Imported WebKit commit 68645295d2e3e09af2c942f092556f06aa5f8b0d (http://svn.webkit.org/repository/webkit/trunk@128073)

New snapshot

375 files changed, 15128 insertions, 10339 deletions

diff --git a/Source/JavaScriptCore/API/JSBase.cpp b/Source/JavaScriptCore/API/JSBase.cpp
index d0ffa3114..677c68187 100644
--- a/Source/JavaScriptCore/API/JSBase.cpp
+++ b/Source/JavaScriptCore/API/JSBase.cpp
@@ -50,10 +50,10 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 
     // evaluate sets "this" to the global object if it is NULL
     JSGlobalObject* globalObject = exec->dynamicGlobalObject();
-    SourceCode source = makeSource(script->ustring(), sourceURL->ustring(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()));
+    SourceCode source = makeSource(script->string(), sourceURL->string(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()));
 
     JSValue evaluationException;
-    JSValue returnValue = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), source, jsThisObject, &evaluationException);
+    JSValue returnValue = evaluate(globalObject->globalExec(), source, jsThisObject, &evaluationException);
 
     if (evaluationException) {
         if (exception)
@@ -73,7 +73,7 @@ bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourc
     ExecState* exec = toJS(ctx);
     APIEntryShim entryShim(exec);
 
-    SourceCode source = makeSource(script->ustring(), sourceURL->ustring(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()));
+    SourceCode source = makeSource(script->string(), sourceURL->string(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()));
     
     JSValue syntaxException;
     bool isValidSyntax = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source, &syntaxException);
diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.cpp b/Source/JavaScriptCore/API/JSCallbackFunction.cpp
index 59de186b0..0f63d3c16 100644
--- a/Source/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/Source/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -49,7 +49,7 @@ JSCallbackFunction::JSCallbackFunction(JSGlobalObject* globalObject, JSObjectCal
 {
 }
 
-void JSCallbackFunction::finishCreation(JSGlobalData& globalData, const UString& name)
+void JSCallbackFunction::finishCreation(JSGlobalData& globalData, const String& name)
 {
     Base::finishCreation(globalData, name);
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.h b/Source/JavaScriptCore/API/JSCallbackFunction.h
index 40bef8c48..50630b550 100644
--- a/Source/JavaScriptCore/API/JSCallbackFunction.h
+++ b/Source/JavaScriptCore/API/JSCallbackFunction.h
@@ -34,12 +34,12 @@ namespace JSC {
 class JSCallbackFunction : public InternalFunction {
 protected:
     JSCallbackFunction(JSGlobalObject*, JSObjectCallAsFunctionCallback);
-    void finishCreation(JSGlobalData&, const UString& name);
+    void finishCreation(JSGlobalData&, const String& name);
 
 public:
     typedef InternalFunction Base;
 
-    static JSCallbackFunction* create(ExecState* exec, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const UString& name)
+    static JSCallbackFunction* create(ExecState* exec, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const String& name)
     {
         JSCallbackFunction* function = new (NotNull, allocateCell<JSCallbackFunction>(*exec->heap())) JSCallbackFunction(globalObject, callback);
         function->finishCreation(exec->globalData(), name);
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h
index 2c3e0e859..36d7fa9c2 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.h
+++ b/Source/JavaScriptCore/API/JSCallbackObject.h
@@ -171,7 +171,7 @@ protected:
     static const unsigned StructureFlags = ProhibitsPropertyCaching | OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesHasInstance | OverridesVisitChildren | OverridesGetPropertyNames | Parent::StructureFlags;
 
 private:
-    static UString className(const JSObject*);
+    static String className(const JSObject*);
 
     static void destroy(JSCell*);
 
diff --git a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
index 160f48887..0691dafc3 100644
--- a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -111,10 +111,10 @@ void JSCallbackObject<Parent>::init(ExecState* exec)
 }
 
 template <class Parent>
-UString JSCallbackObject<Parent>::className(const JSObject* object)
+String JSCallbackObject<Parent>::className(const JSObject* object)
 {
     const JSCallbackObject* thisObject = jsCast<const JSCallbackObject*>(object);
-    UString thisClassName = thisObject->classRef()->className();
+    String thisClassName = thisObject->classRef()->className();
     if (!thisClassName.isEmpty())
         return thisClassName;
     
@@ -568,7 +568,7 @@ JSValue JSCallbackObject<Parent>::staticFunctionGetter(ExecState* exec, JSValue
         }
     }
 
-    return throwError(exec, createReferenceError(exec, "Static function property defined with NULL callAsFunction callback."));
+    return throwError(exec, createReferenceError(exec, ASCIILiteral("Static function property defined with NULL callAsFunction callback.")));
 }
 
 template <class Parent>
@@ -600,7 +600,7 @@ JSValue JSCallbackObject<Parent>::callbackGetter(ExecState* exec, JSValue slotPa
         }
     }
 
-    return throwError(exec, createReferenceError(exec, "hasProperty callback returned true for a property that doesn't exist."));
+    return throwError(exec, createReferenceError(exec, ASCIILiteral("hasProperty callback returned true for a property that doesn't exist.")));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/API/JSClassRef.cpp b/Source/JavaScriptCore/API/JSClassRef.cpp
index 134431654..a95d42e39 100644
--- a/Source/JavaScriptCore/API/JSClassRef.cpp
+++ b/Source/JavaScriptCore/API/JSClassRef.cpp
@@ -42,20 +42,6 @@ using namespace WTF::Unicode;
 
 const JSClassDefinition kJSClassDefinitionEmpty = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
 
-static inline UString tryCreateStringFromUTF8(const char* string)
-{
-    if (!string)
-        return UString();
-
-    size_t length = strlen(string);
-    Vector<UChar, 1024> buffer(length);
-    UChar* p = buffer.data();
-    if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return UString();
-
-    return UString(buffer.data(), p - buffer.data());
-}
-
 OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass* protoClass) 
     : parentClass(definition->parentClass)
     , prototypeClass(0)
@@ -70,14 +56,14 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     , callAsConstructor(definition->callAsConstructor)
     , hasInstance(definition->hasInstance)
     , convertToType(definition->convertToType)
-    , m_className(tryCreateStringFromUTF8(definition->className))
+    , m_className(String::fromUTF8(definition->className))
 {
     initializeThreading();
 
     if (const JSStaticValue* staticValue = definition->staticValues) {
         m_staticValues = adoptPtr(new OpaqueJSClassStaticValuesTable);
         while (staticValue->name) {
-            UString valueName = tryCreateStringFromUTF8(staticValue->name);
+            String valueName = String::fromUTF8(staticValue->name);
             if (!valueName.isNull())
                 m_staticValues->set(valueName.impl(), adoptPtr(new StaticValueEntry(staticValue->getProperty, staticValue->setProperty, staticValue->attributes)));
             ++staticValue;
@@ -87,7 +73,7 @@ OpaqueJSClass::OpaqueJSClass(const JSClassDefinition* definition, OpaqueJSClass*
     if (const JSStaticFunction* staticFunction = definition->staticFunctions) {
         m_staticFunctions = adoptPtr(new OpaqueJSClassStaticFunctionsTable);
         while (staticFunction->name) {
-            UString functionName = tryCreateStringFromUTF8(staticFunction->name);
+            String functionName = String::fromUTF8(staticFunction->name);
             if (!functionName.isNull())
                 m_staticFunctions->set(functionName.impl(), adoptPtr(new StaticFunctionEntry(staticFunction->callAsFunction, staticFunction->attributes)));
             ++staticFunction;
@@ -170,10 +156,10 @@ OpaqueJSClassContextData& OpaqueJSClass::contextData(ExecState* exec)
     return *contextData;
 }
 
-UString OpaqueJSClass::className()
+String OpaqueJSClass::className()
 {
     // Make a deep copy, so that the caller has no chance to put the original into IdentifierTable.
-    return UString(m_className.characters(), m_className.length());
+    return m_className.isolatedCopy();
 }
 
 OpaqueJSClassStaticValuesTable* OpaqueJSClass::staticValues(JSC::ExecState* exec)
diff --git a/Source/JavaScriptCore/API/JSClassRef.h b/Source/JavaScriptCore/API/JSClassRef.h
index 82c7ab3f9..44d5d11b9 100644
--- a/Source/JavaScriptCore/API/JSClassRef.h
+++ b/Source/JavaScriptCore/API/JSClassRef.h
@@ -31,8 +31,8 @@
 #include "Weak.h"
 #include "JSObject.h"
 #include "Protect.h"
-#include "UString.h"
 #include <wtf/HashMap.h>
+#include <wtf/text/WTFString.h>
 
 struct StaticValueEntry {
     WTF_MAKE_FAST_ALLOCATED;
@@ -89,7 +89,7 @@ struct OpaqueJSClass : public ThreadSafeRefCounted<OpaqueJSClass> {
     static PassRefPtr<OpaqueJSClass> createNoAutomaticPrototype(const JSClassDefinition*);
     ~OpaqueJSClass();
     
-    JSC::UString className();
+    String className();
     OpaqueJSClassStaticValuesTable* staticValues(JSC::ExecState*);
     OpaqueJSClassStaticFunctionsTable* staticFunctions(JSC::ExecState*);
     JSC::JSObject* prototype(JSC::ExecState*);
@@ -118,8 +118,8 @@ private:
 
     OpaqueJSClassContextData& contextData(JSC::ExecState*);
 
-    // UStrings in these data members should not be put into any IdentifierTable.
-    JSC::UString m_className;
+    // Strings in these data members should not be put into any IdentifierTable.
+    String m_className;
     OwnPtr<OpaqueJSClassStaticValuesTable> m_staticValues;
     OwnPtr<OpaqueJSClassStaticFunctionsTable> m_staticFunctions;
 };
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index 7a57287de..7c815355b 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -35,7 +35,7 @@
 #include "JSClassRef.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
-#include "UStringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringHash.h>
 
 #if OS(DARWIN)
@@ -167,15 +167,15 @@ JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize)
     JSLockHolder lock(exec);
 
     unsigned count = 0;
-    UStringBuilder builder;
+    StringBuilder builder;
     CallFrame* callFrame = exec;
-    UString functionName;
+    String functionName;
     if (exec->callee()) {
         if (asObject(exec->callee())->inherits(&InternalFunction::s_info)) {
             functionName = asInternalFunction(exec->callee())->name(exec);
-            builder.append("#0 ");
+            builder.appendLiteral("#0 ");
             builder.append(functionName);
-            builder.append("() ");
+            builder.appendLiteral("() ");
             count++;
         }
     }
@@ -183,10 +183,10 @@ JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize)
         ASSERT(callFrame);
         int signedLineNumber;
         intptr_t sourceID;
-        UString urlString;
+        String urlString;
         JSValue function;
         
-        UString levelStr = UString::number(count);
+        String levelStr = String::number(count);
         
         exec->interpreter()->retrieveLastCaller(callFrame, signedLineNumber, sourceID, urlString, function);
 
@@ -200,20 +200,20 @@ JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize)
         }
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
         if (!builder.isEmpty())
-            builder.append("\n");
-        builder.append("#");
+            builder.append('\n');
+        builder.append('#');
         builder.append(levelStr);
-        builder.append(" ");
+        builder.append(' ');
         builder.append(functionName);
-        builder.append("() at ");
+        builder.appendLiteral("() at ");
         builder.append(urlString);
-        builder.append(":");
-        builder.append(UString::number(lineNumber));
+        builder.append(':');
+        builder.appendNumber(lineNumber);
         if (!function || ++count == maxStackSize)
             break;
         callFrame = callFrame->callerFrame();
     }
-    return OpaqueJSString::create(builder.toUString()).leakRef();
+    return OpaqueJSString::create(builder.toString()).leakRef();
 }
 
 
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index e6c0c528a..e206cb16f 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -92,7 +92,7 @@ JSObjectRef JSObjectMakeFunctionWithCallback(JSContextRef ctx, JSStringRef name,
 {
     ExecState* exec = toJS(ctx);
     APIEntryShim entryShim(exec);
-    return toRef(JSCallbackFunction::create(exec, exec->lexicalGlobalObject(), callAsFunction, name ? name->ustring() : "anonymous"));
+    return toRef(JSCallbackFunction::create(exec, exec->lexicalGlobalObject(), callAsFunction, name ? name->string() : ASCIILiteral("anonymous")));
 }
 
 JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor)
@@ -118,10 +118,10 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
     
     MarkedArgumentBuffer args;
     for (unsigned i = 0; i < parameterCount; i++)
-        args.append(jsString(exec, parameterNames[i]->ustring()));
-    args.append(jsString(exec, body->ustring()));
+        args.append(jsString(exec, parameterNames[i]->string()));
+    args.append(jsString(exec, body->string()));
 
-    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL->ustring(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()));
+    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL->string(), TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()));
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -510,7 +510,7 @@ JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef o
     size_t size = array.size();
     propertyNames->array.reserveInitialCapacity(size);
     for (size_t i = 0; i < size; ++i)
-        propertyNames->array.append(JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(array[i].ustring()).leakRef()));
+        propertyNames->array.append(JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(array[i].string()).leakRef()));
     
     return JSPropertyNameArrayRetain(propertyNames);
 }
diff --git a/Source/JavaScriptCore/API/JSProfilerPrivate.cpp b/Source/JavaScriptCore/API/JSProfilerPrivate.cpp
index ea277f059..c83bc63bd 100644
--- a/Source/JavaScriptCore/API/JSProfilerPrivate.cpp
+++ b/Source/JavaScriptCore/API/JSProfilerPrivate.cpp
@@ -34,13 +34,13 @@ using namespace JSC;
 
 void JSStartProfiling(JSContextRef ctx, JSStringRef title)
 {
-    Profiler::profiler()->startProfiling(toJS(ctx), title->ustring());
+    Profiler::profiler()->startProfiling(toJS(ctx), title->string());
 }
 
 void JSEndProfiling(JSContextRef ctx, JSStringRef title)
 {
     ExecState* exec = toJS(ctx);
     Profiler* profiler = Profiler::profiler();
-    profiler->stopProfiling(exec, title->ustring());
+    profiler->stopProfiling(exec, title->string());
 }
 
diff --git a/Source/JavaScriptCore/API/JSStringRefCF.cpp b/Source/JavaScriptCore/API/JSStringRefCF.cpp
index 0877a13e6..e87fd838d 100644
--- a/Source/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/Source/JavaScriptCore/API/JSStringRefCF.cpp
@@ -30,7 +30,6 @@
 #include "InitializeThreading.h"
 #include "JSStringRef.h"
 #include "OpaqueJSString.h"
-#include <runtime/UString.h>
 #include <runtime/JSValue.h>
 #include <wtf/OwnArrayPtr.h>
 
diff --git a/Source/JavaScriptCore/API/JSValueRef.cpp b/Source/JavaScriptCore/API/JSValueRef.cpp
index 9b7268a2d..4c986c253 100644
--- a/Source/JavaScriptCore/API/JSValueRef.cpp
+++ b/Source/JavaScriptCore/API/JSValueRef.cpp
@@ -36,11 +36,11 @@
 #include <runtime/LiteralParser.h>
 #include <runtime/Operations.h>
 #include <runtime/Protect.h>
-#include <runtime/UString.h>
 #include <runtime/JSValue.h>
 
 #include <wtf/Assertions.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 #include <algorithm> // for std::min
 
@@ -227,14 +227,14 @@ JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
     ExecState* exec = toJS(ctx);
     APIEntryShim entryShim(exec);
 
-    return toRef(exec, jsString(exec, string->ustring()));
+    return toRef(exec, jsString(exec, string->string()));
 }
 
 JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string)
 {
     ExecState* exec = toJS(ctx);
     APIEntryShim entryShim(exec);
-    UString str = string->ustring();
+    String str = string->string();
     if (str.is8Bit()) {
         LiteralParser<LChar> parser(exec, str.characters8(), str.length(), StrictJSON);
         return toRef(exec, parser.tryLiteralParse());
@@ -248,7 +248,7 @@ JSStringRef JSValueCreateJSONString(JSContextRef ctx, JSValueRef apiValue, unsig
     ExecState* exec = toJS(ctx);
     APIEntryShim entryShim(exec);
     JSValue value = toJS(exec, apiValue);
-    UString result = JSONStringify(exec, value, indent);
+    String result = JSONStringify(exec, value, indent);
     if (exception)
         *exception = 0;
     if (exec->hadException()) {
diff --git a/Source/JavaScriptCore/API/OpaqueJSString.cpp b/Source/JavaScriptCore/API/OpaqueJSString.cpp
index 9a116e6b2..457cb27f7 100644
--- a/Source/JavaScriptCore/API/OpaqueJSString.cpp
+++ b/Source/JavaScriptCore/API/OpaqueJSString.cpp
@@ -32,18 +32,18 @@
 
 using namespace JSC;
 
-PassRefPtr<OpaqueJSString> OpaqueJSString::create(const UString& ustring)
+PassRefPtr<OpaqueJSString> OpaqueJSString::create(const String& string)
 {
-    if (!ustring.isNull())
-        return adoptRef(new OpaqueJSString(ustring.characters(), ustring.length()));
+    if (!string.isNull())
+        return adoptRef(new OpaqueJSString(string.characters(), string.length()));
     return 0;
 }
 
-UString OpaqueJSString::ustring() const
+String OpaqueJSString::string() const
 {
     if (this && m_characters)
-        return UString(m_characters, m_length);
-    return UString();
+        return String(m_characters, m_length);
+    return String();
 }
 
 Identifier OpaqueJSString::identifier(JSGlobalData* globalData) const
diff --git a/Source/JavaScriptCore/API/OpaqueJSString.h b/Source/JavaScriptCore/API/OpaqueJSString.h
index 1c63150cf..35543cdd6 100644
--- a/Source/JavaScriptCore/API/OpaqueJSString.h
+++ b/Source/JavaScriptCore/API/OpaqueJSString.h
@@ -27,7 +27,7 @@
 #define OpaqueJSString_h
 
 #include <wtf/ThreadSafeRefCounted.h>
-#include <runtime/UString.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
     class Identifier;
@@ -46,12 +46,12 @@ struct OpaqueJSString : public ThreadSafeRefCounted<OpaqueJSString> {
         return adoptRef(new OpaqueJSString(characters, length));
     }
 
-    JS_EXPORT_PRIVATE static PassRefPtr<OpaqueJSString> create(const JSC::UString&);
+    JS_EXPORT_PRIVATE static PassRefPtr<OpaqueJSString> create(const String&);
 
     UChar* characters() { return this ? m_characters : 0; }
     unsigned length() { return this ? m_length : 0; }
 
-    JSC::UString ustring() const;
+    String string() const;
     JSC::Identifier identifier(JSC::JSGlobalData*) const;
 
 private:
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 2689bce5c..22d571933 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -91,7 +91,6 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGOperations.cpp
     dfg/DFGPhase.cpp
     dfg/DFGPredictionPropagationPhase.cpp
-    dfg/DFGRedundantPhiEliminationPhase.cpp
     dfg/DFGRepatch.cpp
     dfg/DFGSpeculativeJIT.cpp
     dfg/DFGSpeculativeJIT32_64.cpp
@@ -208,7 +207,9 @@ SET(JavaScriptCore_SOURCES
     runtime/JSONObject.cpp
     runtime/JSPropertyNameIterator.cpp
     runtime/JSSegmentedVariableObject.cpp
-    runtime/JSStaticScopeObject.cpp
+    runtime/JSNameScope.cpp
+    runtime/JSWithScope.cpp
+    runtime/JSScope.cpp
     runtime/JSString.cpp
     runtime/JSStringJoiner.cpp
     runtime/JSSymbolTableObject.cpp
@@ -243,7 +244,6 @@ SET(JavaScriptCore_SOURCES
     runtime/RegExpMatchesArray.cpp
     runtime/RegExpObject.cpp
     runtime/RegExpPrototype.cpp
-    runtime/ScopeChain.cpp
     runtime/SmallStrings.cpp
     runtime/StrictEvalActivation.cpp
     runtime/StringConstructor.cpp
@@ -254,7 +254,6 @@ SET(JavaScriptCore_SOURCES
     runtime/StructureChain.cpp
     runtime/SymbolTable.cpp
     runtime/TimeoutChecker.cpp
-    runtime/UString.cpp
 
     tools/CodeProfile.cpp
     tools/CodeProfiling.cpp
@@ -292,6 +291,65 @@ SET(JavaScriptCore_LIBRARIES
     ${WTF_LIBRARY_NAME}
 )
 
+IF (ENABLE_LLINT)
+    # We cannot check for RUBY_FOUND because it is set only when the full package is installed and
+    # the only thing we need is the interpreter. Unlike Python, cmake does not provide a macro
+    # for finding the only Ruby interpreter.
+    IF (NOT RUBY_EXECUTABLE)
+        MESSAGE(FATAL_ERROR "The Ruby interpreter is needed to generate LLInt files.")
+    ENDIF ()
+
+    SET(LLINT_ASM
+        llint/LowLevelInterpreter.asm
+        llint/LowLevelInterpreter32_64.asm
+        llint/LowLevelInterpreter64.asm
+    )
+
+    SET(OFFLINE_ASM
+        offlineasm/armv7.rb
+        offlineasm/ast.rb
+        offlineasm/backends.rb
+        offlineasm/cloop.rb
+        offlineasm/config.rb
+        offlineasm/instructions.rb
+        offlineasm/offsets.rb
+        offlineasm/opt.rb
+        offlineasm/parser.rb
+        offlineasm/registers.rb
+        offlineasm/self_hash.rb
+        offlineasm/settings.rb
+        offlineasm/transform.rb
+        offlineasm/x86.rb
+    )
+
+    ADD_CUSTOM_COMMAND(
+        OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h
+        MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/offlineasm/generate_offset_extractor.rb
+        DEPENDS ${LLINT_ASM} ${OFFLINE_ASM}
+        COMMAND ${RUBY_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/offlineasm/generate_offset_extractor.rb ${JAVASCRIPTCORE_DIR}/llint/LowLevelInterpreter.asm ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h
+        VERBATIM)
+
+    ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/llint/LLIntOffsetsExtractor.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h)
+    ADD_EXECUTABLE(LLIntOffsetsExtractor ${JAVASCRIPTCORE_DIR}/llint/LLIntOffsetsExtractor.cpp)
+
+    ADD_CUSTOM_COMMAND(
+        OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntAssembly.h
+        MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/offlineasm/asm.rb
+        DEPENDS LLIntOffsetsExtractor ${LLINT_ASM} ${OFFLINE_ASM}
+        COMMAND ${RUBY_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/offlineasm/asm.rb ${JAVASCRIPTCORE_DIR}/llint/LowLevelInterpreter.asm $<TARGET_FILE:LLIntOffsetsExtractor> ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntAssembly.h
+        VERBATIM)
+
+    ADD_SOURCE_DEPENDENCIES(${JAVASCRIPTCORE_DIR}/llint/LowLevelInterpreter.cpp ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntAssembly.h)
+    LIST(APPEND JavaScriptCore_SOURCES
+        llint/LLIntCLoop.cpp
+        llint/LLIntData.cpp
+        llint/LLIntEntrypoints.cpp
+        llint/LLIntExceptions.cpp
+        llint/LLIntSlowPaths.cpp
+        llint/LLIntThunks.cpp
+        llint/LowLevelInterpreter.cpp
+    )
+ENDIF ()
 
