-    {
-        m_availableRecoveries.append(AvailableRecovery(node, opcode, left, right, format));
+        }
     }
     
-    void addAvailableRecovery(
-        Edge edge, RecoveryOpcode opcode, LValue left, LValue right, ValueFormat format)
+    void addExitArgument(
+        OSRExit& exit, ExitArgumentList& arguments, unsigned index, ValueFormat format,
+        LValue value)
     {
-        addAvailableRecovery(edge.node(), opcode, left, right, format);
+        exit.m_values[index] = ExitValue::exitArgument(ExitArgument(format, arguments.size()));
+        arguments.append(value);
     }
     
     void setInt32(Node* node, LValue value)
@@ -8305,7 +4353,7 @@ private:
             return;
         }
         
-        DFG_CRASH(m_graph, m_node, "Corrupt int52 kind");
+        RELEASE_ASSERT_NOT_REACHED();
     }
     void setJSValue(Node* node, LValue value)
     {
@@ -8370,33 +4418,12 @@ private:
     {
         m_graph.m_plan.weakReferences.addLazily(target);
     }
-
-    LValue loadStructure(LValue value)
-    {
-        LValue tableIndex = m_out.load32(value, m_heaps.JSCell_structureID);
-        LValue tableBase = m_out.loadPtr(
-            m_out.absolute(vm().heap.structureIDTable().base()));
-        TypedPointer address = m_out.baseIndex(
-            m_heaps.structureTable, tableBase, m_out.zeroExtPtr(tableIndex));
-        return m_out.loadPtr(address);
-    }
-
+    
     LValue weakPointer(JSCell* pointer)
     {
         addWeakReference(pointer);
         return m_out.constIntPtr(pointer);
     }
-
-    LValue weakStructureID(Structure* structure)
-    {
-        addWeakReference(structure);
-        return m_out.constInt32(structure->id());
-    }
-    
-    LValue weakStructure(Structure* structure)
-    {
-        return weakPointer(structure);
-    }
     
     TypedPointer addressFor(LValue base, int operand, ptrdiff_t offset = 0)
     {
@@ -8404,100 +4431,37 @@ private:
     }
     TypedPointer payloadFor(LValue base, int operand)
     {
-        return addressFor(base, operand, PayloadOffset);
+        return addressFor(base, operand, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     }
     TypedPointer tagFor(LValue base, int operand)
     {
-        return addressFor(base, operand, TagOffset);
+        return addressFor(base, operand, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
     }
-    TypedPointer addressFor(int operand, ptrdiff_t offset = 0)
+    TypedPointer addressFor(int operand)
     {
-        return addressFor(VirtualRegister(operand), offset);
+        return addressFor(m_callFrame, operand);
     }
-    TypedPointer addressFor(VirtualRegister operand, ptrdiff_t offset = 0)
+    TypedPointer addressFor(VirtualRegister operand)
     {
-        if (operand.isLocal())
-            return addressFor(m_captured, operand.offset(), offset);
-        return addressFor(m_callFrame, operand.offset(), offset);
+        return addressFor(m_callFrame, operand.offset());
     }
     TypedPointer payloadFor(int operand)
     {
-        return payloadFor(VirtualRegister(operand));
+        return payloadFor(m_callFrame, operand);
     }
     TypedPointer payloadFor(VirtualRegister operand)
     {
-        return addressFor(operand, PayloadOffset);
+        return payloadFor(m_callFrame, operand.offset());
     }
     TypedPointer tagFor(int operand)
     {
-        return tagFor(VirtualRegister(operand));
+        return tagFor(m_callFrame, operand);
     }
     TypedPointer tagFor(VirtualRegister operand)
     {
-        return addressFor(operand, TagOffset);
-    }
-    
-    AbstractValue abstractValue(Node* node)
-    {
-        return m_state.forNode(node);
-    }
-    AbstractValue abstractValue(Edge edge)
-    {
-        return abstractValue(edge.node());
-    }
-    
-    SpeculatedType provenType(Node* node)
-    {
-        return abstractValue(node).m_type;
-    }
-    SpeculatedType provenType(Edge edge)
-    {
-        return provenType(edge.node());
-    }
-    
-    JSValue provenValue(Node* node)
-    {
-        return abstractValue(node).m_value;
-    }
-    JSValue provenValue(Edge edge)
-    {
-        return provenValue(edge.node());
-    }
-    
-    StructureAbstractValue abstractStructure(Node* node)
-    {
-        return abstractValue(node).m_structure;
-    }
-    StructureAbstractValue abstractStructure(Edge edge)
-    {
-        return abstractStructure(edge.node());
+        return tagFor(m_callFrame, operand.offset());
     }
     
-    void crash()
-    {
-        crash(m_highBlock->index, m_node->index());
-    }
-    void crash(BlockIndex blockIndex, unsigned nodeIndex)
-    {
-#if ASSERT_DISABLED
-        m_out.call(m_out.operation(ftlUnreachable));
-        UNUSED_PARAM(blockIndex);
-        UNUSED_PARAM(nodeIndex);
-#else
-        m_out.call(
-            m_out.intToPtr(
-                m_out.constIntPtr(ftlUnreachable),
-                pointerType(
-                    functionType(
-                        m_out.voidType, m_out.intPtr, m_out.int32, m_out.int32))),
-            m_out.constIntPtr(codeBlock()), m_out.constInt32(blockIndex),
-            m_out.constInt32(nodeIndex));
-#endif
-        m_out.unreachable();
-    }
-
-    AvailabilityMap& availabilityMap() { return m_availabilityCalculator.m_availability; }
-    
     VM& vm() { return m_graph.m_vm; }
     CodeBlock* codeBlock() { return m_graph.m_codeBlock; }
     
@@ -8507,11 +4471,9 @@ private:
     Output m_out;
     
     LBasicBlock m_prologue;
-    LBasicBlock m_handleExceptions;
     HashMap<BasicBlock*, LBasicBlock> m_blocks;
     
     LValue m_callFrame;
-    LValue m_captured;
     LValue m_tagTypeNumber;
     LValue m_tagMask;
     
@@ -8523,16 +4485,9 @@ private:
     HashMap<Node*, LoweredNodeValue> m_storageValues;
     HashMap<Node*, LoweredNodeValue> m_doubleValues;
     
-    // This is a bit of a hack. It prevents LLVM from having to do CSE on loading of arguments.
-    // It's nice to have these optimizations on our end because we can guarantee them a bit better.
-    // Probably also saves LLVM compile time.
-    HashMap<Node*, LValue> m_loadedArgumentValues;
-    
     HashMap<Node*, LValue> m_phis;
     
-    LocalOSRAvailabilityCalculator m_availabilityCalculator;
-    
-    Vector<AvailableRecovery, 3> m_availableRecoveries;
+    Operands<Availability> m_availability;
     
     InPlaceAbstractState m_state;
     AbstractInterpreter<InPlaceAbstractState> m_interpreter;
@@ -8546,12 +4501,8 @@ private:
     Node* m_node;
     
     uint32_t m_stackmapIDs;
-    unsigned m_tbaaKind;
-    unsigned m_tbaaStructKind;
 };
 
-} // anonymous namespace
-
 void lowerDFGToLLVM(State& state)
 {
     LowerDFGToLLVM lowering(state);
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h
index 0e38d7ba9..ad7d44c4d 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.h
@@ -26,6 +26,8 @@
 #ifndef FTLLowerDFGToLLVM_h
 #define FTLLowerDFGToLLVM_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGGraph.h"
diff --git a/Source/JavaScriptCore/ftl/FTLLoweredNodeValue.h b/Source/JavaScriptCore/ftl/FTLLoweredNodeValue.h
index fc60e567f..93e6c4d09 100644
--- a/Source/JavaScriptCore/ftl/FTLLoweredNodeValue.h
+++ b/Source/JavaScriptCore/ftl/FTLLoweredNodeValue.h
@@ -26,6 +26,8 @@
 #ifndef FTLLoweredNodeValue_h
 #define FTLLoweredNodeValue_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGBasicBlock.h"
diff --git a/Source/JavaScriptCore/ftl/FTLOSREntry.cpp b/Source/JavaScriptCore/ftl/FTLOSREntry.cpp
index 5429eaeb6..185046054 100644
--- a/Source/JavaScriptCore/ftl/FTLOSREntry.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSREntry.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,20 +32,17 @@
 #include "FTLForOSREntryJITCode.h"
 #include "JSStackInlines.h"
 #include "OperandsInlines.h"
-#include "JSCInlines.h"
 
 #if ENABLE(FTL_JIT)
 
 namespace JSC { namespace FTL {
 
-SUPPRESS_ASAN
 void* prepareOSREntry(
     ExecState* exec, CodeBlock* dfgCodeBlock, CodeBlock* entryCodeBlock,
     unsigned bytecodeIndex, unsigned streamIndex)
 {
     VM& vm = exec->vm();
     CodeBlock* baseline = dfgCodeBlock->baselineVersion();
-    ExecutableBase* executable = dfgCodeBlock->ownerExecutable();
     DFG::JITCode* dfgCode = dfgCodeBlock->jitCode()->dfg();
     ForOSREntryJITCode* entryCode = entryCodeBlock->jitCode()->ftlForOSREntry();
     
@@ -55,12 +52,9 @@ void* prepareOSREntry(
             bytecodeIndex, ".\n");
     }
     
-    if (bytecodeIndex)
-        jsCast<ScriptExecutable*>(executable)->setDidTryToEnterInLoop(true);
-
     if (bytecodeIndex != entryCode->bytecodeIndex()) {
         if (Options::verboseOSR())
-            dataLog("    OSR failed because we don't have an entrypoint for bc#", bytecodeIndex, "; ours is for bc#", entryCode->bytecodeIndex(), "\n");
+            dataLog("    OSR failed because we don't have an entrypoint for bc#", bytecodeIndex, "; ours is for bc#", entryCode->bytecodeIndex());
         return 0;
     }
     
@@ -72,14 +66,8 @@ void* prepareOSREntry(
         dataLog("    Values at entry: ", values, "\n");
     
     for (int argument = values.numberOfArguments(); argument--;) {
-        JSValue valueOnStack = exec->r(virtualRegisterForArgument(argument).offset()).asanUnsafeJSValue();
-        JSValue reconstructedValue = values.argument(argument);
-        if (valueOnStack == reconstructedValue || !argument)
-            continue;
-        dataLog("Mismatch between reconstructed values and the the value on the stack for argument arg", argument, " for ", *entryCodeBlock, " at bc#", bytecodeIndex, ":\n");
-        dataLog("    Value on stack: ", valueOnStack, "\n");
-        dataLog("    Reconstructed value: ", reconstructedValue, "\n");
-        RELEASE_ASSERT_NOT_REACHED();
+        RELEASE_ASSERT(
+            exec->r(virtualRegisterForArgument(argument).offset()).jsValue() == values.argument(argument));
     }
     
     RELEASE_ASSERT(
@@ -92,7 +80,7 @@ void* prepareOSREntry(
         scratch[local] = JSValue::encode(values.local(local));
     
     int stackFrameSize = entryCode->common.requiredRegisterCountForExecutionAndExit();
-    if (!vm.interpreter->stack().ensureCapacityFor(&exec->registers()[virtualRegisterForLocal(stackFrameSize - 1).offset()])) {
+    if (!vm.interpreter->stack().grow(&exec->registers()[virtualRegisterForLocal(stackFrameSize).offset()])) {
         if (Options::verboseOSR())
             dataLog("    OSR failed because stack growth failed.\n");
         return 0;
@@ -100,9 +88,7 @@ void* prepareOSREntry(
     
     exec->setCodeBlock(entryCodeBlock);
     
-    void* result = entryCode->addressForCall(
-        vm, executable, ArityCheckNotRequired,
-        RegisterPreservationNotRequired).executableAddress();
+    void* result = entryCode->addressForCall().executableAddress();
     if (Options::verboseOSR())
         dataLog("    Entry will succeed, going to address", RawPointer(result), "\n");
     
diff --git a/Source/JavaScriptCore/ftl/FTLOSREntry.h b/Source/JavaScriptCore/ftl/FTLOSREntry.h
index 3e2c11e43..d19f10e74 100644
--- a/Source/JavaScriptCore/ftl/FTLOSREntry.h
+++ b/Source/JavaScriptCore/ftl/FTLOSREntry.h
@@ -26,6 +26,8 @@
 #ifndef FTLOSREntry_h
 #define FTLOSREntry_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExit.cpp b/Source/JavaScriptCore/ftl/FTLOSRExit.cpp
index 3d96f3944..00ea014cb 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExit.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExit.cpp
@@ -34,7 +34,7 @@
 #include "FTLExitArgument.h"
 #include "FTLExitArgumentList.h"
 #include "FTLJITCode.h"
-#include "JSCInlines.h"
+#include "Operations.h"
 
 namespace JSC { namespace FTL {
 
@@ -61,15 +61,6 @@ CodeLocationJump OSRExit::codeLocationForRepatch(CodeBlock* ftlCodeBlock) const
         m_patchableCodeOffset);
 }
 
-void OSRExit::validateReferences(const TrackedReferences& trackedReferences)
-{
-    for (unsigned i = m_values.size(); i--;)
-        m_values[i].validateReferences(trackedReferences);
-    
-    for (ExitTimeObjectMaterialization* materialization : m_materializations)
-        materialization->validateReferences(trackedReferences);
-}
-
 } } // namespace JSC::FTL
 
 #endif // ENABLE(FTL_JIT)
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExit.h b/Source/JavaScriptCore/ftl/FTLOSRExit.h
index 337c61840..4e479ebdd 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExit.h
+++ b/Source/JavaScriptCore/ftl/FTLOSRExit.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef FTLOSRExit_h
 #define FTLOSRExit_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "CodeOrigin.h"
@@ -33,7 +35,6 @@
 #include "DFGOSRExitBase.h"
 #include "FTLAbbreviations.h"
 #include "FTLExitArgumentList.h"
-#include "FTLExitTimeObjectMaterialization.h"
 #include "FTLExitValue.h"
 #include "FTLFormattedValue.h"
 #include "MethodOfGettingAValueProfile.h"
@@ -41,20 +42,18 @@
 #include "ValueProfile.h"
 #include "VirtualRegister.h"
 
-namespace JSC {
-
-class TrackedReferences;
-
-namespace FTL {
+namespace JSC { namespace FTL {
 
 // Tracks one OSR exit site within the FTL JIT. OSR exit in FTL works by deconstructing
 // the crazy that is OSR down to simple SSA CFG primitives that any compiler backend
-// (including of course LLVM) can grok and do meaningful things to. An exit is just a
-// conditional branch in the emitted code where one destination is the continuation and
-// the other is a basic block that performs a no-return tail-call to an  exit thunk.
-// This thunk takes as its arguments the live non-constant not-already-accounted-for
-// bytecode state. To appreciate how this works consider the following JavaScript
-// program, and its lowering down to LLVM IR including the relevant exits:
+// (including of course LLVM) can grok and do meaningful things to. Except for
+// watchpoint-based exits, which haven't yet been implemented (see webkit.org/b/113647),
+// an exit is just a conditional branch in the emitted code where one destination is the
+// continuation and the other is a basic block that performs a no-return tail-call to an
+// exit thunk. This thunk takes as its arguments the live non-constant
+// not-already-accounted-for bytecode state. To appreciate how this works consider the
+// following JavaScript program, and its lowering down to LLVM IR including the relevant
+// exits:
 //
 // function foo(o) {
 //     var a = o.a; // predicted int
@@ -68,10 +67,10 @@ namespace FTL {
 //
 // BitOr(Check:Int32:@a, Int32:5)
 //
-// Where @a is the node for the value of the 'a' variable. Conceptually, this node can
-// be further broken down to the following (note that this particular lowering never
-// actually happens - we skip this step and go straight to LLVM IR - but it's still
-// useful to see this):
+// Where @a is the node for the GetLocal node that gets the value of the 'a' variable.
+// Conceptually, this node can be further broken down to the following (note that this
+// particular lowering never actually happens - we skip this step and go straight to
+// LLVM IR - but it's still useful to see this):
 //
 // exitIf(@a is not int32);
 // continuation;
@@ -126,12 +125,22 @@ namespace FTL {
 //   arguments into argument position), the backend could choose to simply inform us
 //   where it had placed the arguments and expect the callee (i.e. the exit thunk) to
 //   figure it out from there. It could also tell us what we need to do to pop stack,
-//   although again, it doesn't have to; it could just emit that code normally. We do
-//   all of these things through the patchpoint/stackmap LLVM intrinsics.
+//   although again, it doesn't have to; it could just emit that code normally. Though
+//   we don't support this yet, we could; the only thing that would change on our end
+//   is that we'd need feedback from the backend about the location of the arguments
+//   and a description of the things that need to be done to pop stack. This would
+//   involve switching the m_values array to use something more akin to ValueRecovery
+//   rather than the current ExitValue, albeit possibly with some hacks to better
+//   understand the kinds of places where the LLVM backend would put values.
 //
 // - It could be extended to allow the backend to do its own exit hoisting, by using
 //   intrinsics (or meta-data, or something) to inform the backend that it's safe to
 //   make the predicate passed to 'exitIf()' more truthy.
+//
+// - It could be extended to support watchpoints (see webkit.org/b/113647) by making
+//   the predicate passed to 'exitIf()' be an intrinsic that the backend knows to be
+//   true at compile-time. The backend could then turn the conditional branch into a
+//   replaceable jump, much like the DFG does.
 
 struct OSRExit : public DFG::OSRExitBase {
     OSRExit(
@@ -153,18 +162,10 @@ struct OSRExit : public DFG::OSRExitBase {
     unsigned m_patchableCodeOffset;
     
     Operands<ExitValue> m_values;
-    Bag<ExitTimeObjectMaterialization> m_materializations;
     
     uint32_t m_stackmapID;
     
     CodeLocationJump codeLocationForRepatch(CodeBlock* ftlCodeBlock) const;
-    
-    void considerAddingAsFrequentExitSite(CodeBlock* profiledCodeBlock)
-    {
-        OSRExitBase::considerAddingAsFrequentExitSite(profiledCodeBlock, ExitFromFTL);
-    }
-    
-    void validateReferences(const TrackedReferences&);
 };
 
 } } // namespace JSC::FTL
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompilationInfo.h b/Source/JavaScriptCore/ftl/FTLOSRExitCompilationInfo.h
index 4dd7fb299..796c9d691 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompilationInfo.h
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompilationInfo.h
@@ -26,6 +26,8 @@
 #ifndef FTLOSRExitCompilationInfo_h
 #define FTLOSRExitCompilationInfo_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviations.h"
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
index 1650143a5..076a495ea 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,101 +33,19 @@
 #include "FTLExitArgumentForOperand.h"
 #include "FTLJITCode.h"
 #include "FTLOSRExit.h"
-#include "FTLOperations.h"
-#include "FTLState.h"
 #include "FTLSaveRestore.h"
-#include "LinkBuffer.h"
-#include "MaxFrameExtentForSlowPathCall.h"
 #include "OperandsInlines.h"
-#include "JSCInlines.h"
-#include "RegisterPreservationWrapperGenerator.h"
+#include "Operations.h"
 #include "RepatchBuffer.h"
 
 namespace JSC { namespace FTL {
 
 using namespace DFG;
 
-static void compileRecovery(
-    CCallHelpers& jit, const ExitValue& value, StackMaps::Record* record, StackMaps& stackmaps,
-    char* registerScratch,
-    const HashMap<ExitTimeObjectMaterialization*, EncodedJSValue*>& materializationToPointer)
-{
-    switch (value.kind()) {
-    case ExitValueDead:
-        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
-        break;
-            
-    case ExitValueConstant:
-        jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
-        break;
-            
-    case ExitValueArgument:
-        record->locations[value.exitArgument().argument()].restoreInto(
-            jit, stackmaps, registerScratch, GPRInfo::regT0);
-        break;
-            
-    case ExitValueInJSStack:
-    case ExitValueInJSStackAsInt32:
-    case ExitValueInJSStackAsInt52:
-    case ExitValueInJSStackAsDouble:
-        jit.load64(AssemblyHelpers::addressFor(value.virtualRegister()), GPRInfo::regT0);
-        break;
-            
-    case ExitValueRecovery:
-        record->locations[value.rightRecoveryArgument()].restoreInto(
-            jit, stackmaps, registerScratch, GPRInfo::regT1);
-        record->locations[value.leftRecoveryArgument()].restoreInto(
-            jit, stackmaps, registerScratch, GPRInfo::regT0);
-        switch (value.recoveryOpcode()) {
-        case AddRecovery:
-            switch (value.recoveryFormat()) {
-            case ValueFormatInt32:
-                jit.add32(GPRInfo::regT1, GPRInfo::regT0);
-                break;
-            case ValueFormatInt52:
-                jit.add64(GPRInfo::regT1, GPRInfo::regT0);
-                break;
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-                break;
-            }
-            break;
-        case SubRecovery:
-            switch (value.recoveryFormat()) {
-            case ValueFormatInt32:
-                jit.sub32(GPRInfo::regT1, GPRInfo::regT0);
-                break;
-            case ValueFormatInt52:
-                jit.sub64(GPRInfo::regT1, GPRInfo::regT0);
-                break;
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-                break;
-            }
-            break;
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-            break;
-        }
-        break;
-        
-    case ExitValueMaterializeNewObject:
-        jit.loadPtr(materializationToPointer.get(value.objectMaterialization()), GPRInfo::regT0);
-        break;
-            
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-        break;
-    }
-        
-    reboxAccordingToFormat(
-        value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
-}
-
 static void compileStub(
     unsigned exitID, JITCode* jitCode, OSRExit& exit, VM* vm, CodeBlock* codeBlock)
 {
-    StackMaps::Record* record = nullptr;
+    StackMaps::Record* record;
     
     for (unsigned i = jitCode->stackmaps.records.size(); i--;) {
         record = &jitCode->stackmaps.records[i];
@@ -142,341 +60,116 @@ static void compileStub(
 
     CCallHelpers jit(vm, codeBlock);
     
-    // We need scratch space to save all registers, to build up the JS stack, to deal with unwind
-    // fixup, pointers to all of the objects we materialize, and the elements inside those objects
-    // that we materialize.
-    
-    // Figure out how much space we need for those object allocations.
-    unsigned numMaterializations = 0;
-    size_t maxMaterializationNumArguments = 0;
-    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
-        numMaterializations++;
-        
-        maxMaterializationNumArguments = std::max(
-            maxMaterializationNumArguments,
-            materialization->properties().size());
-    }
-    
-    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(
-        sizeof(EncodedJSValue) * (
-            exit.m_values.size() + numMaterializations + maxMaterializationNumArguments) +
-        requiredScratchMemorySizeInBytes() +
-        jitCode->unwindInfo.m_registers.size() * sizeof(uint64_t));
+    // We need scratch space to save all registers and to build up the JSStack.
+    // Use a scratch buffer to transfer all values.
+    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(sizeof(EncodedJSValue) * exit.m_values.size() + requiredScratchMemorySizeInBytes());
     EncodedJSValue* scratch = scratchBuffer ? static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer()) : 0;
-    EncodedJSValue* materializationPointers = scratch + exit.m_values.size();
-    EncodedJSValue* materializationArguments = materializationPointers + numMaterializations;
-    char* registerScratch = bitwise_cast<char*>(materializationArguments + maxMaterializationNumArguments);
-    uint64_t* unwindScratch = bitwise_cast<uint64_t*>(registerScratch + requiredScratchMemorySizeInBytes());
-    
-    HashMap<ExitTimeObjectMaterialization*, EncodedJSValue*> materializationToPointer;
-    unsigned materializationCount = 0;
-    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
-        materializationToPointer.add(
-            materialization, materializationPointers + materializationCount++);
-    }
+    char* registerScratch = bitwise_cast<char*>(scratch + exit.m_values.size());
     
-    // Note that we come in here, the stack used to be as LLVM left it except that someone called pushToSave().
-    // We don't care about the value they saved. But, we do appreciate the fact that they did it, because we use
-    // that slot for saveAllRegisters().
-
+    // Make sure that saveAllRegisters() has a place on top of the stack to spill things. That
+    // function expects to be able to use top of stack for scratch memory.
+    jit.push(GPRInfo::regT0);
     saveAllRegisters(jit, registerScratch);
     
-    // Bring the stack back into a sane form and assert that it's sane.
-    jit.popToRestore(GPRInfo::regT0);
-    jit.checkStackPointerAlignment();
+    // Bring the stack back into a sane form.
+    jit.pop(GPRInfo::regT0);
+    jit.pop(GPRInfo::regT0);
     
-    if (vm->m_perBytecodeProfiler && codeBlock->jitCode()->dfgCommon()->compilation) {
-        Profiler::Database& database = *vm->m_perBytecodeProfiler;
-        Profiler::Compilation* compilation = codeBlock->jitCode()->dfgCommon()->compilation.get();
-        
-        Profiler::OSRExit* profilerExit = compilation->addOSRExit(
-            exitID, Profiler::OriginStack(database, codeBlock, exit.m_codeOrigin),
-            exit.m_kind, exit.m_kind == UncountableInvalidation);
-        jit.add64(CCallHelpers::TrustedImm32(1), CCallHelpers::AbsoluteAddress(profilerExit->counterAddress()));
-    }
-
     // The remaining code assumes that SP/FP are in the same state that they were in the FTL's
     // call frame.
     
     // Get the call frame and tag thingies.
     // Restore the exiting function's callFrame value into a regT4
+    record->locations[0].restoreInto(jit, jitCode->stackmaps, registerScratch, GPRInfo::regT4);
     jit.move(MacroAssembler::TrustedImm64(TagTypeNumber), GPRInfo::tagTypeNumberRegister);
     jit.move(MacroAssembler::TrustedImm64(TagMask), GPRInfo::tagMaskRegister);
     
     // Do some value profiling.
     if (exit.m_profileValueFormat != InvalidValueFormat) {
-        record->locations[0].restoreInto(jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
+        record->locations[1].restoreInto(jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
         reboxAccordingToFormat(
             exit.m_profileValueFormat, jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
         
         if (exit.m_kind == BadCache || exit.m_kind == BadIndexingType) {
             CodeOrigin codeOrigin = exit.m_codeOriginForExitProfile;
             if (ArrayProfile* arrayProfile = jit.baselineCodeBlockFor(codeOrigin)->getArrayProfile(codeOrigin.bytecodeIndex)) {
-                jit.load32(MacroAssembler::Address(GPRInfo::regT0, JSCell::structureIDOffset()), GPRInfo::regT1);
-                jit.store32(GPRInfo::regT1, arrayProfile->addressOfLastSeenStructureID());
-                jit.load8(MacroAssembler::Address(GPRInfo::regT0, JSCell::indexingTypeOffset()), GPRInfo::regT1);
+                jit.loadPtr(MacroAssembler::Address(GPRInfo::regT0, JSCell::structureOffset()), GPRInfo::regT1);
+                jit.storePtr(GPRInfo::regT1, arrayProfile->addressOfLastSeenStructure());
+                jit.load8(MacroAssembler::Address(GPRInfo::regT1, Structure::indexingTypeOffset()), GPRInfo::regT1);
                 jit.move(MacroAssembler::TrustedImm32(1), GPRInfo::regT2);
                 jit.lshift32(GPRInfo::regT1, GPRInfo::regT2);
                 jit.or32(GPRInfo::regT2, MacroAssembler::AbsoluteAddress(arrayProfile->addressOfArrayModes()));
             }
         }
-
+        
         if (!!exit.m_valueProfile)
             jit.store64(GPRInfo::regT0, exit.m_valueProfile.getSpecFailBucket(0));
     }
 
-    // Materialize all objects. Don't materialize an object until all
-    // of the objects it needs have been materialized. We break cycles
-    // by populating objects late - we only consider an object as
-    // needing another object if the later is needed for the
-    // allocation of the former.
-
-    HashSet<ExitTimeObjectMaterialization*> toMaterialize;
-    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
-        toMaterialize.add(materialization);
-
-    while (!toMaterialize.isEmpty()) {
-        unsigned previousToMaterializeSize = toMaterialize.size();
-
-        Vector<ExitTimeObjectMaterialization*> worklist;
-        worklist.appendRange(toMaterialize.begin(), toMaterialize.end());
-        for (ExitTimeObjectMaterialization* materialization : worklist) {
-            // Check if we can do anything about this right now.
-            bool allGood = true;
-            for (ExitPropertyValue value : materialization->properties()) {
-                if (!value.value().isObjectMaterialization())
-                    continue;
-                if (!value.location().neededForMaterialization())
-                    continue;
-                if (toMaterialize.contains(value.value().objectMaterialization())) {
-                    // Gotta skip this one, since it needs a
-                    // materialization that hasn't been materialized.
-                    allGood = false;
-                    break;
-                }
-            }
-            if (!allGood)
-                continue;
-
-            // All systems go for materializing the object. First we
-            // recover the values of all of its fields and then we
-            // call a function to actually allocate the beast.
-            // We only recover the fields that are needed for the allocation.
-            for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
-                const ExitPropertyValue& property = materialization->properties()[propertyIndex];
-                const ExitValue& value = property.value();
-                if (!property.location().neededForMaterialization())
-                    continue;
-
-                compileRecovery(
-                    jit, value, record, jitCode->stackmaps, registerScratch,
-                    materializationToPointer);
-                jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
-            }
-            
-            // This call assumes that we don't pass arguments on the stack.
-            jit.setupArgumentsWithExecState(
-                CCallHelpers::TrustedImmPtr(materialization),
-                CCallHelpers::TrustedImmPtr(materializationArguments));
-            jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationMaterializeObjectInOSR)), GPRInfo::nonArgGPR0);
-            jit.call(GPRInfo::nonArgGPR0);
-            jit.storePtr(GPRInfo::returnValueGPR, materializationToPointer.get(materialization));
-
-            // Let everyone know that we're done.
-            toMaterialize.remove(materialization);
-        }
-        
-        // We expect progress! This ensures that we crash rather than looping infinitely if there
-        // is something broken about this fixpoint. Or, this could happen if we ever violate the
-        // "materializations form a DAG" rule.
-        RELEASE_ASSERT(toMaterialize.size() < previousToMaterializeSize);
-    }
-
-    // Now that all the objects have been allocated, we populate them
-    // with the correct values. This time we can recover all the
-    // fields, including those that are only needed for the allocation.
-    for (ExitTimeObjectMaterialization* materialization : exit.m_materializations) {
-        for (unsigned propertyIndex = materialization->properties().size(); propertyIndex--;) {
-            const ExitValue& value = materialization->properties()[propertyIndex].value();
-            compileRecovery(
-                jit, value, record, jitCode->stackmaps, registerScratch,
-                materializationToPointer);
-            jit.storePtr(GPRInfo::regT0, materializationArguments + propertyIndex);
-        }
-
-        // This call assumes that we don't pass arguments on the stack
-        jit.setupArgumentsWithExecState(
-            CCallHelpers::TrustedImmPtr(materialization),
-            CCallHelpers::TrustedImmPtr(materializationToPointer.get(materialization)),
-            CCallHelpers::TrustedImmPtr(materializationArguments));
-        jit.move(CCallHelpers::TrustedImmPtr(bitwise_cast<void*>(operationPopulateObjectInOSR)), GPRInfo::nonArgGPR0);
-        jit.call(GPRInfo::nonArgGPR0);
-    }
-
     // Save all state from wherever the exit data tells us it was, into the appropriate place in
-    // the scratch buffer. This also does the reboxing.
+    // the scratch buffer. This doesn't rebox any values yet.
     
     for (unsigned index = exit.m_values.size(); index--;) {
-        compileRecovery(
-            jit, exit.m_values[index], record, jitCode->stackmaps, registerScratch,
-            materializationToPointer);
-        jit.store64(GPRInfo::regT0, scratch + index);
-    }
-    
-    // Henceforth we make it look like the exiting function was called through a register
-    // preservation wrapper. This implies that FP must be nudged down by a certain amount. Then
-    // we restore the various things according to either exit.m_values or by copying from the
-    // old frame, and finally we save the various callee-save registers into where the
-    // restoration thunk would restore them from.
-    
-    ptrdiff_t offset = registerPreservationOffset();
-    RegisterSet toSave = registersToPreserve();
-    
-    // Before we start messing with the frame, we need to set aside any registers that the
-    // FTL code was preserving.
-    for (unsigned i = jitCode->unwindInfo.m_registers.size(); i--;) {
-        RegisterAtOffset entry = jitCode->unwindInfo.m_registers[i];
-        jit.load64(
-            MacroAssembler::Address(MacroAssembler::framePointerRegister, entry.offset()),
-            GPRInfo::regT0);
-        jit.store64(GPRInfo::regT0, unwindScratch + i);
-    }
-    
-    jit.load32(CCallHelpers::payloadFor(JSStack::ArgumentCount), GPRInfo::regT2);
-    
-    // Let's say that the FTL function had failed its arity check. In that case, the stack will
-    // contain some extra stuff.
-    //
-    // First we compute the padded stack space:
-    //
-    //     paddedStackSpace = roundUp(codeBlock->numParameters - regT2 + 1)
-    //
-    // The stack will have regT2 + CallFrameHeaderSize stuff, but above it there will be
-    // paddedStackSpace gunk used by the arity check fail restoration thunk. When that happens
-    // we want to make the stack look like this, from higher addresses down:
-    //
-    //     - register preservation return PC
-    //     - preserved registers
-    //     - arity check fail return PC
-    //     - argument padding
-    //     - actual arguments
-    //     - call frame header
-    //
-    // So that the actual call frame header appears to return to the arity check fail return
-    // PC, and that then returns to the register preservation thunk. The arity check thunk that
-    // we return to will have the padding size encoded into it. It will then know to return
-    // into the register preservation thunk, which uses the argument count to figure out where
-    // registers are preserved.
-
-    // This code assumes that we're dealing with FunctionCode.
-    RELEASE_ASSERT(codeBlock->codeType() == FunctionCode);
-    
-    jit.add32(
-        MacroAssembler::TrustedImm32(-codeBlock->numParameters()), GPRInfo::regT2,
-        GPRInfo::regT3);
-    MacroAssembler::Jump arityIntact = jit.branch32(
-        MacroAssembler::GreaterThanOrEqual, GPRInfo::regT3, MacroAssembler::TrustedImm32(0));
-    jit.neg32(GPRInfo::regT3);
-    jit.add32(MacroAssembler::TrustedImm32(1 + stackAlignmentRegisters() - 1), GPRInfo::regT3);
-    jit.and32(MacroAssembler::TrustedImm32(-stackAlignmentRegisters()), GPRInfo::regT3);
-    jit.add32(GPRInfo::regT3, GPRInfo::regT2);
-    arityIntact.link(&jit);
-
-    // First set up SP so that our data doesn't get clobbered by signals.
-    unsigned conservativeStackDelta =
-        registerPreservationOffset() +
-        exit.m_values.numberOfLocals() * sizeof(Register) +
-        maxFrameExtentForSlowPathCall;
-    conservativeStackDelta = WTF::roundUpToMultipleOf(
-        stackAlignmentBytes(), conservativeStackDelta);
-    jit.addPtr(
-        MacroAssembler::TrustedImm32(-conservativeStackDelta),
-        MacroAssembler::framePointerRegister, MacroAssembler::stackPointerRegister);
-    jit.checkStackPointerAlignment();
-    
-    jit.subPtr(
-        MacroAssembler::TrustedImm32(registerPreservationOffset()),
-        MacroAssembler::framePointerRegister);
-    
-    // Copy the old frame data into its new location.
-    jit.add32(MacroAssembler::TrustedImm32(JSStack::CallFrameHeaderSize), GPRInfo::regT2);
-    jit.move(MacroAssembler::framePointerRegister, GPRInfo::regT1);
-    MacroAssembler::Label loop = jit.label();
-    jit.sub32(MacroAssembler::TrustedImm32(1), GPRInfo::regT2);
-    jit.load64(MacroAssembler::Address(GPRInfo::regT1, offset), GPRInfo::regT0);
-    jit.store64(GPRInfo::regT0, GPRInfo::regT1);
-    jit.addPtr(MacroAssembler::TrustedImm32(sizeof(Register)), GPRInfo::regT1);
-    jit.branchTest32(MacroAssembler::NonZero, GPRInfo::regT2).linkTo(loop, &jit);
-    
-    // At this point regT1 points to where we would save our registers. Save them here.
-    ptrdiff_t currentOffset = 0;
-    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
-        if (!toSave.get(reg))
-            continue;
-        currentOffset += sizeof(Register);
-        unsigned unwindIndex = jitCode->unwindInfo.indexOf(reg);
-        if (unwindIndex == UINT_MAX) {
-            // The FTL compilation didn't preserve this register. This means that it also
-            // didn't use the register. So its value at the beginning of OSR exit should be
-            // preserved by the thunk. Luckily, we saved all registers into the register
-            // scratch buffer, so we can restore them from there.
-            jit.load64(registerScratch + offsetOfReg(reg), GPRInfo::regT0);
-        } else {
-            // The FTL compilation preserved the register. Its new value is therefore
-            // irrelevant, but we can get the value that was preserved by using the unwind
-            // data. We've already copied all unwind-able preserved registers into the unwind
-            // scratch buffer, so we can get it from there.
-            jit.load64(unwindScratch + unwindIndex, GPRInfo::regT0);
+        ExitValue value = exit.m_values[index];
+        
+        switch (value.kind()) {
+        case ExitValueDead:
+            jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), GPRInfo::regT0);
+            break;
+            
+        case ExitValueConstant:
+            jit.move(MacroAssembler::TrustedImm64(JSValue::encode(value.constant())), GPRInfo::regT0);
+            break;
+            
+        case ExitValueArgument:
+            record->locations[value.exitArgument().argument()].restoreInto(
+                jit, jitCode->stackmaps, registerScratch, GPRInfo::regT0);
+            break;
+            
+        case ExitValueInJSStack:
+        case ExitValueInJSStackAsInt32:
+        case ExitValueInJSStackAsInt52:
+        case ExitValueInJSStackAsDouble:
+            jit.load64(AssemblyHelpers::addressFor(value.virtualRegister(), GPRInfo::regT4), GPRInfo::regT0);
+            break;
+            
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+            break;
         }
-        jit.store64(GPRInfo::regT0, AssemblyHelpers::Address(GPRInfo::regT1, currentOffset));
+        
+        jit.store64(GPRInfo::regT0, scratch + index);
     }
     
-    // We need to make sure that we return into the register restoration thunk. This works
-    // differently depending on whether or not we had arity issues.
-    MacroAssembler::Jump arityIntactForReturnPC = jit.branch32(
-        MacroAssembler::GreaterThanOrEqual,
-        CCallHelpers::payloadFor(JSStack::ArgumentCount),
-        MacroAssembler::TrustedImm32(codeBlock->numParameters()));
-    
-    // The return PC in the call frame header points at exactly the right arity restoration
-    // thunk. We don't want to change that. But the arity restoration thunk's frame has a
-    // return PC and we want to reroute that to our register restoration thunk. The arity
-    // restoration's return PC just just below regT1, and the register restoration's return PC
-    // is right at regT1.
-    jit.loadPtr(MacroAssembler::Address(GPRInfo::regT1, -static_cast<ptrdiff_t>(sizeof(Register))), GPRInfo::regT0);
-    jit.storePtr(GPRInfo::regT0, GPRInfo::regT1);
-    jit.storePtr(
-        MacroAssembler::TrustedImmPtr(vm->getCTIStub(registerRestorationThunkGenerator).code().executableAddress()),
-        MacroAssembler::Address(GPRInfo::regT1, -static_cast<ptrdiff_t>(sizeof(Register))));
-    
-    MacroAssembler::Jump arityReturnPCReady = jit.jump();
-
-    arityIntactForReturnPC.link(&jit);
-    
-    jit.loadPtr(MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()), GPRInfo::regT0);
-    jit.storePtr(GPRInfo::regT0, GPRInfo::regT1);
-    jit.storePtr(
-        MacroAssembler::TrustedImmPtr(vm->getCTIStub(registerRestorationThunkGenerator).code().executableAddress()),
-        MacroAssembler::Address(MacroAssembler::framePointerRegister, CallFrame::returnPCOffset()));
-    
-    arityReturnPCReady.link(&jit);
-    
-    // Now get state out of the scratch buffer and place it back into the stack. The values are
-    // already reboxed so we just move them.
+    // Now get state out of the scratch buffer and place it back into the stack. This part does
+    // all reboxing.
     for (unsigned index = exit.m_values.size(); index--;) {
         int operand = exit.m_values.operandForIndex(index);
+        ExitValue value = exit.m_values[index];
         
         jit.load64(scratch + index, GPRInfo::regT0);
-        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast<VirtualRegister>(operand)));
+        reboxAccordingToFormat(
+            value.valueFormat(), jit, GPRInfo::regT0, GPRInfo::regT1, GPRInfo::regT2);
+        jit.store64(GPRInfo::regT0, AssemblyHelpers::addressFor(static_cast<VirtualRegister>(operand), GPRInfo::regT4));
     }
     
+    // Restore the old stack pointer and then put regT4 into callFrameRegister. The idea is
+    // that the FTL call frame is pushed onto the JS call frame and we can recover the old
+    // value of the stack pointer by popping the FTL call frame. We already know what the
+    // frame pointer in the JS call frame was because it would have been passed as an argument
+    // to the FTL call frame.
+    jit.move(MacroAssembler::framePointerRegister, MacroAssembler::stackPointerRegister);
+    jit.pop(GPRInfo::nonArgGPR0);
+    jit.pop(GPRInfo::nonArgGPR0);
+    jit.move(GPRInfo::regT4, GPRInfo::callFrameRegister);
+    
     handleExitCounts(jit, exit);
     reifyInlinedCallFrames(jit, exit);
     adjustAndJumpToTarget(jit, exit);
     