 # GENERATOR 1-A: LUT creator
 FOREACH (_file ${JavaScriptCore_LUT_FILES})
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index a8434ccc7..83cae4a31 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,3411 @@
+2012-09-10  Hojong Han  <hojong.han@samsung.com>
+
+        [EFL] JIT memory usage is not retrieved
+        https://bugs.webkit.org/show_bug.cgi?id=96095
+
+        Reviewed by Geoffrey Garen.
+
+        Fill JITBytes for EFL port.
+
+        * runtime/MemoryStatistics.cpp:
+        (JSC::globalMemoryStatistics):
+
+2012-09-10  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [CMake][EFL] Enable the LLInt
+        https://bugs.webkit.org/show_bug.cgi?id=92682
+
+        Reviewed by Csaba Osztrogonác.
+
+        Generate the headers needed by LLint when LLint is enabled.
+
+        * CMakeLists.txt:
+
+2012-09-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing files.
+
+2012-09-09  Mark Lam  <mark.lam@apple.com>
+
+        Fixed a few llint C++ interpreter bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=96127.
+
+        Reviewed by Geoffrey Garen.
+
+        * llint/LLIntCLoop.h:
+            CLoop::execute()'s bootstrapOpcodeId does not need a default
+            value. There is no case when this function is called without
+            that parameter being specified.
+        * llint/LowLevelInterpreter.asm:
+            Moved the dispatchAfterCall() call to where it is needed.
+            For the C_LOOP back-end, it generates unreachable code. 
+        * llint/LowLevelInterpreter.cpp:
+            #include <wtf/Assertions.h> because LLIntAssembly.h needs it.
+        (JSC):
+            Fixed bug in SIGN_BIT32() macro.
+            Placate a MSVC warning for t0, and t1 being uninitialized.
+        (JSC::CLoop::execute):
+            The bootstrapOpcodeId arg should always be specified.
+            MSVC doesn't like UNUSED_PARAM() for labels. Switch to using
+                the new UNUSED_LABEL() macro.
+        * offlineasm/cloop.rb:
+        * offlineasm/generate_offset_extractor.rb:
+            Resolved a compiler warning found via MSVC.
+
+2012-09-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Add StringBuilder::appendNumber() and use it
+        https://bugs.webkit.org/show_bug.cgi?id=96030
+
+        Reviewed by Eric Seidel.
+
+        Also fix a bunch of append() vs. appendLiteral() issues in the surrounding code.
+
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+
+2012-09-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Make the String initialization on the function side of String::number()
+        https://bugs.webkit.org/show_bug.cgi?id=95940
+
+        Reviewed by Benjamin Poulain.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-09-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out <http://trac.webkit.org/changeset/127939> because it broke
+        fast/js/named-function-expression.html.
+
+            Refactored bytecode generator initialization to support moving captured vars around
+            https://bugs.webkit.org/show_bug.cgi?id=96159
+
+            Reviewed by Gavin Barraclough.
+
+2012-09-08  Csaba Osztrogonác  <ossy@webkit.org>
+
+        LLInt buildfix for case sensitive filesystems
+        https://bugs.webkit.org/show_bug.cgi?id=96099
+
+        Reviewed by Michael Saboff.
+
+        * llint/LowLevelInterpreter.cpp: Fix filenames.
+
+2012-09-07  Benjamin Poulain  <bpoulain@apple.com>
+
+        Rename the ustring() accessor to string()
+        https://bugs.webkit.org/show_bug.cgi?id=95919
+
+        Reviewed by Geoffrey Garen.
+
+        Rename ustring() to string() to make the accessor name more logical after
+        r127191.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectCopyPropertyNames):
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling):
+        (JSEndProfiling):
+        * API/JSValueRef.cpp:
+        (JSValueMakeString):
+        (JSValueMakeFromJSONString):
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::string):
+        * API/OpaqueJSString.h:
+        (OpaqueJSString):
+        * bytecode/CodeBlock.cpp:
+        (JSC::idName):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::processClauseList):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::addFunction):
+        (GlobalObject::addConstructableFunction):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createRegExp):
+        * parser/Parser.cpp:
+        (JSC::::parsePrimaryExpression):
+        * parser/Parser.h:
+        (JSC::Scope::declareVariable):
+        (JSC::Scope::declareParameter):
+        (JSC::Scope::useVariable):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createRegExp):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::finishCreation):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/Identifier.h:
+        (JSC::Identifier::string):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::calculatedDisplayName):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSONObject.cpp:
+        (JSC::PropertyNameForFunctionCall::value):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::Walker::walk):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::finishCreation):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolveBase):
+        * runtime/JSString.h:
+        (JSC::inlineJSValueNotStringtoString):
+        * runtime/LiteralParser.cpp:
+        (JSC::::parse):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+
+2012-09-07  Gavin Barraclough  <barraclough@apple.com>
+
+        CALLFRAME_OFFSET and EXCEPTION_OFFSET are same in ctiTrampoline on ARM Thumb2
+        https://bugs.webkit.org/show_bug.cgi?id=82013
+
+        Reviewed by Geoff Garen.
+
+        Neither of these values need to be stored. At all.
+
+        * jit/JITStubs.cpp:
+        (JSC):
+        (JSC::ctiTrampoline):
+        (JSC::JITThunks::JITThunks):
+            - Nothing to see here. Move along.
+
+2012-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r127938.
+        http://trac.webkit.org/changeset/127938
+        https://bugs.webkit.org/show_bug.cgi?id=96166
+
+        It broke the build (Requested by smfr on #webkit).
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC):
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+
+2012-09-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored bytecode generator initialization to support moving captured vars around
+        https://bugs.webkit.org/show_bug.cgi?id=96159
+
+        Reviewed by Gavin Barraclough.
+
+        This patch separates the stages of allocating registers, declaring identifiers
+        in the symbol table, and initializing registers, so you can change
+        allocation decisions without breaking the world.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Call a set of helper functions
+        instead of inlining all the code, to help clarity.
+
+        (JSC::BytecodeGenerator::allocateCapturedVars):
+        (JSC::BytecodeGenerator::allocateUncapturedVars):
+        (JSC::BytecodeGenerator::allocateActivationVar):
+        (JSC::BytecodeGenerator::allocateArgumentsVars):
+        (JSC::BytecodeGenerator::allocateCalleeVarUndeclared):
+        (JSC::BytecodeGenerator::declareParameters):
+        (JSC::BytecodeGenerator::declareCallee):
+        (JSC::BytecodeGenerator::initCalleeVar):
+        (JSC::BytecodeGenerator::initArgumentsVars):
+        (JSC::BytecodeGenerator::initActivationVar):
+        (JSC::BytecodeGenerator::initThisParameter):
+        (JSC::BytecodeGenerator::initFunctionDeclarations):
+        (JSC::BytecodeGenerator::declareParameter):
+        (JSC::BytecodeGenerator::createLazyRegisterIfNecessary):
+        (JSC::BytecodeGenerator::createActivationIfNecessary): Factored these
+        helper functions out from pre-existing code.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFuncDeclStatement):
+        (JSC::ASTBuilder::addVar):
+        * parser/Nodes.h:
+        (JSC::DeclarationStacks::VarDeclaration::VarDeclaration):
+        (VarDeclaration):
+        (JSC::DeclarationStacks::FunctionDeclaration::FunctionDeclaration):
+        (FunctionDeclaration): Declaration stacks get a little more data now,
+        to support allocating registers before putting things in the symbol
+        table. I'm convinced that we should eventually just expand the symbol
+        table to understand these things.
+
+2012-09-07  Mark Lam  <mark.lam@apple.com>
+
+        Fix a llint C++ interpreter bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=96127.
+
+        Reviewed by Filip Pizlo.
+
+        * llint/LowLevelInterpreter.cpp:
+        (JSC):
+        (JSC::CLoop::execute):
+        * offlineasm/cloop.rb:
+
+2012-09-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Object.prototype.__define{G,S}etter__ with non-callable second parameter should throw TypeError instead of SyntaxError
+        https://bugs.webkit.org/show_bug.cgi?id=93873
+
+        Reviewed by Sam Weinig.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+            - throw TypeError instead of SyntaxError
+        (JSC::objectProtoFuncDefineSetter):
+            - throw TypeError instead of SyntaxError
+
+2012-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSC should have a zombie mode
+        https://bugs.webkit.org/show_bug.cgi?id=96047
+
+        Reviewed by Geoffrey Garen.
+
+        To aid clients of JSC while they are debugging memory issues, we should add a zombie 
+        mode that scribbles into objects in the MarkedSpace after they are found to be dead 
+        to prevent a sort of "use after free" situation. As a first cut we should support a 
+        mode that just scribbles on objects prior to their being reused (i.e. while they are 
+        "zombies") and a mode in which, in addition to scribbling on zombies, once an object 
+        has been marked its mark bit will never be cleared, thus giving us "immortal" zombies.
+
+        These two modes will be enabled through the use of environment variables. For now these 
+        will be "JSZombieEnabled" and "JSImmortalZombieEnabled". Setting them to any value will 
+        result in the use of the appropriate mode.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collect): Zombifies dead objects at the end of collection if zombie mode is enabled.
+        (ZombifyCellFunctor):
+        (JSC::ZombifyCellFunctor::ZombifyCellFunctor): Sets marked bits for dead objects if in immortal mode and writes 0xbbadbeef into them.
+        (JSC::ZombifyCellFunctor::operator()):
+        (JSC):
+        (ZombifyBlockFunctor):
+        (JSC::ZombifyBlockFunctor::operator()):
+        (JSC::Heap::zombifyDeadObjects): Eagerly sweeps so that we don't write garbage into an object before it 
+        is finalized/destroyed.
+        * heap/Heap.h:
+        (Heap):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::forEachDeadCell): Used to iterate over dead cells at the end of collection if zombie mode is enabled.
+        (JSC):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        (JSC):
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in <http://trac.webkit.org/changeset/127698> with a fix for
+        fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html, which
+        is to make sure that function declarations don't put their names in scope.
+
+        Reviewed by Gavin Barraclough.
+
+            Named functions should not allocate scope objects for their names
+            https://bugs.webkit.org/show_bug.cgi?id=95659
+
+            Reviewed by Oliver Hunt.
+
+2012-09-06  Michael Saboff  <msaboff@apple.com>
+
+        16 bit JSRopeString up converts an 8 bit fibers to 16 bits during resolution
+        https://bugs.webkit.org/show_bug.cgi?id=95810
+
+        Reviewed by Benjamin Poulain.
+
+        Added 8 bit path that copies the contents of an 8 bit fiber to the 16 bit buffer
+        when resolving a 16 bit rope.
+
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeSlowCase):
+
+2012-09-06  Gavin Barraclough  <barraclough@apple.com>
+
+        JS test suite puts incorrect limitations on Function.toString()
+        https://bugs.webkit.org/show_bug.cgi?id=3975
+
+        Reviewed by Geoff Garen.
+
+        The result of function toString is implementation defined;
+        these test cases were looking for specific whitespace formatting
+        that matches mozilla's, and for redundant braces to be inserted
+        around if/else blocks. Stop that.
+
+        * tests/mozilla/expected.html:
+        * tests/mozilla/js1_2/function/tostring-1.js:
+        (simplify):
+            - reduce whitespace differences
+        * tests/mozilla/js1_2/function/tostring-2.js:
+        (simplify):
+            - reduce whitespace differences
+        (TestOr):
+        (TestAnd):
+            - added braces to match expected output
+
+2012-09-06  Yuqiang Xian  <yuqiang.xian@intel.com>
+
+        Performance regressions on 32-bit platforms with revisions 125637 and 126387
+        https://bugs.webkit.org/show_bug.cgi?id=95953
+
+        Reviewed by Filip Pizlo.
+
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_get_by_val): Fix the typo.
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out <http://trac.webkit.org/changeset/127698> because it broke
+        fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html
+
+            Named functions should not allocate scope objects for their names
+            https://bugs.webkit.org/show_bug.cgi?id=95659
+
+            Reviewed by Oliver Hunt.
+
+2012-09-06  Mark Lam  <mark.lam@apple.com>
+
+        Renamed useYarrJIT() option to useRegExpJIT(). Also fixed regression in
+        which inadvertantly allows the ASM llint to use the baseline JIT when
+        useRegExpJIT() is true.
+        https://bugs.webkit.org/show_bug.cgi?id=95918.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::canUseJIT):
+        (JSC::JSGlobalData::canUseRegExpJIT):
+        (JSGlobalData):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        (JSC):
+
+2012-09-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for Interpreter after r127698.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Named functions should not allocate scope objects for their names
+        https://bugs.webkit.org/show_bug.cgi?id=95659
+
+        Reviewed by Oliver Hunt.
+
+        In most cases, we can merge a function expression's name into its symbol
+        table. This reduces memory footprint per closure from three objects
+        (function + activation + name scope) to two (function + activation),
+        speeds up closure allocation, and speeds up recursive calls.
+
+        In the case of a named function expression that contains a non-strict
+        eval, the rules are so bat-poop crazy that I don't know how to model
+        them without an extra object. Since functions now default to not having
+        such an object, this case needs to allocate the object on function
+        entry.
+
+        Therefore, this patch makes the slow case a bit slower so the fast case
+        can be faster and more memory-efficient. (Note that the slow case already
+        allocates an activation on entry, and until recently also allocated a
+        scope chain node on entry, so adding one allocation on entry shouldn't
+        break the bank.)
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock): Caught a missed initializer. No behavior change.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Put the callee in static scope
+        during compilation so it doesn't need to be in dynamic scope at runtime.
+
+        (JSC::BytecodeGenerator::resolveCallee):
+        (JSC::BytecodeGenerator::addCallee): Helper functions for either statically
+        resolving the callee or adding a dynamic scope that will resolve to it,
+        depending on whether you're in the fast path.
+
+        We move the callee into a var location if it's captured because activations
+        prefer to have contiguous ranges of captured variables.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::registerFor):
+        (BytecodeGenerator):
+
+        * dfg/DFGOperations.cpp:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): This is the point of the patch: remove
+        one allocation in the case of a named function expression.
+
+        * parser/Parser.cpp:
+        (JSC::::Parser):
+        * parser/Parser.h:
+        (JSC::Scope::declareCallee):
+        (Scope):
+        (Parser):
+        (JSC::parse):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode): Pipe the callee's name through
+        the parser so we get accurate information on whether the callee was captured.
+
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::produceCodeBlockFor):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::create):
+        (FunctionExecutable):
+        (JSC::FunctionExecutable::finishCreation): I had to refactor function
+        creation to support the following function constructor quirk: the function
+        gets a name, but its name is not in lexical scope.
+
+        To simplify this, FunctionExecutable now automatically extracts all the
+        data it needs from the parsed node. The special "fromGlobalCode" path
+        used by the function constructor creates an anonymous function, and then
+        quirkily sets the value used by the .name property to be non-null, even
+        though the parsed name is null.
+
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::JSNameScope): Added support for explicitly specifying
+        your container scope. The compiler uses this for named function expressions.
+
+2012-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        a = data[a]++; sets the wrong key in data
+        https://bugs.webkit.org/show_bug.cgi?id=91270
+
+        Reviewed by Oliver Hunt.
+
+        Postfix inc/dec is unsafely using finalDestination, can trample base/subscript prior to the result being put.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+            - Remove redundant parens.
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PostfixNode::emitDot):
+            - Refactored to use tempDestination instead of finalDestination.
+        (JSC::PrefixNode::emitBracket):
+        (JSC::PrefixNode::emitDot):
+            - Should be using emitPreIncOrDec.
+
+2012-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Bug, assignment within subscript of prefix/postfix increment of bracket access
+        https://bugs.webkit.org/show_bug.cgi?id=95913
+
+        Reviewed by Oliver Hunt.
+
+        javascript:alert((function(){ var a = { x:1 }; var b = { x:1 }; a[a=b,"x"]++; return a.x; })())
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitBracket):
+        (JSC::PrefixNode::emitBracket):
+            - Should check for assigments in the subscript when loading the base.
+        * parser/Nodes.h:
+        (JSC::BracketAccessorNode::subscriptHasAssignments):
+        (BracketAccessorNode):
+            - Used by emitBracket methods.
+
+2012-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Merge prefix/postfix nodes
+        https://bugs.webkit.org/show_bug.cgi?id=95898
+
+        Reviewed by Geoff Garen.
+
+        Simplify the AST.
+        This will also mean we have access to m_subscriptHasAssignments when generating a prefix/postfix op applied to a bracket access.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+            - was PostfixResolveNode::emitBytecode
+        (JSC::PostfixNode::emitBracket):
+            - was PostfixBracketNode::emitBytecode
+        (JSC::PostfixNode::emitDot):
+            - was PostfixDotNode::emitBytecode
+        (JSC::PostfixNode::emitBytecode):
+            - was PostfixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate.
+        (JSC::PrefixNode::emitResolve):
+            - was PrefixResolveNode::emitBytecode
+        (JSC::PrefixNode::emitBracket):
+            - was PrefixBracketNode::emitBytecode
+        (JSC::PrefixNode::emitDot):
+            - was PrefixDotNode::emitBytecode
+        (JSC::PrefixNode::emitBytecode):
+            - was PrefixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate.
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::makePrefixNode):
+            - Just makes a PrefixNode!
+        (JSC::ASTBuilder::makePostfixNode):
+            - Just makes a PostfixNode!
+        * parser/NodeConstructors.h:
+        (JSC::PostfixNode::PostfixNode):
+            - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode.
+        (JSC::PrefixNode::PrefixNode):
+            - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode.
+        * parser/Nodes.h:
+        (PostfixNode):
+            - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode.
+        (PrefixNode):
+            - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode.
+
+2012-09-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of JSCell::classInfoOffset() from tryCacheGetByID
+        https://bugs.webkit.org/show_bug.cgi?id=95860
+
+        Reviewed by Oliver Hunt.
+
+        We should just do the indirection through the Structure instead.
+
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::tryCacheGetByID):
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Throw exceptions when assigning to const in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=95894
+
+        Reviewed by Oliver Hunt.
+
+        Currently, this never happens; but it will start happening once the
+        callee is a local const register. In this patch, there's no change in
+        behavior.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded): Helper function
+        for doing the throwing.
+        * bytecompiler/BytecodeGenerator.h:
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode): Call the helper function.
+
+2012-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored callee access in the DFG to support it in the general case
+        https://bugs.webkit.org/show_bug.cgi?id=95887
+
+        Reviewed by Phil Pizlo and Gavin Barraclough.
+
+        To support named function expressions, the DFG needs to understand the
+        callee register being used in arbitrary expressions, and not just
+        create_this.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getDirect): 
+        (JSC::DFG::ByteCodeParser::getCallee): Remap access to the callee register
+        into a GetCallee node. Otherwise, we get confused and think we have a
+        negatively indexed argument.
+
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand): Inlining also
+        needs to remap, but to the callee in the inline frame, and not the caller's
+        callee.
+
+        (JSC::DFG::ByteCodeParser::parseBlock): Since we support the callee in
+        the general case now, there's no need to handle it in a special way for
+        create_this.
+
+2012-09-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of JSCell::classInfoOffset() from virtualForThunkGenerator
+        https://bugs.webkit.org/show_bug.cgi?id=95821
+
+        Reviewed by Oliver Hunt.
+
+        We can replace the load of the ClassInfo from the object with a load from the Structure.
+
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::virtualForThunkGenerator):
+
+2012-09-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Fix the uses of String::operator+=() for Mac
+        https://bugs.webkit.org/show_bug.cgi?id=95818
+
+        Reviewed by Dan Bernstein.
+
+        * jsc.cpp:
+        (functionJSCStack): Use StringBuilder to create the stack dump, it is faster
+        and avoid String::operator+=().
+
+        * parser/Parser.h:
+        (JSC::Parser::updateErrorMessageSpecialCase):
+        (JSC::Parser::updateErrorMessage):
+        (JSC::Parser::updateErrorWithNameAndMessage):
+        Use the String operators (and makeString) to concatenate the strings.
+
+2012-09-05  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        DFG JIT doesn't work properly on ARM hardfp
+        https://bugs.webkit.org/show_bug.cgi?id=95684
+
+        Reviewed by Filip Pizlo.
+
+        Add hardfp support to DFG JIT. The patch is created with the
+        help of Zoltan Herczeg.
+
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGFPRInfo.h:
+        (FPRInfo):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+
+2012-09-04  Mark Lam  <mark.lam@apple.com>
+
+        Allow the YarrJIT to use the assembler even when useJIT() is false.
+        Introduce the useYarrJIT() option.
+        https://bugs.webkit.org/show_bug.cgi?id=95809.
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+        * runtime/Options.h:
+        (JSC):
+
+2012-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        inc/dec behave incorrectly operating on a resolved const
+        https://bugs.webkit.org/show_bug.cgi?id=95815
+
+        Reviewed by Geoff Garen.
+
+        There are two bugs here.
+
+        (1) When the value being incremented is const, and the result is ignored, we assume this cannot be observed, and emit no code.
+            However if the value being incremented is not a primitive & has a valueOf conversion, then this should be being called.
+
+        (2) In the case of a pre-increment of a const value where the result is not ignored, we'll move +/-1 to the destination, then
+            add the resolved const value being incremented to this. This is problematic if the destination is a local, and the const
+            value being incremented has a valueOf conversion that throws - the destination will be modified erroneously. Instead, we
+            need to use a temporary location.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+            - always at least perform a toNumber conversion, use tempDestination when reducing inc/dec to an add +/-1.
+
+2012-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound
+        https://bugs.webkit.org/show_bug.cgi?id=95717
+
+        Reviewed by Oliver Hunt.
+        
+        Rolling back in after fixing the negative index case.
+
+        Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already
+        there so we should just use it!
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r127503.
+        http://trac.webkit.org/changeset/127503
+        https://bugs.webkit.org/show_bug.cgi?id=95788
+
+        broke some tests (fast/js/dfg-negative-array-index, fast/js
+        /dfg-put-by-val-setter-then-get-by-val) (Requested by thorton
+        on #webkit).
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-04  Benjamin Poulain  <bpoulain@apple.com>
+
+        Improve JSC use of Strings after the UString->String change
+        https://bugs.webkit.org/show_bug.cgi?id=95633
+
+        Reviewed by Geoffrey Garen.
+
+        This patch improve the use of strings in the JSC runtime.
+
+        The initialization of Identifier is left for future patches.
+
+        The improvements are the following:
+        -5% faster to raise one of the modified exception.
+        -3 times faster to execute Boolean::toString()
+
+        Most of the changes are just about using the new methods
+        for string literals.
+
+        With the changes, the binary on x86_64 gets 176 bytes smaller.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        (JSContextCreateBacktrace):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::nameForRegister):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::addStackTraceIfNecessary):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString): Instead of instanciating new strings, reuse the
+        keywords available in SmallStrings. Avoiding the creation of the JSString and StringImpl
+        makes the method significantly faster.
+
+        * runtime/DateConversion.cpp:
+        (JSC::formatDateTime):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToISOString):
+        Change the way we use snprintf() for clarity and performance.
+
+        Instead of allocating one extra byte to put a zero "just in case", we use the size returned
+        by snprintf().
+        To prevent any overflow from a programming mistake, we explicitely test for overflow and
+        return an empty string.
+
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::createNotEnoughArgumentsError):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::StrictModeTypeErrorFunction::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        (JSC::errorProtoFuncToString):
+        Using a null String is correct because (8) uses jsString(), (9) tests for a length of 0.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::defaultValue):
+        (JSC::TerminatedExecutionError::defaultValue):
+        (JSC::createStackOverflowError):
+        (JSC::createOutOfMemoryError):
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::FunctionExecutable::paramString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::create):
+        Using a null String for the name is correct because InternalFunction uses jsString()
+        to create the name value.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        There is no need to create an empty string for a null string, jsString() handle both
+        cases as empty JSString.
+
+        * runtime/JSArray.cpp:
+        (JSC::reject):
+        (JSC::SparseArrayValueMap::put):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation): Same issue as InternalFunction::finishCreation.
+
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler): Use CFSTR() instead of CFStringCreateWithCString().
+        CFStringCreateWithCString() copy the content and may choose to decode the data.
+        CFSTR() is much more efficient.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        JSFunction uses jsString() to create the name, we can use null strings instead
+        of creating empty strings.
+
+        (JSC::JSGlobalObject::createThrowTypeError): ditto.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defineOwnProperty):
+        * runtime/JSString.cpp:
+        Return an empty JSString to avoid the creation of a temporary empty String.
+
+        (JSC::JSRopeString::getIndexSlowCase):
+        * runtime/JSString.h:
+        (JSC): Remove the versions of jsNontrivialString() taking a char*. All the callers
+        have been replaced by calls using ASCIILiteral.
+
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/LiteralParser.cpp:
+        (JSC::::Lexer::lex):
+        (JSC::::Lexer::lexString):
+        (JSC::::Lexer::lexNumber):
+        (JSC::::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::getErrorMessage):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorGetPrototypeOf):
+        (JSC::objectConstructorGetOwnPropertyDescriptor):
+        (JSC::objectConstructorGetOwnPropertyNames):
+        (JSC::objectConstructorKeys):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        (JSC::objectConstructorSeal):
+        (JSC::objectConstructorFreeze):
+        (JSC::objectConstructorPreventExtensions):
+        (JSC::objectConstructorIsSealed):
+        (JSC::objectConstructorIsFrozen):
+        (JSC::objectConstructorIsExtensible):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::reject):
+        (JSC::regExpObjectSource):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::defineOwnProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+
+2012-09-04  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound
+        https://bugs.webkit.org/show_bug.cgi?id=95717
+
+        Reviewed by Oliver Hunt.
+
+        Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already
+        there so we should just use it!
+
+        * bytecode/DFGExitProfile.h:
+        (JSC::DFG::exitKindToString):
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::callOperation):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-09-04  Zoltan Horvath  <zoltan@webkit.org>
+
+        Extend the coverage of the Custom Allocation Framework in WTF and in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=95737
+
+        Reviewed by Eric Seidel.
+
+        Add WTF_MAKE_FAST_ALLOCATED macro to the following class declarations because these are instantiated by operator new.
+
+        * wtf/CryptographicallyRandomNumber.cpp: CryptographicallyRandomNumber is instantiated at wtf/CryptographicallyRandomNumber.cpp:162.
+
+        * heap/MachineStackMarker.cpp:
+        (MachineThreads::Thread): Thread is instantiated at heap/MachineStackMarker.cpp:196.
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (FixedVMPoolExecutableAllocator): FixedVMPoolExecutableAllocator is instantiated at jit/ExecutableAllocatorFixedVMPool.cpp:111
+        * parser/SourceProviderCache.h:
+        (SourceProviderCache): SourceProviderCache is instantiated at parser/SourceProvider.h:49.
+        * parser/SourceProviderCacheItem.h:
+        (SourceProviderCacheItem): SourceProviderCacheItem is instantiated at parser/Parser.cpp:843.
+        * runtime/GCActivityCallback.h:
+        (GCActivityCallback): GCActivityCallback is instantiated at runtime/GCActivityCallback.h:96.
+        * tools/CodeProfile.h:
+        (CodeProfile): CodeProfile is instantiated at JavaScriptCore/tools/CodeProfiling.cpp:140.
+
+2012-09-04  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove uses of ClassInfo from SpeculativeJIT::compileObjectOrOtherLogicalNot
+        https://bugs.webkit.org/show_bug.cgi?id=95510
+
+        Reviewed by Oliver Hunt.
+
+        More refactoring to get rid of ClassInfo checks in the DFG.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+
+2012-09-03  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r127393.
+
+        * interpreter/Interpreter.h:
+
+2012-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed failures seen on Linux bots.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_push_with_scope):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h: push_*_scope doesn't have a destination operand anymore.
+        Accordingly, update these places in the baseline JIT, which I missed in my last patch.
+
+2012-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored scope chain opcodes to support optimization for named function expressions
+        https://bugs.webkit.org/show_bug.cgi?id=95658
+
+        Reviewed by Sam Weinig.
+
+        Renamed
+            push_scope => push_with_scope
+            push_new_scope => push_name_scope
+        to clarify the difference between them.
+
+        Changed push_with_scope and push_name_scope not to save the new scope in
+        a temporary register, since doing so made optimization harder.
+
+        (The old behavior was a hold-over from when the scope chain wasn't
+        a GC object, and wouldn't be marked otherwise. Now, the scope chain is
+        marked because it is a GC object pointed to by the call frame.)
+
+        Changed push_name_scope to accept an operand specifying the attributes
+        for the named property, instead of assuming DontDelete, because a named
+        function expression needs ReadOnly|DontDelete.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::highestUsedRegister): Removed this function,
+        which used to be related to preserving saved scope object temporaries,
+        because it had no callers.
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back out a piece of <http://trac.webkit.org/changeset/127293>
+        because it broke inspector tests on Windows.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+2012-09-01  Mark Lam  <mark.lam@apple.com>
+
+        LLInt C loop backend.
+        https://bugs.webkit.org/show_bug.cgi?id=91052.
+
+        Reviewed by Filip Pizlo.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::bytecodeOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.h:
+        (JITStackFrame):
+        (JSC):
+        * llint/LLIntCLoop.cpp: Added.
+        (JSC):
+        (LLInt):
+        (JSC::LLInt::CLoop::initialize):
+        (JSC::LLInt::CLoop::catchRoutineFor):
+        (JSC::LLInt::CLoop::hostCodeEntryFor):
+        (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor):
+        (JSC::LLInt::CLoop::jsCodeEntryFor):
+        * llint/LLIntCLoop.h: Added.
+        (JSC):
+        (LLInt):
+        (CLoop):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::initialize):
+        * llint/LLIntData.h:
+        (JSC):
+        * llint/LLIntOfflineAsmConfig.h:
+        * llint/LLIntOpcode.h:
+        * llint/LLIntThunks.cpp:
+        (LLInt):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        (LLInt):
+        (JSC::LLInt::Ints2Double):
+        (JSC):
+        (JSC::CLoop::execute):
+        * llint/LowLevelInterpreter.h:
+        (JSC):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/asm.rb:
+        * offlineasm/backends.rb:
+        * offlineasm/cloop.rb: Added.
+        * offlineasm/instructions.rb:
+        * runtime/Executable.h:
+        (ExecutableBase):
+        (JSC::ExecutableBase::hostCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeEntryFor):
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
+        (JSC::ExecutableBase::catchRoutineFor):
+        (NativeExecutable):
+        * runtime/JSValue.h:
+        (JSC):
+        (LLInt):
+        (JSValue):
+        * runtime/JSValueInlineMethods.h:
+        (JSC):
+        (JSC::JSValue::JSValue):
+        * runtime/Options.cpp:
+        (JSC::Options::initialize):
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSActivation.h:
+        (JSActivation):
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSScope::globalThis):
+        (JSC):
+        (JSC::JSGlobalObject::globalThis):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren):
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::JSScope):
+        (JSC::JSScope::globalObject):
+        (JSC::JSScope::globalData):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+
+2012-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back out a piece of <http://trac.webkit.org/changeset/127293>
+        because it broke Window inspector tests.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSActivation.h:
+        (JSActivation):
+
+2012-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, attempt to fix Windows, take two.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, attempt to fix Windows.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-31  Filip Pizlo  <fpizlo@apple.com>
+
+        JSArray::putDirectIndex should by default behave like JSObject::putDirect
+        https://bugs.webkit.org/show_bug.cgi?id=95630
+
+        Reviewed by Gavin Barraclough.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        * runtime/JSArray.h:
+        (SparseArrayValueMap):
+        (JSArray):
+        (JSC::JSArray::putDirectIndex):
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::walk):
+        * runtime/RegExpMatchesArray.cpp:
+        (JSC::RegExpMatchesArray::reifyAllProperties):
+        (JSC::RegExpMatchesArray::reifyMatchProperty):
+        * runtime/StringPrototype.cpp:
+        (JSC::splitStringByOneCharacterImpl):
+        (JSC::stringProtoFuncSplit):
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::nameScopeStructure):
+
+2012-08-31  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of ClassInfo in SpeculativeJIT::emitBranch
+        https://bugs.webkit.org/show_bug.cgi?id=95623
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled back in a piece of <http://trac.webkit.org/changeset/127293>.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (MarkedBlock):
+        (JSC::MarkedBlock::globalData):
+        (JSC):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (WeakSet):
+        (JSC::WeakSet::WeakSet):
+        (JSC::WeakSet::globalData):
+        * runtime/JSGlobalData.h:
+        (JSC::WeakSet::heap):
+        (JSC):
+
+2012-08-31  Mark Lam  <mark.lam@apple.com>
+
+        Refactor LLInt and supporting code in preparation for the C Loop backend.
+        https://bugs.webkit.org/show_bug.cgi?id=95531.
+
+        Reviewed by Filip Pizlo.
+
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch
+            fetch the catch routine for a thrown exception.  This will allow
+            us to redefine that for the C loop later, and still keep this
+            code readable.
+        * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to
+            LowLevelInterpreter.cpp which is the only place they are used. This
+            will make it more convenient to redefine them for the C loop later.
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry()
+            jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing
+            the entry points to functions being called.
+        * llint/LLIntSlowPaths.h:
+        (SlowPathReturnType):
+        (JSC::LLInt::encodeResult):
+        (LLInt):
+        (JSC::LLInt::decodeResult): Added.  Needed by LLInt C Loop later.
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter.cpp:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/asm.rb: Disambiguate between opcodes and other labels.
+        * offlineasm/config.rb:
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::hostCodeEntryFor): Added.
+        (ExecutableBase):
+        (JSC::ExecutableBase::jsCodeEntryFor): Added.
+        (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added.
+        (JSC::ExecutableBase::catchRoutineFor): Added.
+        * runtime/JSValueInlineMethods.h:
+        (JSC):
+
+2012-08-31  Tony Chang  <tony@chromium.org>
+
+        Remove ENABLE_CSS3_FLEXBOX compile time flag
+        https://bugs.webkit.org/show_bug.cgi?id=95382
+
+        Reviewed by Ojan Vafai.
+
+        Everyone is already enabling this by default and the spec has stablized.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Rolled out http://trac.webkit.org/changeset/127293 because it broke
+        inspector tests on Windows.
+
+            Shrink activation objects by half
+            https://bugs.webkit.org/show_bug.cgi?id=95591
+
+            Reviewed by Sam Weinig.
+
+2012-08-31  Geoffrey Garen  <ggaren@apple.com>
+
+        Shrink activation objects by half
+        https://bugs.webkit.org/show_bug.cgi?id=95591
+
+        Reviewed by Sam Weinig.
+
+        Removed the global object, global data, and global this pointers from
+        JSScope, and changed an int to a bitfield. This gets the JSActivation
+        class down to 64 bytes, which in practice cuts it in half by getting it
+        out of the 128 byte size class.
+
+        Now, it's one extra indirection to get these pointers. These pointers
+        aren't accessed by JIT code, so I thought there would be no cost to the
+        extra indirection. However, some C++-heavy SunSpider tests regressed a
+        bit in an early version of the patch, which added even more indirection.
+        This suggests that calls to exec->globalData() and/or exec->lexicalGlobalObject()
+        are common and probably duplicated in lots of places, and could stand
+        further optimization in C++.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute): Test against the specific activation
+        for our global object, since there's no VM-shared activation structure
+        anymore. This is guaranteed to have the same success rate as the old test
+        because activation scope is fixed at compile time.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::MarkedBlock):
+        * heap/MarkedBlock.h:
+        (JSC::MarkedBlock::globalData):
+        * heap/WeakSet.cpp:
+        (JSC::WeakSet::addAllocator):
+        * heap/WeakSet.h:
+        (WeakSet):
+        (JSC::WeakSet::WeakSet):
+        (JSC::WeakSet::globalData): Store a JSGlobalData* instead of a Heap*
+        because JSGlobalData->Heap is just a constant fold in the addressing
+        mode, while Heap->JSGlobalData is an extra pointer dereference. (These
+        objects should eventually just merge.)
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global_dynamic): See DFGAbstractState.cpp.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm: Load the activation structure from
+        the code block instead of the global data because the structure is not
+        VM-shared anymore. (See DFGAbstractState.cpp.)
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSActivation): This is the point of the patch: Remove the data.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): No longer VM-shared. (See DFGAbstractState.cpp.)
+
+        (JSC::WeakSet::heap): (See WeakSet.h.)
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::setGlobalThis):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::withScopeStructure):
+        (JSC::JSGlobalObject::strictEvalActivationStructure):
+        (JSC::JSGlobalObject::activationStructure):
+        (JSC::JSGlobalObject::nameScopeStructure):
+        (JSC::JSScope::globalThis):
+        (JSC::JSGlobalObject::globalThis): Data that used to be in the JSScope
+        class goes here now, so it's not duplicated across all activations.
+
+        * runtime/JSNameScope.h:
+        (JSC::JSNameScope::JSNameScope):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::visitChildren): This is the point of the patch: Remove the data.
+
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::JSScope):
+        (JSC::JSScope::globalObject):
+        (JSC::JSScope::globalData):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::JSWithScope):
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation): Simplified now that
+        we don't need to pass so much data to JSScope.
+
+2012-08-31  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r127191.
+
+        * bytecode/JumpTable.h:
+
+2012-08-30  Filip Pizlo  <fpizlo@apple.com>
+
+        ASSERTION FAILURE in JSC::JSGlobalData::float32ArrayDescriptor when running fast/js/dfg-float64array.html
+        https://bugs.webkit.org/show_bug.cgi?id=95398
+
+        Reviewed by Mark Hahnenberg.
+
+        Trying to get the build failure to be a bit more informative.
+
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: add some #includes that, for some reason, only the Qt linker requires.
+
+        * runtime/BooleanObject.cpp:
+        * runtime/ErrorInstance.cpp:
+        * runtime/NameInstance.cpp:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Fix the Qt build: Removed a now-dead variable.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2012-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        Ambiguous operator[]  after r127191 on some compiler
+        https://bugs.webkit.org/show_bug.cgi?id=95509
+
+        Reviewed by Simon Fraser.
+
+        On some compilers, the operator[] conflicts with the Obj-C++ operators. This attempts to solve
+        the issue.
+
+        * runtime/JSString.h:
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsString):
+        (JSC::jsSubstring8):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: Remove the inline keyword at the declaration
+        site. 
+
+        The Qt compiler seems to be confused, complaining about these functions
+        not being defined in a translation unit, even though no generated code
+        in the unit calls these functions. Maybe removing the keyword at the
+        declaration site will change its mind.
+
+        This shouldn't change the inlining decision at all: the definition is
+        still inline.
+
+        * interpreter/CallFrame.h:
+        (ExecState):
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Undo Qt build fix guess, since it breaks other builds.
+
+        * runtime/JSArray.h:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: add an #include to JSArray.h, since
+        it's included by some of the files Qt complains about, and
+        some of is functions call the functions Qt complains about.
+
+        * runtime/JSArray.h:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Second step toward fixing the Windows build: Add new symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Qt build: add an #include.
+
+        * bytecode/GetByIdStatus.cpp:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        First step toward fixing the Windows build: Remove old symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2012-08-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Use one object instead of two for closures, eliminating ScopeChainNode