-    LinkBuffer patchBuffer(*vm, jit, codeBlock);
+    LinkBuffer patchBuffer(*vm, &jit, codeBlock);
     exit.m_code = FINALIZE_CODE_IF(
-        shouldShowDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit(),
+        shouldShowDisassembly(),
         patchBuffer,
         ("FTL OSR exit #%u (%s, %s) from %s, with operands = %s, and record = %s",
             exitID, toCString(exit.m_codeOrigin).data(),
@@ -488,9 +181,6 @@ static void compileStub(
 extern "C" void* compileFTLOSRExit(ExecState* exec, unsigned exitID)
 {
     SamplingRegion samplingRegion("FTL OSR Exit Compilation");
-
-    if (shouldShowDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit())
-        dataLog("Compiling OSR exit with exitID = ", exitID, "\n");
     
     CodeBlock* codeBlock = exec->codeBlock();
     
@@ -506,19 +196,6 @@ extern "C" void* compileFTLOSRExit(ExecState* exec, unsigned exitID)
     JITCode* jitCode = codeBlock->jitCode()->ftl();
     OSRExit& exit = jitCode->osrExit[exitID];
     
-    if (shouldShowDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit()) {
-        dataLog("    Owning block: ", pointerDump(codeBlock), "\n");
-        dataLog("    Origin: ", exit.m_codeOrigin, "\n");
-        if (exit.m_codeOriginForExitProfile != exit.m_codeOrigin)
-            dataLog("    Origin for exit profile: ", exit.m_codeOriginForExitProfile, "\n");
-        dataLog("    Exit values: ", exit.m_values, "\n");
-        if (!exit.m_materializations.isEmpty()) {
-            dataLog("    Materializations:\n");
-            for (ExitTimeObjectMaterialization* materialization : exit.m_materializations)
-                dataLog("        ", pointerDump(materialization), "\n");
-        }
-    }
-
     prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
     
     compileStub(exitID, jitCode, exit, vm, codeBlock);
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.h b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.h
index d26b81417..eba9cb859 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.h
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.h
@@ -26,6 +26,8 @@
 #ifndef FTLOSRExitCompiler_h
 #define FTLOSRExitCompiler_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGOperations.h"
diff --git a/Source/JavaScriptCore/ftl/FTLOperations.cpp b/Source/JavaScriptCore/ftl/FTLOperations.cpp
deleted file mode 100644
index 8cdbc5d10..000000000
--- a/Source/JavaScriptCore/ftl/FTLOperations.cpp
+++ /dev/null
@@ -1,353 +0,0 @@
-/*
- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLOperations.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "ClonedArguments.h"
-#include "DirectArguments.h"
-#include "JSCInlines.h"
-#include "JSLexicalEnvironment.h"
-
-namespace JSC { namespace FTL {
-
-using namespace JSC::DFG;
-
-extern "C" JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState* exec, Structure* structure)
-{
-    VM& vm = exec->vm();
-    NativeCallFrameTracer tracer(&vm, exec);
-    
-    Butterfly* butterfly = Butterfly::create(
-        vm, nullptr, 0, structure->outOfLineCapacity(), false, IndexingHeader(), 0);
-    
-    return JSFinalObject::create(exec, structure, butterfly);
-}
-
-extern "C" void JIT_OPERATION operationPopulateObjectInOSR(
-    ExecState* exec, ExitTimeObjectMaterialization* materialization,
-    EncodedJSValue* encodedValue, EncodedJSValue* values)
-{
-    VM& vm = exec->vm();
-    CodeBlock* codeBlock = exec->codeBlock();
-
-    // We cannot GC. We've got pointers in evil places.
-    // FIXME: We are not doing anything that can GC here, and this is
-    // probably unnecessary.
-    DeferGCForAWhile deferGC(vm.heap);
-
-    switch (materialization->type()) {
-    case PhantomNewObject: {
-        JSFinalObject* object = jsCast<JSFinalObject*>(JSValue::decode(*encodedValue));
-        Structure* structure = object->structure();
-
-        // Figure out what the heck to populate the object with. Use
-        // getPropertiesConcurrently() because that happens to be
-        // lower-level and more convenient. It doesn't change the
-        // materialization of the property table. We want to have
-        // minimal visible effects on the system. Also, don't mind
-        // that this is O(n^2). It doesn't matter. We only get here
-        // from OSR exit.
-        for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
-            for (unsigned i = materialization->properties().size(); i--;) {
-                const ExitPropertyValue& property = materialization->properties()[i];
-                if (property.location().kind() != NamedPropertyPLoc)
-                    continue;
-                if (codeBlock->identifier(property.location().info()).impl() != entry.key)
-                    continue;
-
-                object->putDirect(vm, entry.offset, JSValue::decode(values[i]));
-            }
-        }
-        break;
-    }
-
-    case PhantomNewFunction:
-    case PhantomDirectArguments:
-    case PhantomClonedArguments:
-        // Those are completely handled by operationMaterializeObjectInOSR
-        break;
-
-    case PhantomCreateActivation: {
-        JSLexicalEnvironment* activation = jsCast<JSLexicalEnvironment*>(JSValue::decode(*encodedValue));
-
-        // Figure out what to populate the activation with
-        for (unsigned i = materialization->properties().size(); i--;) {
-            const ExitPropertyValue& property = materialization->properties()[i];
-            if (property.location().kind() != ClosureVarPLoc)
-                continue;
-
-            activation->variableAt(ScopeOffset(property.location().info())).set(exec->vm(), activation, JSValue::decode(values[i]));
-        }
-
-        break;
-    }
-
-
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-        break;
-
-    }
-}
-
-extern "C" JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
-    ExecState* exec, ExitTimeObjectMaterialization* materialization, EncodedJSValue* values)
-{
-    VM& vm = exec->vm();
-
-    // We cannot GC. We've got pointers in evil places.
-    DeferGCForAWhile deferGC(vm.heap);
-    
-    switch (materialization->type()) {
-    case PhantomNewObject: {
-        // Figure out what the structure is
-        Structure* structure = nullptr;
-        for (unsigned i = materialization->properties().size(); i--;) {
-            const ExitPropertyValue& property = materialization->properties()[i];
-            if (property.location() != PromotedLocationDescriptor(StructurePLoc))
-                continue;
-
-            structure = jsCast<Structure*>(JSValue::decode(values[i]));
-            break;
-        }
-        RELEASE_ASSERT(structure);
-
-        JSFinalObject* result = JSFinalObject::create(vm, structure);
-
-        // The real values will be put subsequently by
-        // operationPopulateNewObjectInOSR. We can't fill them in
-        // now, because they may not be available yet (typically
-        // because we have a cyclic dependency graph).
-
-        // We put a dummy value here in order to avoid super-subtle
-        // GC-and-OSR-exit crashes in case we have a bug and some
-        // field is, for any reason, not filled later.
-        // We use a random-ish number instead of a sensible value like
-        // undefined to make possible bugs easier to track.
-        for (PropertyMapEntry entry : structure->getPropertiesConcurrently())
-            result->putDirect(vm, entry.offset, jsNumber(19723));
-
-        return result;
-    }
-
-    case PhantomNewFunction: {
-        // Figure out what the executable and activation are
-        FunctionExecutable* executable = nullptr;
-        JSScope* activation = nullptr;
-        for (unsigned i = materialization->properties().size(); i--;) {
-            const ExitPropertyValue& property = materialization->properties()[i];
-            if (property.location() == PromotedLocationDescriptor(FunctionExecutablePLoc))
-                executable = jsCast<FunctionExecutable*>(JSValue::decode(values[i]));
-            if (property.location() == PromotedLocationDescriptor(FunctionActivationPLoc))
-                activation = jsCast<JSScope*>(JSValue::decode(values[i]));
-        }
-        RELEASE_ASSERT(executable && activation);
-
-        JSFunction* result = JSFunction::createWithInvalidatedReallocationWatchpoint(vm, executable, activation);
-
-        return result;
-    }
-
-    case PhantomCreateActivation: {
-        // Figure out what the scope and symbol table are
-        JSScope* scope = nullptr;
-        SymbolTable* table = nullptr;
-        for (unsigned i = materialization->properties().size(); i--;) {
-            const ExitPropertyValue& property = materialization->properties()[i];
-            if (property.location() == PromotedLocationDescriptor(ActivationScopePLoc))
-                scope = jsCast<JSScope*>(JSValue::decode(values[i]));
-            else if (property.location() == PromotedLocationDescriptor(ActivationSymbolTablePLoc))
-                table = jsCast<SymbolTable*>(JSValue::decode(values[i]));
-        }
-        RELEASE_ASSERT(scope);
-        RELEASE_ASSERT(table);
-
-        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
-            materialization->origin(), exec->codeBlock());
-        Structure* structure = codeBlock->globalObject()->activationStructure();
-
-        // It doesn't matter what values we initialize as bottom values inside the activation constructor because
-        // activation sinking will set bottom values for each slot.
-        // FIXME: Slight optimization would be to create a constructor that doesn't initialize all slots.
-        JSLexicalEnvironment* result = JSLexicalEnvironment::create(vm, structure, scope, table, jsUndefined());
-
-        RELEASE_ASSERT(materialization->properties().size() - 2 == table->scopeSize());
-
-        // The real values will be put subsequently by
-        // operationPopulateNewObjectInOSR. See the PhantomNewObject
-        // case for details.
-        for (unsigned i = materialization->properties().size(); i--;) {
-            const ExitPropertyValue& property = materialization->properties()[i];
-            if (property.location().kind() != ClosureVarPLoc)
-                continue;
-
-            result->variableAt(ScopeOffset(property.location().info())).set(
-                exec->vm(), result, jsNumber(29834));
-        }
-
-        if (validationEnabled()) {
-            // Validate to make sure every slot in the scope has one value.
-            ConcurrentJITLocker locker(table->m_lock);
-            for (auto iter = table->begin(locker), end = table->end(locker); iter != end; ++iter) {
-                bool found = false;
-                for (unsigned i = materialization->properties().size(); i--;) {
-                    const ExitPropertyValue& property = materialization->properties()[i];
-                    if (property.location().kind() != ClosureVarPLoc)
-                        continue;
-                    if (ScopeOffset(property.location().info()) == iter->value.scopeOffset()) {
-                        found = true;
-                        break;
-                    }
-                }
-                ASSERT_UNUSED(found, found);
-            }
-            unsigned numberOfClosureVarPloc = 0;
-            for (unsigned i = materialization->properties().size(); i--;) {
-                const ExitPropertyValue& property = materialization->properties()[i];
-                if (property.location().kind() == ClosureVarPLoc)
-                    numberOfClosureVarPloc++;
-            }
-            ASSERT(numberOfClosureVarPloc == table->scopeSize());
-        }
-
-        return result;
-    }
-
-    case PhantomDirectArguments:
-    case PhantomClonedArguments: {
-        if (!materialization->origin().inlineCallFrame) {
-            switch (materialization->type()) {
-            case PhantomDirectArguments:
-                return DirectArguments::createByCopying(exec);
-            case PhantomClonedArguments:
-                return ClonedArguments::createWithMachineFrame(exec, exec, ArgumentsMode::Cloned);
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-                return nullptr;
-            }
-        }
-
-        // First figure out the argument count. If there isn't one then we represent the machine frame.
-        unsigned argumentCount = 0;
-        if (materialization->origin().inlineCallFrame->isVarargs()) {
-            for (unsigned i = materialization->properties().size(); i--;) {
-                const ExitPropertyValue& property = materialization->properties()[i];
-                if (property.location() != PromotedLocationDescriptor(ArgumentCountPLoc))
-                    continue;
-                
-                argumentCount = JSValue::decode(values[i]).asUInt32();
-                RELEASE_ASSERT(argumentCount);
-                break;
-            }
-            RELEASE_ASSERT(argumentCount);
-        } else
-            argumentCount = materialization->origin().inlineCallFrame->arguments.size();
-        
-        JSFunction* callee = nullptr;
-        if (materialization->origin().inlineCallFrame->isClosureCall) {
-            for (unsigned i = materialization->properties().size(); i--;) {
-                const ExitPropertyValue& property = materialization->properties()[i];
-                if (property.location() != PromotedLocationDescriptor(ArgumentsCalleePLoc))
-                    continue;
-                
-                callee = jsCast<JSFunction*>(JSValue::decode(values[i]));
-                break;
-            }
-        } else
-            callee = materialization->origin().inlineCallFrame->calleeConstant();
-        RELEASE_ASSERT(callee);
-        
-        CodeBlock* codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(
-            materialization->origin(), exec->codeBlock());
-        
-        // We have an inline frame and we have all of the data we need to recreate it.
-        switch (materialization->type()) {
-        case PhantomDirectArguments: {
-            unsigned length = argumentCount - 1;
-            unsigned capacity = std::max(length, static_cast<unsigned>(codeBlock->numParameters() - 1));
-            DirectArguments* result = DirectArguments::create(
-                vm, codeBlock->globalObject()->directArgumentsStructure(), length, capacity);
-            result->callee().set(vm, result, callee);
-            for (unsigned i = materialization->properties().size(); i--;) {
-                const ExitPropertyValue& property = materialization->properties()[i];
-                if (property.location().kind() != ArgumentPLoc)
-                    continue;
-                
-                unsigned index = property.location().info();
-                if (index >= capacity)
-                    continue;
-                
-                // We don't want to use setIndexQuickly(), since that's only for the passed-in
-                // arguments but sometimes the number of named arguments is greater. For
-                // example:
-                //
-                // function foo(a, b, c) { ... }
-                // foo();
-                //
-                // setIndexQuickly() would fail for indices 0, 1, 2 - but we need to recover
-                // those here.
-                result->argument(DirectArgumentsOffset(index)).set(
-                    vm, result, JSValue::decode(values[i]));
-            }
-            return result;
-        }
-        case PhantomClonedArguments: {
-            unsigned length = argumentCount - 1;
-            ClonedArguments* result = ClonedArguments::createEmpty(
-                vm, codeBlock->globalObject()->outOfBandArgumentsStructure(), callee);
-            
-            for (unsigned i = materialization->properties().size(); i--;) {
-                const ExitPropertyValue& property = materialization->properties()[i];
-                if (property.location().kind() != ArgumentPLoc)
-                    continue;
-                
-                unsigned index = property.location().info();
-                if (index >= length)
-                    continue;
-                result->putDirectIndex(exec, index, JSValue::decode(values[i]));
-            }
-            
-            result->putDirect(vm, vm.propertyNames->length, jsNumber(length));
-            return result;
-        }
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-            return nullptr;
-        }
-    }
-        
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-        return nullptr;
-    }
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLOperations.h b/Source/JavaScriptCore/ftl/FTLOperations.h
deleted file mode 100644
index a5568f91b..000000000
--- a/Source/JavaScriptCore/ftl/FTLOperations.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLOperations_h
-#define FTLOperations_h
-
-#if ENABLE(FTL_JIT)
-
-#include "DFGOperations.h"
-#include "FTLExitTimeObjectMaterialization.h"
-
-namespace JSC { namespace FTL {
-
-extern "C" {
-
-JSCell* JIT_OPERATION operationNewObjectWithButterfly(ExecState*, Structure*) WTF_INTERNAL;
-
-JSCell* JIT_OPERATION operationMaterializeObjectInOSR(
-    ExecState*, ExitTimeObjectMaterialization*, EncodedJSValue*) WTF_INTERNAL;
-
-void JIT_OPERATION operationPopulateObjectInOSR(
-    ExecState*, ExitTimeObjectMaterialization*, EncodedJSValue*, EncodedJSValue*) WTF_INTERNAL;
-
-} // extern "C"
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLOperations_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLOutput.cpp b/Source/JavaScriptCore/ftl/FTLOutput.cpp
index 30d5fbd50..fb2fc93b1 100644
--- a/Source/JavaScriptCore/ftl/FTLOutput.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOutput.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,111 +45,6 @@ Output::~Output()
     llvm->DisposeBuilder(m_builder);
 }
 
-void Output::initialize(LModule module, LValue function, AbstractHeapRepository& heaps)
-{
-    IntrinsicRepository::initialize(module);
-    m_function = function;
-    m_heaps = &heaps;
-}
-
-LBasicBlock Output::appendTo(LBasicBlock block, LBasicBlock nextBlock)
-{
-    appendTo(block);
-    return insertNewBlocksBefore(nextBlock);
-}
-
-void Output::appendTo(LBasicBlock block)
-{
-    m_block = block;
-    
-    llvm->PositionBuilderAtEnd(m_builder, block);
-}
-
-LBasicBlock Output::newBlock(const char* name)
-{
-    if (!m_nextBlock)
-        return appendBasicBlock(m_context, m_function, name);
-    return insertBasicBlock(m_context, m_nextBlock, name);
-}
-
-LValue Output::sensibleDoubleToInt(LValue value)
-{
-    RELEASE_ASSERT(isX86());
-    return call(
-        x86SSE2CvtTSD2SIIntrinsic(),
-        insertElement(
-            insertElement(getUndef(vectorType(doubleType, 2)), value, int32Zero),
-            doubleZero, int32One));
-}
-
-LValue Output::load(TypedPointer pointer, LType refType)
-{
-    LValue result = get(intToPtr(pointer.value(), refType));
-    pointer.heap().decorateInstruction(result, *m_heaps);
-    return result;
-}
-
-void Output::store(LValue value, TypedPointer pointer, LType refType)
-{
-    LValue result = set(value, intToPtr(pointer.value(), refType));
-    pointer.heap().decorateInstruction(result, *m_heaps);
-}
-
-LValue Output::baseIndex(LValue base, LValue index, Scale scale, ptrdiff_t offset)
-{
-    LValue accumulatedOffset;
-        
-    switch (scale) {
-    case ScaleOne:
-        accumulatedOffset = index;
-        break;
-    case ScaleTwo:
-        accumulatedOffset = shl(index, intPtrOne);
-        break;
-    case ScaleFour:
-        accumulatedOffset = shl(index, intPtrTwo);
-        break;
-    case ScaleEight:
-    case ScalePtr:
-        accumulatedOffset = shl(index, intPtrThree);
-        break;
-    }
-        
-    if (offset)
-        accumulatedOffset = add(accumulatedOffset, constIntPtr(offset));
-        
-    return add(base, accumulatedOffset);
-}
-
-void Output::branch(LValue condition, LBasicBlock taken, Weight takenWeight, LBasicBlock notTaken, Weight notTakenWeight)
-{
-    LValue branch = buildCondBr(m_builder, condition, taken, notTaken);
-    
-    if (!takenWeight || !notTakenWeight)
-        return;
-    
-    double total = takenWeight.value() + notTakenWeight.value();
-    
-    setMetadata(
-        branch, profKind,
-        mdNode(
-            m_context, branchWeights,
-            constInt32(takenWeight.scaleToTotal(total)),
-            constInt32(notTakenWeight.scaleToTotal(total))));
-}
-
-void Output::check(LValue condition, WeightedTarget taken, Weight notTakenWeight)
-{
-    LBasicBlock continuation = FTL_NEW_BLOCK(*this, ("Output::check continuation"));
-    branch(condition, taken, WeightedTarget(continuation, notTakenWeight));
-    appendTo(continuation);
-}
-
-void Output::check(LValue condition, WeightedTarget taken)
-{
-    check(condition, taken, taken.weight().inverse());
-}
-
 } } // namespace JSC::FTL
 
 #endif // ENABLE(FTL_JIT)
diff --git a/Source/JavaScriptCore/ftl/FTLOutput.h b/Source/JavaScriptCore/ftl/FTLOutput.h
index e2d973d3c..2ec873503 100644
--- a/Source/JavaScriptCore/ftl/FTLOutput.h
+++ b/Source/JavaScriptCore/ftl/FTLOutput.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef FTLOutput_h
 #define FTLOutput_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "DFGCommon.h"
@@ -33,11 +35,7 @@
 #include "FTLAbstractHeapRepository.h"
 #include "FTLCommonValues.h"
 #include "FTLIntrinsicRepository.h"
-#include "FTLState.h"
-#include "FTLSwitchCase.h"
 #include "FTLTypedPointer.h"
-#include "FTLWeight.h"
-#include "FTLWeightedTarget.h"
 #include <wtf/StringPrintStream.h>
 
 namespace JSC { namespace FTL {
@@ -72,7 +70,12 @@ public:
     Output(LContext);
     ~Output();
     
-    void initialize(LModule, LValue, AbstractHeapRepository&);
+    void initialize(LModule module, LValue function, AbstractHeapRepository& heaps)
+    {
+        IntrinsicRepository::initialize(module);
+        m_function = function;
+        m_heaps = &heaps;
+    }
     
     LBasicBlock insertNewBlocksBefore(LBasicBlock nextBlock)
     {
@@ -81,11 +84,24 @@ public:
         return lastNextBlock;
     }
     
-    LBasicBlock appendTo(LBasicBlock, LBasicBlock nextBlock);
-    
-    void appendTo(LBasicBlock);
+    LBasicBlock appendTo(LBasicBlock block, LBasicBlock nextBlock)
+    {
+        appendTo(block);
+        return insertNewBlocksBefore(nextBlock);
+    }
     
-    LBasicBlock newBlock(const char* name = "");
+    void appendTo(LBasicBlock block)
+    {
+        m_block = block;
+        
+        llvm->PositionBuilderAtEnd(m_builder, block);
+    }
+    LBasicBlock newBlock(const char* name = "")
+    {
+        if (!m_nextBlock)
+            return appendBasicBlock(m_context, m_function, name);
+        return insertBasicBlock(m_context, m_nextBlock, name);
+    }
     
     LValue param(unsigned index) { return getParam(m_function, index); }
     LValue constBool(bool value) { return constInt(boolean, value); }
@@ -99,12 +115,13 @@ public:
     LValue constDouble(double value) { return constReal(doubleType, value); }
     
     LValue phi(LType type) { return buildPhi(m_builder, type); }
-    template<typename... Params>
-    LValue phi(LType type, ValueFromBlock value, Params... theRest)
+    LValue phi(LType type, ValueFromBlock value1)
     {
-        LValue result = phi(type, theRest...);
-        addIncoming(result, value);
-        return result;
+        return buildPhi(m_builder, type, value1);
+    }
+    LValue phi(LType type, ValueFromBlock value1, ValueFromBlock value2)
+    {
+        return buildPhi(m_builder, type, value1, value2);
     }
     template<typename VectorType>
     LValue phi(LType type, const VectorType& vector)
@@ -133,20 +150,12 @@ public:
     LValue bitOr(LValue left, LValue right) { return buildOr(m_builder, left, right); }
     LValue bitXor(LValue left, LValue right) { return buildXor(m_builder, left, right); }
     LValue shl(LValue left, LValue right) { return buildShl(m_builder, left, right); }
-    LValue aShr(LValue left, LValue right) { return buildAShr(m_builder, left, right); } // arithmetic = signed
-    LValue lShr(LValue left, LValue right) { return buildLShr(m_builder, left, right); } // logical = unsigned
+    LValue aShr(LValue left, LValue right) { return buildAShr(m_builder, left, right); }
+    LValue lShr(LValue left, LValue right) { return buildLShr(m_builder, left, right); }
     LValue bitNot(LValue value) { return buildNot(m_builder, value); }
     
     LValue insertElement(LValue vector, LValue element, LValue index) { return buildInsertElement(m_builder, vector, element, index); }
-
-    LValue ceil64(LValue operand)
-    {
-        return call(ceil64Intrinsic(), operand);
-    }
-    LValue ctlz32(LValue xOperand, LValue yOperand)
-    {
-        return call(ctlz32Intrinsic(), xOperand, yOperand);
-    }
+    
     LValue addWithOverflow32(LValue left, LValue right)
     {
         return call(addWithOverflow32Intrinsic(), left, right);
@@ -175,42 +184,20 @@ public:
     {
         return call(doubleAbsIntrinsic(), value);
     }
-
-    LValue doubleSin(LValue value)
-    {
-        return call(doubleSinIntrinsic(), value);
-    }
-    LValue doubleCos(LValue value)
-    {
-        return call(doubleCosIntrinsic(), value);
-    }
-
-    LValue doublePow(LValue xOperand, LValue yOperand)
-    {
-        return call(doublePowIntrinsic(), xOperand, yOperand);
-    }
-
-    LValue doublePowi(LValue xOperand, LValue yOperand)
-    {
-        return call(doublePowiIntrinsic(), xOperand, yOperand);
-    }
-
-    LValue doubleSqrt(LValue value)
-    {
-        return call(doubleSqrtIntrinsic(), value);
-    }
-
-    LValue doubleLog(LValue value)
+    
+    static bool hasSensibleDoubleToInt() { return isX86(); }
+    LValue sensibleDoubleToInt(LValue value)
     {
-        return call(doubleLogIntrinsic(), value);
+        RELEASE_ASSERT(isX86());
+        return call(
+            x86SSE2CvtTSD2SIIntrinsic(),
+            insertElement(
+                insertElement(getUndef(vectorType(doubleType, 2)), value, int32Zero),
+                doubleZero, int32One));
     }
-
-    static bool hasSensibleDoubleToInt() { return isX86(); }
-    LValue sensibleDoubleToInt(LValue);
     
     LValue signExt(LValue value, LType type) { return buildSExt(m_builder, value, type); }
     LValue zeroExt(LValue value, LType type) { return buildZExt(m_builder, value, type); }
-    LValue zeroExtPtr(LValue value) { return zeroExt(value, intPtr); }
     LValue fpToInt(LValue value, LType type) { return buildFPToSI(m_builder, value, type); }
     LValue fpToUInt(LValue value, LType type) { return buildFPToUI(m_builder, value, type); }
     LValue fpToInt32(LValue value) { return fpToInt(value, int32); }
@@ -223,25 +210,23 @@ public:
     LValue castToInt32(LValue value) { return intCast(value, int32); }
     LValue fpCast(LValue value, LType type) { return buildFPCast(m_builder, value, type); }
     LValue intToPtr(LValue value, LType type) { return buildIntToPtr(m_builder, value, type); }
-    LValue ptrToInt(LValue value, LType type) { return buildPtrToInt(m_builder, value, type); }
     LValue bitCast(LValue value, LType type) { return buildBitCast(m_builder, value, type); }
     
-    // Hilariously, the #define machinery in the stdlib means that this method is actually called
-    // __builtin_alloca. So far this appears benign. :-|
     LValue alloca(LType type) { return buildAlloca(m_builder, type); }
-    
-    // Access the value of an alloca. Also used as a low-level implementation primitive for
-    // load(). Never use this to load from "pointers" in the FTL sense, since FTL pointers
-    // are actually integers. This requires an LLVM pointer. Broadly speaking, you don't
-    // have any LLVM pointers even if you really think you do. A TypedPointer is not an
-    // LLVM pointer. See comment block at top of this file to understand the distinction
-    // between LLVM pointers, FTL pointers, and FTL references.
     LValue get(LValue reference) { return buildLoad(m_builder, reference); }
-    // Similar to get() but for storing to the value in an alloca.
     LValue set(LValue value, LValue reference) { return buildStore(m_builder, value, reference); }
     
-    LValue load(TypedPointer, LType refType);
-    void store(LValue, TypedPointer, LType refType);
+    LValue load(TypedPointer pointer, LType refType)
+    {
+        LValue result = get(intToPtr(pointer.value(), refType));
+        pointer.heap().decorateInstruction(result, *m_heaps);
+        return result;
+    }
+    void store(LValue value, TypedPointer pointer, LType refType)
+    {
+        LValue result = set(value, intToPtr(pointer.value(), refType));
+        pointer.heap().decorateInstruction(result, *m_heaps);
+    }
     
     LValue load8(TypedPointer pointer) { return load(pointer, ref8); }
     LValue load16(TypedPointer pointer) { return load(pointer, ref16); }
@@ -279,8 +264,31 @@ public:
         return address(field, base, offset + field.offset());
     }
     
-    LValue baseIndex(LValue base, LValue index, Scale, ptrdiff_t offset = 0);
-
+    LValue baseIndex(LValue base, LValue index, Scale scale, ptrdiff_t offset = 0)
+    {
+        LValue accumulatedOffset;
+        
+        switch (scale) {
+        case ScaleOne:
+            accumulatedOffset = index;
+            break;
+        case ScaleTwo:
+            accumulatedOffset = shl(index, intPtrOne);
+            break;
+        case ScaleFour:
+            accumulatedOffset = shl(index, intPtrTwo);
+            break;
+        case ScaleEight:
+        case ScalePtr:
+            accumulatedOffset = shl(index, intPtrThree);
+            break;
+        }
+        
+        if (offset)
+            accumulatedOffset = add(accumulatedOffset, constIntPtr(offset));
+        
+        return add(base, accumulatedOffset);
+    }
     TypedPointer baseIndex(const AbstractHeap& heap, LValue base, LValue index, Scale scale, ptrdiff_t offset = 0)
     {
         return TypedPointer(heap, baseIndex(base, index, scale, offset));
@@ -301,26 +309,11 @@ public:
     LValue load64(LValue base, const AbstractField& field) { return load64(address(base, field)); }
     LValue loadPtr(LValue base, const AbstractField& field) { return loadPtr(address(base, field)); }
     LValue loadDouble(LValue base, const AbstractField& field) { return loadDouble(address(base, field)); }
-    void store8(LValue value, LValue base, const AbstractField& field) { store8(value, address(base, field)); }
     void store32(LValue value, LValue base, const AbstractField& field) { store32(value, address(base, field)); }
     void store64(LValue value, LValue base, const AbstractField& field) { store64(value, address(base, field)); }
     void storePtr(LValue value, LValue base, const AbstractField& field) { storePtr(value, address(base, field)); }
     void storeDouble(LValue value, LValue base, const AbstractField& field) { storeDouble(value, address(base, field)); }
     
-    void ascribeRange(LValue loadInstruction, const ValueRange& range)
-    {
-        range.decorateInstruction(m_context, loadInstruction, rangeKind);
-    }
-    
-    LValue nonNegative32(LValue loadInstruction)
-    {
-        ascribeRange(loadInstruction, nonNegativeInt32);
-        return loadInstruction;
-    }
-    
-    LValue load32NonNegative(TypedPointer pointer) { return nonNegative32(load32(pointer)); }
-    LValue load32NonNegative(LValue base, const AbstractField& field) { return nonNegative32(load32(base, field)); }
-    
     LValue icmp(LIntPredicate cond, LValue left, LValue right) { return buildICmp(m_builder, cond, left, right); }
     LValue equal(LValue left, LValue right) { return icmp(LLVMIntEQ, left, right); }
     LValue notEqual(LValue left, LValue right) { return icmp(LLVMIntNE, left, right); }
@@ -373,8 +366,13 @@ public:
     LValue call(LValue function, const VectorType& vector) { return buildCall(m_builder, function, vector); }
     LValue call(LValue function) { return buildCall(m_builder, function); }
     LValue call(LValue function, LValue arg1) { return buildCall(m_builder, function, arg1); }
-    template<typename... Args>
-    LValue call(LValue function, LValue arg1, Args... args) { return buildCall(m_builder, function, arg1, args...); }
+    LValue call(LValue function, LValue arg1, LValue arg2) { return buildCall(m_builder, function, arg1, arg2); }
+    LValue call(LValue function, LValue arg1, LValue arg2, LValue arg3) { return buildCall(m_builder, function, arg1, arg2, arg3); }
+    LValue call(LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4) { return buildCall(m_builder, function, arg1, arg2, arg3, arg4); }
+    LValue call(LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5) { return buildCall(m_builder, function, arg1, arg2, arg3, arg4, arg5); }
+    LValue call(LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5, LValue arg6) { return buildCall(m_builder, function, arg1, arg2, arg3, arg4, arg5, arg6); }
+    LValue call(LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5, LValue arg6, LValue arg7) { return buildCall(m_builder, function, arg1, arg2, arg3, arg4, arg5, arg6, arg7); }
+    LValue call(LValue function, LValue arg1, LValue arg2, LValue arg3, LValue arg4, LValue arg5, LValue arg6, LValue arg7, LValue arg8) { return buildCall(m_builder, function, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8); }
     
     template<typename FunctionType>
     LValue operation(FunctionType function)
@@ -383,43 +381,9 @@ public:
     }
     
     void jump(LBasicBlock destination) { buildBr(m_builder, destination); }
-    void branch(LValue condition, LBasicBlock taken, Weight takenWeight, LBasicBlock notTaken, Weight notTakenWeight);
-    void branch(LValue condition, WeightedTarget taken, WeightedTarget notTaken)
-    {
-        branch(condition, taken.target(), taken.weight(), notTaken.target(), notTaken.weight());
-    }
-
-    // Branches to an already-created handler if true, "falls through" if false. Fall-through is
-    // simulated by creating a continuation for you.
-    void check(LValue condition, WeightedTarget taken, Weight notTakenWeight);
-    
-    // Same as check(), but uses Weight::inverse() to compute the notTakenWeight.
-    void check(LValue condition, WeightedTarget taken);
-    
+    void branch(LValue condition, LBasicBlock taken, LBasicBlock notTaken) { buildCondBr(m_builder, condition, taken, notTaken); }
     template<typename VectorType>
-    void switchInstruction(LValue value, const VectorType& cases, LBasicBlock fallThrough, Weight fallThroughWeight)
-    {
-        LValue inst = buildSwitch(m_builder, value, cases, fallThrough);
-        
-        double total = 0;
-        if (!fallThroughWeight)
-            return;
-        total += fallThroughWeight.value();
-        for (unsigned i = cases.size(); i--;) {
-            if (!cases[i].weight())
-                return;
-            total += cases[i].weight().value();
-        }
-        
-        Vector<LValue> mdArgs;
-        mdArgs.append(branchWeights);
-        mdArgs.append(constInt32(fallThroughWeight.scaleToTotal(total)));
-        for (unsigned i = 0; i < cases.size(); ++i)
-            mdArgs.append(constInt32(cases[i].weight().scaleToTotal(total)));
-        
-        setMetadata(inst, profKind, mdNode(m_context, mdArgs));
-    }
-    
+    void switchInstruction(LValue value, const VectorType& cases, LBasicBlock fallThrough) { buildSwitch(m_builder, value, cases, fallThrough); }
     void ret(LValue value) { buildRet(m_builder, value); }
     
     void unreachable() { buildUnreachable(m_builder); }
@@ -429,6 +393,16 @@ public:
         call(trapIntrinsic());
     }
     
+    void crashNonTerminal()
+    {
+        call(intToPtr(constIntPtr(abort), pointerType(functionType(voidType))));
+    }
+    void crash()
+    {
+        crashNonTerminal();
+        unreachable();
+    }
+    
     ValueFromBlock anchor(LValue value)
     {
         return ValueFromBlock(value, m_block);
@@ -442,7 +416,7 @@ public:
 };
 
 #define FTL_NEW_BLOCK(output, nameArguments) \
-    (LIKELY(!verboseCompilationEnabled()) \
+    (LIKELY(!::JSC::DFG::verboseCompilationEnabled()) \
     ? (output).newBlock() \
     : (output).newBlock((toCString nameArguments).data()))
 