+        https://bugs.webkit.org/show_bug.cgi?id=95501
+
+        Reviewed by Filip Pizlo.
+
+        This patch removes ScopeChainNode, and moves all the data and related
+        functions that used to be in ScopeChainNode into JSScope.
+
+        Most of this patch is mechanical changes to use a JSScope* where we used
+        to use a ScopeChainNode*. I've only specifically commented about items
+        that were non-mechanical.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h: Don't require an explicit scope chain argument
+        when evaluating code. Clients never wanted anything other than the
+        global scope, and other arbitrary scopes probably wouldn't work
+        correctly, anyway.
+
+        * runtime/JSScope.cpp:
+        * runtime/JSScope.h:
+        (JSC::JSScope::JSScope): JSScope now requires the data we used to pass to
+        ScopeChainNode, so it can link itself into the scope chain correctly.
+
+        * runtime/JSWithScope.h:
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::JSWithScope): JSWithScope gets an extra constructor
+        for specifically supplying your own scope chain. The DOM needs this
+        interface for setting up the scope chain for certain event handlers.
+        Other clients always just push the JSWithScope to the head of the current
+        scope chain.
+
+2012-08-30  Mark Lam  <mark.lam@apple.com>
+
+        Render unto #ifdef's that which belong to them.
+        https://bugs.webkit.org/show_bug.cgi?id=95482.
+
+        Reviewed by Filip Pizlo.
+
+        Refining / disambiguating between #ifdefs and adding some. For
+        example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places.
+        Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we
+        want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT)
+        and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs
+        in certain places which were previously incorrect.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        * bytecode/Opcode.h:
+        (JSC::padOpcodeName):
+        * config.h:
+        * dfg/DFGOperations.cpp:
+        * interpreter/AbstractPC.cpp:
+        (JSC::AbstractPC::AbstractPC):
+        * interpreter/CallFrame.h:
+        (ExecState):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::getLineNumberForCallFrame):
+        (JSC::getCallerInfo):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::getOpcode):
+        (JSC::Interpreter::getOpcodeID):
+        (Interpreter):
+        * jit/HostCallReturnValue.h:
+        * jit/JITCode.h:
+        (JITCode):
+        * jit/JITExceptions.cpp:
+        * jit/JITExceptions.h:
+        * jit/JSInterfaceJIT.h:
+        * llint/LLIntData.h:
+        (JSC::LLInt::getOpcode):
+        * llint/LLIntEntrypoints.cpp:
+        (JSC::LLInt::getFunctionEntrypoint):
+        (JSC::LLInt::getEvalEntrypoint):
+        (JSC::LLInt::getProgramEntrypoint):
+        * llint/LLIntOffsetsExtractor.cpp:
+        (JSC::LLIntOffsetsExtractor::dummy):
+        * llint/LLIntSlowPaths.cpp:
+        (LLInt):
+        * runtime/JSGlobalData.cpp:
+        (JSC):
+
+2012-08-30  JungJik Lee  <jungjik.lee@samsung.com>
+
+        [EFL][WK2] Add WebMemorySampler feature.
+        https://bugs.webkit.org/show_bug.cgi?id=91214
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebMemorySampler collects Javascript stack and JIT memory usage in globalMemoryStatistics.
+
+        * PlatformEfl.cmake:
+
+2012-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        Replace JSC::UString by WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=95271
+
+        Reviewed by Geoffrey Garen.
+
+        Having JSC::UString and WTF::String increase the complexity of working on WebKit, and
+        add useless conversions in the bindings. It also cause some code bloat.
+
+        The performance advantages of UString have been ported over in previous patches. This patch
+        is the last step: getting rid of UString.
+
+        In addition to the simplified code, this also reduce the binary size by 15kb on x86_64.
+
+        * API/OpaqueJSString.cpp:
+        (OpaqueJSString::ustring):
+        * runtime/Identifier.h:
+        (JSC::Identifier::ustring):
+        To avoid changing everything at once, the function named ustring() were kept as is. They
+        will be renamed in a follow up patch.
+
+        * runtime/JSString.h:
+        (JSC::JSString::string):
+        (JSC::JSValue::toWTFString):
+        (JSC::inlineJSValueNotStringtoString):
+        (JSC::JSValue::toWTFStringInline):
+        Since JSValue::toString() already exist (and return the JSString), the direct accessor is renamed
+        to ::toWTFString(). We may change ::string() to ::jsString() and ::toWTFString() to ::toString()
+        in the future.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow): Replace the use of UString::getCharacters<>() by String::getCharactersWithUpconvert<>().
+
+2012-08-24  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove uses of ClassInfo in StrictEq and CompareEq in the DFG
+        https://bugs.webkit.org/show_bug.cgi?id=93401
+
+        Reviewed by Filip Pizlo.
+
+        Another incremental step in removing the dependence on ClassInfo pointers in object headers.
+
+        * bytecode/SpeculatedType.h:
+        (JSC::isCellOrOtherSpeculation):
+        (JSC):
+        * dfg/DFGAbstractState.cpp: Updated the CFA to reflect the changes to the backend.
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGNode.h:
+        (Node):
+        (JSC::DFG::Node::shouldSpeculateString): Added this new function since it was conspicuously absent.
+        (JSC::DFG::Node::shouldSpeculateNonStringCellOrOther): Also add this function for use in the CFA.
+        * dfg/DFGSpeculativeJIT.cpp: Refactored how we handle CompareEq and CompareStrictEq in the DFG. We now just 
+        check for Strings by comparing the object's Structure to the global Structure for strings. We only 
+        check for MasqueradesAsUndefined if the watchpoint has fired. These changes allow us to remove our 
+        uses of the ClassInfo pointer for compiling these nodes.
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
+        (JSC::DFG::SpeculativeJIT::compare):
+        (JSC::DFG::SpeculativeJIT::compileStrictEq):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp: Same changes for 32 bit as for 64 bit.
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compileObjectEquality):
+        (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
+        (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
+
+2012-08-30  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Implement IncrementalSweeper for PLATFORM(BLACKBERRY)
+        https://bugs.webkit.org/show_bug.cgi?id=95469
+
+        Reviewed by Rob Buis.
+
+        RIM PR# 200595.
+        Share most code with USE(CF) and implement timer-related methods
+        for PLATFORM(BLACKBERRY).
+
+        * heap/IncrementalSweeper.cpp:
+        (JSC):
+        (JSC::IncrementalSweeper::IncrementalSweeper):
+        (JSC::IncrementalSweeper::create):
+        (JSC::IncrementalSweeper::scheduleTimer):
+        (JSC::IncrementalSweeper::cancelTimer):
+        (JSC::IncrementalSweeper::doSweep):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+
+2012-08-30  Mark Lam  <mark.lam@apple.com>
+
+        Fix broken classic intrpreter build.
+        https://bugs.webkit.org/show_bug.cgi?id=95484.
+
+        Reviewed by Filip Pizlo.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-08-30  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        Build warning : -Wsign-compare on DFGByteCodeParser.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=95418
+
+        Reviewed by Filip Pizlo.
+
+        There is a build warning '-Wsign-compare' on
+        findArgumentPositionForLocal() in DFGByteCodeParser.cpp.
+
+        For removing this warning, casting statement is added explicitly.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
+        (JSC::DFG::ByteCodeParser::findArgumentPosition):
+
+2012-08-30  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Set timer client on platform timer used in HeapTimer
+        https://bugs.webkit.org/show_bug.cgi?id=95464
+
+        Reviewed by Rob Buis.
+
+        Otherwise the timer won't work.
+
+        * heap/HeapTimer.cpp:
+        (JSC::HeapTimer::HeapTimer):
+
+2012-08-30  Julien BRIANCEAU   <jbrianceau@nds.com>
+
+        [sh4] Add missing implementation for JavaScriptCore JIT
+        https://bugs.webkit.org/show_bug.cgi?id=95452
+
+        Reviewed by Oliver Hunt.
+
+        * assembler/MacroAssemblerSH4.h:
+        (JSC::MacroAssemblerSH4::isCompactPtrAlignedAddressOffset):
+        (MacroAssemblerSH4):
+        (JSC::MacroAssemblerSH4::add32):
+        (JSC::MacroAssemblerSH4::convertibleLoadPtr):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::labelIgnoringWatchpoints):
+        (SH4Assembler):
+        (JSC::SH4Assembler::replaceWithLoad):
+        (JSC::SH4Assembler::replaceWithAddressComputation):
+
+2012-08-30  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Eliminate build warnings
+        https://bugs.webkit.org/show_bug.cgi?id=95338
+
+        Reviewed by Filip Pizlo.
+
+        static_cast to the same type to eliminate the build time warnings.
+
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::flushWithoutBarrier):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::branch32):
+
+2012-08-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of ClassInfo from compileGetByValOnArguments and compileGetArgumentsLength
+        https://bugs.webkit.org/show_bug.cgi?id=95131
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it 
+        with an assert to guarantee this.
+
+2012-08-29  Mark Lam  <mark.lam@apple.com>
+
+        Refactoring LLInt::Data.
+        https://bugs.webkit.org/show_bug.cgi?id=95316.
+
+        Reviewed by Geoff Garen.
+
+        This change allows its opcodeMap to be easily queried from any function
+        without needing to go through a GlobalData object.  It also introduces
+        the LLInt::getCodePtr() methods that will be used by the LLInt C loop
+        later to redefine how llint symbols (opcodes and trampoline glue
+        labels) get resolved.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
+        (MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::adjustPCIfAtCallSite):
+        (JSC::CodeBlock::bytecodeOffset):
+        * bytecode/Opcode.h:
+            Remove the 'const' to simplify things and avoid having to do
+            additional casts and #ifdefs in many places.
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC::computeForLLInt):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::initialize):
+        * interpreter/Interpreter.h:
+        (Interpreter):
+        * jit/JITExceptions.cpp:
+        (JSC::genericThrow):
+        * llint/LLIntData.cpp:
+        (LLInt):
+        (JSC::LLInt::initialize):
+        * llint/LLIntData.h:
+        (JSC):
+        (LLInt):
+        (Data):
+        (JSC::LLInt::exceptionInstructions):
+        (JSC::LLInt::opcodeMap):
+        (JSC::LLInt::getOpcode):
+        (JSC::LLInt::getCodePtr):
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntExceptions.cpp:
+        (JSC::LLInt::returnToThrowForThrownException):
+        (JSC::LLInt::returnToThrow):
+        (JSC::LLInt::callToThrow):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::handleHostCall):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce): Initialize the singleton LLInt data.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Removed the now unneeded LLInt::Data instance in
+            JSGlobalData.
+        * runtime/JSValue.h:
+        (JSValue):
+
+2012-08-29  Gavin Barraclough  <barraclough@apple.com>
+
+        PutById uses DataLabel32, not DataLabelCompact
+        https://bugs.webkit.org/show_bug.cgi?id=95245
+
+        Reviewed by Geoff Garen.
+
+        JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now,
+        since they currently both do the same thing, but if we were to ever make compact mean
+        8-bit this could be a real problem. Also, relying on the object still being in eax
+        on entry to the transition stub isn't very robust - added nonArgGPR1 to at least make
+        this explicit.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_id):
+            - copy regT0 to nonArgGPR1
+        (JSC::JIT::privateCompilePutByIdTransition):
+            - DataLabelCompact -> DataLabel32
+        (JSC::JIT::resetPatchPutById):
+            - reload regT0 from nonArgGPR1
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+            - added nonArgGPR1
+
+2012-08-28  Yong Li  <yoli@rim.com>
+
+        ExecutableAllocator should be destructed after Heap
+        https://bugs.webkit.org/show_bug.cgi?id=95244
+
+        Reviewed by Rob Buis.
+
+        RIM PR# 199364.
+        Make ExecutableAllocator the first member in JSGlobalData.
+        Existing Web Worker tests can show the issue.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+
+2012-08-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export!
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Introduced JSWithScope, making all scope objects subclasses of JSScope
+        https://bugs.webkit.org/show_bug.cgi?id=95295
+
+        Reviewed by Filip Pizlo.
+
+        This is a step toward removing ScopeChainNode. With a uniform representation
+        for objects in the scope chain, we can move data from ScopeChainNode
+        into JSScope.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Build!
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL): Use an explicit JSWithScope object
+        for 'with' statements. Since 'with' can put any object in the scope
+        chain, we'll need an adapter object to hold the data ScopeChainNode
+        currently holds.
+
+        (JSGlobalData): Support for JSWithScope.
+
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::objectAtScope):
+        * runtime/JSScope.h: Check for and unwrap JSWithScope.
+
+        * runtime/JSType.h: Support for JSWithScope.
+
+        * runtime/StrictEvalActivation.cpp:
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        * runtime/StrictEvalActivation.h:
+        (StrictEvalActivation): Inherit from JSScope, to make the scope chain uniform.
+
+        * runtime/JSWithScope.cpp: Added.
+        (JSC::JSWithScope::visitChildren):
+        * runtime/JSWithScope.h: Added.
+        (JSWithScope):
+        (JSC::JSWithScope::create):
+        (JSC::JSWithScope::object):
+        (JSC::JSWithScope::createStructure):
+        (JSC::JSWithScope::JSWithScope): New adapter object. Since this object
+        is never exposed to scripts, it doesn't need any meaningful implementation
+        of property access or other callbacks.
+
+2012-08-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed. Build fix for !ENABLE(JIT) after r126962.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Added JSScope::objectInScope(), and refactored callers to use it
+        https://bugs.webkit.org/show_bug.cgi?id=95281
+
+        Reviewed by Gavin Barraclough.
+
+        This is a step toward removing ScopeChainNode. We need a layer of
+        indirection so that 'with' scopes can proxy for an object.
+        JSScope::objectInScope() will be that layer.
+
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::tryGet):
+        (JSC::EvalCodeCache::getSlow):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl): . vs ->
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        * runtime/JSScope.cpp:
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveSkip):
+        (JSC::JSScope::resolveGlobalDynamic):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis): Added JSScope::objectAtScope() calls.
+
+        * runtime/JSScope.h:
+        (JSScope):
+        (JSC::JSScope::objectAtScope):
+        (JSC):
+        (ScopeChainIterator):
+        (JSC::ScopeChainIterator::ScopeChainIterator):
+        (JSC::ScopeChainIterator::get):
+        (JSC::ScopeChainIterator::operator->):
+        (JSC::ScopeChainIterator::operator++):
+        (JSC::ScopeChainIterator::operator==):
+        (JSC::ScopeChainIterator::operator!=):
+        (JSC::ScopeChainNode::begin):
+        (JSC::ScopeChainNode::end): I moved ScopeChainIterator to this file
+        to resolve a circular #include problem. Eventually, I'll probably rename
+        it to JSScope::iterator, so I think it belongs here.
+
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        (JSC::ScopeChainNode::localDepth): . vs ->
+
+        * runtime/ScopeChain.h:
+        (ScopeChainNode): I made the 'object' data member private because it's
+        no longer safe to access -- you need to call JSScope::objectAtScope()
+        instead.
+
+        The JITs need to be friends because of the private declaration.
+
+        Subtly, JIT/LLInt code is correct without any changes because JIT/LLInt
+        code never compiles direct access to a with scope.
+
+2012-08-28  Mark Lam  <mark.lam@apple.com>
+
+        Adding support for adding LLInt opcode extensions.  This will be needed
+        by the LLInt C loop interpreter later.
+        https://bugs.webkit.org/show_bug.cgi?id=95277.
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+        * llint/LLIntOpcode.h: Added.
+        * llint/LowLevelInterpreter.h:
+
+2012-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Rolled out r126928, this broke stuff :'-(
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::resetPatchPutById):
+
+2012-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        PutById uses DataLabel32, not DataLabelCompact
+        https://bugs.webkit.org/show_bug.cgi?id=95245
+
+        Reviewed by Geoff Garen.
+
+        JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now,
+        since they currently both do the same thing, but if we were to ever make compact mean
+        8-bit this could be a real problem. Also, don't rely on the object still being in eax
+        on entry to the transition stub – this isn't very robust.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+            - DataLabelCompact -> DataLabel32
+        (JSC::JIT::resetPatchPutById):
+            - reload regT0 from the stack
+
+2012-08-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r126914.
+        http://trac.webkit.org/changeset/126914
+        https://bugs.webkit.org/show_bug.cgi?id=95239
+
+        it breaks everything and fixes nothing (Requested by pizlo on
+        #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-28  Filip Pizlo  <fpizlo@apple.com>
+
+        LLInt should not rely on ordering of global labels
+        https://bugs.webkit.org/show_bug.cgi?id=95221
+
+        Reviewed by Oliver Hunt.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-08-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Rename first/second to key/value in HashMap iterators
+        https://bugs.webkit.org/show_bug.cgi?id=82784
+
+        Reviewed by Eric Seidel.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        GCC warning in JSActivation is causing Mac EWS errors
+        https://bugs.webkit.org/show_bug.cgi?id=95103
+
+        Reviewed by Sam Weinig.
+
+        Try to fix a strict aliasing violation by using bitwise_cast. The
+        union in the cast should signal to the compiler that aliasing between
+        types is happening.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+
+2012-08-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: svn add two files I forgot in my last patch.
+
+2012-08-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Refactored and consolidated variable resolution functions
+        https://bugs.webkit.org/show_bug.cgi?id=95166
+
+        Reviewed by Filip Pizlo.
+
+        This patch does a few things:
+
+        (1) Introduces a new class, JSScope, which is the base class for all
+        objects that represent a scope in the scope chain.
+
+        (2) Refactors and consolidates duplicate implementations of variable
+        resolution into the JSScope class.
+
+        (3) Renames JSStaticScopeObject to JSNameScope because, as distinct from
+        something like a 'let' scope, JSStaticScopeObject only has storage for a
+        single name.
+
+        These changes makes logical sense to me as-is. I will also use them in an
+        upcoming optimization.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri: Build!
+
+        * bytecode/CodeBlock.cpp:
+        (JSC): Build fix for LLInt-only builds.
+
+        * bytecode/GlobalResolveInfo.h:
+        (GlobalResolveInfo): Use PropertyOffset to be consistent with other parts
+        of the engine.
+
+        * bytecompiler/NodesCodegen.cpp:
+        * dfg/DFGOperations.cpp: Use the shared code in JSScope instead of rolling
+        our own.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h: Use the shared code in JSScope instead of rolling
+        our own.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION): Use the shared code in JSScope instead of rolling
+        our own.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (LLInt): Use the shared code in JSScope instead of rolling our own. Note
+        that one of these slow paths calls the wrong helper function. I left it
+        that way to avoid a behavior change in a refactoring patch.
+
+        * parser/Nodes.cpp: Updated for rename.
+
+        * runtime/CommonSlowPaths.h:
+        (CommonSlowPaths): Removed resolve slow paths because were duplicative.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): Updated for renames.
+
+        * runtime/JSNameScope.cpp: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp.
+        (JSC):
+        (JSC::JSNameScope::visitChildren):
+        (JSC::JSNameScope::toThisObject):
+        (JSC::JSNameScope::put):
+        (JSC::JSNameScope::getOwnPropertySlot):
+        * runtime/JSNameScope.h: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.h.
+        (JSC):
+        (JSC::JSNameScope::create):
+        (JSC::JSNameScope::createStructure):
+        (JSNameScope):
+        (JSC::JSNameScope::JSNameScope):
+        (JSC::JSNameScope::isDynamicScope): Used do-webcore-rename script here.
+        It is fabulous!
+
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::isNameScopeObject): More rename.
+
+        * runtime/JSScope.cpp: Added.
+        (JSC):
+        (JSC::JSScope::isDynamicScope):
+        (JSC::JSScope::resolve):
+        (JSC::JSScope::resolveSkip):
+        (JSC::JSScope::resolveGlobal):
+        (JSC::JSScope::resolveGlobalDynamic):
+        (JSC::JSScope::resolveBase):
+        (JSC::JSScope::resolveWithBase):
+        (JSC::JSScope::resolveWithThis):
+        * runtime/JSScope.h: Added.
+        (JSC):
+        (JSScope):
+        (JSC::JSScope::JSScope): All the code here is a port from the
+        Interpreter.cpp implementations of this functionality.
+
+        * runtime/JSStaticScopeObject.cpp: Removed.
+        * runtime/JSStaticScopeObject.h: Removed.
+
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC):
+        * runtime/JSSymbolTableObject.h:
+        (JSSymbolTableObject):
+        * runtime/JSType.h: Updated for rename.
+
+        * runtime/Operations.h:
+        (JSC::resolveBase): Removed because it was duplicative.
+
+2012-08-28  Alban Browaeys <prahal@yahoo.com>
+
+        [GTK] LLint build fails with -g -02
+        https://bugs.webkit.org/show_bug.cgi?id=90098
+
+        Reviewed by Filip Pizlo.
+
+        Avoid duplicate offsets for llint, discarding them.
+
+        * offlineasm/offsets.rb:
+
+2012-08-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r126836.
+        http://trac.webkit.org/changeset/126836
+        https://bugs.webkit.org/show_bug.cgi?id=95163
+
+        Broke all Apple ports, EFL, and Qt. (Requested by tkent on
+        #webkit).
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-27  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Rename first/second to key/value in HashMap iterators
+        https://bugs.webkit.org/show_bug.cgi?id=82784
+
+        Reviewed by Eric Seidel.
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
+        (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertyNames):
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::~OpaqueJSClass):
+        (OpaqueJSClassContextData::OpaqueJSClassContextData):
+        (OpaqueJSClass::contextData):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::EvalCodeCache::visitAggregate):
+        (JSC::CodeBlock::nameForRegister):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::offsetForValue):
+        (JSC::StringJumpTable::ctiForValue):
+        * bytecode/LazyOperandValueProfile.cpp:
+        (JSC::LazyOperandValueProfileParser::getIfPresent):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addConstantValue):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::addStringConstant):
+        (JSC::BytecodeGenerator::emitLazyNewFunction):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PropertyListNode::emitBytecode):
+        * debugger/Debugger.cpp:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
+        (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
+        (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
+        * dfg/DFGAssemblyHelpers.cpp:
+        (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
+        * dfg/DFGByteCodeCache.h:
+        (JSC::DFG::ByteCodeCache::~ByteCodeCache):
+        (JSC::DFG::ByteCodeCache::get):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
+        (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
+        * heap/Heap.cpp:
+        (JSC::Heap::markProtectedObjects):
+        * heap/Heap.h:
+        (JSC::Heap::forEachProtectedCell):
+        * heap/JITStubRoutineSet.cpp:
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/Weak.h:
+        (JSC::weakRemove):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::ctiStub):
+        * parser/Parser.cpp:
+        (JSC::::parseStrictObjectLiteral):
+        * profiler/Profile.cpp:
+        (JSC::functionNameCountPairComparator):
+        (JSC::Profile::debugPrintDataSampleStyle):
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSArray.cpp:
+        (JSC::SparseArrayValueMap::put):
+        (JSC::SparseArrayValueMap::putDirect):
+        (JSC::SparseArrayValueMap::visitChildren):
+        (JSC::JSArray::enterDictionaryMode):
+        (JSC::JSArray::defineOwnNumericProperty):
+        (JSC::JSArray::getOwnPropertySlotByIndex):
+        (JSC::JSArray::getOwnPropertyDescriptor):
+        (JSC::JSArray::putByIndexBeyondVectorLength):
+        (JSC::JSArray::putDirectIndexBeyondVectorLength):
+        (JSC::JSArray::deletePropertyByIndex):
+        (JSC::JSArray::getOwnPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes):
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::invalidateCode):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::clear):
+        (JSC::WeakGCMap::set):
+        * tools/ProfileTreeNode.h:
+        (JSC::ProfileTreeNode::sampleChild):
+        (JSC::ProfileTreeNode::childCount):
+        (JSC::ProfileTreeNode::dumpInternal):
+        (JSC::ProfileTreeNode::compareEntries):
+
+2012-08-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Structure check hoisting should abstain if the OSR entry's must-handle value for the respective variable has a different structure
+        https://bugs.webkit.org/show_bug.cgi?id=95141
+        <rdar://problem/12170401>
+
+        Reviewed by Mark Hahnenberg.
+
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove use of ClassInfo from SpeculativeJIT::compileGetByValOnArguments
+        https://bugs.webkit.org/show_bug.cgi?id=95131
+
+        Reviewed by Filip Pizlo.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it 
+        with an assert to guarantee this.
+
+2012-08-27  Oliver Hunt  <oliver@apple.com>
+
+        Remove opcode definition autogen for now
+        https://bugs.webkit.org/show_bug.cgi?id=95148
+
+        Reviewed by Mark Hahnenberg.
+
+        This isn't worth doing at the moment.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/OpcodeDefinitions.h: Removed.
+        * bytecode/opcodes: Removed.
+        * opcode_definition_generator.py: Removed.
+        * opcode_generator.py: Removed.
+        * opcode_parser.py: Removed.
+
+2012-08-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove uses of TypedArray ClassInfo from SpeculativeJIT::checkArgumentTypes
+        https://bugs.webkit.org/show_bug.cgi?id=95112
+
+        Reviewed by Filip Pizlo.
+
+        Removing these checks since we no longer need them.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::initialize):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
+
+2012-08-27  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add ECMAScript Number to String conversion to WTF::String
+        https://bugs.webkit.org/show_bug.cgi?id=95016
+
+        Reviewed by Geoffrey Garen.
+
+        Rename UString::number(double) to UString::numberToStringECMAScript(double) to
+        differenciate it from the fixed-width conversion performed by String::number().
+
+        * parser/ParserArena.h:
+        (JSC::IdentifierArena::makeNumericIdentifier):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        * runtime/NumericStrings.h:
+        (JSC::NumericStrings::add):
+        * runtime/UString.cpp:
+        (JSC::UString::numberToStringECMAScript):
+        * runtime/UString.h:
+        (UString):
+
+2012-08-27  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        Rename RegisterProtocolHandler API to NavigatorContentUtils
+        https://bugs.webkit.org/show_bug.cgi?id=94920
+
+        Reviewed by Adam Barth.
+
+        ENABLE_REGISTER_PROTOCOL_HANDLER is renamed to ENABLE_NAVIGATOR_CONTENT_UTILS.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, fix for builds without VALUE_PROFILING. I had forgotten that shouldEmitProfiling()
+        is designed to return true if DFG_JIT is disabled. I should be using canBeOptimized() instead.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+
+2012-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't allocate space for arguments and call frame if arguments aren't captured
+        https://bugs.webkit.org/show_bug.cgi?id=95024
+
+        Reviewed by Phil Pizlo.
+
+        27% on v8-real-earley.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::registerOffset): The offset is zero if we're skipping
+        the arguments and call frame because "offset" means space reserved for
+        those things.
+
+        (JSC::JSActivation::tearOff): Don't copy the scope chain and callee. We
+        don't need them for anything, and we're no longer guaranteed to have
+        space for them.
+
+2012-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed the NULL checks from visitChildren functions
+        https://bugs.webkit.org/show_bug.cgi?id=95021
+
+        Reviewed by Oliver Hunt.
+
+        As of http://trac.webkit.org/changeset/126624, all values are NULL-checked
+        during GC, so explicit NULL checks aren't needed anymore.
+
+2011-08-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Removed a JSC-specific hack from the web inspector
+        https://bugs.webkit.org/show_bug.cgi?id=95033
+
+        Reviewed by Filip Pizlo.
+
+        Added support for what the web inspector really wanted instead.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut): Added some explanation for these
+        checks, which were non-obvious to me.
+
+        (JSC::JSActivation::getOwnPropertySlot): It's impossible to access the
+        arguments property of an activation after it's been torn off, since the
+        only way to tear off an activation is to instantiate a new function,
+        which has its own arguments property in scope. However, the inspector
+        get special access to activations, and may try to perform this access,
+        so we need a special guard to maintain coherence and avoid crashing in
+        case the activation optimized out the arguments property.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::getOwnPropertyDescriptor): Provide getOwnPropertyNames
+        and getOwnPropertyDescriptor implementations, to meet the web inspector's
+        needs. (User code can never call these.)
+
+2012-08-24  Filip Pizlo  <fpizlo@apple.com>
+
+        Finally inlining should correctly track the catch context
+        https://bugs.webkit.org/show_bug.cgi?id=94986
+        <rdar://problem/11753784>
+
+        Reviewed by Sam Weinig.
+
+        This fixes two behaviors:
+        
+        1) Throwing from a finally block. Previously, we would seem to reenter the finally
+           block - though only once.
+        
+        2) Executing a finally block from some nested context, for example due to a
+           'continue', 'break', or 'return' in the try. This would execute the finally
+           block in the context of of the try block, which could lead to either scope depth
+           mismatches or reexecutions of the finally block on throw, similarly to (1) but
+           for different reasons.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::pushTry):
+        (JSC::BytecodeGenerator::popTryAndEmitCatch):
+        * bytecompiler/BytecodeGenerator.h:
+        (FinallyContext):
+        (TryData):
+        (JSC):
+        (TryContext):
+        (TryRange):
+        (BytecodeGenerator):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+
+2012-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        Array type checks and storage accesses should be uniformly represented and available to CSE
+        https://bugs.webkit.org/show_bug.cgi?id=95013
+
+        Reviewed by Oliver Hunt.
+
+        This uniformly breaks up all array accesses into up to three parts:
+        
+        1) The type check, using a newly introduced CheckArray node, in addition to possibly
+           a CheckStructure node. We were already inserting the CheckStructure prior to this
+           patch. The CheckArray node will be automatically eliminated if the thing it was
+           checking for had already been checked for, either intentionally (a CheckStructure
+           inserted based on the array profile of this access) or accidentally (some checks,
+           typically a CheckStructure, inserted for some unrelated operations). The
+           CheckArray node may not be inserted if the array type is non-specific (Generic or
+           ForceExit).
+        
+        2) The storage load using GetIndexedPropertyStorage. Previously, this only worked for
+           GetByVal. Now it works for all array accesses. The storage load may not be
+           inserted if the mode of array access does not permit CSE of storage loads (like
+           non-specific modes or Arguments).
+        
+        3) The access itself: one of GetByVal, PutByVal, PutByValAlias, ArrayPush, ArrayPop,
+           GetArrayLength, StringCharAt, or StringCharCodeAt.
+        
+        This means that the type check can be subjected to CSE even if the CFA isn't smart
+        enough to reason about it (yet!). It also means that the storage load can always be
+        subjected to CSE; previously CSE on storage load only worked for array loads and not
+        other forms of access. Finally, it removes the bizarre behavior that
+        GetIndexedPropertyStorage previously had: previously, it was responsible for the type
+        check in some cases, but not others; this made reasoning about the CFA really
+        confusing.
+        
+        This change also disables late refinement of array mode, since I decided that
+        supporting that feature is both confusing and likely unprofitable. The array modes are
+        now locked in in the first fixup run after prediction propagation. Of course,
+        refinements from Generic to something else would not have been a problem; we could
+        reenable those if we thought we really needed to.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.cpp:
+        (JSC::DFG::fromStructure):
+        (DFG):
+        (JSC::DFG::refineArrayMode):
+        * dfg/DFGArrayMode.h:
+        (DFG):
+        (JSC::DFG::modeIsJSArray):
+        (JSC::DFG::lengthNeedsStorage):
+        (JSC::DFG::modeIsSpecific):
+        (JSC::DFG::modeSupportsLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::CSEPhase):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (CSEPhase):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        (JSC::DFG::performCSE):
+        * dfg/DFGCSEPhase.h:
+        (DFG):
+        * dfg/DFGCommon.h:
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::checkArray):
+        (FixupPhase):
+        (JSC::DFG::FixupPhase::blessArrayOperation):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (DFG):
+        (JSC::DFG::Graph::dump):
+        (JSC::DFG::Graph::collectGarbage):
+        * dfg/DFGGraph.h:
+        (Graph):
+        (JSC::DFG::Graph::vote):
+        (JSC::DFG::Graph::substitute):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        (JSC::DFG::Node::setArrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGPhase.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::checkArray):
+        (JSC::DFG::SpeculativeJIT::useChildren):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-26  Filip Pizlo  <fpizlo@apple.com>
+
+        DFGGraph.h has a bogus comment about the nature of StorageAccessData
+        https://bugs.webkit.org/show_bug.cgi?id=95035
+
+        Reviewed by Oliver Hunt.
+
+        The comment is both wrong (storage access instructions don't reference CheckStructure)
+        and highly redundant: of course it's the case that two structures may have the same
+        identifier. Our interference analyses currently don't care about this and make the
+        conservative assumptions when necessary (same identifier, same object -> must be same
+        property; same identifier, may be same object -> may be the same property). Better to
+        remove the bogus comment since the code that operates over this data structure is
+        fairly self-explanatory already.
+
+        * dfg/DFGGraph.h:
+        (StorageAccessData):
+
+2012-08-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Try a little harder to fix the Linux build.
+
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+
+2012-08-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the Linux build.
+
+        * runtime/JSActivation.cpp:
+
+2012-08-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Don't use malloc / destructors for activation objects
+        https://bugs.webkit.org/show_bug.cgi?id=94897
+
+        Reviewed by Oliver Hunt.
+
+        65% faster on v8-real-earley.
+
+        Lots of boilerplate here, but the jist is this:
+
+        (1) Use CopiedSpace instead of malloc to allocate the activation's
+        backing store.
+
+        (2) Use MarkedSpace instead of ref-counting to allocate the symbol table.
+
+        (3) ==> No more destructor.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::stronglyVisitStrongReferences):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::symbolTable):
+        (CodeBlock):
+        (JSC::GlobalCodeBlock::GlobalCodeBlock):
+        (JSC::FunctionCodeBlock::FunctionCodeBlock):
+        (FunctionCodeBlock): SymbolTable is a GC object now, so it gets a write
+        barrier and visit calls instead of ref-counting. I changed all CodeBlocks
+        to use shared symbol tables because the distinction between shared and
+        unshared hurt my head.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::resolve):
+        (JSC::BytecodeGenerator::resolveConstDecl):
+        (JSC::BytecodeGenerator::emitPutStaticVar):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Sometimes, a period just wants
+        to be an arrow. And then C++ is there to accommodate.
+
+        * jit/JITDriver.h:
+        (JSC::jitCompileFunctionIfAppropriate):
+        * runtime/Arguments.h:
+        (ArgumentsData):
+        (JSC::Arguments::setRegisters):
+        (Arguments):
+        (JSC::Arguments::argument):
+        (JSC::Arguments::finishCreation):
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::visitChildren):
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::symbolTable):
+        (FunctionExecutable):
+        * runtime/ExecutionHarness.h:
+        (JSC::prepareFunctionForExecution): I changed from WriteBarrier to
+        WriteBarrierBase so activations could reuse StorageBarrier and PropertyStorage.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::finishCreation): Allocate the symbol table here,
+        after we're fully constructed, to avoid GC during initialization.
+
+        (JSC::JSActivation::visitChildren):
+        (JSC::JSActivation::symbolTableGet):
+        (JSC::JSActivation::symbolTablePut):
+        (JSC::JSActivation::getOwnPropertyNames):
+        (JSC::JSActivation::symbolTablePutWithAttributes):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::create):
+        (JSActivation):
+        (JSC::JSActivation::registerOffset):
+        (JSC):
+        (JSC::JSActivation::registerArraySize):
+        (JSC::JSActivation::registerArraySizeInBytes):
+        (JSC::JSActivation::tearOff): Tear-off zero-initializes all uncopied
+        registers. This makes it safe to copyAndAppend the full buffer in
+        visitChildren, without any extra checks.
+
+        * runtime/JSCell.h:
+        (JSCell): Moved a shared default set of flags into this base class, so
+        I could use it in a few places.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData): New structure for symbol tables.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::addStaticGlobals):
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::symbolTableHasProperty): We don't need an inline
+        symbol table -- JSSymbolTableObject will GC allocate one for us.
+
+        * runtime/JSObject.h:
+        (JSObject):
+        * runtime/JSSegmentedVariableObject.h:
+        (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC):
+        (JSC::JSStaticScopeObject::visitChildren): NULL check our register store
+        because finishCreation allocates an object now, so we may get marked
+        before we've assigned to our register store.
+
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::finishCreation):
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSStaticScopeObject): No more destructor for this object, either, since
+        it no longer embeds a hash table.
+
+        * runtime/JSSymbolTableObject.cpp:
+        (JSC::JSSymbolTableObject::visitChildren):
+        (JSC::JSSymbolTableObject::deleteProperty):
+        (JSC::JSSymbolTableObject::getOwnPropertyNames):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::JSSymbolTableObject::symbolTable):
+        (JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::JSSymbolTableObject):
+        (JSC::JSSymbolTableObject::finishCreation):
+        (JSC::symbolTableGet):
+        (JSC::symbolTablePut):
+        (JSC::symbolTablePutWithAttributes): SymbolTableObject allocates a symbol
+        table automatically if one isn't provided. (Activations provide their
+        own, which they get from compiled code.)
+
+        * runtime/JSVariableObject.cpp:
+        (JSC):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::registerAt):
+        (JSC::JSVariableObject::addressOfRegisters):
+        (JSVariableObject):
+        (JSC::JSVariableObject::JSVariableObject):
+        (JSC::JSVariableObject::finishCreation): Removed a bunch of obsolete code.
+        Activations manage their registers directly now.
+
+        * runtime/StorageBarrier.h:
+        (StorageBarrier):
+        (JSC::StorageBarrier::operator!):
+
+        * runtime/SymbolTable.cpp:
+        (JSC):
+        (JSC::SharedSymbolTable::destroy):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::create):
+        (SharedSymbolTable):
+        (JSC::SharedSymbolTable::createStructure):
+        (JSC::SharedSymbolTable::SharedSymbolTable): Boilerplat code to
+        make shared symbol table GC-allocated.
+
+2012-08-25  Filip Pizlo  <fpizlo@apple.com>
+
+        op_call should have ArrayProfiling for the benefit of array intrinsics
+        https://bugs.webkit.org/show_bug.cgi?id=95014
+
+        Reviewed by Sam Weinig.
+
+        This is a performance-neutral change that just adds the profiling but does not
+        use it, yet. If in the future we wanted to make this kind of profiling cheaper
+        we could move it into specialized thunks for the relevant array intrinsics, but
+        I figure that if this much simpler change gives us what we need without any
+        discernable performance penalty then that's for the best.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::compileOpCall):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
+2012-08-25  Filip Pizlo  <fpizlo@apple.com>
+
+        The redundant phi elimination phase is not used and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=95006
+
+        Reviewed by Dan Bernstein.
+
+        Just removing dead code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGDriver.cpp:
+        * dfg/DFGRedundantPhiEliminationPhase.cpp: Removed.
+        * dfg/DFGRedundantPhiEliminationPhase.h: Removed.
+
+2012-08-24  Benjamin Poulain  <bpoulain@apple.com>
+
+        Unify Number to StringImpl conversion
+        https://bugs.webkit.org/show_bug.cgi?id=94879
+
+        Reviewed by Geoffrey Garen.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::UString::number):
+        Update UString to directly use the common NumberToString implementation.
+
+2012-08-24  Oliver Hunt  <oliver@apple.com>
+
+        Always null check cells before marking
+        https://bugs.webkit.org/show_bug.cgi?id=94968
+
+        Reviewed by Geoffrey Garen.
+
+        Originally we tried to minimise null checks by only null checking values
+        that we knew could be null, however given that we can't ever guarantee
+        when a GC will happen, we're better off just always assuming that a null
+        check will be necessary.  This results in a much less fragile code base
+        as we can add GC allocations to object initialisers without having to
+        subsequently worry about whether the object we are initialising will need
+        to add a bunch of null checks in its visitChildren implementation.
+
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::internalAppend):
+        * heap/MarkStackInlineMethods.h:
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendUnbarrieredPointer):
+        * runtime/Structure.h:
+        (JSC::MarkStack::internalAppend):
+
+2012-08-23  Oliver Hunt  <oliver@apple.com>
+
+        Autogenerate Opcode definitions
+        https://bugs.webkit.org/show_bug.cgi?id=94840
+
+        Reviewed by Gavin Barraclough.
+
+        Start the process of autogenerating the code emission for the bytecode.
+        We'll just start with automatic generation of the list of Opcodes as that
+        requires the actual definition of the opcodes, and the logic for parsing
+        them.
+
+        Due to some rather annoying dependency cycles, this initial version has
+        the OpcodeDefinitions.h file checked into the tree, although with some
+        work I hope to be able to fix that.
+
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.h:
+          Include OpcodeDefinitions.h as our definitive source of info
+          about the opcodes.
+        * bytecode/OpcodeDefinitions.h: Added.
+          Autogenerated file
+        * bytecode/opcodes: Added.
+          The new opcode definition file
+        * opcode_definition_generator.py: Added.
+        (generateOpcodeDefinition):
+        (generate):
+          Module that generates the content for OpcodeDefinitions.h
+        * opcode_generator.py: Added.
+        (printUsage):
+        (main):
+          Driver script
+        * opcode_parser.py: Added.
+          Simple parser for the opcode definitions.
+
 2011-08-23  Geoffrey Garen  <ggaren@apple.com>
 