diff --git a/Source/JavaScriptCore/ftl/FTLRecoveryOpcode.cpp b/Source/JavaScriptCore/ftl/FTLRecoveryOpcode.cpp
deleted file mode 100644
index 70770dd81..000000000
--- a/Source/JavaScriptCore/ftl/FTLRecoveryOpcode.cpp
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLRecoveryOpcode.h"
-
-#if ENABLE(FTL_JIT)
-
-#include <wtf/PrintStream.h>
-
-namespace WTF {
-
-void printInternal(PrintStream& out, JSC::FTL::RecoveryOpcode opcode)
-{
-    switch (opcode) {
-    case JSC::FTL::AddRecovery:
-        out.print("Add");
-        return;
-    case JSC::FTL::SubRecovery:
-        out.print("Sub");
-        return;
-    }
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLRecoveryOpcode.h b/Source/JavaScriptCore/ftl/FTLRecoveryOpcode.h
deleted file mode 100644
index 43a755a94..000000000
--- a/Source/JavaScriptCore/ftl/FTLRecoveryOpcode.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLRecoveryOpcode_h
-#define FTLRecoveryOpcode_h
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC { namespace FTL {
-
-enum RecoveryOpcode {
-    AddRecovery,
-    SubRecovery
-};
-
-} } // namespace JSC::FTL
-
-namespace WTF {
-
-class PrintStream;
-void printInternal(PrintStream&, JSC::FTL::RecoveryOpcode);
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLRecoveryOpcode_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLRegisterAtOffset.cpp b/Source/JavaScriptCore/ftl/FTLRegisterAtOffset.cpp
deleted file mode 100644
index 460572283..000000000
--- a/Source/JavaScriptCore/ftl/FTLRegisterAtOffset.cpp
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLRegisterAtOffset.h"
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC { namespace FTL {
-
-void RegisterAtOffset::dump(PrintStream& out) const
-{
-    out.print(reg(), " at ", offset());
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLRegisterAtOffset.h b/Source/JavaScriptCore/ftl/FTLRegisterAtOffset.h
deleted file mode 100644
index 277338dc0..000000000
--- a/Source/JavaScriptCore/ftl/FTLRegisterAtOffset.h
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLRegisterAtOffset_h
-#define FTLRegisterAtOffset_h
-
-#if ENABLE(FTL_JIT)
-
-#include "Reg.h"
-#include <wtf/PrintStream.h>
-
-namespace JSC { namespace FTL {
-
-class RegisterAtOffset {
-public:
-    RegisterAtOffset()
-        : m_offset(0)
-    {
-    }
-    
-    RegisterAtOffset(Reg reg, ptrdiff_t offset)
-        : m_reg(reg)
-        , m_offset(offset)
-    {
-    }
-    
-    bool operator!() const { return !m_reg; }
-    
-    Reg reg() const { return m_reg; }
-    ptrdiff_t offset() const { return m_offset; }
-    
-    bool operator==(const RegisterAtOffset& other) const
-    {
-        return reg() == other.reg() && offset() == other.offset();
-    }
-    
-    bool operator<(const RegisterAtOffset& other) const
-    {
-        if (reg() != other.reg())
-            return reg() < other.reg();
-        return offset() < other.offset();
-    }
-    
-    static Reg getReg(RegisterAtOffset* value) { return value->reg(); }
-    
-    void dump(PrintStream& out) const;
-
-private:
-    Reg m_reg;
-    ptrdiff_t m_offset;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLRegisterAtOffset_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLSaveRestore.cpp b/Source/JavaScriptCore/ftl/FTLSaveRestore.cpp
deleted file mode 100644
index c752fd22f..000000000
--- a/Source/JavaScriptCore/ftl/FTLSaveRestore.cpp
+++ /dev/null
@@ -1,149 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLSaveRestore.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "FPRInfo.h"
-#include "GPRInfo.h"
-#include "MacroAssembler.h"
-#include "RegisterSet.h"
-
-namespace JSC { namespace FTL {
-
-static size_t bytesForGPRs()
-{
-    return MacroAssembler::numberOfRegisters() * sizeof(int64_t);
-}
-
-static size_t bytesForFPRs()
-{
-    // FIXME: It might be worthwhile saving the full state of the FP registers, at some point.
-    // Right now we don't need this since we only do the save/restore just prior to OSR exit, and
-    // OSR exit will be guaranteed to only need the double portion of the FP registers.
-    return MacroAssembler::numberOfFPRegisters() * sizeof(double);
-}
-
-size_t requiredScratchMemorySizeInBytes()
-{
-    return bytesForGPRs() + bytesForFPRs();
-}
-
-size_t offsetOfGPR(GPRReg reg)
-{
-    return MacroAssembler::registerIndex(reg) * sizeof(int64_t);
-}
-
-size_t offsetOfFPR(FPRReg reg)
-{
-    return bytesForGPRs() + MacroAssembler::fpRegisterIndex(reg) * sizeof(double);
-}
-
-size_t offsetOfReg(Reg reg)
-{
-    if (reg.isGPR())
-        return offsetOfGPR(reg.gpr());
-    return offsetOfFPR(reg.fpr());
-}
-
-namespace {
-
-struct Regs {
-    Regs()
-    {
-        special = RegisterSet::stackRegisters();
-        special.merge(RegisterSet::reservedHardwareRegisters());
-        
-        first = MacroAssembler::firstRegister();
-        while (special.get(first))
-            first = MacroAssembler::nextRegister(first);
-        second = MacroAssembler::nextRegister(first);
-        while (special.get(second))
-            second = MacroAssembler::nextRegister(second);
-    }
-    
-    RegisterSet special;
-    GPRReg first;
-    GPRReg second;
-};
-
-} // anonymous namespace
-
-void saveAllRegisters(MacroAssembler& jit, char* scratchMemory)
-{
-    Regs regs;
-    
-    // Get the first register out of the way, so that we can use it as a pointer.
-    jit.poke64(regs.first, 0);
-    jit.move(MacroAssembler::TrustedImmPtr(scratchMemory), regs.first);
-    
-    // Get all of the other GPRs out of the way.
-    for (MacroAssembler::RegisterID reg = regs.second; reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
-        if (regs.special.get(reg))
-            continue;
-        jit.store64(reg, MacroAssembler::Address(regs.first, offsetOfGPR(reg)));
-    }
-    
-    // Restore the first register into the second one and save it.
-    jit.peek64(regs.second, 0);
-    jit.store64(regs.second, MacroAssembler::Address(regs.first, offsetOfGPR(regs.first)));
-    
-    // Finally save all FPR's.
-    for (MacroAssembler::FPRegisterID reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
-        if (regs.special.get(reg))
-            continue;
-        jit.storeDouble(reg, MacroAssembler::Address(regs.first, offsetOfFPR(reg)));
-    }
-}
-
-void restoreAllRegisters(MacroAssembler& jit, char* scratchMemory)
-{
-    Regs regs;
-    
-    // Give ourselves a pointer to the scratch memory.
-    jit.move(MacroAssembler::TrustedImmPtr(scratchMemory), regs.first);
-    
-    // Restore all FPR's.
-    for (MacroAssembler::FPRegisterID reg = MacroAssembler::firstFPRegister(); reg <= MacroAssembler::lastFPRegister(); reg = MacroAssembler::nextFPRegister(reg)) {
-        if (regs.special.get(reg))
-            continue;
-        jit.loadDouble(MacroAssembler::Address(regs.first, offsetOfFPR(reg)), reg);
-    }
-    
-    for (MacroAssembler::RegisterID reg = regs.second; reg <= MacroAssembler::lastRegister(); reg = MacroAssembler::nextRegister(reg)) {
-        if (regs.special.get(reg))
-            continue;
-        jit.load64(MacroAssembler::Address(regs.first, offsetOfGPR(reg)), reg);
-    }
-    
-    jit.load64(MacroAssembler::Address(regs.first, offsetOfGPR(regs.first)), regs.first);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLSaveRestore.h b/Source/JavaScriptCore/ftl/FTLSaveRestore.h
deleted file mode 100644
index 720c76c3e..000000000
--- a/Source/JavaScriptCore/ftl/FTLSaveRestore.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLSaveRestore_h
-#define FTLSaveRestore_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FPRInfo.h"
-#include "GPRInfo.h"
-#include "Reg.h"
-
-namespace JSC {
-
-class MacroAssembler;
-
-namespace FTL {
-
-size_t requiredScratchMemorySizeInBytes();
-
-size_t offsetOfReg(Reg);
-size_t offsetOfGPR(GPRReg);
-size_t offsetOfFPR(FPRReg);
-
-// Assumes that top-of-stack can be used as a pointer-sized scratchpad. Saves all of
-// the registers into the scratch buffer such that RegisterID * sizeof(int64_t) is the
-// offset of every register.
-void saveAllRegisters(MacroAssembler& jit, char* scratchMemory);
-
-void restoreAllRegisters(MacroAssembler& jit, char* scratchMemory);
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLSaveRestore_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp b/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp
deleted file mode 100644
index ffbd474b6..000000000
--- a/Source/JavaScriptCore/ftl/FTLSlowPathCall.cpp
+++ /dev/null
@@ -1,220 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLSlowPathCall.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "CCallHelpers.h"
-#include "FTLState.h"
-#include "GPRInfo.h"
-#include "JSCInlines.h"
-
-namespace JSC { namespace FTL {
-
-namespace {
-
-// This code relies on us being 64-bit. FTL is currently always 64-bit.
-static const size_t wordSize = 8;
-
-// This will be an RAII thingy that will set up the necessary stack sizes and offsets and such.
-class CallContext {
-public:
-    CallContext(
-        State& state, const RegisterSet& usedRegisters, CCallHelpers& jit,
-        unsigned numArgs, GPRReg returnRegister)
-        : m_state(state)
-        , m_usedRegisters(usedRegisters)
-        , m_jit(jit)
-        , m_numArgs(numArgs)
-        , m_returnRegister(returnRegister)
-    {
-        // We don't care that you're using callee-save, stack, or hardware registers.
-        m_usedRegisters.exclude(RegisterSet::stackRegisters());
-        m_usedRegisters.exclude(RegisterSet::reservedHardwareRegisters());
-        m_usedRegisters.exclude(RegisterSet::calleeSaveRegisters());
-        
-        // The return register doesn't need to be saved.
-        if (m_returnRegister != InvalidGPRReg)
-            m_usedRegisters.clear(m_returnRegister);
-        
-        size_t stackBytesNeededForReturnAddress = wordSize;
-        
-        m_offsetToSavingArea =
-            (std::max(m_numArgs, NUMBER_OF_ARGUMENT_REGISTERS) - NUMBER_OF_ARGUMENT_REGISTERS) * wordSize;
-        
-        for (unsigned i = std::min(NUMBER_OF_ARGUMENT_REGISTERS, numArgs); i--;)
-            m_argumentRegisters.set(GPRInfo::toArgumentRegister(i));
-        m_callingConventionRegisters.merge(m_argumentRegisters);
-        if (returnRegister != InvalidGPRReg)
-            m_callingConventionRegisters.set(GPRInfo::returnValueGPR);
-        m_callingConventionRegisters.filter(m_usedRegisters);
-        
-        unsigned numberOfCallingConventionRegisters =
-            m_callingConventionRegisters.numberOfSetRegisters();
-        
-        size_t offsetToThunkSavingArea =
-            m_offsetToSavingArea +
-            numberOfCallingConventionRegisters * wordSize;
-        
-        m_stackBytesNeeded =
-            offsetToThunkSavingArea +
-            stackBytesNeededForReturnAddress +
-            (m_usedRegisters.numberOfSetRegisters() - numberOfCallingConventionRegisters) * wordSize;
-        
-        m_stackBytesNeeded = (m_stackBytesNeeded + stackAlignmentBytes() - 1) & ~(stackAlignmentBytes() - 1);
-        
-        m_jit.subPtr(CCallHelpers::TrustedImm32(m_stackBytesNeeded), CCallHelpers::stackPointerRegister);
-        
-        m_thunkSaveSet = m_usedRegisters;
-        
-        // This relies on all calling convention registers also being temp registers.
-        unsigned stackIndex = 0;
-        for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
-            GPRReg reg = GPRInfo::toRegister(i);
-            if (!m_callingConventionRegisters.get(reg))
-                continue;
-            m_jit.storePtr(reg, CCallHelpers::Address(CCallHelpers::stackPointerRegister, m_offsetToSavingArea + (stackIndex++) * wordSize));
-            m_thunkSaveSet.clear(reg);
-        }
-        
-        m_offset = offsetToThunkSavingArea;
-    }
-    
-    ~CallContext()
-    {
-        if (m_returnRegister != InvalidGPRReg)
-            m_jit.move(GPRInfo::returnValueGPR, m_returnRegister);
-        
-        unsigned stackIndex = 0;
-        for (unsigned i = GPRInfo::numberOfRegisters; i--;) {
-            GPRReg reg = GPRInfo::toRegister(i);
-            if (!m_callingConventionRegisters.get(reg))
-                continue;
-            m_jit.loadPtr(CCallHelpers::Address(CCallHelpers::stackPointerRegister, m_offsetToSavingArea + (stackIndex++) * wordSize), reg);
-        }
-        
-        m_jit.addPtr(CCallHelpers::TrustedImm32(m_stackBytesNeeded), CCallHelpers::stackPointerRegister);
-    }
-    
-    RegisterSet usedRegisters() const
-    {
-        return m_thunkSaveSet;
-    }
-    
-    ptrdiff_t offset() const
-    {
-        return m_offset;
-    }
-    
-    SlowPathCallKey keyWithTarget(void* callTarget) const
-    {
-        return SlowPathCallKey(usedRegisters(), callTarget, m_argumentRegisters, offset());
-    }
-    
-    MacroAssembler::Call makeCall(void* callTarget, MacroAssembler::JumpList* exceptionTarget)
-    {
-        MacroAssembler::Call result = m_jit.call();
-        m_state.finalizer->slowPathCalls.append(SlowPathCall(
-            result, keyWithTarget(callTarget)));
-        if (exceptionTarget)
-            exceptionTarget->append(m_jit.emitExceptionCheck());
-        return result;
-    }
-    
-private:
-    State& m_state;
-    RegisterSet m_usedRegisters;
-    RegisterSet m_argumentRegisters;
-    RegisterSet m_callingConventionRegisters;
-    CCallHelpers& m_jit;
-    unsigned m_numArgs;
-    GPRReg m_returnRegister;
-    size_t m_offsetToSavingArea;
-    size_t m_stackBytesNeeded;
-    RegisterSet m_thunkSaveSet;
-    ptrdiff_t m_offset;
-};
-
-} // anonymous namespace
-
-void storeCodeOrigin(State& state, CCallHelpers& jit, CodeOrigin codeOrigin)
-{
-    if (!codeOrigin.isSet())
-        return;
-    
-    unsigned index = state.jitCode->common.addCodeOrigin(codeOrigin);
-    unsigned locationBits = CallFrame::Location::encodeAsCodeOriginIndex(index);
-    jit.store32(
-        CCallHelpers::TrustedImm32(locationBits),
-        CCallHelpers::tagFor(static_cast<VirtualRegister>(JSStack::ArgumentCount)));
-}
-
-MacroAssembler::Call callOperation(
-    State& state, const RegisterSet& usedRegisters, CCallHelpers& jit,
-    CodeOrigin codeOrigin, MacroAssembler::JumpList* exceptionTarget,
-    J_JITOperation_ESsiCI operation, GPRReg result, StructureStubInfo* stubInfo,
-    GPRReg object, const UniquedStringImpl* uid)
-{
-    storeCodeOrigin(state, jit, codeOrigin);
-    CallContext context(state, usedRegisters, jit, 4, result);
-    jit.setupArgumentsWithExecState(
-        CCallHelpers::TrustedImmPtr(stubInfo), object, CCallHelpers::TrustedImmPtr(uid));
-    return context.makeCall(bitwise_cast<void*>(operation), exceptionTarget);
-}
-
-MacroAssembler::Call callOperation(
-    State& state, const RegisterSet& usedRegisters, CCallHelpers& jit,
-    CodeOrigin codeOrigin, MacroAssembler::JumpList* exceptionTarget,
-    J_JITOperation_ESsiJI operation, GPRReg result, StructureStubInfo* stubInfo,
-    GPRReg object, UniquedStringImpl* uid)
-{
-    storeCodeOrigin(state, jit, codeOrigin);
-    CallContext context(state, usedRegisters, jit, 4, result);
-    jit.setupArgumentsWithExecState(
-        CCallHelpers::TrustedImmPtr(stubInfo), object,
-        CCallHelpers::TrustedImmPtr(uid));
-    return context.makeCall(bitwise_cast<void*>(operation), exceptionTarget);
-}
-
-MacroAssembler::Call callOperation(
-    State& state, const RegisterSet& usedRegisters, CCallHelpers& jit, 
-    CodeOrigin codeOrigin, MacroAssembler::JumpList* exceptionTarget,
-    V_JITOperation_ESsiJJI operation, StructureStubInfo* stubInfo, GPRReg value,
-    GPRReg object, UniquedStringImpl* uid)
-{
-    storeCodeOrigin(state, jit, codeOrigin);
-    CallContext context(state, usedRegisters, jit, 5, InvalidGPRReg);
-    jit.setupArgumentsWithExecState(
-        CCallHelpers::TrustedImmPtr(stubInfo), value, object,
-        CCallHelpers::TrustedImmPtr(uid));
-    return context.makeCall(bitwise_cast<void*>(operation), exceptionTarget);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLSlowPathCall.h b/Source/JavaScriptCore/ftl/FTLSlowPathCall.h
deleted file mode 100644
index 818ef6464..000000000
--- a/Source/JavaScriptCore/ftl/FTLSlowPathCall.h
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLSlowPathCall_h
-#define FTLSlowPathCall_h
-
-#if ENABLE(FTL_JIT)
-
-#include "CCallHelpers.h"
-#include "FTLSlowPathCallKey.h"
-#include "JITOperations.h"
-#include "StructureStubInfo.h"
-
-namespace JSC { namespace FTL {
-
-class State;
-
-class SlowPathCall {
-public:
-    SlowPathCall() { }
-    
-    SlowPathCall(MacroAssembler::Call call, const SlowPathCallKey& key)
-        : m_call(call)
-        , m_key(key)
-    {
-    }
-    
-    MacroAssembler::Call call() const { return m_call; }
-    SlowPathCallKey key() const { return m_key; }
-    
-private:
-    MacroAssembler::Call m_call;
-    SlowPathCallKey m_key;
-};
-
-void storeCodeOrigin(State&, CCallHelpers&, CodeOrigin);
-
-MacroAssembler::Call callOperation(
-    State&, const RegisterSet&, CCallHelpers&, CodeOrigin, CCallHelpers::JumpList*,
-    J_JITOperation_ESsiCI, GPRReg, StructureStubInfo*, GPRReg,
-    const UniquedStringImpl* uid);
-MacroAssembler::Call callOperation(
-    State&, const RegisterSet&, CCallHelpers&, CodeOrigin, CCallHelpers::JumpList*,
-    J_JITOperation_ESsiJI, GPRReg result, StructureStubInfo*, GPRReg object,
-    UniquedStringImpl* uid);
-MacroAssembler::Call callOperation(
-    State&, const RegisterSet&, CCallHelpers&, CodeOrigin, CCallHelpers::JumpList*,
-    V_JITOperation_ESsiJJI, StructureStubInfo*, GPRReg value, GPRReg object,
-    UniquedStringImpl* uid);
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLSlowPathCall_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLSlowPathCallKey.cpp b/Source/JavaScriptCore/ftl/FTLSlowPathCallKey.cpp
deleted file mode 100644
index 4cc835d82..000000000
--- a/Source/JavaScriptCore/ftl/FTLSlowPathCallKey.cpp
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLSlowPathCallKey.h"
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC { namespace FTL {
-
-void SlowPathCallKey::dump(PrintStream& out) const
-{
-    out.print("<usedRegisters = ", m_usedRegisters, ", offset = ", m_offset, ", callTarget = ", RawPointer(m_callTarget), ", argumentRegisters = ", m_argumentRegisters, ">");
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLSlowPathCallKey.h b/Source/JavaScriptCore/ftl/FTLSlowPathCallKey.h
deleted file mode 100644
index 22f87107d..000000000
--- a/Source/JavaScriptCore/ftl/FTLSlowPathCallKey.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLSlowPathCallKey_h
-#define FTLSlowPathCallKey_h
-
-#if ENABLE(FTL_JIT)
-
-#include "RegisterSet.h"
-
-namespace JSC { namespace FTL {
-
-// This is used for creating some sanity in slow-path calls out of the FTL's inline
-// caches. The idea is that we don't want all of the register save/restore stuff to
-// be generated at each IC site. Instead, the IC slow path call site will just save
-// the registers needed for the arguments. It will arrange for there to be enough
-// space on top of stack to save the remaining registers and the return PC. Then it
-// will call a shared thunk that will save the remaining registers. That thunk needs
-// to know the stack offset at which things get saved along with the call target.
-
-// Note that the offset is *not including* the return PC that would be pushed on X86.
-
-class SlowPathCallKey {
-public:
-    SlowPathCallKey()
-        : m_callTarget(0)
-        , m_offset(0)
-    {
-    }
-    
-    SlowPathCallKey(
-        const RegisterSet& set, void* callTarget, const RegisterSet& argumentRegisters,
-        ptrdiff_t offset)
-        : m_usedRegisters(set)
-        , m_callTarget(callTarget)
-        , m_argumentRegisters(argumentRegisters)
-        , m_offset(offset)
-    {
-    }
-    
-    const RegisterSet& usedRegisters() const { return m_usedRegisters; }
-    void* callTarget() const { return m_callTarget; }
-    const RegisterSet& argumentRegisters() const { return m_argumentRegisters; }
-    ptrdiff_t offset() const { return m_offset; }
-    
-    SlowPathCallKey withCallTarget(void* callTarget)
-    {
-        return SlowPathCallKey(usedRegisters(), callTarget, argumentRegisters(), offset());
-    }
-    
-    void dump(PrintStream&) const;
-    
-    enum EmptyValueTag { EmptyValue };
-    enum DeletedValueTag { DeletedValue };
-    
-    SlowPathCallKey(EmptyValueTag)
-        : m_usedRegisters(RegisterSet::EmptyValue)
-        , m_callTarget(0)
-        , m_offset(0)
-    {
-    }
-    
-    SlowPathCallKey(DeletedValueTag)
-        : m_usedRegisters(RegisterSet::DeletedValue)
-        , m_callTarget(0)
-        , m_offset(0)
-    {
-    }
-    
-    bool isEmptyValue() const { return m_usedRegisters.isEmptyValue(); }
-    bool isDeletedValue() const { return m_usedRegisters.isDeletedValue(); }
-    
-    bool operator==(const SlowPathCallKey& other) const
-    {
-        return m_usedRegisters == other.m_usedRegisters
-            && m_callTarget == other.m_callTarget
-            && m_offset == other.m_offset;
-    }
-    unsigned hash() const
-    {
-        return m_usedRegisters.hash() + PtrHash<void*>::hash(m_callTarget) + m_offset;
-    }
-
-private:
-    RegisterSet m_usedRegisters;
-    void* m_callTarget;
-    RegisterSet m_argumentRegisters;
-    ptrdiff_t m_offset;
-};
-
-struct SlowPathCallKeyHash {
-    static unsigned hash(const SlowPathCallKey& key) { return key.hash(); }
-    static bool equal(const SlowPathCallKey& a, const SlowPathCallKey& b) { return a == b; }
-    static const bool safeToCompareToEmptyOrDeleted = false;
-};
-
-} } // namespace JSC::FTL
-
-namespace WTF {
-
-template<typename T> struct DefaultHash;
-template<> struct DefaultHash<JSC::FTL::SlowPathCallKey> {
-    typedef JSC::FTL::SlowPathCallKeyHash Hash;
-};
-
-template<typename T> struct HashTraits;
-template<> struct HashTraits<JSC::FTL::SlowPathCallKey> : public CustomHashTraits<JSC::FTL::SlowPathCallKey> { };
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLSlowPathCallKey_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLStackMaps.cpp b/Source/JavaScriptCore/ftl/FTLStackMaps.cpp
deleted file mode 100644
index a8ce12bab..000000000
--- a/Source/JavaScriptCore/ftl/FTLStackMaps.cpp
+++ /dev/null
@@ -1,300 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLStackMaps.h"
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLLocation.h"
-#include <wtf/CommaPrinter.h>
-#include <wtf/DataLog.h>
-#include <wtf/ListDump.h>
-
-namespace JSC { namespace FTL {
-
-template<typename T>
-T readObject(StackMaps::ParseContext& context)
-{
-    T result;
-    result.parse(context);
-    return result;
-}
-
-void StackMaps::Constant::parse(StackMaps::ParseContext& context)
-{
-    integer = context.view->read<int64_t>(context.offset, true);
-}
-
-void StackMaps::Constant::dump(PrintStream& out) const
-{
-    out.printf("0x%016llx", static_cast<unsigned long long>(integer));
-}
-
-void StackMaps::StackSize::parse(StackMaps::ParseContext& context)
-{
-    switch (context.version) {
-    case 0:
-        functionOffset = context.view->read<uint32_t>(context.offset, true);
-        size = context.view->read<uint32_t>(context.offset, true);
-        break;
-        
-    default:
-        functionOffset = context.view->read<uint64_t>(context.offset, true);
-        size = context.view->read<uint64_t>(context.offset, true);
-        break;
-    }
-}
-
-void StackMaps::StackSize::dump(PrintStream& out) const
-{
-    out.print("(off:", functionOffset, ", size:", size, ")");
-}
-
-void StackMaps::Location::parse(StackMaps::ParseContext& context)
-{
-    kind = static_cast<Kind>(context.view->read<uint8_t>(context.offset, true));
-    size = context.view->read<uint8_t>(context.offset, true);
-    dwarfReg = DWARFRegister(context.view->read<uint16_t>(context.offset, true));
-    this->offset = context.view->read<int32_t>(context.offset, true);
-}
-
-void StackMaps::Location::dump(PrintStream& out) const
-{
-    out.print("(", kind, ", ", dwarfReg, ", off:", offset, ", size:", size, ")");
-}
-
-GPRReg StackMaps::Location::directGPR() const
-{
-    return FTL::Location::forStackmaps(nullptr, *this).directGPR();
-}
-
-void StackMaps::Location::restoreInto(
-    MacroAssembler& jit, StackMaps& stackmaps, char* savedRegisters, GPRReg result) const
-{
-    FTL::Location::forStackmaps(&stackmaps, *this).restoreInto(jit, savedRegisters, result);
-}
-
-void StackMaps::LiveOut::parse(StackMaps::ParseContext& context)
-{
-    dwarfReg = DWARFRegister(context.view->read<uint16_t>(context.offset, true)); // regnum
-    context.view->read<uint8_t>(context.offset, true); // reserved
-    size = context.view->read<uint8_t>(context.offset, true); // size in bytes
-}
-
-void StackMaps::LiveOut::dump(PrintStream& out) const
-{
-    out.print("(", dwarfReg, ", ", size, ")");
-}
-
-bool StackMaps::Record::parse(StackMaps::ParseContext& context)
-{
-    int64_t id = context.view->read<int64_t>(context.offset, true);
-    ASSERT(static_cast<int32_t>(id) == id);
-    patchpointID = static_cast<uint32_t>(id);
-    if (static_cast<int32_t>(patchpointID) < 0)
-        return false;
-    
-    instructionOffset = context.view->read<uint32_t>(context.offset, true);
-    flags = context.view->read<uint16_t>(context.offset, true);
-    
-    unsigned length = context.view->read<uint16_t>(context.offset, true);
-    while (length--)
-        locations.append(readObject<Location>(context));
-    
-    if (context.version >= 1)
-        context.view->read<uint16_t>(context.offset, true); // padding
-
-    unsigned numLiveOuts = context.view->read<uint16_t>(context.offset, true);
-    while (numLiveOuts--)
-        liveOuts.append(readObject<LiveOut>(context));
-
-    if (context.version >= 1) {
-        if (context.offset & 7) {
-            ASSERT(!(context.offset & 3));
-            context.view->read<uint32_t>(context.offset, true); // padding
-        }
-    }
-    
-    return true;
-}
-
-void StackMaps::Record::dump(PrintStream& out) const
-{
-    out.print(
-        "(#", patchpointID, ", offset = ", instructionOffset, ", flags = ", flags,
-        ", locations = [", listDump(locations), "], liveOuts = [",
-        listDump(liveOuts), "])");
-}
-
-RegisterSet StackMaps::Record::locationSet() const
-{
-    RegisterSet result;
-    for (unsigned i = locations.size(); i--;) {
-        Reg reg = locations[i].dwarfReg.reg();
-        if (!reg)
-            continue;
-        result.set(reg);
-    }
-    return result;
-}
-
-RegisterSet StackMaps::Record::liveOutsSet() const
-{
-    RegisterSet result;
-    for (unsigned i = liveOuts.size(); i--;) {
-        LiveOut liveOut = liveOuts[i];
-        Reg reg = liveOut.dwarfReg.reg();
-        // FIXME: Either assert that size is not greater than sizeof(pointer), or actually
-        // save the high bits of registers.
-        // https://bugs.webkit.org/show_bug.cgi?id=130885
-        if (!reg) {
-            dataLog("Invalid liveOuts entry in: ", *this, "\n");
-            RELEASE_ASSERT_NOT_REACHED();
-        }
-        result.set(reg);
-    }
-    return result;
-}
-
-RegisterSet StackMaps::Record::usedRegisterSet() const
-{
-    RegisterSet result;
-    result.merge(locationSet());
-    result.merge(liveOutsSet());
-    return result;
-}
-
-bool StackMaps::parse(DataView* view)
-{
-    ParseContext context;
-    context.offset = 0;
-    context.view = view;
-    
-    version = context.version = context.view->read<uint8_t>(context.offset, true);
-
-    context.view->read<uint8_t>(context.offset, true); // Reserved
-    context.view->read<uint8_t>(context.offset, true); // Reserved
-    context.view->read<uint8_t>(context.offset, true); // Reserved
-
-    uint32_t numFunctions;
-    uint32_t numConstants;
-    uint32_t numRecords;
-    
-    numFunctions = context.view->read<uint32_t>(context.offset, true);
-    if (context.version >= 1) {
-        numConstants = context.view->read<uint32_t>(context.offset, true);
-        numRecords = context.view->read<uint32_t>(context.offset, true);
-    }
-    while (numFunctions--)
-        stackSizes.append(readObject<StackSize>(context));
-    
-    if (!context.version)
-        numConstants = context.view->read<uint32_t>(context.offset, true);
-    while (numConstants--)
-        constants.append(readObject<Constant>(context));
-    
-    if (!context.version)
-        numRecords = context.view->read<uint32_t>(context.offset, true);
-    while (numRecords--) {
-        Record record;
-        if (!record.parse(context))
-            return false;
-        records.append(record);
-    }
-    
-    return true;
-}
-
-void StackMaps::dump(PrintStream& out) const
-{
-    out.print("Version:", version, ", StackSizes[", listDump(stackSizes), "], Constants:[", listDump(constants), "], Records:[", listDump(records), "]");
-}
-
-void StackMaps::dumpMultiline(PrintStream& out, const char* prefix) const
-{
-    out.print(prefix, "Version: ", version, "\n");
-    out.print(prefix, "StackSizes:\n");
-    for (unsigned i = 0; i < stackSizes.size(); ++i)
-        out.print(prefix, "    ", stackSizes[i], "\n");
-    out.print(prefix, "Constants:\n");
-    for (unsigned i = 0; i < constants.size(); ++i)
-        out.print(prefix, "    ", constants[i], "\n");
-    out.print(prefix, "Records:\n");
-    for (unsigned i = 0; i < records.size(); ++i)
-        out.print(prefix, "    ", records[i], "\n");
-}
-
-StackMaps::RecordMap StackMaps::computeRecordMap() const
-{
-    RecordMap result;
-    for (unsigned i = records.size(); i--;)
-        result.add(records[i].patchpointID, Vector<Record>()).iterator->value.append(records[i]);
-    return result;
-}
-
-unsigned StackMaps::stackSize() const
-{
-    RELEASE_ASSERT(stackSizes.size() == 1);
-
-    return stackSizes[0].size;
-}
-
-} } // namespace JSC::FTL
-
-namespace WTF {
-
-using namespace JSC::FTL;
-
-void printInternal(PrintStream& out, StackMaps::Location::Kind kind)
-{
-    switch (kind) {
-    case StackMaps::Location::Unprocessed:
-        out.print("Unprocessed");
-        return;
-    case StackMaps::Location::Register:
-        out.print("Register");
-        return;
-    case StackMaps::Location::Direct:
-        out.print("Direct");
-        return;
-    case StackMaps::Location::Indirect:
-        out.print("Indirect");
-        return;
-    case StackMaps::Location::Constant:
-        out.print("Constant");
-        return;
-    case StackMaps::Location::ConstantIndex:
-        out.print("ConstantIndex");
-        return;
-    }
-    dataLog("Unrecognized kind: ", static_cast<int>(kind), "\n");
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLStackMaps.h b/Source/JavaScriptCore/ftl/FTLStackMaps.h
deleted file mode 100644
index 6440b0f7f..000000000
--- a/Source/JavaScriptCore/ftl/FTLStackMaps.h
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLStackMaps_h
-#define FTLStackMaps_h
-
-#if ENABLE(FTL_JIT)
-
-#include "DataView.h"
-#include "FTLDWARFRegister.h"
-#include "GPRInfo.h"
-#include "RegisterSet.h"
-#include <wtf/HashMap.h>
-
-namespace JSC {
-
-class MacroAssembler;
-
-namespace FTL {
-
-struct StackMaps {
-    struct ParseContext {
-        unsigned version;
-        DataView* view;
-        unsigned offset;
-    };
-    
-    struct Constant {
-        int64_t integer;
-        
-        void parse(ParseContext&);
-        void dump(PrintStream& out) const;
-    };
-
-    struct StackSize {
-        uint64_t functionOffset;
-        uint64_t size;
-
-        void parse(ParseContext&);
-        void dump(PrintStream&) const;
-    };
-
-    struct Location {
-        enum Kind : int8_t {
-            Unprocessed,
-            Register,
-            Direct,
-            Indirect,
-            Constant,
-            ConstantIndex
-        };
-        
-        DWARFRegister dwarfReg;
-        uint8_t size;
-        Kind kind;
-        int32_t offset;
-        
-        void parse(ParseContext&);
-        void dump(PrintStream& out) const;
-        
-        GPRReg directGPR() const;
-        void restoreInto(MacroAssembler&, StackMaps&, char* savedRegisters, GPRReg result) const;
-    };
-    
-    // FIXME: Investigate how much memory this takes and possibly prune it from the
-    // format we keep around in FTL::JITCode. I suspect that it would be most awesome to
-    // have a CompactStackMaps struct that lossily stores only that subset of StackMaps
-    // and Record that we actually need for OSR exit.
-    // https://bugs.webkit.org/show_bug.cgi?id=130802
-    struct LiveOut {
-        DWARFRegister dwarfReg;
-        uint8_t size;
-        
-        void parse(ParseContext&);
-        void dump(PrintStream& out) const;
-    };
-    
-    struct Record {
-        uint32_t patchpointID;
-        uint32_t instructionOffset;
-        uint16_t flags;
-        
-        Vector<Location> locations;
-        Vector<LiveOut> liveOuts;
-        
-        bool parse(ParseContext&);
-        void dump(PrintStream&) const;
-        
-        RegisterSet liveOutsSet() const;
-        RegisterSet locationSet() const;
-        RegisterSet usedRegisterSet() const;
-    };
-
-    unsigned version;
-    Vector<StackSize> stackSizes;
-    Vector<Constant> constants;
-    Vector<Record> records;
-    
-    bool parse(DataView*); // Returns true on parse success, false on failure. Failure means that LLVM is signaling compile failure to us.
-    void dump(PrintStream&) const;
-    void dumpMultiline(PrintStream&, const char* prefix) const;
-    
-    typedef HashMap<uint32_t, Vector<Record>, WTF::IntHash<uint32_t>, WTF::UnsignedWithZeroKeyHashTraits<uint32_t>> RecordMap;
-    
-    RecordMap computeRecordMap() const;
-
-    unsigned stackSize() const;
-};
-
-} } // namespace JSC::FTL
-
-namespace WTF {
-
-void printInternal(PrintStream&, JSC::FTL::StackMaps::Location::Kind);
-
-} // namespace WTF
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLStackMaps_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLState.cpp b/Source/JavaScriptCore/ftl/FTLState.cpp
index 7c94bab36..c263b264b 100644
--- a/Source/JavaScriptCore/ftl/FTLState.cpp
+++ b/Source/JavaScriptCore/ftl/FTLState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,8 +32,6 @@
 #include "FTLForOSREntryJITCode.h"
 #include "FTLJITCode.h"
 #include "FTLJITFinalizer.h"
-#include <llvm/InitializeLLVM.h>
-#include <stdio.h>
 
 namespace JSC { namespace FTL {
 
@@ -45,12 +43,6 @@ State::State(Graph& graph)
     , module(0)
     , function(0)
     , generatedFunction(0)
-    , handleStackOverflowExceptionStackmapID(UINT_MAX)
-    , handleExceptionStackmapID(UINT_MAX)
-    , capturedStackmapID(UINT_MAX)
-    , varargsSpillSlotsStackmapID(UINT_MAX)
-    , unwindDataSection(0)
-    , unwindDataSectionSize(0)
 {
     switch (graph.m_plan.mode) {
     case FTLMode: {
@@ -68,9 +60,9 @@ State::State(Graph& graph)
         RELEASE_ASSERT_NOT_REACHED();
         break;
     }
-
-    graph.m_plan.finalizer = std::make_unique<JITFinalizer>(graph.m_plan);
-    finalizer = static_cast<JITFinalizer*>(graph.m_plan.finalizer.get());
+    
+    finalizer = new JITFinalizer(graph.m_plan);
+    graph.m_plan.finalizer = adoptPtr(finalizer);
 }
 
 State::~State()
@@ -80,11 +72,6 @@ State::~State()
 
 void State::dumpState(const char* when)
 {
-    dumpState(module, when);
-}
-
-void State::dumpState(LModule module, const char* when)
-{
     dataLog("LLVM IR for ", CodeBlockWithJITType(graph.m_codeBlock, FTL::JITCode::FTLJIT), " ", when, ":\n");
     dumpModule(module);
 }
diff --git a/Source/JavaScriptCore/ftl/FTLState.h b/Source/JavaScriptCore/ftl/FTLState.h
index 42fb9d2ca..c82db6728 100644
--- a/Source/JavaScriptCore/ftl/FTLState.h
+++ b/Source/JavaScriptCore/ftl/FTLState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,33 +26,21 @@
 #ifndef FTLState_h
 #define FTLState_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
-#include "DFGCommon.h"
 #include "DFGGraph.h"
 #include "FTLAbbreviations.h"
 #include "FTLGeneratedFunction.h"
 #include "FTLInlineCacheDescriptor.h"
 #include "FTLJITCode.h"
 #include "FTLJITFinalizer.h"
-#include "FTLJSCall.h"
-#include "FTLJSCallVarargs.h"
 #include "FTLStackMaps.h"
-#include "FTLState.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC { namespace FTL {
 
-inline bool verboseCompilationEnabled()
-{
-    return DFG::verboseCompilationEnabled(DFG::FTLMode);
-}
-
-inline bool shouldShowDisassembly()
-{
-    return DFG::shouldShowDisassembly(DFG::FTLMode);
-}
-
 class State {
     WTF_MAKE_NONCOPYABLE(State);
     
@@ -66,29 +54,16 @@ public:
     LContext context;
     LModule module;
     LValue function;
-    bool allocationFailed { false }; // Throw out the compilation once LLVM returns.
     RefPtr<JITCode> jitCode;
     GeneratedFunction generatedFunction;
     JITFinalizer* finalizer;
-    unsigned handleStackOverflowExceptionStackmapID;
-    unsigned handleExceptionStackmapID;
-    unsigned capturedStackmapID;
-    unsigned varargsSpillSlotsStackmapID;
     SegmentedVector<GetByIdDescriptor> getByIds;
     SegmentedVector<PutByIdDescriptor> putByIds;
-    SegmentedVector<CheckInDescriptor> checkIns;
-    Vector<JSCall> jsCalls;
-    Vector<JSCallVarargs> jsCallVarargses;
     Vector<CString> codeSectionNames;
     Vector<CString> dataSectionNames;
-    void* unwindDataSection;
-    size_t unwindDataSectionSize;
-    RefPtr<DataSection> stackmapsSection;
+    RefCountedArray<LSectionWord> stackmapsSection;
     
     void dumpState(const char* when);
-    void dumpState(LModule, const char* when);
-
-    HashSet<CString> nativeLoadedLibraries;
 };
 
 } } // namespace JSC::FTL
diff --git a/Source/JavaScriptCore/ftl/FTLSwitchCase.h b/Source/JavaScriptCore/ftl/FTLSwitchCase.h
index cd6bc078d..e9f17d010 100644
--- a/Source/JavaScriptCore/ftl/FTLSwitchCase.h
+++ b/Source/JavaScriptCore/ftl/FTLSwitchCase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,36 +26,28 @@
 #ifndef FTLSwitchCase_h
 #define FTLSwitchCase_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviatedTypes.h"
-#include "FTLWeight.h"
 
 namespace JSC { namespace FTL {
 
 class SwitchCase {
 public:
-    SwitchCase()
-        : m_value(nullptr)
-        , m_target(nullptr)
-    {
-    }
-
-    SwitchCase(LValue value, LBasicBlock target, Weight weight = Weight())
+    SwitchCase(LValue value, LBasicBlock target)
         : m_value(value)
         , m_target(target)
-        , m_weight(weight)
     {
     }
 
     LValue value() const { return m_value; }
     LBasicBlock target() const { return m_target; }
-    Weight weight() const { return m_weight; }
 
 private:
     LValue m_value;
     LBasicBlock m_target;
-    Weight m_weight;
 };
 
 } } // namespace JSC::FTL
diff --git a/Source/JavaScriptCore/ftl/FTLThunks.cpp b/Source/JavaScriptCore/ftl/FTLThunks.cpp
index f2198ad2b..bf04af02a 100644
--- a/Source/JavaScriptCore/ftl/FTLThunks.cpp
+++ b/Source/JavaScriptCore/ftl/FTLThunks.cpp
@@ -39,28 +39,19 @@ namespace JSC { namespace FTL {
 
 using namespace DFG;
 
-MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM& vm, const Location& location)
 {
-    AssemblyHelpers jit(vm, 0);
+    AssemblyHelpers jit(&vm, 0);
     
     // Note that the "return address" will be the OSR exit ID.
     
-    ptrdiff_t stackMisalignment = MacroAssembler::pushToSaveByteOffset();
-    
     // Pretend that we're a C call frame.
-    jit.pushToSave(MacroAssembler::framePointerRegister);
+    jit.push(MacroAssembler::framePointerRegister);
     jit.move(MacroAssembler::stackPointerRegister, MacroAssembler::framePointerRegister);
-    stackMisalignment += MacroAssembler::pushToSaveByteOffset();
+    jit.push(GPRInfo::regT0);
+    jit.push(GPRInfo::regT0);
     
-    // Now create ourselves enough stack space to give saveAllRegisters() a scratch slot.
-    unsigned numberOfRequiredPops = 0;
-    do {
-        jit.pushToSave(GPRInfo::regT0);
-        stackMisalignment += MacroAssembler::pushToSaveByteOffset();
-        numberOfRequiredPops++;
-    } while (stackMisalignment % stackAlignmentBytes());
-    
-    ScratchBuffer* scratchBuffer = vm->scratchBufferForSize(requiredScratchMemorySizeInBytes());
+    ScratchBuffer* scratchBuffer = vm.scratchBufferForSize(requiredScratchMemorySizeInBytes());
     char* buffer = static_cast<char*>(scratchBuffer->dataBuffer());
     
     saveAllRegisters(jit, buffer);
@@ -69,10 +60,8 @@ MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
     jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::nonArgGPR1);
     jit.storePtr(MacroAssembler::TrustedImmPtr(requiredScratchMemorySizeInBytes()), GPRInfo::nonArgGPR1);
 
-    jit.loadPtr(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
-    jit.peek(
-        GPRInfo::argumentGPR1,
-        (stackMisalignment - MacroAssembler::pushToSaveByteOffset()) / sizeof(void*));
+    location.restoreInto(jit, buffer, GPRInfo::argumentGPR0, 1);
+    jit.peek(GPRInfo::argumentGPR1, 3);
     MacroAssembler::Call functionCall = jit.call();
     
     // At this point we want to make a tail call to what was returned to us in the
@@ -82,56 +71,24 @@ MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM* vm)
     
     jit.move(GPRInfo::returnValueGPR, GPRInfo::regT0);
     
-    // Make sure we tell the GC that we're not using the scratch buffer anymore.
-    jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT1);
-    jit.storePtr(MacroAssembler::TrustedImmPtr(0), GPRInfo::regT1);
-    
     // Prepare for tail call.
-    while (numberOfRequiredPops--)
-        jit.popToRestore(GPRInfo::regT1);
-    jit.popToRestore(MacroAssembler::framePointerRegister);
+    jit.pop(GPRInfo::regT1);
+    jit.pop(GPRInfo::regT1);
+    jit.pop(MacroAssembler::framePointerRegister);
     
     // At this point we're sitting on the return address - so if we did a jump right now, the
     // tail-callee would be happy. Instead we'll stash the callee in the return address and then
     // restore all registers.
     
     jit.restoreReturnAddressBeforeReturn(GPRInfo::regT0);
-
+    
     restoreAllRegisters(jit, buffer);
 
     jit.ret();
     
-    LinkBuffer patchBuffer(*vm, jit, GLOBAL_THUNK_ID);
+    LinkBuffer patchBuffer(vm, &jit, GLOBAL_THUNK_ID);
     patchBuffer.link(functionCall, compileFTLOSRExit);
-    return FINALIZE_CODE(patchBuffer, ("FTL OSR exit generation thunk"));
-}
-
-static void registerClobberCheck(AssemblyHelpers& jit, RegisterSet dontClobber)
-{
-    if (!Options::clobberAllRegsInFTLICSlowPath())
-        return;
-    
-    RegisterSet clobber = RegisterSet::allRegisters();
-    clobber.exclude(RegisterSet::reservedHardwareRegisters());
-    clobber.exclude(RegisterSet::stackRegisters());
-    clobber.exclude(RegisterSet::calleeSaveRegisters());
-    clobber.exclude(dontClobber);
-    
-    GPRReg someGPR;
-    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
-        if (!clobber.get(reg) || !reg.isGPR())
-            continue;
-        
-        jit.move(AssemblyHelpers::TrustedImm32(0x1337beef), reg.gpr());
-        someGPR = reg.gpr();
-    }
-    
-    for (Reg reg = Reg::first(); reg <= Reg::last(); reg = reg.next()) {
-        if (!clobber.get(reg) || !reg.isFPR())
-            continue;
-        
-        jit.move64ToDouble(someGPR, reg.fpr());
-    }
+    return FINALIZE_CODE(patchBuffer, ("FTL OSR exit generation thunk for callFrame at %s", toCString(location).data()));
 }
 
 MacroAssemblerCodeRef slowPathCallThunkGenerator(VM& vm, const SlowPathCallKey& key)
@@ -165,10 +122,8 @@ MacroAssemblerCodeRef slowPathCallThunkGenerator(VM& vm, const SlowPathCallKey&
     jit.preserveReturnAddressAfterCall(GPRInfo::nonArgGPR0);
     jit.storePtr(GPRInfo::nonArgGPR0, AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, key.offset()));
     
-    registerClobberCheck(jit, key.argumentRegisters());
+    JITCompiler::Call call = jit.call();
     
-    AssemblyHelpers::Call call = jit.call();
-
     jit.loadPtr(AssemblyHelpers::Address(MacroAssembler::stackPointerRegister, key.offset()), GPRInfo::nonPreservedNonReturnGPR);
     jit.restoreReturnAddressBeforeReturn(GPRInfo::nonPreservedNonReturnGPR);
     
@@ -192,7 +147,7 @@ MacroAssemblerCodeRef slowPathCallThunkGenerator(VM& vm, const SlowPathCallKey&
     
     jit.ret();
 