         Unreviewed, rolling out r126505.
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 9c1b8ffa7..f9a0eb29c 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -47,7 +47,6 @@ ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS;
 ENABLE_CSS_COMPOSITING = ;
 ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION;
 ENABLE_CSS_VARIABLES = ;
-ENABLE_CSS3_FLEXBOX = ENABLE_CSS3_FLEXBOX;
 ENABLE_CSS3_TEXT_DECORATION = ;
 ENABLE_CUSTOM_SCHEME_HANDLER = ;
 ENABLE_DASHBOARD_SUPPORT = $(ENABLE_DASHBOARD_SUPPORT_$(REAL_PLATFORM_NAME));
@@ -105,6 +104,7 @@ ENABLE_METER_ELEMENT = ENABLE_METER_ELEMENT;
 ENABLE_MHTML = ;
 ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
+ENABLE_NAVIGATOR_CONTENT_UTILS = ;
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
 ENABLE_NOTIFICATIONS_macosx = $(ENABLE_NOTIFICATIONS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_NOTIFICATIONS_macosx_1070 = ;
@@ -113,7 +113,6 @@ ENABLE_NOTIFICATIONS_macosx_1090 = ENABLE_NOTIFICATIONS;
 ENABLE_PAGE_VISIBILITY_API = ;
 ENABLE_PROGRESS_ELEMENT = ENABLE_PROGRESS_ELEMENT;
 ENABLE_QUOTA = ;
-ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
 ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
@@ -140,4 +139,4 @@ ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS3_TEXT_DECORATION) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_TEXT_DECORATION) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig
index cff1fe049..5cb8681fa 100644
--- a/Source/JavaScriptCore/Configurations/Version.xcconfig
+++ b/Source/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 8;
+MINOR_VERSION = 10;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index b0c31599c..dd584f747 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -217,8 +217,6 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGPhase.h \
 	Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp \
 	Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.h \
-	Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp \
-	Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h \
 	Source/JavaScriptCore/dfg/DFGRegisterBank.h \
 	Source/JavaScriptCore/dfg/DFGRegisterSet.h \
 	Source/JavaScriptCore/dfg/DFGRepatch.cpp \
@@ -406,6 +404,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/ThunkGenerators.cpp \
 	Source/JavaScriptCore/jit/ThunkGenerators.h \
 	Source/JavaScriptCore/llint/LLIntCommon.h \
+	Source/JavaScriptCore/llint/LLIntCLoop.cpp \
+	Source/JavaScriptCore/llint/LLIntCLoop.h \
 	Source/JavaScriptCore/llint/LLIntData.cpp \
 	Source/JavaScriptCore/llint/LLIntData.h \
 	Source/JavaScriptCore/llint/LLIntEntrypoints.cpp \
@@ -413,6 +413,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/llint/LLIntExceptions.cpp \
 	Source/JavaScriptCore/llint/LLIntExceptions.h \
 	Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h \
+	Source/JavaScriptCore/llint/LLIntOpcode.h \
 	Source/JavaScriptCore/llint/LLIntSlowPaths.cpp \
 	Source/JavaScriptCore/llint/LLIntSlowPaths.h \
 	Source/JavaScriptCore/llint/LLIntThunks.cpp \
@@ -549,8 +550,11 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/JSPropertyNameIterator.h \
 	Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp \
 	Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h \
-	Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp \
-	Source/JavaScriptCore/runtime/JSStaticScopeObject.h \
+	Source/JavaScriptCore/runtime/JSWithScope.cpp \
+	Source/JavaScriptCore/runtime/JSNameScope.cpp \
+	Source/JavaScriptCore/runtime/JSNameScope.h \
+	Source/JavaScriptCore/runtime/JSScope.cpp \
+	Source/JavaScriptCore/runtime/JSScope.h \
 	Source/JavaScriptCore/runtime/JSStringBuilder.h \
 	Source/JavaScriptCore/runtime/JSStringJoiner.cpp \
 	Source/JavaScriptCore/runtime/JSStringJoiner.h \
@@ -565,6 +569,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/JSValueInlineMethods.h \
 	Source/JavaScriptCore/runtime/JSVariableObject.cpp \
 	Source/JavaScriptCore/runtime/JSVariableObject.h \
+	Source/JavaScriptCore/runtime/JSWithScope.h \
 	Source/JavaScriptCore/runtime/JSWrapperObject.cpp \
 	Source/JavaScriptCore/runtime/JSWrapperObject.h \
 	Source/JavaScriptCore/runtime/LiteralParser.cpp \
@@ -629,9 +634,6 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/RegExpPrototype.h \
 	Source/JavaScriptCore/runtime/SamplingCounter.cpp \
 	Source/JavaScriptCore/runtime/SamplingCounter.h \
-	Source/JavaScriptCore/runtime/ScopeChain.cpp \
-	Source/JavaScriptCore/runtime/ScopeChain.h \
-	Source/JavaScriptCore/runtime/ScopeChainMark.h \
 	Source/JavaScriptCore/runtime/SmallStrings.cpp \
 	Source/JavaScriptCore/runtime/SmallStrings.h \
 	Source/JavaScriptCore/runtime/StorageBarrier.h \
@@ -657,10 +659,6 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/TimeoutChecker.h \
 	Source/JavaScriptCore/runtime/Tracing.h \
 	Source/JavaScriptCore/runtime/Uint16WithFraction.h \
-	Source/JavaScriptCore/runtime/UString.cpp \
-	Source/JavaScriptCore/runtime/UString.h \
-	Source/JavaScriptCore/runtime/UStringBuilder.h \
-	Source/JavaScriptCore/runtime/UStringConcatenate.h \
 	Source/JavaScriptCore/runtime/WeakGCMap.h \
 	Source/JavaScriptCore/runtime/WeakRandom.h \
 	Source/JavaScriptCore/runtime/WriteBarrier.h \
@@ -699,6 +697,7 @@ offlineasm_nosources += \
 	Source/JavaScriptCore/offlineasm/asm.rb \
 	Source/JavaScriptCore/offlineasm/ast.rb \
 	Source/JavaScriptCore/offlineasm/backends.rb \
+	Source/JavaScriptCore/offlineasm/cloop.rb \
 	Source/JavaScriptCore/offlineasm/config.rb \
 	Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb \
 	Source/JavaScriptCore/offlineasm/instructions.rb \
diff --git a/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore b/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore
deleted file mode 100644
index f6c1348f3..000000000
--- a/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-*.Makefile
-*.mk
-*.sln
-*.vcproj*
-*.vcxproj*
-JavaScriptCore.xcodeproj
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index 84d5e16a6..787abc182 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -1,143 +1,143 @@
-
-Microsoft Visual Studio Solution File, Format Version 9.00
-# Visual Studio 2005
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
-	ProjectSection(ProjectDependencies) = postProject
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
-	ProjectSection(ProjectDependencies) = postProject
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "..\..\WTF\WTF.vcproj\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"
-	ProjectSection(ProjectDependencies) = postProject
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950} = {5AE5F5E4-782D-4F63-B4D7-3977B52B9950}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
-	ProjectSection(ProjectDependencies) = postProject
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "testRegExp", "testRegExp\testRegExp.vcproj", "{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}"
-	ProjectSection(ProjectDependencies) = postProject
-		{C59E5129-B453-49B7-A52B-1E104715F76E} = {C59E5129-B453-49B7-A52B-1E104715F76E}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTFGenerated", "..\..\WTF\WTF.vcproj\WTFGenerated.vcproj", "{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug_All|Win32 = Debug_All|Win32
-		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32
-		Debug|Win32 = Debug|Win32
-		Production|Win32 = Production|Win32
-		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32
-		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
-		Release_PGO|Win32 = Release_PGO|Win32
-		Release|Win32 = Release|Win32
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.Build.0 = Production|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32
-		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug|Win32.ActiveCfg = Debug|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug|Win32.Build.0 = Debug|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Production|Win32.ActiveCfg = Production|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Production|Win32.Build.0 = Production|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release|Win32.ActiveCfg = Release|Win32
-		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release|Win32.Build.0 = Release|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.ActiveCfg = Debug|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.Build.0 = Debug|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.ActiveCfg = Production|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.Build.0 = Production|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.ActiveCfg = Production|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.Build.0 = Production|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.ActiveCfg = Release|Win32
-		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.Build.0 = Release|Win32
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
+