-    LinkBuffer patchBuffer(vm, jit, GLOBAL_THUNK_ID);
+    LinkBuffer patchBuffer(vm, &jit, GLOBAL_THUNK_ID);
     patchBuffer.link(call, FunctionPtr(key.callTarget()));
     return FINALIZE_CODE(patchBuffer, ("FTL slow path call thunk for %s", toCString(key).data()));
 }
diff --git a/Source/JavaScriptCore/ftl/FTLThunks.h b/Source/JavaScriptCore/ftl/FTLThunks.h
index 8cfb16d3d..bbcdbddc9 100644
--- a/Source/JavaScriptCore/ftl/FTLThunks.h
+++ b/Source/JavaScriptCore/ftl/FTLThunks.h
@@ -26,6 +26,8 @@
 #ifndef FTLThunks_h
 #define FTLThunks_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLLocation.h"
@@ -39,7 +41,7 @@ class VM;
 
 namespace FTL {
 
-MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM*);
+MacroAssemblerCodeRef osrExitGenerationThunkGenerator(VM&, const Location&);
 MacroAssemblerCodeRef slowPathCallThunkGenerator(VM&, const SlowPathCallKey&);
 
 template<typename KeyTypeArgument>
@@ -76,6 +78,12 @@ typename MapType::KeyType keyForThunk(MapType& map, MacroAssemblerCodePtr ptr)
 
 class Thunks {
 public:
+    MacroAssemblerCodeRef getOSRExitGenerationThunk(VM& vm, const Location& location)
+    {
+        return generateIfNecessary(
+            vm, m_osrExitThunks, location, osrExitGenerationThunkGenerator);
+    }
+    
     MacroAssemblerCodeRef getSlowPathCallThunk(VM& vm, const SlowPathCallKey& key)
     {
         return generateIfNecessary(
@@ -88,6 +96,7 @@ public:
     }
     
 private:
+    ThunkMap<Location> m_osrExitThunks;
     ThunkMap<SlowPathCallKey> m_slowPathCallThunks;
 };
 
diff --git a/Source/JavaScriptCore/ftl/FTLTypedPointer.h b/Source/JavaScriptCore/ftl/FTLTypedPointer.h
index 7591a535d..fbee5a3ec 100644
--- a/Source/JavaScriptCore/ftl/FTLTypedPointer.h
+++ b/Source/JavaScriptCore/ftl/FTLTypedPointer.h
@@ -26,6 +26,8 @@
 #ifndef FTLTypedPointer_h
 #define FTLTypedPointer_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviations.h"
diff --git a/Source/JavaScriptCore/ftl/FTLUnwindInfo.cpp b/Source/JavaScriptCore/ftl/FTLUnwindInfo.cpp
deleted file mode 100644
index 2867a7245..000000000
--- a/Source/JavaScriptCore/ftl/FTLUnwindInfo.cpp
+++ /dev/null
@@ -1,1044 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- * Copyright (C) 2014 Samsung Electronics
- * Copyright (C) 2014 University of Szeged
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * ==============================================================================
- *
- * University of Illinois/NCSA
- * Open Source License
- *
- * Copyright (c) 2009-2014 by the contributors of LLVM/libc++abi project.
- *
- * All rights reserved.
- *
- * Developed by:
- *
- *    LLVM Team
- *
- *    University of Illinois at Urbana-Champaign
- *
- *    http://llvm.org
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal with
- * the Software without restriction, including without limitation the rights to
- * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
- * of the Software, and to permit persons to whom the Software is furnished to do
- * so, subject to the following conditions:
- *
- *    * Redistributions of source code must retain the above copyright notice,
- *      this list of conditions and the following disclaimers.
- *
- *    * Redistributions in binary form must reproduce the above copyright notice,
- *      this list of conditions and the following disclaimers in the
- *      documentation and/or other materials provided with the distribution.
- *
- *    * Neither the names of the LLVM Team, University of Illinois at
- *      Urbana-Champaign, nor the names of its contributors may be used to
- *      endorse or promote products derived from this Software without specific
- *      prior written permission.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
- * CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE
- * SOFTWARE.
- *
- * ==============================================================================
- *
- * Copyright (c) 2009-2014 by the contributors of LLVM/libc++abi project.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "config.h"
-#include "FTLUnwindInfo.h"
-
-#if ENABLE(FTL_JIT)
-
-#if OS(DARWIN)
-#include <mach-o/compact_unwind_encoding.h>
-#endif
-#include <wtf/ListDump.h>
-
-namespace JSC { namespace FTL {
-
-UnwindInfo::UnwindInfo() { }
-UnwindInfo::~UnwindInfo() { }
-
-
-namespace {
-#if OS(DARWIN)
-struct CompactUnwind {
-    void* function;
-    uint32_t size;
-    compact_unwind_encoding_t encoding;
-    void* personality;
-    void* lsda;
-};
-#elif OS(LINUX)
-// DWARF unwind instructions
-enum {
-    DW_CFA_nop                 = 0x0,
-    DW_CFA_set_loc             = 0x1,
-    DW_CFA_advance_loc1        = 0x2,
-    DW_CFA_advance_loc2        = 0x3,
-    DW_CFA_advance_loc4        = 0x4,
-    DW_CFA_offset_extended     = 0x5,
-    DW_CFA_def_cfa             = 0xC,
-    DW_CFA_def_cfa_register    = 0xD,
-    DW_CFA_def_cfa_offset      = 0xE,
-    DW_CFA_offset_extended_sf = 0x11,
-    DW_CFA_def_cfa_sf         = 0x12,
-    DW_CFA_def_cfa_offset_sf  = 0x13,
-    // high 2 bits are 0x1, lower 6 bits are delta
-    DW_CFA_advance_loc        = 0x40,
-    // high 2 bits are 0x2, lower 6 bits are register
-    DW_CFA_offset             = 0x80
-};
-
-enum {
-    DW_CFA_operand_mask = 0x3F // low 6 bits mask for opcode-encoded operands in DW_CFA_advance_loc and DW_CFA_offset
-};
-
-// FSF exception handling Pointer-Encoding constants
-enum {
-    DW_EH_PE_ptr       = 0x00,
-    DW_EH_PE_uleb128   = 0x01,
-    DW_EH_PE_udata2    = 0x02,
-    DW_EH_PE_udata4    = 0x03,
-    DW_EH_PE_udata8    = 0x04,
-    DW_EH_PE_sleb128   = 0x09,
-    DW_EH_PE_sdata2    = 0x0A,
-    DW_EH_PE_sdata4    = 0x0B,
-    DW_EH_PE_sdata8    = 0x0C,
-    DW_EH_PE_absptr    = 0x00,
-    DW_EH_PE_pcrel     = 0x10,
-    DW_EH_PE_indirect  = 0x80
-};
-
-enum {
-    DW_EH_PE_relative_mask = 0x70
-};
-
-// 64-bit x86_64 registers
-enum {
-    UNW_X86_64_rbx =  3,
-    UNW_X86_64_rbp =  6,
-    UNW_X86_64_r12 = 12,
-    UNW_X86_64_r13 = 13,
-    UNW_X86_64_r14 = 14,
-    UNW_X86_64_r15 = 15
-};
-
-enum {
-    DW_X86_64_RET_addr = 16
-};
-
-enum {
-    UNW_ARM64_x0 = 0,
-    UNW_ARM64_x1 = 1,
-    UNW_ARM64_x2 = 2,
-    UNW_ARM64_x3 = 3,
-    UNW_ARM64_x4 = 4,
-    UNW_ARM64_x5 = 5,
-    UNW_ARM64_x6 = 6,
-    UNW_ARM64_x7 = 7,
-    UNW_ARM64_x8 = 8,
-    UNW_ARM64_x9 = 9,
-    UNW_ARM64_x10 = 10,
-    UNW_ARM64_x11 = 11,
-    UNW_ARM64_x12 = 12,
-    UNW_ARM64_x13 = 13,
-    UNW_ARM64_x14 = 14,
-    UNW_ARM64_x15 = 15,
-    UNW_ARM64_x16 = 16,
-    UNW_ARM64_x17 = 17,
-    UNW_ARM64_x18 = 18,
-    UNW_ARM64_x19 = 19,
-    UNW_ARM64_x20 = 20,
-    UNW_ARM64_x21 = 21,
-    UNW_ARM64_x22 = 22,
-    UNW_ARM64_x23 = 23,
-    UNW_ARM64_x24 = 24,
-    UNW_ARM64_x25 = 25,
-    UNW_ARM64_x26 = 26,
-    UNW_ARM64_x27 = 27,
-    UNW_ARM64_x28 = 28,
-    UNW_ARM64_fp = 29,
-    UNW_ARM64_x30 = 30,
-    UNW_ARM64_sp = 31,
-    UNW_ARM64_v0 = 64,
-    UNW_ARM64_v1 = 65,
-    UNW_ARM64_v2 = 66,
-    UNW_ARM64_v3 = 67,
-    UNW_ARM64_v4 = 68,
-    UNW_ARM64_v5 = 69,
-    UNW_ARM64_v6 = 70,
-    UNW_ARM64_v7 = 71,
-    UNW_ARM64_v8 = 72,
-    UNW_ARM64_v9 = 73,
-    UNW_ARM64_v10 = 74,
-    UNW_ARM64_v11 = 75,
-    UNW_ARM64_v12 = 76,
-    UNW_ARM64_v13 = 77,
-    UNW_ARM64_v14 = 78,
-    UNW_ARM64_v15 = 79,
-    UNW_ARM64_v16 = 80,
-    UNW_ARM64_v17 = 81,
-    UNW_ARM64_v18 = 82,
-    UNW_ARM64_v19 = 83,
-    UNW_ARM64_v20 = 84,
-    UNW_ARM64_v21 = 85,
-    UNW_ARM64_v22 = 86,
-    UNW_ARM64_v23 = 87,
-    UNW_ARM64_v24 = 88,
-    UNW_ARM64_v25 = 89,
-    UNW_ARM64_v26 = 90,
-    UNW_ARM64_v27 = 91,
-    UNW_ARM64_v28 = 92,
-    UNW_ARM64_v29 = 93,
-    UNW_ARM64_v30 = 94,
-    UNW_ARM64_v31 = 95
-};
-
-static uint8_t get8(uintptr_t addr)    { return *((uint8_t*)addr); }
-static uint16_t get16(uintptr_t addr)  { return *((uint16_t*)addr); }
-static uint32_t get32(uintptr_t addr)  { return *((uint32_t*)addr); }
-static uint64_t get64(uintptr_t addr)  { return *((uint64_t*)addr); }
-
-static uintptr_t getP(uintptr_t addr)
-{
-    // FIXME: add support for 32 bit pointers on 32 bit architectures
-    return get64(addr);
-}
-
-static uint64_t getULEB128(uintptr_t& addr, uintptr_t end)
-{
-    const uint8_t* p = (uint8_t*)addr;
-    const uint8_t* pend = (uint8_t*)end;
-    uint64_t result = 0;
-    int bit = 0;
-    do  {
-        uint64_t b;
-
-        RELEASE_ASSERT(p != pend); // truncated uleb128 expression
-
-        b = *p & 0x7f;
-
-        RELEASE_ASSERT(!(bit >= 64 || b << bit >> bit != b)); // malformed uleb128 expression
-
-        result |= b << bit;
-        bit += 7;
-    } while (*p++ >= 0x80);
-    addr = (uintptr_t)p;
-    return result;
-}
-
-static int64_t getSLEB128(uintptr_t& addr, uintptr_t end)
-{
-    const uint8_t* p = (uint8_t*)addr;
-    const uint8_t* pend = (uint8_t*)end;
-
-    int64_t result = 0;
-    int bit = 0;
-    uint8_t byte;
-    do {
-        RELEASE_ASSERT(p != pend); // truncated sleb128 expression
-
-        byte = *p++;
-        result |= ((byte & 0x7f) << bit);
-        bit += 7;
-    } while (byte & 0x80);
-    // sign extend negative numbers
-    if ((byte & 0x40))
-        result |= (-1LL) << bit;
-    addr = (uintptr_t)p;
-    return result;
-}
-
-static uintptr_t getEncodedP(uintptr_t& addr, uintptr_t end, uint8_t encoding)
-{
-    uintptr_t startAddr = addr;
-    const uint8_t* p = (uint8_t*)addr;
-    uintptr_t result;
-
-    // first get value
-    switch (encoding & 0x0F) {
-    case DW_EH_PE_ptr:
-        result = getP(addr);
-        p += sizeof(uintptr_t);
-        addr = (uintptr_t)p;
-        break;
-    case DW_EH_PE_uleb128:
-        result = getULEB128(addr, end);
-        break;
-    case DW_EH_PE_udata2:
-        result = get16(addr);
-        p += 2;
-        addr = (uintptr_t)p;
-        break;
-    case DW_EH_PE_udata4:
-        result = get32(addr);
-        p += 4;
-        addr = (uintptr_t)p;
-        break;
-    case DW_EH_PE_udata8:
-        result = get64(addr);
-        p += 8;
-        addr = (uintptr_t)p;
-        break;
-    case DW_EH_PE_sleb128:
-        result = getSLEB128(addr, end);
-        break;
-    case DW_EH_PE_sdata2:
-        result = (int16_t)get16(addr);
-        p += 2;
-        addr = (uintptr_t)p;
-        break;
-    case DW_EH_PE_sdata4:
-        result = (int32_t)get32(addr);
-        p += 4;
-        addr = (uintptr_t)p;
-        break;
-    case DW_EH_PE_sdata8:
-        result = get64(addr);
-        p += 8;
-        addr = (uintptr_t)p;
-        break;
-    default:
-        RELEASE_ASSERT_NOT_REACHED(); // unknown pointer encoding
-    }
-
-    // then add relative offset
-    switch (encoding & DW_EH_PE_relative_mask) {
-    case DW_EH_PE_absptr:
-        // do nothing
-        break;
-    case DW_EH_PE_pcrel:
-        result += startAddr;
-        break;
-    default:
-        RELEASE_ASSERT_NOT_REACHED(); // unsupported or unknown pointer encoding
-    }
-
-    if (encoding & DW_EH_PE_indirect)
-        result = getP(result);
-
-    return result;
-}
-
-// Information encoded in a CIE (Common Information Entry)
-struct CIE_Info {
-    uintptr_t cieStart;
-    uintptr_t cieLength;
-    uintptr_t cieInstructions;
-    uint8_t pointerEncoding;
-    uint8_t lsdaEncoding;
-    uint8_t personalityEncoding;
-    uint8_t personalityOffsetInCIE;
-    uintptr_t personality;
-    int dataAlignFactor;
-    bool fdesHaveAugmentationData;
-};
-
-// Information about an FDE (Frame Description Entry)
-struct FDE_Info {
-    uintptr_t fdeStart;
-    uintptr_t fdeLength;
-    uintptr_t fdeInstructions;
-    uintptr_t lsda;
-};
-
-// Information about a frame layout and registers saved determined
-// by "running" the dwarf FDE "instructions"
-#if CPU(ARM64)
-enum { MaxRegisterNumber = 120 };
-#elif CPU(X86_64)
-enum { MaxRegisterNumber = 17 };
-#else
-#error "Unrecognized architecture"
-#endif
-
-struct RegisterLocation {
-    bool saved;
-    int64_t offset;
-};
-
-struct PrologInfo {
-    uint32_t cfaRegister;
-    int32_t cfaRegisterOffset; // CFA = (cfaRegister)+cfaRegisterOffset
-    RegisterLocation savedRegisters[MaxRegisterNumber]; // from where to restore registers
-};
-
-static void parseCIE(uintptr_t cie, CIE_Info* cieInfo)
-{
-    cieInfo->pointerEncoding = 0;
-    cieInfo->lsdaEncoding = 0;
-    cieInfo->personalityEncoding = 0;
-    cieInfo->personalityOffsetInCIE = 0;
-    cieInfo->personality = 0;
-    cieInfo->dataAlignFactor = 0;
-    cieInfo->fdesHaveAugmentationData = false;
-    cieInfo->cieStart = cie;
-
-    uintptr_t p = cie;
-    uint64_t cieLength = get32(p);
-    p += 4;
-    uintptr_t cieContentEnd = p + cieLength;
-    if (cieLength == 0xffffffff) {
-        // 0xffffffff means length is really next 8 bytes
-        cieLength = get64(p);
-        p += 8;
-        cieContentEnd = p + cieLength;
-    }
-
-    RELEASE_ASSERT(cieLength);
-
-    // CIE ID is always 0
-    RELEASE_ASSERT(!get32(p)); // CIE ID is not zero
-    p += 4;
-    // Version is always 1 or 3
-    uint8_t version = get8(p);
-    RELEASE_ASSERT((version == 1) || (version == 3)); // CIE version is not 1 or 3
-
-    ++p;
-    // save start of augmentation string and find end
-    uintptr_t strStart = p;
-    while (get8(p))
-        ++p;
-    ++p;
-    // parse code aligment factor
-    getULEB128(p, cieContentEnd);
-    // parse data alignment factor
-    cieInfo->dataAlignFactor = getSLEB128(p, cieContentEnd);
-    // parse return address register
-    getULEB128(p, cieContentEnd);
-    // parse augmentation data based on augmentation string
-    if (get8(strStart) == 'z') {
-        // parse augmentation data length
-        getULEB128(p, cieContentEnd);
-        for (uintptr_t s = strStart; get8(s) != '\0'; ++s) {
-            switch (get8(s)) {
-            case 'z':
-                cieInfo->fdesHaveAugmentationData = true;
-                break;
-            case 'P': // FIXME: should assert on personality (just to keep in sync with the CU behaviour)
-                cieInfo->personalityEncoding = get8(p);
-                ++p;
-                cieInfo->personalityOffsetInCIE = p - cie;
-                cieInfo->personality = getEncodedP(p, cieContentEnd, cieInfo->personalityEncoding);
-                break;
-            case 'L': // FIXME: should assert on LSDA (just to keep in sync with the CU behaviour)
-                cieInfo->lsdaEncoding = get8(p);
-                ++p;
-                break;
-            case 'R':
-                cieInfo->pointerEncoding = get8(p);
-                ++p;
-                break;
-            default:
-                // ignore unknown letters
-                break;
-            }
-        }
-    }
-    cieInfo->cieLength = cieContentEnd - cieInfo->cieStart;
-    cieInfo->cieInstructions = p;
-}
-
-static void findFDE(uintptr_t pc, uintptr_t ehSectionStart, uint32_t sectionLength, FDE_Info* fdeInfo, CIE_Info* cieInfo)
-{
-    uintptr_t p = ehSectionStart;
-    const uintptr_t ehSectionEnd = p + sectionLength;
-    while (p < ehSectionEnd) {
-        uintptr_t currentCFI = p;
-        uint64_t cfiLength = get32(p);
-        p += 4;
-        if (cfiLength == 0xffffffff) {
-            // 0xffffffff means length is really next 8 bytes
-            cfiLength = get64(p);
-            p += 8;
-        }
-        RELEASE_ASSERT(cfiLength); // end marker reached before finding FDE for pc
-
-        uint32_t id = get32(p);
-        if (!id) {
-            // skip over CIEs
-            p += cfiLength;
-        } else {
-            // process FDE to see if it covers pc
-            uintptr_t nextCFI = p + cfiLength;
-            uint32_t ciePointer = get32(p);
-            uintptr_t cieStart = p - ciePointer;
-            // validate pointer to CIE is within section
-            RELEASE_ASSERT((ehSectionStart <= cieStart) && (cieStart < ehSectionEnd)); // malformed FDE. CIE is bad
-
-            parseCIE(cieStart, cieInfo);
-
-            p += 4;
-            // parse pc begin and range
-            uintptr_t pcStart = getEncodedP(p, nextCFI, cieInfo->pointerEncoding);
-            uintptr_t pcRange = getEncodedP(p, nextCFI, cieInfo->pointerEncoding & 0x0F);
-
-            // test if pc is within the function this FDE covers
-            // if pc is not in begin/range, skip this FDE
-            if ((pcStart <= pc) && (pc < pcStart+pcRange)) {
-                // parse rest of info
-                fdeInfo->lsda = 0;
-                // check for augmentation length
-                if (cieInfo->fdesHaveAugmentationData) {
-                    uintptr_t augLen = getULEB128(p, nextCFI);
-                    uintptr_t endOfAug = p + augLen;
-                    if (cieInfo->lsdaEncoding) {
-                        // peek at value (without indirection). Zero means no lsda
-                        uintptr_t lsdaStart = p;
-                        if (getEncodedP(p, nextCFI, cieInfo->lsdaEncoding & 0x0F)) {
-                            // reset pointer and re-parse lsda address
-                            p = lsdaStart;
-                            fdeInfo->lsda = getEncodedP(p, nextCFI, cieInfo->lsdaEncoding);
-                        }
-                    }
-                    p = endOfAug;
-                }
-                fdeInfo->fdeStart = currentCFI;
-                fdeInfo->fdeLength = nextCFI - currentCFI;
-                fdeInfo->fdeInstructions = p;
-
-                return; // FDE found
-            }
-
-            p = nextCFI;
-        }
-    }
-
-    RELEASE_ASSERT_NOT_REACHED(); // no FDE found for pc
-}
-
-static void executeDefCFARegister(uint64_t reg, PrologInfo* results)
-{
-    RELEASE_ASSERT(reg <= MaxRegisterNumber); // reg too big
-    results->cfaRegister = reg;
-}
-
-static void executeDefCFAOffset(int64_t offset, PrologInfo* results)
-{
-    RELEASE_ASSERT(offset <= 0x80000000); // cfa has negative offset (dwarf might contain epilog)
-    results->cfaRegisterOffset = offset;
-}
-
-static void executeOffset(uint64_t reg, int64_t offset, PrologInfo *results)
-{
-    if (reg > MaxRegisterNumber)
-        return;
-
-    RELEASE_ASSERT(!results->savedRegisters[reg].saved);
-    results->savedRegisters[reg].saved = true;
-    results->savedRegisters[reg].offset = offset;
-}
-
-static void parseInstructions(uintptr_t instructions, uintptr_t instructionsEnd, const CIE_Info& cieInfo, PrologInfo* results)
-{
-    uintptr_t p = instructions;
-
-    // see Dwarf Spec, section 6.4.2 for details on unwind opcodes
-    while ((p < instructionsEnd)) {
-        uint64_t reg;
-        uint8_t opcode = get8(p);
-        uint8_t operand;
-        ++p;
-        switch (opcode) {
-        case DW_CFA_nop:
-            break;
-        case DW_CFA_set_loc:
-            getEncodedP(p, instructionsEnd, cieInfo.pointerEncoding);
-            break;
-        case DW_CFA_advance_loc1:
-            p += 1;
-            break;
-        case DW_CFA_advance_loc2:
-            p += 2;
-            break;
-        case DW_CFA_advance_loc4:
-            p += 4;
-            break;
-        case DW_CFA_def_cfa:
-            executeDefCFARegister(getULEB128(p, instructionsEnd), results);
-            executeDefCFAOffset(getULEB128(p, instructionsEnd), results);
-            break;
-        case DW_CFA_def_cfa_sf:
-            executeDefCFARegister(getULEB128(p, instructionsEnd), results);
-            executeDefCFAOffset(getSLEB128(p, instructionsEnd) * cieInfo.dataAlignFactor, results);
-            break;
-        case DW_CFA_def_cfa_register:
-            executeDefCFARegister(getULEB128(p, instructionsEnd), results);
-            break;
-        case DW_CFA_def_cfa_offset:
-            executeDefCFAOffset(getULEB128(p, instructionsEnd), results);
-            break;
-        case DW_CFA_def_cfa_offset_sf:
-            executeDefCFAOffset(getSLEB128(p, instructionsEnd) * cieInfo.dataAlignFactor, results);
-            break;
-        case DW_CFA_offset_extended:
-            reg = getULEB128(p, instructionsEnd);
-            executeOffset(reg, getULEB128(p, instructionsEnd) * cieInfo.dataAlignFactor, results);
-            break;
-        case DW_CFA_offset_extended_sf:
-            reg = getULEB128(p, instructionsEnd);
-            executeOffset(reg, getSLEB128(p, instructionsEnd) * cieInfo.dataAlignFactor, results);
-            break;
-        default:
-            operand = opcode & DW_CFA_operand_mask;
-            switch (opcode & ~DW_CFA_operand_mask) {
-            case DW_CFA_offset:
-                executeOffset(operand, getULEB128(p, instructionsEnd) * cieInfo.dataAlignFactor, results);
-                break;
-            case DW_CFA_advance_loc:
-                break;
-            default:
-                RELEASE_ASSERT_NOT_REACHED(); // unknown or unsupported CFA opcode
-            }
-        }
-    }
-}
-
-static void parseFDEInstructions(const FDE_Info& fdeInfo, const CIE_Info& cieInfo, PrologInfo* results)
-{
-    // clear results
-    bzero(results, sizeof(PrologInfo));
-
-    // parse CIE then FDE instructions
-    parseInstructions(cieInfo.cieInstructions, cieInfo.cieStart + cieInfo.cieLength, cieInfo, results);
-    parseInstructions(fdeInfo.fdeInstructions, fdeInfo.fdeStart + fdeInfo.fdeLength, cieInfo, results);
-}
-#endif
-} // anonymous namespace
-
-bool UnwindInfo::parse(void* section, size_t size, GeneratedFunction generatedFunction)
-{
-    m_registers.clear();
-    RELEASE_ASSERT(!!section);
-    if (!section)
-        return false;
-
-#if OS(DARWIN)
-    RELEASE_ASSERT(size >= sizeof(CompactUnwind));
-    
-    CompactUnwind* data = bitwise_cast<CompactUnwind*>(section);
-    
-    RELEASE_ASSERT(!data->personality); // We don't know how to handle this.
-    RELEASE_ASSERT(!data->lsda); // We don't know how to handle this.
-    RELEASE_ASSERT(data->function == generatedFunction); // The unwind data better be for our function.
-    
-    compact_unwind_encoding_t encoding = data->encoding;
-    RELEASE_ASSERT(!(encoding & UNWIND_IS_NOT_FUNCTION_START));
-    RELEASE_ASSERT(!(encoding & UNWIND_HAS_LSDA));
-    RELEASE_ASSERT(!(encoding & UNWIND_PERSONALITY_MASK));
-
-#if CPU(X86_64)
-    RELEASE_ASSERT((encoding & UNWIND_X86_64_MODE_MASK) == UNWIND_X86_64_MODE_RBP_FRAME);
-    
-    int32_t offset = -((encoding & UNWIND_X86_64_RBP_FRAME_OFFSET) >> 16) * 8;
-    uint32_t nextRegisters = encoding;
-    for (unsigned i = 5; i--;) {
-        uint32_t currentRegister = nextRegisters & 7;
-        nextRegisters >>= 3;
-        
-        switch (currentRegister) {
-        case UNWIND_X86_64_REG_NONE:
-            break;
-            
-        case UNWIND_X86_64_REG_RBX:
-            m_registers.append(RegisterAtOffset(X86Registers::ebx, offset));
-            break;
-            
-        case UNWIND_X86_64_REG_R12:
-            m_registers.append(RegisterAtOffset(X86Registers::r12, offset));
-            break;
-            
-        case UNWIND_X86_64_REG_R13:
-            m_registers.append(RegisterAtOffset(X86Registers::r13, offset));
-            break;
-            
-        case UNWIND_X86_64_REG_R14:
-            m_registers.append(RegisterAtOffset(X86Registers::r14, offset));
-            break;
-            
-        case UNWIND_X86_64_REG_R15:
-            m_registers.append(RegisterAtOffset(X86Registers::r15, offset));
-            break;
-            
-        case UNWIND_X86_64_REG_RBP:
-            m_registers.append(RegisterAtOffset(X86Registers::ebp, offset));
-            break;
-            
-        default:
-            RELEASE_ASSERT_NOT_REACHED();
-        }
-        
-        offset += 8;
-    }
-#elif CPU(ARM64)
-    RELEASE_ASSERT((encoding & UNWIND_ARM64_MODE_MASK) == UNWIND_ARM64_MODE_FRAME);
-    
-    m_registers.append(RegisterAtOffset(ARM64Registers::fp, 0));
-    
-    int32_t offset = 0;
-    if (encoding & UNWIND_ARM64_FRAME_X19_X20_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::x19, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::x20, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_X21_X22_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::x21, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::x22, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_X23_X24_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::x23, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::x24, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_X25_X26_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::x25, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::x26, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_X27_X28_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::x27, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::x28, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_D8_D9_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::q8, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::q9, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_D10_D11_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::q10, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::q11, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_D12_D13_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::q12, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::q13, offset -= 8));
-    }
-    if (encoding & UNWIND_ARM64_FRAME_D14_D15_PAIR) {
-        m_registers.append(RegisterAtOffset(ARM64Registers::q14, offset -= 8));
-        m_registers.append(RegisterAtOffset(ARM64Registers::q15, offset -= 8));
-    }
-#else
-#error "Unrecognized architecture"
-#endif
-
-#elif OS(LINUX)
-    FDE_Info fdeInfo;
-    CIE_Info cieInfo;
-    PrologInfo prolog;
-
-    findFDE((uintptr_t)generatedFunction, (uintptr_t)section, size, &fdeInfo, &cieInfo);
-    parseFDEInstructions(fdeInfo, cieInfo, &prolog);
-
-#if CPU(X86_64)
-    RELEASE_ASSERT(prolog.cfaRegister == UNW_X86_64_rbp);
-    RELEASE_ASSERT(prolog.cfaRegisterOffset == 16);
-    RELEASE_ASSERT(prolog.savedRegisters[UNW_X86_64_rbp].saved);
-    RELEASE_ASSERT(prolog.savedRegisters[UNW_X86_64_rbp].offset == -prolog.cfaRegisterOffset);
-
-    for (int i = 0; i < MaxRegisterNumber; ++i) {
-        if (prolog.savedRegisters[i].saved) {
-            switch (i) {
-            case UNW_X86_64_rbx:
-                m_registers.append(RegisterAtOffset(X86Registers::ebx, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_X86_64_r12:
-                m_registers.append(RegisterAtOffset(X86Registers::r12, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_X86_64_r13:
-                m_registers.append(RegisterAtOffset(X86Registers::r13, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_X86_64_r14:
-                m_registers.append(RegisterAtOffset(X86Registers::r14, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_X86_64_r15:
-                m_registers.append(RegisterAtOffset(X86Registers::r15, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_X86_64_rbp:
-                m_registers.append(RegisterAtOffset(X86Registers::ebp, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case DW_X86_64_RET_addr:
-                break;
-            default:
-                RELEASE_ASSERT_NOT_REACHED(); // non-standard register being saved in prolog
-            }
-        }
-    }
-#elif CPU(ARM64)
-    RELEASE_ASSERT(prolog.cfaRegister == UNW_ARM64_fp);
-    RELEASE_ASSERT(prolog.cfaRegisterOffset == 16);
-    RELEASE_ASSERT(prolog.savedRegisters[UNW_ARM64_fp].saved);
-    RELEASE_ASSERT(prolog.savedRegisters[UNW_ARM64_fp].offset == -prolog.cfaRegisterOffset);
-
-    for (int i = 0; i < MaxRegisterNumber; ++i) {
-        if (prolog.savedRegisters[i].saved) {
-            switch (i) {
-            case UNW_ARM64_x0:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x0, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x1:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x1, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x2:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x2, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x3:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x3, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x4:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x4, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x5:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x5, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x6:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x6, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x7:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x7, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x8:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x8, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x9:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x9, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x10:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x10, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x11:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x11, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x12:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x12, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x13:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x13, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x14:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x14, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x15:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x15, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x16:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x16, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x17:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x17, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x18:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x18, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x19:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x19, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x20:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x20, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x21:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x21, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x22:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x22, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x23:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x23, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x24:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x24, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x25:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x25, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x26:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x26, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x27:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x27, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x28:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x28, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_fp:
-                m_registers.append(RegisterAtOffset(ARM64Registers::fp, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_x30:
-                m_registers.append(RegisterAtOffset(ARM64Registers::x30, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_sp:
-                m_registers.append(RegisterAtOffset(ARM64Registers::sp, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v0:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q0, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v1:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q1, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v2:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q2, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v3:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q3, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v4:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q4, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v5:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q5, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v6:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q6, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v7:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q7, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v8:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q8, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v9:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q9, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v10:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q10, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v11:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q11, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v12:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q12, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v13:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q13, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v14:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q14, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v15:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q15, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v16:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q16, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v17:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q17, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v18:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q18, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v19:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q19, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v20:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q20, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v21:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q21, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v22:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q22, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v23:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q23, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v24:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q24, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v25:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q25, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v26:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q26, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v27:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q27, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v28:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q28, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v29:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q29, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v30:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q30, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            case UNW_ARM64_v31:
-                m_registers.append(RegisterAtOffset(ARM64Registers::q31, prolog.savedRegisters[i].offset + prolog.cfaRegisterOffset));
-                break;
-            default:
-                RELEASE_ASSERT_NOT_REACHED(); // non-standard register being saved in prolog
-            }
-        }
-    }
-#else
-#error "Unrecognized architecture"
-#endif
-
-#endif
-    std::sort(m_registers.begin(), m_registers.end());
-    return true;
-}
-
-void UnwindInfo::dump(PrintStream& out) const
-{
-    out.print(listDump(m_registers));
-}
-
-RegisterAtOffset* UnwindInfo::find(Reg reg) const
-{
-    return tryBinarySearch<RegisterAtOffset, Reg>(m_registers, m_registers.size(), reg, RegisterAtOffset::getReg);
-}
-
-unsigned UnwindInfo::indexOf(Reg reg) const
-{
-    if (RegisterAtOffset* pointer = find(reg))
-        return pointer - m_registers.begin();
-    return UINT_MAX;
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
diff --git a/Source/JavaScriptCore/ftl/FTLUnwindInfo.h b/Source/JavaScriptCore/ftl/FTLUnwindInfo.h
deleted file mode 100644
index 6d2bf63c6..000000000
--- a/Source/JavaScriptCore/ftl/FTLUnwindInfo.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- * Copyright (C) 2014 Samsung Electronics
- * Copyright (C) 2014 University of Szeged
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLUnwindInfo_h
-#define FTLUnwindInfo_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLGeneratedFunction.h"
-#include "FTLRegisterAtOffset.h"
-
-namespace JSC { namespace FTL {
-
-struct UnwindInfo {
-    UnwindInfo();
-    ~UnwindInfo();
-    
-    bool parse(void*, size_t, GeneratedFunction);
-    
-    void dump(PrintStream&) const;
-    
-    RegisterAtOffset* find(Reg) const;
-    unsigned indexOf(Reg) const; // Returns UINT_MAX if not found.
-    
-    Vector<RegisterAtOffset> m_registers;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLUnwindInfo_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLValueFormat.cpp b/Source/JavaScriptCore/ftl/FTLValueFormat.cpp
index 45fdc09d3..5a89d6a49 100644
--- a/Source/JavaScriptCore/ftl/FTLValueFormat.cpp
+++ b/Source/JavaScriptCore/ftl/FTLValueFormat.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,7 +71,6 @@ void reboxAccordingToFormat(
     case ValueFormatDouble: {
         jit.moveDoubleTo64(FPRInfo::fpRegT0, scratch1);
         jit.move64ToDouble(value, FPRInfo::fpRegT0);
-        jit.purifyNaN(FPRInfo::fpRegT0);
         jit.boxDouble(FPRInfo::fpRegT0, value);
         jit.move64ToDouble(scratch1, FPRInfo::fpRegT0);
         break;
diff --git a/Source/JavaScriptCore/ftl/FTLValueFormat.h b/Source/JavaScriptCore/ftl/FTLValueFormat.h
index 4a4dcbe59..b031f0de2 100644
--- a/Source/JavaScriptCore/ftl/FTLValueFormat.h
+++ b/Source/JavaScriptCore/ftl/FTLValueFormat.h
@@ -26,6 +26,8 @@
 #ifndef FTLValueFormat_h
 #define FTLValueFormat_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "GPRInfo.h"
diff --git a/Source/JavaScriptCore/ftl/FTLValueFromBlock.h b/Source/JavaScriptCore/ftl/FTLValueFromBlock.h
index 31246fd22..fec0a1b37 100644
--- a/Source/JavaScriptCore/ftl/FTLValueFromBlock.h
+++ b/Source/JavaScriptCore/ftl/FTLValueFromBlock.h
@@ -26,6 +26,8 @@
 #ifndef FTLValueFromBlock_h
 #define FTLValueFromBlock_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(FTL_JIT)
 