+Microsoft Visual Studio Solution File, Format Version 9.00

+# Visual Studio 2005

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"

+	ProjectSection(ProjectDependencies) = postProject

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"

+	ProjectSection(ProjectDependencies) = postProject

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTF", "..\..\WTF\WTF.vcproj\WTF.vcproj", "{AA8A5A85-592B-4357-BC60-E0E91E026AF6}"

+	ProjectSection(ProjectDependencies) = postProject

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950} = {5AE5F5E4-782D-4F63-B4D7-3977B52B9950}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"

+	ProjectSection(ProjectDependencies) = postProject

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6} = {AA8A5A85-592B-4357-BC60-E0E91E026AF6}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "testRegExp", "testRegExp\testRegExp.vcproj", "{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}"

+	ProjectSection(ProjectDependencies) = postProject

+		{C59E5129-B453-49B7-A52B-1E104715F76E} = {C59E5129-B453-49B7-A52B-1E104715F76E}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WTFGenerated", "..\..\WTF\WTF.vcproj\WTFGenerated.vcproj", "{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}"

+EndProject

+Global

+	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

+		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32

+		Debug|Win32 = Debug|Win32

+		Production|Win32 = Production|Win32

+		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32

+		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32

+		Release_PGO|Win32 = Release_PGO|Win32

+		Release|Win32 = Release|Win32

+	EndGlobalSection

+	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.Build.0 = Debug|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.ActiveCfg = Production|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Production|Win32.Build.0 = Production|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.ActiveCfg = Production|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGO|Win32.Build.0 = Production|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug|Win32.ActiveCfg = Debug|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Debug|Win32.Build.0 = Debug|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Production|Win32.ActiveCfg = Production|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Production|Win32.Build.0 = Production|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release|Win32.ActiveCfg = Release|Win32

+		{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}.Release|Win32.Build.0 = Release|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.ActiveCfg = Debug|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Debug|Win32.Build.0 = Debug|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.ActiveCfg = Production|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Production|Win32.Build.0 = Production|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.ActiveCfg = Production|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO_Optimize|Win32.Build.0 = Production|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.ActiveCfg = Production|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release_PGO|Win32.Build.0 = Production|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.ActiveCfg = Release|Win32

+		{5AE5F5E4-782D-4F63-B4D7-3977B52B9950}.Release|Win32.Build.0 = Release|Win32

+	EndGlobalSection

+	GlobalSection(SolutionProperties) = preSolution

+		HideSolutionNode = FALSE

+	EndGlobalSection

+EndGlobal

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index e3453201b..aa7ec78df 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -24,12 +24,8 @@ EXPORTS
     ??0StringObject@JSC@@IAE@AAVJSGlobalData@1@PAVStructure@1@@Z
     ??0Structure@JSC@@AAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@VJSValue@1@ABVTypeInfo@1@PBUClassInfo@1@@Z
     ??0ThreadCondition@WTF@@QAE@XZ
-    ??0UString@JSC@@QAE@PBD@Z
-    ??0UString@JSC@@QAE@PBDI@Z
-    ??0UString@JSC@@QAE@PB_W@Z
-    ??0UString@JSC@@QAE@PB_WI@Z
     ??0WTFThreadData@WTF@@QAE@XZ
-    ??0YarrPattern@Yarr@JSC@@QAE@ABVUString@2@_N1PAPBD@Z
+    ??0YarrPattern@Yarr@JSC@@QAE@ABVString@WTF@@_N1PAPBD@Z
     ??1ArrayBufferView@WTF@@UAE@XZ
     ??1ClientData@JSGlobalData@JSC@@UAE@XZ
     ??1Collator@WTF@@QAE@XZ
@@ -44,7 +40,6 @@ EXPORTS
     ??1ThreadCondition@WTF@@QAE@XZ
     ??1WTFThreadData@WTF@@QAE@XZ
     ??1WeakHandleOwner@JSC@@UAE@XZ
-    ??8JSC@@YA_NABVUString@0@0@Z
     ??8WTF@@YA_NABVCString@0@0@Z
     ?EcmaScriptConverter@DoubleToStringConverter@double_conversion@WTF@@SAABV123@XZ
     ?StringToDouble@StringToDoubleConverter@double_conversion@WTF@@SANPBDIPAI@Z
@@ -71,7 +66,12 @@ EXPORTS
     ?allocateSlowCase@MarkedAllocator@JSC@@AAEPAXXZ
     ?append@StringBuilder@WTF@@QAEXPBEI@Z
     ?append@StringBuilder@WTF@@QAEXPB_WI@Z
-    ?ascii@UString@JSC@@QBE?AVCString@WTF@@XZ
+    ?appendNumber@StringBuilder@WTF@@QAEXH@Z
+    ?appendNumber@StringBuilder@WTF@@QAEXI@Z
+    ?appendNumber@StringBuilder@WTF@@QAEXJ@Z
+    ?appendNumber@StringBuilder@WTF@@QAEXK@Z
+    ?appendNumber@StringBuilder@WTF@@QAEX_J@Z
+    ?appendNumber@StringBuilder@WTF@@QAEX_K@Z
     ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
     ?base64Decode@WTF@@YA_NABVString@1@AAV?$Vector@D$0A@@1@W4Base64DecodePolicy@1@@Z
     ?base64Encode@WTF@@YA?AVString@1@PBDIW4Base64EncodePolicy@1@@Z
@@ -84,7 +84,7 @@ EXPORTS
     ?calculateDSTOffset@WTF@@YANNN@Z
     ?calculateStringHashAndLengthFromUTF8MaskingTop8Bits@Unicode@WTF@@YAIPBD0AAI1@Z
     ?calculateUTCOffset@WTF@@YAHXZ
-    ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
+    ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVString@WTF@@XZ
     ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
     ?callHostFunctionAsConstructor@JSC@@YI_JPAVExecState@1@@Z
     ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
@@ -97,7 +97,7 @@ EXPORTS
     ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@@Z
     ?checkSyntax@JSC@@YA_NPAVExecState@1@ABVSourceCode@1@PAVJSValue@1@@Z
     ?checksum@MD5@WTF@@QAEXAAV?$Vector@E$0BA@@2@@Z
-    ?className@JSObject@JSC@@SA?AVUString@2@PBV12@@Z
+    ?className@JSObject@JSC@@SA?AVString@WTF@@PBV12@@Z
     ?clear@SourceProviderCache@JSC@@QAEXXZ
     ?clearRareData@JSGlobalObject@JSC@@CAXPAVJSCell@2@@Z
     ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
@@ -107,31 +107,30 @@ EXPORTS
     ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
     ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
     ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?constructFunctionSkippingEvalEnabledCheck@JSC@@YAPAVJSObject@1@PAVExecState@1@PAVJSGlobalObject@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@ABVTextPosition@WTF@@@Z
+    ?constructFunctionSkippingEvalEnabledCheck@JSC@@YAPAVJSObject@1@PAVExecState@1@PAVJSGlobalObject@1@ABVArgList@1@ABVIdentifier@1@ABVString@WTF@@ABVTextPosition@8@@Z
     ?constructNumber@JSC@@YAPAVNumberObject@1@PAVExecState@1@PAVJSGlobalObject@1@VJSValue@1@@Z
     ?constructString@JSC@@YAPAVStringObject@1@PAVExecState@1@PAVJSGlobalObject@1@VJSValue@1@@Z
     ?convertLatin1ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBEPBEPAPADPAD@Z
     ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
     ?convertUTF8ToUTF16@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBDPBDPAPA_WPA_W_N@Z
-    ?create@JSFunction@JSC@@SAPAV12@PAVExecState@2@PAVJSGlobalObject@2@HABVUString@2@P6I_J0@ZW4Intrinsic@2@3@Z
+    ?create@JSFunction@JSC@@SAPAV12@PAVExecState@2@PAVJSGlobalObject@2@HABVString@WTF@@P6I_J0@ZW4Intrinsic@2@3@Z
     ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@W4HeapType@2@@Z
-    ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
-    ?create@RegExp@JSC@@SAPAV12@AAVJSGlobalData@2@ABVUString@2@W4RegExpFlags@2@@Z
+    ?create@RegExp@JSC@@SAPAV12@AAVJSGlobalData@2@ABVString@WTF@@W4RegExpFlags@2@@Z
     ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
-    ?createError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?createError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z
     ?createInterruptedExecutionException@JSC@@YAPAVJSObject@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@W4HeapType@2@@Z
     ?createNotEnoughArgumentsError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?createRangeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
-    ?createReferenceError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?createRangeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z
+    ?createReferenceError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z
     ?createSingleCharacterString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@E@Z
     ?createStackOverflowError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?createSyntaxError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?createSyntaxError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
     ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
     ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z
-    ?createTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?createTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z
     ?cryptographicallyRandomNumber@WTF@@YAIXZ
     ?cryptographicallyRandomValues@WTF@@YAXPAXI@Z
     ?currentThread@WTF@@YAIXZ
@@ -164,7 +163,7 @@ EXPORTS
     ?detachThread@WTF@@YAXI@Z
     ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
     ?deleteAllCompiledCode@Heap@JSC@@QAEXXZ
-    ?displayName@JSFunction@JSC@@QAE?BVUString@2@PAVExecState@2@@Z
+    ?displayName@JSFunction@JSC@@QAE?BVString@WTF@@PAVExecState@2@@Z
     ?dtoa@WTF@@YAXQADNAA_NAAHAAI@Z
     ?dumpAllOptions@Options@JSC@@SAXPAU_iobuf@@@Z
     ?dumpCallFrame@Interpreter@JSC@@QAEXPAVExecState@2@@Z
@@ -172,8 +171,8 @@ EXPORTS
     ?empty@StringImpl@WTF@@SAPAV12@XZ
     ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
     ?equalUTF16WithUTF8@Unicode@WTF@@YA_NPB_W0PBD1@Z
-    ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
-    ?evaluate@JSC@@YA?AVJSValue@1@PAVExecState@1@PAVScopeChainNode@1@ABVSourceCode@1@V21@PAV21@@Z
+    ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVString@WTF@@AAV32@@Z
+    ?evaluate@JSC@@YA?AVJSValue@1@PAVExecState@1@ABVSourceCode@1@V21@PAV21@@Z
     ?exclude@Profile@JSC@@QAEXPBVProfileNode@2@@Z
     ?execute@ParallelEnvironment@WTF@@QAEXPAX@Z
     ?expand@MarkStackArray@JSC@@AAEXXZ
@@ -191,7 +190,7 @@ EXPORTS
     ?findAllocator@WeakSet@JSC@@AAEPAUFreeCell@WeakBlock@2@XZ
     ?finishCreation@BooleanObject@JSC@@IAEXAAVJSGlobalData@2@@Z
     ?finishCreation@DateInstance@JSC@@IAEXAAVJSGlobalData@2@N@Z
-    ?finishCreation@InternalFunction@JSC@@IAEXAAVJSGlobalData@2@ABVUString@2@@Z
+    ?finishCreation@InternalFunction@JSC@@IAEXAAVJSGlobalData@2@ABVString@WTF@@@Z
     ?finishCreation@JSArray@JSC@@IAEXAAVJSGlobalData@2@I@Z
     ?finishCreation@RegExpObject@JSC@@IAEXPAVJSGlobalObject@2@@Z
     ?finishCreation@StringObject@JSC@@IAEXAAVJSGlobalData@2@PAVJSString@2@@Z
@@ -200,8 +199,7 @@ EXPORTS
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@H@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@I@Z
     ?functionGetter@PropertySlot@JSC@@ABE?AVJSValue@2@PAVExecState@2@@Z
-    ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
-    ?getCalculatedDisplayName@JSC@@YA?AVUString@1@PAVExecState@1@PAVJSObject@1@@Z
+    ?getCalculatedDisplayName@JSC@@YA?AVString@WTF@@PAVExecState@1@PAVJSObject@1@@Z
     ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z
     ?getCallableObjectSlow@JSC@@YAPAVJSCell@1@PAV21@@Z
     ?getConstructData@JSCell@JSC@@SA?AW4ConstructType@2@PAV12@AATConstructData@2@@Z
@@ -216,8 +214,8 @@ EXPORTS
     ?getPropertyNames@JSObject@JSC@@SAXPAV12@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z
     ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
     ?getStackTrace@Interpreter@JSC@@SAXPAVJSGlobalData@2@AAV?$Vector@UStackFrame@JSC@@$0A@@WTF@@@Z
-    ?getString@JSCell@JSC@@QBE?AVUString@2@PAVExecState@2@@Z
-    ?getString@JSCell@JSC@@QBE_NPAVExecState@2@AAVUString@2@@Z
+    ?getString@JSCell@JSC@@QBE?AVString@WTF@@PAVExecState@2@@Z
+    ?getString@JSCell@JSC@@QBE_NPAVExecState@2@AAVString@WTF@@@Z
     ?get@Structure@JSC@@QAEHAAVJSGlobalData@2@VPropertyName@2@AAIAAPAVJSCell@2@@Z
     ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?globalExec@JSGlobalObject@JSC@@QAEPAVExecState@2@XZ
@@ -236,7 +234,7 @@ EXPORTS
     ?initializeMainThread@WTF@@YAXXZ
     ?initializeThreading@JSC@@YAXXZ
     ?initializeThreading@WTF@@YAXXZ
-    ?interpret@Yarr@JSC@@YAIPAUBytecodePattern@12@ABVUString@2@IPAI@Z
+    ?interpret@Yarr@JSC@@YAIPAUBytecodePattern@12@ABVString@WTF@@IPAI@Z
     ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
     ?isBusy@Heap@JSC@@QAE_NXZ
     ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
@@ -246,31 +244,25 @@ EXPORTS
     ?isTerminatedExecutionException@JSC@@YA_NVJSValue@1@@Z
     ?isValidAllocation@Heap@JSC@@AAE_NI@Z
     ?isValidCallee@JSValue@JSC@@QAE_NXZ
-    ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
-    ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?length@CString@WTF@@QBEIXZ
     ?lock@JSLock@JSC@@QAEXXZ
     ?lock@Mutex@WTF@@QAEXXZ
     ?lockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
-    ?match@RegExp@JSC@@QAEHAAVJSGlobalData@2@ABVUString@2@IAAV?$Vector@H$0CA@@WTF@@@Z
+    ?match@RegExp@JSC@@QAEHAAVJSGlobalData@2@ABVString@WTF@@IAAV?$Vector@H$0CA@@5@@Z
     ?materializePropertyMap@Structure@JSC@@AAEXAAVJSGlobalData@2@@Z
     ?monotonicallyIncreasingTime@WTF@@YANXZ
     ?monthFromDayInYear@WTF@@YAHH_N@Z
     ?msToYear@WTF@@YAHN@Z
-    ?name@InternalFunction@JSC@@QAEABVUString@2@PAVExecState@2@@Z
-    ?name@JSFunction@JSC@@QAEABVUString@2@PAVExecState@2@@Z
+    ?name@JSFunction@JSC@@QAEABVString@WTF@@PAVExecState@2@@Z
     ?neuter@ArrayBufferView@WTF@@MAEXXZ
     ?newUninitialized@CString@WTF@@SA?AV12@IAAPAD@Z
     ?notifyWriteSlow@SymbolTableEntry@JSC@@AAEXXZ
     ?notifyWriteSlow@WatchpointSet@JSC@@QAEXXZ
     ?nullptr@@3Vnullptr_t@std@@A
-    ?number@String@WTF@@SA?AV12@NII@Z
-    ?number@UString@JSC@@SA?AV12@H@Z
-    ?number@UString@JSC@@SA?AV12@I@Z
-    ?number@UString@JSC@@SA?AV12@N@Z
     ?numberToFixedPrecisionString@WTF@@YAPBDNIQAD_N@Z
     ?numberToFixedWidthString@WTF@@YAPBDNIQAD@Z
     ?numberToString@WTF@@YAPBDNQAD@Z
+    ?objectAtScope@JSScope@JSC@@SAPAVJSObject@2@PAV12@@Z
     ?objectCount@Heap@JSC@@QAEIXZ
     ?objectProtoFuncToString@JSC@@YI_JPAVExecState@1@@Z
     ?objectTypeCounts@Heap@JSC@@QAE?AV?$PassOwnPtr@V?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@@WTF@@XZ
@@ -284,12 +276,12 @@ EXPORTS
     ?put@JSGlobalObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@VPropertyName@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?put@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@VPropertyName@2@VJSValue@2@AAVPutPropertySlot@2@@Z
     ?putByIndex@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@IVJSValue@2@_N@Z
-    ?putDirectIndexBeyondVectorLength@JSArray@JSC@@AAE_NPAVExecState@2@IVJSValue@2@_N@Z
+    ?putDirectIndexBeyondVectorLength@JSArray@JSC@@AAE_NPAVExecState@2@IVJSValue@2@W4PutDirectIndexMode@2@@Z
     ?putDirectVirtual@JSGlobalObject@JSC@@SAXPAVJSObject@2@PAVExecState@2@VPropertyName@2@VJSValue@2@I@Z
     ?putDirectVirtual@JSObject@JSC@@SAXPAV12@PAVExecState@2@VPropertyName@2@VJSValue@2@I@Z
     ?randomNumber@WTF@@YANXZ
     ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
-    ?regExpFlags@JSC@@YA?AW4RegExpFlags@1@ABVUString@1@@Z
+    ?regExpFlags@JSC@@YA?AW4RegExpFlags@1@ABVString@WTF@@@Z
     ?reifyString@StringBuilder@WTF@@ABEXXZ
     ?releaseDecommitted@OSAllocator@WTF@@SAXPAXI@Z
     ?releaseExecutableMemory@JSGlobalData@JSC@@QAEXXZ
@@ -306,7 +298,7 @@ EXPORTS
     ?resolveRope@JSRopeString@JSC@@ABEXPAVExecState@2@@Z
     ?restoreAll@Profile@JSC@@QAEXXZ
     ?retrieveCallerFromVMCode@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVJSFunction@2@@Z
-    ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
+    ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVString@WTF@@AAVJSValue@2@@Z
     ?setConfigurable@PropertyDescriptor@JSC@@QAEX_N@Z
     ?setDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@I@Z
     ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
@@ -333,11 +325,10 @@ EXPORTS
     ?slowValidateCell@JSC@@YAXPAVJSCell@1@@Z
     ?slowValidateCell@JSC@@YAXPAVJSGlobalObject@1@@Z
     ?sourceCode@JSFunction@JSC@@QBEPBVSourceCode@2@XZ
-    ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
+    ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVString@WTF@@@Z
     ?startSampling@JSGlobalData@JSC@@QAEXXZ
-    ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
+    ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVString@4@@Z
     ?stopSampling@JSGlobalData@JSC@@QAEXXZ
-    ?substringSharingImpl@UString@JSC@@QBE?AV12@II@Z
     ?suggestedNewOutOfLineStorageCapacity@Structure@JSC@@QAEIXZ
     ?sweeper@Heap@JSC@@QAEPAVIncrementalSweeper@2@XZ
     ?synthesizePrototype@JSValue@JSC@@QBEPAVJSObject@2@PAVExecState@2@@Z
@@ -346,7 +337,7 @@ EXPORTS
     ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@PAV21@@Z
     ?throwSyntaxError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
     ?throwTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?throwTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVUString@1@@Z
+    ?throwTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z
     ?timedWait@ThreadCondition@WTF@@QAE_NAAVMutex@2@N@Z
     ?tlsKeyCount@WTF@@YAAAJXZ
     ?tlsKeys@WTF@@YAPAKXZ
@@ -362,6 +353,7 @@ EXPORTS
     ?toStringSlowCase@JSValue@JSC@@ABEPAVJSString@2@PAVExecState@2@@Z
     ?toThisObject@JSObject@JSC@@SAPAV12@PAVJSCell@2@PAVExecState@2@@Z
     ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
+    ?toWTFStringSlowCase@JSValue@JSC@@ABE?AVString@WTF@@PAVExecState@2@@Z
     ?transfer@ArrayBuffer@WTF@@QAE_NAAVArrayBufferContents@2@AAV?$Vector@V?$RefPtr@VArrayBufferView@WTF@@@WTF@@$0A@@2@@Z
     ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z
     ?tryFastMalloc@WTF@@YA?AUTryMallocReturnValue@1@I@Z
@@ -373,7 +365,6 @@ EXPORTS
     ?unlock@Mutex@WTF@@QAEXXZ
     ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
     ?unprotect@Heap@JSC@@QAE_NVJSValue@2@@Z
-    ?utf8@UString@JSC@@QBE?AVCString@WTF@@_N@Z
     ?validate@MarkStack@JSC@@KAXPAVJSCell@2@@Z
     ?visitChildren@JSGlobalObject@JSC@@SAXPAVJSCell@2@AAVSlotVisitor@2@@Z
     ?visitChildren@JSGlobalThis@JSC@@KAXPAVJSCell@2@AAVSlotVisitor@2@@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 78c44feb5..a7f7cf9af 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1,2448 +1,2432 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCore"
-	ProjectGUID="{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
-	RootNamespace="JavaScriptCore"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreDebug.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreRelease.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_PGO|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreReleasePGO.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="2"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Cairo_CFLite|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreDebugCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_Cairo_CFLite|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreReleaseCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_All|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreDebugAll.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Production|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreProduction.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_PGO_Optimize|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets=".\JavaScriptCoreReleasePGOOptimize.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="4"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="runtime"
-			>
-			<File
-				RelativePath="..\..\runtime\ArgList.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ArgList.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Arguments.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Arguments.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ArrayConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ArrayConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ArrayPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ArrayPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BatchedTransitionOptimizer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BooleanConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BooleanConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BooleanObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BooleanObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BooleanPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\BooleanPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\CallData.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\CallData.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ClassInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\CommonIdentifiers.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\CommonIdentifiers.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\CommonSlowPaths.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Completion.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Completion.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ConstructData.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ConstructData.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateConversion.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateConversion.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateInstance.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateInstance.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DateInstanceCache.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DatePrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\DatePrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Error.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Error.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ErrorConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ErrorConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ErrorInstance.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ErrorInstance.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ErrorPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ErrorPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ExceptionHelpers.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\ExceptionHelpers.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Executable.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Executable.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\FunctionConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\FunctionConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\FunctionPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\FunctionPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\GCActivityCallback.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\GCActivityCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\GetterSetter.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\GetterSetter.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Identifier.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Identifier.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\InitializeThreading.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\InitializeThreading.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\InternalFunction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\InternalFunction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSActivation.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSActivation.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSArray.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSArray.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSBoundFunction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSBoundFunction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSCell.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSCell.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSDateMath.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSDateMath.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSFunction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSFunction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalData.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalData.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalObjectFunctions.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalObjectFunctions.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalThis.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSGlobalThis.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSLock.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSLock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSNotAnObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSNotAnObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSONObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSONObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSPropertyNameIterator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSPropertyNameIterator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSSegmentedVariableObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSSegmentedVariableObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSStaticScopeObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSStaticScopeObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSString.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSString.h"
-				>
-			</File>
-                        <File
-                                RelativePath="..\..\runtime\JSStringJoiner.cpp"
-                                >
-                        </File>
-                        <File
-                                RelativePath="..\..\runtime\JSStringJoiner.h"
-                                >
-                        </File>
-			<File
-				RelativePath="..\..\runtime\JSSymbolTableObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSSymbolTableObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSType.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSTypeInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSValue.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSValue.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSValueInlineMethods.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSVariableObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSVariableObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSWrapperObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSWrapperObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\LiteralParser.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\LiteralParser.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Lookup.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Lookup.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MathObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\MathObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NameConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NameConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NameInstance.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NameInstance.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NamePrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NamePrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NativeErrorConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NativeErrorConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NativeErrorPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NativeErrorPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumberConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumberConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumberObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumberObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumberPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumberPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\NumericStrings.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ObjectConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ObjectConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ObjectPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ObjectPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Operations.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Operations.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Options.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Options.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertyDescriptor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertyDescriptor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertyMapHashTable.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertyNameArray.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertyNameArray.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertyOffset.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertySlot.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\PropertySlot.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Protect.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExp.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExp.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpCache.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpCache.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpCachedResult.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpCachedResult.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpKey.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpMatchesArray.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpMatchesArray.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\RegExpPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\SamplingCounter.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\SamplingCounter.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ScopeChain.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ScopeChain.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\ScopeChainMark.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\SmallStrings.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\SmallStrings.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StrictEvalActivation.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StrictEvalActivation.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringPrototype.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringPrototype.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringRecursionChecker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StringRecursionChecker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Structure.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Structure.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StructureChain.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StructureChain.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\StructureTransitionTable.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\SymbolTable.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\SymbolTable.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\Terminator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\TimeoutChecker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\TimeoutChecker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\UString.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\UString.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\UStringBuilder.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\UStringConcatenate.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\UStringImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\WeakGCMap.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\WeakRandom.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="API"
-			>
-			<File
-				RelativePath="..\..\API\APICast.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JavaScript.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JavaScriptCore.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSAPIValueWrapper.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\runtime\JSAPIValueWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSBase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSBase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSBasePrivate.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackConstructor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackConstructor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackFunction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackFunction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackObject.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackObject.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSCallbackObjectFunctions.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSClassRef.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSClassRef.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSContextRef.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSContextRef.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSContextRefPrivate.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSObjectRef.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSObjectRef.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSRetainPtr.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSStringRef.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSStringRef.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSStringRefBSTR.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSStringRefBSTR.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSStringRefCF.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSStringRefCF.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSValueRef.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSValueRef.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSWeakObjectMapRefInternal.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSWeakObjectMapRefPrivate.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\JSWeakObjectMapRefPrivate.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\OpaqueJSString.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\OpaqueJSString.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\API\WebKitAvailability.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="profiler"
-			>
-			<File
-				RelativePath="..\..\profiler\CallIdentifier.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\Profile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\Profile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\ProfileGenerator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\ProfileGenerator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\ProfileNode.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\ProfileNode.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\Profiler.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\profiler\Profiler.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="tools"
-			>
-			<File
-				RelativePath="..\..\tools\CodeProfile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\tools\CodeProfile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\tools\CodeProfiling.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\tools\CodeProfiling.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\tools\ProfileTreeNode.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\tools\TieredMMapArray.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="bytecode"
-			>
-			<File
-				RelativePath="..\..\bytecode\ArrayProfile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\ArrayProfile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CallLinkInfo.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CallLinkInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CallLinkStatus.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CallLinkStatus.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CallReturnOffsetToBytecodeOffset.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CodeBlock.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CodeBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CodeOrigin.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\CodeType.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\Comment.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\EvalCodeCache.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\ExecutionCounter.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\ExpressionRangeInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\GetByIdStatus.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\GetByIdStatus.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\GlobalResolveInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\HandlerInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\Instruction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\JumpTable.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\JumpTable.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\LazyOperandValueProfile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\LazyOperandValueProfile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\LineInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\MethodCallLinkInfo.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\MethodCallLinkInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\MethodCallLinkStatus.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\MethodCallLinkStatus.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\Opcode.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\Opcode.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\PolymorphicPutByIdList.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\SpeculatedType.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\SpeculatedType.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\PutByIdStatus.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\PutByIdStatus.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\SamplingTool.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\SamplingTool.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\StructureStubClearingWatchpoint.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\StructureStubClearingWatchpoint.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\StructureStubInfo.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\StructureStubInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\ValueProfile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\Watchpoint.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecode\Watchpoint.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="debugger"
-			>
-			<File
-				RelativePath="..\..\debugger\Debugger.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\debugger\Debugger.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\debugger\DebuggerActivation.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\debugger\DebuggerActivation.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\debugger\DebuggerCallFrame.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\debugger\DebuggerCallFrame.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="assembler"
-			>
-			<File
-				RelativePath="..\..\assembler\AbstractMacroAssembler.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\AssemblerBuffer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\CodeLocation.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\LinkBuffer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\LinkBuffer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\MacroAssembler.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\MacroAssemblerX86.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\MacroAssemblerX86Common.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\RepatchBuffer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\assembler\X86Assembler.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="dfg"
-			>
-			<File
-				RelativePath="..\..\dfg\DFGDriver.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\dfg\DFGIntrinsic.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\dfg\DFGOSREntry.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="yarr"
-			>
-			<File
-				RelativePath="..\..\yarr\Yarr.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrCanonicalizeUCS2.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrCanonicalizeUCS2.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrInterpreter.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrInterpreter.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrJIT.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrJIT.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrParser.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrPattern.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrPattern.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrSyntaxChecker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\yarr\YarrSyntaxChecker.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="jit"
-			>
-			<File
-				RelativePath="..\..\jit\ExecutableAllocator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\ExecutableAllocator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\HostCallReturnValue.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\GCAwareJITStubRoutine.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\GCAwareJITStubRoutine.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JIT.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JIT.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITArithmetic.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITArithmetic32_64.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITCall.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITCall32_64.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITCode.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITExceptions.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITExceptions.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITInlineMethods.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITOpcodes.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITOpcodes32_64.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITPropertyAccess.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITPropertyAccess32_64.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITStubCall.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITStubRoutine.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITStubRoutine.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITStubs.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JITStubs.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JumpReplacementWatchpoint.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JumpReplacementWatchpoint.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\JSInterfaceJIT.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\SpecializedThunkJIT.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\ThunkGenerators.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\jit\ThunkGenerators.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="llint"
-			>
-			<File
-				RelativePath="..\..\llint\LLIntData.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="disassembler"
-			>
-			<File
-				RelativePath="..\..\disassembler\Disassembler.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="interpreter"
-			>
-			<File
-				RelativePath="..\..\interpreter\AbstractPC.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\AbstractPC.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\CachedCall.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\CallFrame.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\CallFrame.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\CallFrameClosure.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\Interpreter.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\Interpreter.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\Register.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\RegisterFile.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\RegisterFile.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\VMInspector.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\interpreter\VMInspector.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="bytecompiler"
-			>
-			<File
-				RelativePath="..\..\bytecompiler\BytecodeGenerator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecompiler\BytecodeGenerator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecompiler\Label.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecompiler\LabelScope.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecompiler\NodesCodegen.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\bytecompiler\RegisterID.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="parser"
-			>
-			<File
-				RelativePath="..\..\parser\ASTBuilder.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\Lexer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\Lexer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\NodeConstructors.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\NodeInfo.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\Nodes.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\Nodes.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\Parser.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\Parser.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\ParserArena.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\ParserArena.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\ResultType.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\SourceCode.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\SourceProvider.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\SourceProviderCache.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\SourceProviderCache.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\SourceProviderCacheItem.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\parser\SyntaxChecker.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Derived Sources"
-			>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\ArrayPrototype.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\DatePrototype.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\lexer.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\MathObject.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\NamePrototype.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\NumberConstructor.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\RegExpConstructor.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\RegExpObject.lut.h"
-				>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\StringPrototype.lut.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="heap"
-			>
-			<File
-				RelativePath="..\..\heap\ConservativeRoots.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\ConservativeRoots.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\CopiedAllocator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\CopiedBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\CopiedSpace.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\CopiedSpace.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\CopiedSpaceInlineMethods.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\DFGCodeBlocks.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\DFGCodeBlocks.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\GCAssertions.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\Handle.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HandleSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HandleSet.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HeapTimer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HeapTimer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\JITStubRoutineSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\JITStubRoutineSet.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\IncrementalSweeper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\IncrementalSweeper.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakBlock.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakSet.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakSetInlines.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakHandleOwner.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WeakHandleOwner.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HandleStack.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HandleStack.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\BlockAllocator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\BlockAllocator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\GCThreadSharedData.cpp"
-				>
-			</File>
-			<File
-    			RelativePath="..\..\heap\GCThreadSharedData.h"
-    			>
-			</File>
-			<File
-				RelativePath="..\..\heap\Heap.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\Heap.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HeapBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\HeapRootVisitor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\Local.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\LocalScope.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MachineStackMarker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MachineStackMarker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkedAllocator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkedAllocator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkedBlock.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkedBlock.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkedSpace.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkedSpace.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkStack.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkStack.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\MarkStackInlineMethods.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\Strong.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\StrongInlines.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\VTableSpectrum.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\VTableSpectrum.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\Weak.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WriteBarrierSupport.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\..\heap\WriteBarrierSupport.h"
-				>
-			</File>
-		</Filter>
-		<File
-			RelativePath="..\..\config.h"
-			>
-		</File>
-		<File
-			RelativePath=".\JavaScriptCore.def"
-			>
-		</File>
-		<File
-			RelativePath=".\JavaScriptCore_debug.def"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCore"