 #include "FTLAbbreviatedTypes.h"
diff --git a/Source/JavaScriptCore/ftl/FTLValueRange.cpp b/Source/JavaScriptCore/ftl/FTLValueRange.cpp
deleted file mode 100644
index 0897c86bd..000000000
--- a/Source/JavaScriptCore/ftl/FTLValueRange.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "FTLValueRange.h"
-
-#include "FTLAbbreviations.h"
-
-#if ENABLE(FTL_JIT)
-
-namespace JSC { namespace FTL {
-
-void ValueRange::decorateInstruction(
-    LContext context, LValue loadInstruction, unsigned rangeKind) const
-{
-    if (!m_rangeMetadata)
-        m_rangeMetadata = mdNode(context, m_begin, m_end);
-    setMetadata(loadInstruction, rangeKind, m_rangeMetadata);
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
diff --git a/Source/JavaScriptCore/ftl/FTLValueRange.h b/Source/JavaScriptCore/ftl/FTLValueRange.h
deleted file mode 100644
index bee44efa1..000000000
--- a/Source/JavaScriptCore/ftl/FTLValueRange.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLValueRange_h
-#define FTLValueRange_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLAbbreviatedTypes.h"
-
-namespace JSC { namespace FTL {
-
-class ValueRange {
-public:
-    ValueRange()
-        : m_begin(0)
-        , m_end(0)
-        , m_rangeMetadata(0)
-    {
-    }
-    
-    ValueRange(LValue begin, LValue end)
-        : m_begin(begin)
-        , m_end(end)
-        , m_rangeMetadata(0)
-    {
-    }
-    
-    LValue begin() const { return m_begin; }
-    LValue end() const { return m_end; }
-    
-    void decorateInstruction(LContext, LValue loadInstruction, unsigned rangeKind) const;
-    
-private:
-    LValue m_begin;
-    LValue m_end;
-    mutable LValue m_rangeMetadata;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLValueRange_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLWeight.h b/Source/JavaScriptCore/ftl/FTLWeight.h
deleted file mode 100644
index 34eb37c91..000000000
--- a/Source/JavaScriptCore/ftl/FTLWeight.h
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLWeight_h
-#define FTLWeight_h
-
-#if ENABLE(FTL_JIT)
-
-#include <wtf/MathExtras.h>
-#include <wtf/StdLibExtras.h>
-
-namespace JSC { namespace FTL {
-
-class Weight {
-public:
-    Weight()
-        : m_value(std::numeric_limits<float>::quiet_NaN())
-    {
-    }
-    
-    explicit Weight(float value)
-        : m_value(value)
-    {
-    }
-    
-    bool isSet() const { return m_value == m_value; }
-    bool operator!() const { return !isSet(); }
-    
-    float value() const { return m_value; }
-    
-    unsigned scaleToTotal(double total) const
-    {
-        // LLVM accepts 32-bit unsigned branch weights but in dumps it might display them
-        // as signed values. We don't need all 32 bits, so we just use the 31 bits.
-        double result = static_cast<double>(m_value) * INT_MAX / total;
-        if (result < 0)
-            return 0;
-        if (result > INT_MAX)
-            return INT_MAX;
-        return static_cast<unsigned>(result);
-    }
-    
-    // Inverse weight for a two-target branch.
-    Weight inverse() const
-    {
-        if (!isSet())
-            return Weight();
-        if (value())
-            return Weight(0);
-        return Weight(1);
-    }
-    
-private:
-    float m_value;
-};
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLWeight_h
-
diff --git a/Source/JavaScriptCore/ftl/FTLWeightedTarget.h b/Source/JavaScriptCore/ftl/FTLWeightedTarget.h
deleted file mode 100644
index b4a8e5e74..000000000
--- a/Source/JavaScriptCore/ftl/FTLWeightedTarget.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef FTLWeightedTarget_h
-#define FTLWeightedTarget_h
-
-#if ENABLE(FTL_JIT)
-
-#include "FTLAbbreviatedTypes.h"
-#include "FTLWeight.h"
-
-namespace JSC { namespace FTL {
-
-class WeightedTarget {
-public:
-    WeightedTarget()
-        : m_target(nullptr)
-    {
-    }
-    
-    WeightedTarget(LBasicBlock target, Weight weight)
-        : m_target(target)
-        , m_weight(weight)
-    {
-    }
-    
-    WeightedTarget(LBasicBlock target, float weight)
-        : m_target(target)
-        , m_weight(weight)
-    {
-    }
-    
-    LBasicBlock target() const { return m_target; }
-    Weight weight() const { return m_weight; }
-    
-private:
-    LBasicBlock m_target;
-    Weight m_weight;
-};
-
-// Helpers for creating weighted targets for statically known (or unknown) branch
-// profiles.
-
-inline WeightedTarget usually(LBasicBlock block)
-{
-    return WeightedTarget(block, 1);
-}
-
-inline WeightedTarget rarely(LBasicBlock block)
-{
-    return WeightedTarget(block, 0);
-}
-
-// This means we let LLVM figure it out basic on its static estimates. LLVM's static
-// estimates are usually pretty darn good, so there's generally nothing wrong with
-// using this.
-inline WeightedTarget unsure(LBasicBlock block)
-{
-    return WeightedTarget(block, Weight());
-}
-
-} } // namespace JSC::FTL
-
-#endif // ENABLE(FTL_JIT)
-
-#endif // FTLWeightedTarget_h
-