+	ProjectGUID="{011D10F1-B656-4A1B-A0C3-3842F02122C5}"

+	RootNamespace="JavaScriptCore"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreDebug.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreRelease.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_PGO|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreReleasePGO.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="2"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Cairo_CFLite|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreDebugCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_Cairo_CFLite|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreReleaseCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreDebugAll.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Production|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreProduction.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_PGO_Optimize|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets=".\JavaScriptCoreReleasePGOOptimize.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="4"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<Filter

+			Name="runtime"

+			>

+			<File

+				RelativePath="..\..\runtime\ArgList.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ArgList.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Arguments.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Arguments.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ArrayConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ArrayConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ArrayPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ArrayPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BatchedTransitionOptimizer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BooleanConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BooleanConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BooleanObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BooleanObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BooleanPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\BooleanPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\CallData.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\CallData.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ClassInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\CommonIdentifiers.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\CommonIdentifiers.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\CommonSlowPaths.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Completion.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Completion.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ConstructData.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ConstructData.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateConversion.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateConversion.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateInstance.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateInstance.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DateInstanceCache.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DatePrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\DatePrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Error.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Error.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ErrorConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ErrorConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ErrorInstance.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ErrorInstance.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ErrorPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ErrorPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ExceptionHelpers.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\ExceptionHelpers.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Executable.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Executable.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\FunctionConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\FunctionConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\FunctionPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\FunctionPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\GCActivityCallback.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\GCActivityCallback.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\GetterSetter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\GetterSetter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Identifier.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Identifier.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\InitializeThreading.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\InitializeThreading.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\InternalFunction.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\InternalFunction.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSActivation.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSActivation.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSArray.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSArray.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSBoundFunction.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSBoundFunction.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSCell.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSCell.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSDateMath.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSDateMath.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSFunction.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSFunction.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalData.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalData.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalObjectFunctions.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalObjectFunctions.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalThis.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSGlobalThis.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSLock.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSLock.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSNotAnObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSNotAnObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSONObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSONObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSPropertyNameIterator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSPropertyNameIterator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSSegmentedVariableObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSSegmentedVariableObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSWithScope.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSWithScope.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSNameScope.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSNameScope.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSScope.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSScope.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSString.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSString.h"

+				>

+			</File>

+                        <File

+                                RelativePath="..\..\runtime\JSStringJoiner.cpp"

+                                >

+                        </File>

+                        <File

+                                RelativePath="..\..\runtime\JSStringJoiner.h"

+                                >

+                        </File>

+			<File

+				RelativePath="..\..\runtime\JSSymbolTableObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSSymbolTableObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSType.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSTypeInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSValue.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSValue.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSValueInlineMethods.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSVariableObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSVariableObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSWrapperObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSWrapperObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\LiteralParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\LiteralParser.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Lookup.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Lookup.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\MathObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\MathObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NameConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NameConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NameInstance.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NameInstance.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NamePrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NamePrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NativeErrorConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NativeErrorConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NativeErrorPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NativeErrorPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumberConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumberConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumberObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumberObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumberPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumberPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\NumericStrings.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ObjectConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ObjectConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ObjectPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\ObjectPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Operations.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Operations.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Options.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Options.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyDescriptor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyDescriptor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyMapHashTable.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyNameArray.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyNameArray.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertyOffset.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertySlot.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\PropertySlot.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Protect.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExp.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExp.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpCache.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpCache.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpCachedResult.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpCachedResult.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpKey.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpMatchesArray.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpMatchesArray.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\RegExpPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\SamplingCounter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\SamplingCounter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\SmallStrings.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\SmallStrings.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StrictEvalActivation.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StrictEvalActivation.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringPrototype.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringPrototype.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringRecursionChecker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StringRecursionChecker.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Structure.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Structure.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StructureChain.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StructureChain.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StructureTransitionTable.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\SymbolTable.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\SymbolTable.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\Terminator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\TimeoutChecker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\TimeoutChecker.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\WeakGCMap.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\WeakRandom.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="API"

+			>

+			<File

+				RelativePath="..\..\API\APICast.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JavaScript.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JavaScriptCore.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSAPIValueWrapper.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\JSAPIValueWrapper.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSBase.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSBase.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSBasePrivate.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackConstructor.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackConstructor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackFunction.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackFunction.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackObject.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackObject.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSCallbackObjectFunctions.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSClassRef.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSClassRef.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSContextRef.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSContextRef.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSContextRefPrivate.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSObjectRef.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSObjectRef.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSRetainPtr.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSStringRef.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSStringRef.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSStringRefBSTR.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSStringRefBSTR.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSStringRefCF.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSStringRefCF.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSValueRef.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSValueRef.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSWeakObjectMapRefInternal.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSWeakObjectMapRefPrivate.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\JSWeakObjectMapRefPrivate.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\OpaqueJSString.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\OpaqueJSString.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\API\WebKitAvailability.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="profiler"

+			>

+			<File

+				RelativePath="..\..\profiler\CallIdentifier.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\Profile.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\Profile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\ProfileGenerator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\ProfileGenerator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\ProfileNode.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\ProfileNode.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\Profiler.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\profiler\Profiler.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="tools"

+			>

+			<File

+				RelativePath="..\..\tools\CodeProfile.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\tools\CodeProfile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\tools\CodeProfiling.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\tools\CodeProfiling.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\tools\ProfileTreeNode.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\tools\TieredMMapArray.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="bytecode"

+			>

+			<File

+				RelativePath="..\..\bytecode\ArrayProfile.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\ArrayProfile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CallLinkInfo.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CallLinkInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CallLinkStatus.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CallLinkStatus.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CallReturnOffsetToBytecodeOffset.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CodeBlock.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CodeBlock.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CodeOrigin.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\CodeType.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\Comment.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\EvalCodeCache.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\ExecutionCounter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\ExpressionRangeInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\GetByIdStatus.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\GetByIdStatus.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\GlobalResolveInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\HandlerInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\Instruction.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\JumpTable.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\JumpTable.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\LazyOperandValueProfile.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\LazyOperandValueProfile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\LineInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\MethodCallLinkInfo.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\MethodCallLinkInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\MethodCallLinkStatus.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\MethodCallLinkStatus.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\MethodOfGettingAValueProfile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\Opcode.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\Opcode.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\PolymorphicPutByIdList.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\SpeculatedType.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\SpeculatedType.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\PutByIdStatus.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\PutByIdStatus.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\SamplingTool.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\SamplingTool.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\StructureStubClearingWatchpoint.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\StructureStubClearingWatchpoint.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\StructureStubInfo.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\StructureStubInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\ValueProfile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\Watchpoint.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecode\Watchpoint.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="debugger"

+			>

+			<File

+				RelativePath="..\..\debugger\Debugger.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\debugger\Debugger.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\debugger\DebuggerActivation.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\debugger\DebuggerActivation.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\debugger\DebuggerCallFrame.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\debugger\DebuggerCallFrame.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="assembler"

+			>

+			<File

+				RelativePath="..\..\assembler\AbstractMacroAssembler.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\AssemblerBuffer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\CodeLocation.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\LinkBuffer.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\LinkBuffer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\MacroAssembler.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\MacroAssemblerX86.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\MacroAssemblerX86Common.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\RepatchBuffer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\assembler\X86Assembler.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="dfg"

+			>

+			<File

+				RelativePath="..\..\dfg\DFGDriver.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\dfg\DFGIntrinsic.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\dfg\DFGOSREntry.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="yarr"

+			>

+			<File

+				RelativePath="..\..\yarr\Yarr.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrCanonicalizeUCS2.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrCanonicalizeUCS2.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrInterpreter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrInterpreter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrJIT.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrJIT.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrParser.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrPattern.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrPattern.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrSyntaxChecker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\yarr\YarrSyntaxChecker.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="jit"

+			>

+			<File

+				RelativePath="..\..\jit\ExecutableAllocator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\ExecutableAllocator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\HostCallReturnValue.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\GCAwareJITStubRoutine.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\GCAwareJITStubRoutine.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JIT.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JIT.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITArithmetic.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITArithmetic32_64.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITCall.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITCall32_64.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITCode.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITExceptions.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITExceptions.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITInlineMethods.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITOpcodes.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITOpcodes32_64.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITPropertyAccess.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITPropertyAccess32_64.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITStubCall.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITStubRoutine.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITStubRoutine.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITStubs.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JITStubs.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JumpReplacementWatchpoint.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JumpReplacementWatchpoint.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\JSInterfaceJIT.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\SpecializedThunkJIT.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\ThunkGenerators.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\jit\ThunkGenerators.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="llint"

+			>

+			<File

+				RelativePath="..\..\llint\LLIntData.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="disassembler"

+			>

+			<File

+				RelativePath="..\..\disassembler\Disassembler.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="interpreter"

+			>

+			<File

+				RelativePath="..\..\interpreter\AbstractPC.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\AbstractPC.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\CachedCall.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\CallFrame.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\CallFrame.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\CallFrameClosure.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\Interpreter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\Interpreter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\Register.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\RegisterFile.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\RegisterFile.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\VMInspector.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\interpreter\VMInspector.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="bytecompiler"

+			>

+			<File

+				RelativePath="..\..\bytecompiler\BytecodeGenerator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecompiler\BytecodeGenerator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecompiler\Label.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecompiler\LabelScope.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecompiler\NodesCodegen.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\bytecompiler\RegisterID.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="parser"

+			>

+			<File

+				RelativePath="..\..\parser\ASTBuilder.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\Lexer.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\Lexer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\NodeConstructors.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\NodeInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\Nodes.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\Nodes.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\Parser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\Parser.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\ParserArena.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\ParserArena.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\ResultType.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\SourceCode.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\SourceProvider.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\SourceProviderCache.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\SourceProviderCache.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\SourceProviderCacheItem.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\parser\SyntaxChecker.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Derived Sources"

+			>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\ArrayPrototype.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\DatePrototype.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\lexer.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\MathObject.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\NamePrototype.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\NumberConstructor.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\RegExpConstructor.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\RegExpObject.lut.h"

+				>

+			</File>

+			<File

+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\StringPrototype.lut.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="heap"

+			>

+			<File

+				RelativePath="..\..\heap\ConservativeRoots.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\ConservativeRoots.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\CopiedAllocator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\CopiedBlock.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\CopiedSpace.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\CopiedSpace.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\CopiedSpaceInlineMethods.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\DFGCodeBlocks.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\DFGCodeBlocks.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\GCAssertions.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\Handle.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HandleSet.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HandleSet.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HeapTimer.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HeapTimer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\JITStubRoutineSet.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\JITStubRoutineSet.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\IncrementalSweeper.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\IncrementalSweeper.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakBlock.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakBlock.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakSet.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakSet.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakSetInlines.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakImpl.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakHandleOwner.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WeakHandleOwner.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HandleStack.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HandleStack.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\BlockAllocator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\BlockAllocator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\GCThreadSharedData.cpp"

+				>

+			</File>

+			<File

+    			RelativePath="..\..\heap\GCThreadSharedData.h"

+    			>

+			</File>

+			<File

+				RelativePath="..\..\heap\Heap.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\Heap.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HeapBlock.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\HeapRootVisitor.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\Local.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\LocalScope.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MachineStackMarker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MachineStackMarker.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkedAllocator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkedAllocator.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkedBlock.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkedBlock.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkedSpace.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkedSpace.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkStack.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkStack.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\MarkStackInlineMethods.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\Strong.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\StrongInlines.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\VTableSpectrum.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\VTableSpectrum.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\Weak.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WriteBarrierSupport.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\heap\WriteBarrierSupport.h"

+				>

+			</File>

+		</Filter>

+		<File

+			RelativePath="..\..\config.h"

+			>

+		</File>

+		<File

+			RelativePath=".\JavaScriptCore.def"

+			>

+		</File>

+		<File

+			RelativePath=".\JavaScriptCore_debug.def"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops
index 61e10b433..fe884aa43 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops
@@ -1,11 +1,11 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreCF"
-	>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="CoreFoundation$(LibraryConfigSuffix).lib"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCF"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="CoreFoundation$(LibraryConfigSuffix).lib"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
index 1e7aed7fc..8c9e31f47 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops
@@ -1,11 +1,11 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreCFLite"
-	>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="CFLite$(WebKitConfigSuffix).lib"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCFLite"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="CFLite$(WebKitConfigSuffix).lib"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index 7d2461d11..236dd7b0e 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -1,20 +1,20 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreCommon"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../disassembler;../../jit/;../../llint/;../../runtime/;../../tools/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
-		PreprocessorDefinitions="STATICALLY_LINKED_WITH_WTF;__STD_C"
-		ForcedIncludeFiles="ICUVersion.h"
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="gdi32.lib oleaut32.lib winmm.lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib WTF$(WebKitConfigSuffix).lib"
-		OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"
-		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"
-		ModuleDefinitionFile="JavaScriptCore.def"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../disassembler;../../jit/;../../llint/;../../runtime/;../../tools/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"

+		PreprocessorDefinitions="STATICALLY_LINKED_WITH_WTF;__STD_C"

+		ForcedIncludeFiles="ICUVersion.h"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="gdi32.lib oleaut32.lib winmm.lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib WTF$(WebKitConfigSuffix).lib"

+		OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

+		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"

+		ModuleDefinitionFile="JavaScriptCore.def"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
index 45cca2e41..6de574be5 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebug.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreDebug"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreDebug"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
index 395f86a5b..90223be1a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugAll.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreDebugAll"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreDebugAll"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
index bba6bd2b4..4238d1572 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreDebugCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreDebugCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreDebugCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index 9ab7648e3..394f2b8aa 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -1,104 +1,104 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGenerated"
-	ProjectGUID="{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
-	RootNamespace="JavaScriptCoreGenerated"
-	Keyword="MakeFileProj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebug.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_All|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugAll.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedRelease.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Production|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedProduction.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_Cairo_CFLite|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Cairo_CFLite|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugCairoCFLite.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_PGO|Win32"
-			ConfigurationType="0"
-			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleasePGO.vsprops"
-			>
-			<Tool
-				Name="VCNMakeTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath=".\build-generated-files.sh"
-			>
-		</File>
-		<File
-			RelativePath=".\copy-files.cmd"
-			>
-		</File>
-		<File
-			RelativePath="..\..\DerivedSources.make"
-			>
-		</File>
-		<File
-			RelativePath=".\JavaScriptCoreGenerated.make"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGenerated"

+	ProjectGUID="{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"

+	RootNamespace="JavaScriptCoreGenerated"

+	Keyword="MakeFileProj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebug.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugAll.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedRelease.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Production|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedProduction.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_Cairo_CFLite|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Cairo_CFLite|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedDebugCairoCFLite.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_PGO|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets=".\JavaScriptCoreGeneratedReleasePGO.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath=".\build-generated-files.sh"

+			>

+		</File>

+		<File

+			RelativePath=".\copy-files.cmd"

+			>

+		</File>

+		<File

+			RelativePath="..\..\DerivedSources.make"

+			>

+		</File>

+		<File

+			RelativePath=".\JavaScriptCoreGenerated.make"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
index 1b718df2b..eb747a0ca 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedCommon.vsprops
@@ -1,14 +1,14 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedCommon"
-	OutputDirectory="$(ConfigurationBuildDir)\lib"
-	>
-	<Tool
-		Name="VCNMakeTool"
-		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"
-		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"
-		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedCommon"

+	OutputDirectory="$(ConfigurationBuildDir)\lib"

+	>

+	<Tool

+		Name="VCNMakeTool"

+		BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make"

+		ReBuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean&#x0D;&#x0A;nmake -f JavaScriptCoreGenerated.make"

+		CleanCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;set CONFIGURATIONBUILDDIR=$(WebKitOutputDir)\$(ConfigurationName)&#x0D;&#x0A;set PRODUCTION=$(PRODUCTION)&#x0D;&#x0A;nmake /nologo -f JavaScriptCoreGenerated.make clean"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
index 1321f5d5a..5bee6ea49 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebug.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedDebug"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedDebug"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
index 215790925..61e5c297b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugAll.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedDebugAll"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedDebugAll"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
index 13faa2199..5bd330bd8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedDebugCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedDebugCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedDebugCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
index 2b92efd2b..6fbc585d6 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedProduction.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedProduction"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedProduction"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
index 6b6436e25..5e9c39950 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedRelease.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedRelease"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
index e9e2cc96a..d0f5b47e3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleaseCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedReleaseCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedReleaseCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
index 1f6207a10..649ec1fb8 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGeneratedReleasePGO.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreGeneratedReleasePGO"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreGeneratedReleasePGO"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreGeneratedCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops
index 48173b03f..647b3ac18 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCorePGOOptimize.vsprops
@@ -1,15 +1,15 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCorePGOOptimize"
-	>
-  <Tool
-		Name="VCLinkerTool"
-		ImportLibrary="$(WebKitOutputDir)\Release_PGO\lib\$(TargetName).lib"
-	/>
-  <UserMacro
-    Name="ConfigurationBuildDir"
-    Value="$(WebKitOutputDir)\Release_PGO"
-  />
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCorePGOOptimize"

+	>

+  <Tool

+		Name="VCLinkerTool"

+		ImportLibrary="$(WebKitOutputDir)\Release_PGO\lib\$(TargetName).lib"

+	/>

+  <UserMacro

+    Name="ConfigurationBuildDir"

+    Value="$(WebKitOutputDir)\Release_PGO"

+  />

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
index 0f66ead58..0822117f5 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreProduction.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreProduction"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreProduction"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
index 2b5495793..614c7a0d9 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreRelease.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreRelease"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
index 9a00723fe..05f1b77c9 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleaseCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreReleaseCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreReleaseCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCFLite.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
index 79eca08ea..c17193942 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGO.vsprops
@@ -1,16 +1,16 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreReleasePGO"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"
-	>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalLibraryDirectories="&quot;$(ConfigurationBuildDir)\..\Production\lib&quot;"
-	/>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\..\Production\include\private&quot;"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreReleasePGO"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalLibraryDirectories="&quot;$(ConfigurationBuildDir)\..\Production\lib&quot;"

+	/>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\..\Production\include\private&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
index e8faef70b..0c7c2d3c7 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreReleasePGOOptimize.vsprops
@@ -1,12 +1,12 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreReleasePGOOptimize"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;.\JavaScriptCorePGOOptimize.vsprops"
-	>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalLibraryDirectories="&quot;$(ConfigurationBuildDir)\..\Production\lib&quot;"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreReleasePGOOptimize"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;.\JavaScriptCorePGOOptimize.vsprops"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalLibraryDirectories="&quot;$(ConfigurationBuildDir)\..\Production\lib&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
index f2ccebe6f..a706a9c51 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
@@ -1,80 +1,80 @@
-
-Microsoft Visual Studio Solution File, Format Version 9.00
-# Visual Studio 2005
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"
-	ProjectSection(ProjectDependencies) = postProject
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}
-	EndProjectSection
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"
-EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"
-	ProjectSection(ProjectDependencies) = postProject
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}
-	EndProjectSection
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug_All|Win32 = Debug_All|Win32
-		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32
-		Debug|Win32 = Debug|Win32
-		Production|Win32 = Production|Win32
-		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32
-		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32
-		Release_PGO|Win32 = Release_PGO|Win32
-		Release|Win32 = Release|Win32
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32
-		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32
-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.Build.0 = Release_PGO|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32
-		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
+

+Microsoft Visual Studio Solution File, Format Version 9.00

+# Visual Studio 2005

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCore", "JavaScriptCore\JavaScriptCore.vcproj", "{011D10F1-B656-4A1B-A0C3-3842F02122C5}"

+	ProjectSection(ProjectDependencies) = postProject

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A} = {4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C59E5129-B453-49B7-A52B-1E104715F76E}"

+	ProjectSection(ProjectDependencies) = postProject

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}

+	EndProjectSection

+EndProject

+Global

+	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

+		Debug_Cairo_CFLite|Win32 = Debug_Cairo_CFLite|Win32

+		Debug|Win32 = Debug|Win32

+		Production|Win32 = Production|Win32

+		Release_Cairo_CFLite|Win32 = Release_Cairo_CFLite|Win32

+		Release_PGO_Optimize|Win32 = Release_PGO_Optimize|Win32

+		Release_PGO|Win32 = Release_PGO|Win32

+		Release|Win32 = Release|Win32

+	EndGlobalSection

+	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.Build.0 = Debug|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.ActiveCfg = Production|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Production|Win32.Build.0 = Production|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO_Optimize|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO_Optimize|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Debug|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Debug|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.ActiveCfg = Production|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Production|Win32.Build.0 = Production|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.ActiveCfg = Debug_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo_CFLite|Win32.Build.0 = Debug_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.Build.0 = Debug|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.ActiveCfg = Production|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Production|Win32.Build.0 = Production|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.ActiveCfg = Release_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo_CFLite|Win32.Build.0 = Release_Cairo_CFLite|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.ActiveCfg = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO_Optimize|Win32.Build.0 = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.ActiveCfg = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGO|Win32.Build.0 = Release_PGO|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

+	EndGlobalSection

+	GlobalSection(SolutionProperties) = preSolution

+		HideSolutionNode = FALSE

+	EndGlobalSection

+EndGlobal

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index 9e04fee9c..5997d9f93 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -1,473 +1,473 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jsc"
-	ProjectGUID="{C59E5129-B453-49B7-A52B-1E104715F76E}"
-	RootNamespace="jsc"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscDebug.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscRelease.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Cairo_CFLite|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscDebugCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_All|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscDebugAll.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Production|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscProduction.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_Cairo_CFLite|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscReleaseCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_PGO|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\jscReleasePGO.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\AtomicString.cpp"
-			>
-		</File>
-		<File
-			RelativePath="..\..\jsc.cpp"
-			>
-		</File>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringBuilder.cpp"
-			>
-		</File>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringImpl.cpp"
-			>
-		</File>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\WTFString.cpp"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jsc"

+	ProjectGUID="{C59E5129-B453-49B7-A52B-1E104715F76E}"

+	RootNamespace="jsc"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscDebug.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscRelease.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Cairo_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscDebugCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscDebugAll.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Production|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscProduction.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_Cairo_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscReleaseCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_PGO|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\jscReleasePGO.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\AtomicString.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\..\jsc.cpp"

+			>

+		</File>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringBuilder.cpp"

+			>

+		</File>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringImpl.cpp"

+			>

+		</File>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\WTFString.cpp"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
index 4e3767ff6..9bb7fe93a 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscCommon.vsprops
@@ -1,20 +1,20 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscCommon"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../heap/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
-		PreprocessorDefinitions="__STD_C"
-		ForcedIncludeFiles="ICUVersion.h"
-		ForcedUsingFiles=""
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"
-		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"
-		SubSystem="1"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../heap/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"

+		PreprocessorDefinitions="__STD_C"

+		ForcedIncludeFiles="ICUVersion.h"

+		ForcedUsingFiles=""

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

+		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"

+		SubSystem="1"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
index 56e25689d..f2765fba4 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebug.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscDebug"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscDebug"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
index b9a471eee..4a2727d0d 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugAll.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscDebugAll"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscDebugAll"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\jscCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
index 1469263fa..5f0db2314 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscDebugCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscDebugCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\jscCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscDebugCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\jscCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
index 4fab85769..f450e5520 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscProduction.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscProduction"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\jscCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscProduction"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\jscCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
index 4de5720a2..b3dbed9a6 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscRelease.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscRelease"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\jscCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
index daf8b396b..29b0e5527 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleaseCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscReleaseCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\jscCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscReleaseCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\jscCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
index 0e4fb8459..800a821bb 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/jsc/jscReleasePGO.vsprops
@@ -1,12 +1,12 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="jscReleasePGO"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\jscCommon.vsprops"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\..\Production\include\private&quot;;&quot;$(ConfigurationBuildDir)\..\Production\include\private\wtf\text&quot;"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="jscReleasePGO"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\jscCommon.vsprops"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\..\Production\include\private&quot;;&quot;$(ConfigurationBuildDir)\..\Production\include\private\wtf\text&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj
index 57b9ce643..9362d775a 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj
@@ -1,480 +1,480 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExp"
-	ProjectGUID="{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}"
-	RootNamespace="testRegExp"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpDebug.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpRelease.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Cairo_CFLite|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpDebugCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_All|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpDebugAll.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Production|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpProduction.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_Cairo_CFLite|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpReleaseCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_PGO|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testRegExpReleasePGO.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalOptions="/SAFESEH"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\AtomicString.cpp"
-			>
-		</File>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringBuilder.cpp"
-			>
-		</File>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringImpl.cpp"
-			>
-		</File>
-		<File
-			RelativePath="..\..\testRegExp.cpp"
-			>
-		</File>
-		<File
-			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\WTFString.cpp"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExp"

+	ProjectGUID="{14C94979-1ED3-4E1D-9B55-A80FCF4677D0}"

+	RootNamespace="testRegExp"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpDebug.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpRelease.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Cairo_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpDebugCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpDebugAll.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Production|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpProduction.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_Cairo_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpReleaseCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_PGO|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testRegExpReleasePGO.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/SAFESEH"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\AtomicString.cpp"

+			>

+		</File>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringBuilder.cpp"

+			>

+		</File>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\StringImpl.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\..\testRegExp.cpp"

+			>

+		</File>

+		<File

+			RelativePath="$(ConfigurationBuildDir)\include\private\wtf\text\WTFString.cpp"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops
index 0c39edec8..2e8edfb49 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops
@@ -1,20 +1,20 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpCommon"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../heap/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"
-		PreprocessorDefinitions="__STD_C"
-		ForcedIncludeFiles="ICUVersion.h"
-		ForcedUsingFiles=""
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"
-		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"
-		SubSystem="1"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;&quot;../../os-win32/&quot;;../../assembler/;../../API/;../../parser/;../../heap/;../../runtime/;../../VM/;../../bytecode/;../../interpreter/;../../wtf/;../../debugger/;../../bytecompiler/;../../profiler;../../jit/;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"

+		PreprocessorDefinitions="__STD_C"

+		ForcedIncludeFiles="ICUVersion.h"

+		ForcedUsingFiles=""

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib user32.lib"

+		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"

+		SubSystem="1"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops
index ba8f94274..e71f2e7ce 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpDebug"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testRegExpCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpDebug"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testRegExpCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops
index a06969e13..5590713ea 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpDebugAll"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testRegExpCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpDebugAll"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testRegExpCommon.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops
index 930d1f515..fddb47257 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpDebugCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\testRegExpCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpDebugCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\testRegExpCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops
index 84e184c14..d6d7a9fd2 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpProduction"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\testRegExpCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpProduction"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\testRegExpCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops
index aa2e8841b..d34a44e4c 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testRegExpCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpRelease"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testRegExpCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops
index 6e07117f5..2f0199486 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpReleaseCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\testRegExpCommon.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpReleaseCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\testRegExpCommon.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops
index 079224b2b..771999f24 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops
@@ -1,12 +1,12 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testRegExpReleasePGO"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\testRegExpCommon.vsprops"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\..\Production\include\private&quot;;&quot;$(ConfigurationBuildDir)\..\Production\include\private\wtf\text&quot;"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testRegExpReleasePGO"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\testRegExpCommon.vsprops"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\..\Production\include\private&quot;;&quot;$(ConfigurationBuildDir)\..\Production\include\private\wtf\text&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
index 1dfdd1e88..de9518e16 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
@@ -1,448 +1,448 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapi"
-	ProjectGUID="{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}"
-	RootNamespace="testapi"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testapiDebug.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testapiRelease.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Cairo_CFLite|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testapiDebugCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release_Cairo_CFLite|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testapiReleaseCairoCFLite.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_All|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testapiDebugAll.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Production|Win32"
-			ConfigurationType="1"
-			InheritedPropertySheets=".\testapiProduction.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath="..\..\API\tests\testapi.c"
-			>
-			<FileConfiguration
-				Name="Debug|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					CompileAs="2"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Release|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					CompileAs="2"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Debug_Cairo_CFLite|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					CompileAs="2"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Release_Cairo_CFLite|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					CompileAs="2"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Debug_All|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					CompileAs="2"
-				/>
-			</FileConfiguration>
-			<FileConfiguration
-				Name="Production|Win32"
-				>
-				<Tool
-					Name="VCCLCompilerTool"
-					CompileAs="2"
-				/>
-			</FileConfiguration>
-		</File>
-		<File
-			RelativePath="..\..\API\tests\testapi.js"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapi"

+	ProjectGUID="{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}"

+	RootNamespace="testapi"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testapiDebug.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testapiRelease.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Cairo_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testapiDebugCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_Cairo_CFLite|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testapiReleaseCairoCFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testapiDebugAll.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Production|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets=".\testapiProduction.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath="..\..\API\tests\testapi.c"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_Cairo_CFLite|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release_Cairo_CFLite|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_All|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Production|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

+			RelativePath="..\..\API\tests\testapi.js"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
index 1d2060f6f..a15d04d23 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiCommon.vsprops
@@ -1,21 +1,21 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiCommon"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;"
-		PreprocessorDefinitions="NOMINMAX"
-		WarningLevel="4"
-		Detect64BitPortabilityProblems="true"
-		ForcedIncludeFiles="ICUVersion.h"
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib"
-		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"
-		SubSystem="1"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)\..\..\API&quot;;&quot;$(ConfigurationBuildDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;"

+		PreprocessorDefinitions="NOMINMAX"

+		WarningLevel="4"

+		Detect64BitPortabilityProblems="true"

+		ForcedIncludeFiles="ICUVersion.h"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WTF$(WebKitConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib libicuin$(LibraryConfigSuffix).lib libicuuc$(LibraryConfigSuffix).lib"

+		AdditionalLibraryDirectories="&quot;$(IntDir)\lib&quot;"

+		SubSystem="1"

+	/>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
index c0873b2c9..f17de961b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebug.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiDebug"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiDebug"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
index 999087c6c..9e5f2c515 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugAll.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiDebugAll"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiDebugAll"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
index e56c03fc4..821c88574 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiDebugCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiDebugCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiDebugCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
index ea3a0f0fb..4dbc0c185 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiProduction.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiProduction"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiProduction"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
index e2de5e259..15ad84ffd 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiRelease.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiRelease"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiRelease"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
index ffc45ae9e..692de7447 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapiReleaseCairoCFLite.vsprops
@@ -1,8 +1,8 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="testapiReleaseCairoCFLite"
-	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"
-	>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="testapiReleaseCairoCFLite"

+	InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\releaseproduction.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCFLite.vsprops"

+	>

+</VisualStudioPropertySheet>

diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index da029cc08..948cecc11 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -58,9 +58,6 @@
 /* End PBXAggregateTarget section */
 
 /* Begin PBXBuildFile section */
-		08DDA5C11264631700751732 /* UStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 08DDA5BB12645F1D00751732 /* UStringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0A4337BB1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0A4337BA1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp */; };
-		0A4337BE1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0A4337BD1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h */; };
 		0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F0B839A14BCF45D00885B4F /* LLIntEntrypoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */; };
 		0F0B839B14BCF46000885B4F /* LLIntEntrypoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -142,9 +139,9 @@
 		0F63944015C75F1D006A597C /* DFGStructureCheckHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63943C15C75F14006A597C /* DFGStructureCheckHoistingPhase.cpp */; };
 		0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63945115D07051006A597C /* ArrayProfile.cpp */; };
 		0F63945515D07057006A597C /* ArrayProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63945215D07051006A597C /* ArrayProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63948115E48114006A597C /* DFGArrayMode.cpp */; };
 		0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63948215E48114006A597C /* DFGArrayMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F766D2815A8CC1E008F363E /* JITStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */; };
@@ -255,7 +252,6 @@
 		0FFFC95F14EF90BB00C72532 /* DFGVirtualRegisterAllocationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */; };
 		0FFFC96014EF90BD00C72532 /* DFGVirtualRegisterAllocationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
-		140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */; };
 		140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85E0255597D01FF60F7 /* JSFunction.cpp */; };
 		140B7D1D0DC69AF7009C42B8 /* JSActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */; };
 		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -317,6 +313,8 @@
 		1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8900A508B100005F061 /* JSCallbackFunction.cpp */; };
 		1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */; };
 		1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440FCE20A51E46B0005F061 /* JSClassRef.cpp */; };
+		1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1442565F15EDE98D0066A49B /* JSWithScope.cpp */; };
+		1442566215EDE98D0066A49B /* JSWithScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 1442566015EDE98D0066A49B /* JSWithScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14469DDE107EC7E700650446 /* Lookup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8680255597D01FF60F7 /* Lookup.cpp */; };
 		14469DDF107EC7E700650446 /* MathObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86A0255597D01FF60F7 /* MathObject.cpp */; };
 		14469DE0107EC7E700650446 /* NativeErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */; };
@@ -328,11 +326,9 @@
 		14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */; };
 		14469DE7107EC7E700650446 /* PropertyNameArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */; };
 		14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65621E6B089E859700760F35 /* PropertySlot.cpp */; };
-		14469DEA107EC7E700650446 /* ScopeChain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9374D3A8038D9D74008635CE /* ScopeChain.cpp */; };
 		14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */; };
 		14469DEC107EC7E700650446 /* StringObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C20E16EE3300B34460 /* StringObject.cpp */; };
 		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
-		14469DEE107EC7E700650446 /* UString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8850255597D01FF60F7 /* UString.cpp */; };
 		144836E7132DA7BE005BE785 /* ConservativeRoots.h in Headers */ = {isa = PBXBuildFile; fileRef = 149DAAF212EB559D0083B12B /* ConservativeRoots.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		145722861437E140005FDE26 /* StrongInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 145722851437E140005FDE26 /* StrongInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
@@ -370,6 +366,10 @@
 		14816E1C154CC56C00B8054C /* BlockAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 14816E1A154CC56C00B8054C /* BlockAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B74C0A43032800517CFC /* JSStringRef.cpp */; };
 		1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B7E20A43076000517CFC /* JSObjectRef.cpp */; };
+		14874AE315EBDE4A002E3587 /* JSNameScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14874ADF15EBDE4A002E3587 /* JSNameScope.cpp */; };
+		14874AE415EBDE4A002E3587 /* JSNameScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 14874AE015EBDE4A002E3587 /* JSNameScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14874AE515EBDE4A002E3587 /* JSScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14874AE115EBDE4A002E3587 /* JSScope.cpp */; };
+		14874AE615EBDE4A002E3587 /* JSScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 14874AE215EBDE4A002E3587 /* JSScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */; };
 		148F21B0107EC5410042EC2C /* Lexer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8650255597D01FF60F7 /* Lexer.cpp */; };
@@ -653,14 +653,12 @@
 		BC18C45B0E16F5CD00B34460 /* RegExpObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87C0255597D01FF60F7 /* RegExpObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C45D0E16F5CD00B34460 /* Register.h in Headers */ = {isa = PBXBuildFile; fileRef = 149B24FF0D8AF6D1009CB8C7 /* Register.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C45E0E16F5CD00B34460 /* RegisterFile.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D792640DAA03FB001A9F05 /* RegisterFile.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4610E16F5CD00B34460 /* ScopeChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 9374D3A7038D9D74008635CE /* ScopeChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866EE0DD59AFA00A2B2A1 /* SourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C10E16EE3300B34460 /* StringConstructor.h */; };
 		BC18C4680E16F5CD00B34460 /* StringObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C30E16EE3300B34460 /* StringObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C46A0E16F5CD00B34460 /* StringPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C60E16EE3300B34460 /* StringPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C46B0E16F5CD00B34460 /* SymbolTable.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A396A60CD2933100B5B4FF /* SymbolTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C4760E16F5CD00B34460 /* UString.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A8860255597D01FF60F7 /* UString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DE3D0F40DD8DDFB00468714 /* WebKitAvailability.h */; settings = {ATTRIBUTES = (Public, ); }; };
 		BC18C5240E16FC8A00B34460 /* ArrayPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5230E16FC8A00B34460 /* ArrayPrototype.lut.h */; };
 		BC18C5260E16FCA700B34460 /* StringPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5250E16FCA700B34460 /* StringPrototype.lut.h */; };
@@ -717,8 +715,11 @@
 		E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
 		E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
+		FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE4A331F15BD2E07006F54F3 /* VMInspector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE4A331D15BD2E07006F54F3 /* VMInspector.cpp */; };
 		FE4A332015BD2E07006F54F3 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE4A331E15BD2E07006F54F3 /* VMInspector.h */; };
+		FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = FED287B115EC9A5700DA8161 /* LLIntOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -813,10 +814,6 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		0896C29B1265AAF600B1CDD3 /* UStringConcatenate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UStringConcatenate.h; sourceTree = "<group>"; };
-		08DDA5BB12645F1D00751732 /* UStringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UStringBuilder.h; sourceTree = "<group>"; };
-		0A4337BA1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGRedundantPhiEliminationPhase.cpp; path = dfg/DFGRedundantPhiEliminationPhase.cpp; sourceTree = "<group>"; };
-		0A4337BD1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRedundantPhiEliminationPhase.h; path = dfg/DFGRedundantPhiEliminationPhase.h; sourceTree = "<group>"; };
 		0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
 		0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntEntrypoints.cpp; path = llint/LLIntEntrypoints.cpp; sourceTree = "<group>"; };
 		0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntEntrypoints.h; path = llint/LLIntEntrypoints.h; sourceTree = "<group>"; };
@@ -901,9 +898,9 @@
 		0F63943D15C75F14006A597C /* DFGStructureCheckHoistingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureCheckHoistingPhase.h; path = dfg/DFGStructureCheckHoistingPhase.h; sourceTree = "<group>"; };
 		0F63945115D07051006A597C /* ArrayProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayProfile.cpp; sourceTree = "<group>"; };
 		0F63945215D07051006A597C /* ArrayProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayProfile.h; sourceTree = "<group>"; };
+		0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureAbstractValue.h; path = dfg/DFGStructureAbstractValue.h; sourceTree = "<group>"; };
 		0F63948115E48114006A597C /* DFGArrayMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArrayMode.cpp; path = dfg/DFGArrayMode.cpp; sourceTree = "<group>"; };
 		0F63948215E48114006A597C /* DFGArrayMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayMode.h; path = dfg/DFGArrayMode.h; sourceTree = "<group>"; };
-		0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureAbstractValue.h; path = dfg/DFGStructureAbstractValue.h; sourceTree = "<group>"; };
 		0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdjacencyList.h; path = dfg/DFGAdjacencyList.h; sourceTree = "<group>"; };
 		0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdge.h; path = dfg/DFGEdge.h; sourceTree = "<group>"; };
 		0F766D1C15A5028D008F363E /* JITStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubRoutine.h; sourceTree = "<group>"; };
@@ -1062,6 +1059,8 @@
 		1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackConstructor.cpp; sourceTree = "<group>"; };
 		1440FCE10A51E46B0005F061 /* JSClassRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClassRef.h; sourceTree = "<group>"; };
 		1440FCE20A51E46B0005F061 /* JSClassRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClassRef.cpp; sourceTree = "<group>"; };
+		1442565F15EDE98D0066A49B /* JSWithScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWithScope.cpp; sourceTree = "<group>"; };
+		1442566015EDE98D0066A49B /* JSWithScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWithScope.h; sourceTree = "<group>"; };
 		145722851437E140005FDE26 /* StrongInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StrongInlines.h; sourceTree = "<group>"; };
 		145C507F0D9DF63B0088F6B9 /* CallData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallData.h; sourceTree = "<group>"; };
 		146AAB2A0B66A84900E55F16 /* JSStringRefCF.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSStringRefCF.h; sourceTree = "<group>"; };
@@ -1080,6 +1079,10 @@
 		1482B78A0A4305AB00517CFC /* APICast.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APICast.h; sourceTree = "<group>"; };
 		1482B7E10A43076000517CFC /* JSObjectRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObjectRef.h; sourceTree = "<group>"; };
 		1482B7E20A43076000517CFC /* JSObjectRef.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObjectRef.cpp; sourceTree = "<group>"; };
+		14874ADF15EBDE4A002E3587 /* JSNameScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNameScope.cpp; sourceTree = "<group>"; };
+		14874AE015EBDE4A002E3587 /* JSNameScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNameScope.h; sourceTree = "<group>"; };
+		14874AE115EBDE4A002E3587 /* JSScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScope.cpp; sourceTree = "<group>"; };
+		14874AE215EBDE4A002E3587 /* JSScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScope.h; sourceTree = "<group>"; };
 		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
 		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
 		1497209014EB831500FEB1B7 /* PassWeak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PassWeak.h; sourceTree = "<group>"; };
@@ -1162,7 +1165,6 @@
 		65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CommonIdentifiers.cpp; sourceTree = "<group>"; };
 		65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CommonIdentifiers.h; sourceTree = "<group>"; };
 		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
-		7E2C6C980D31C6B6002D44E2 /* ScopeChainMark.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopeChainMark.h; sourceTree = "<group>"; };
 		7E4EE7080EBB7963005934AA /* StructureChain.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureChain.h; sourceTree = "<group>"; };
 		7E4EE70E0EBB7A5B005934AA /* StructureChain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureChain.cpp; sourceTree = "<group>"; };
 		7EFF00630EC05A9A00AA7C93 /* NodeInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeInfo.h; sourceTree = "<group>"; };
@@ -1275,8 +1277,6 @@
 		93345A8812D838C400302BE3 /* StringRecursionChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringRecursionChecker.h; sourceTree = "<group>"; };
 		933A349A038AE7C6008635CE /* Identifier.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Identifier.h; sourceTree = "<group>"; tabWidth = 8; };
 		933A349D038AE80F008635CE /* Identifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Identifier.cpp; sourceTree = "<group>"; tabWidth = 8; };
-		9374D3A7038D9D74008635CE /* ScopeChain.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ScopeChain.h; sourceTree = "<group>"; tabWidth = 8; };
-		9374D3A8038D9D74008635CE /* ScopeChain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScopeChain.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		937B63CC09E766D200A671DD /* DerivedSources.make */ = {isa = PBXFileReference; explicitFileType = sourcecode.make; fileEncoding = 4; path = DerivedSources.make; sourceTree = "<group>"; usesTabs = 1; };
 		938772E5038BFE19008635CE /* JSArray.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSArray.h; sourceTree = "<group>"; tabWidth = 8; };
 		93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArray.cpp; sourceTree = "<group>"; };
@@ -1352,8 +1352,6 @@
 		A7DCB77912E3D90500911940 /* WriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrier.h; sourceTree = "<group>"; };
 		A7E2EA690FB460CF00601F06 /* LiteralParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LiteralParser.h; sourceTree = "<group>"; };
 		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
-		A7E42C180E3938830065A544 /* JSStaticScopeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStaticScopeObject.h; sourceTree = "<group>"; };
-		A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStaticScopeObject.cpp; sourceTree = "<group>"; };
 		A7F8690E0F9584A100558697 /* CachedCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedCall.h; sourceTree = "<group>"; };
 		A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameClosure.h; sourceTree = "<group>"; };
 		A7F9935D0FD7325100A0B2D0 /* JSONObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.h; sourceTree = "<group>"; };
@@ -1512,12 +1510,13 @@
 		F692A87C0255597D01FF60F7 /* RegExpObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RegExpObject.h; sourceTree = "<group>"; tabWidth = 8; };
 		F692A87D0255597D01FF60F7 /* RegExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExp.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		F692A87E0255597D01FF60F7 /* RegExp.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RegExp.h; sourceTree = "<group>"; tabWidth = 8; };
-		F692A8850255597D01FF60F7 /* UString.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UString.cpp; sourceTree = "<group>"; tabWidth = 8; };
-		F692A8860255597D01FF60F7 /* UString.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = UString.h; sourceTree = "<group>"; tabWidth = 8; };
 		F692A8870255597D01FF60F7 /* JSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSValue.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = "<group>"; };
+		FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCLoop.h; path = llint/LLIntCLoop.h; sourceTree = "<group>"; };
 		FE4A331D15BD2E07006F54F3 /* VMInspector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VMInspector.cpp; sourceTree = "<group>"; };
 		FE4A331E15BD2E07006F54F3 /* VMInspector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMInspector.h; sourceTree = "<group>"; };
 		FEB63AA2159B9DA3008932A6 /* Comment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Comment.h; sourceTree = "<group>"; };
+		FED287B115EC9A5700DA8161 /* LLIntOpcode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntOpcode.h; path = llint/LLIntOpcode.h; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -1650,6 +1649,9 @@
 		0F46809C14BA7F4D00BFE272 /* llint */ = {
 			isa = PBXGroup;
 			children = (
+				FED287B115EC9A5700DA8161 /* LLIntOpcode.h */,
+				FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */,
+				FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */,
 				5DDDF44614FEE72200B4FB4D /* LLIntDesiredOffsets.h */,
 				0F0B839514BCF45A00885B4F /* LLIntEntrypoints.cpp */,
 				0F0B839614BCF45A00885B4F /* LLIntEntrypoints.h */,
@@ -2015,7 +2017,6 @@
 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
 			isa = PBXGroup;
 			children = (
-				C2D58C3315912FEE0021A844 /* GCActivityCallback.cpp */,
 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
 				BCF605120E203EF800B9A64D /* ArgList.h */,
 				BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
@@ -2070,6 +2071,7 @@
 				BC2680C10E16D4E900A06E92 /* FunctionConstructor.h */,
 				F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */,
 				F692A85D0255597D01FF60F7 /* FunctionPrototype.h */,
+				C2D58C3315912FEE0021A844 /* GCActivityCallback.cpp */,
 				DDF7ABD211F60ED200108E36 /* GCActivityCallback.h */,
 				BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
 				BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
@@ -2103,6 +2105,8 @@
 				8604F503143CE1C100B295F5 /* JSGlobalThis.h */,
 				65EA4C99092AF9E20093D800 /* JSLock.cpp */,
 				65EA4C9A092AF9E20093D800 /* JSLock.h */,
+				14874ADF15EBDE4A002E3587 /* JSNameScope.cpp */,
+				14874AE015EBDE4A002E3587 /* JSNameScope.h */,
 				A72700780DAC605600E548D7 /* JSNotAnObject.cpp */,
 				A72700770DAC605600E548D7 /* JSNotAnObject.h */,
 				BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
@@ -2111,10 +2115,10 @@
 				A7F9935D0FD7325100A0B2D0 /* JSONObject.h */,
 				A727FF660DA3053B00E548D7 /* JSPropertyNameIterator.cpp */,
 				A727FF650DA3053B00E548D7 /* JSPropertyNameIterator.h */,
+				14874AE115EBDE4A002E3587 /* JSScope.cpp */,
+				14874AE215EBDE4A002E3587 /* JSScope.h */,
 				0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */,
 				0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */,
-				A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */,
-				A7E42C180E3938830065A544 /* JSStaticScopeObject.h */,
 				BC02E9B60E1842FA000F9297 /* JSString.cpp */,
 				F692A8620255597D01FF60F7 /* JSString.h */,
 				86E85538111B9968001AF51E /* JSStringBuilder.h */,
@@ -2129,6 +2133,8 @@
 				865A30F0135007E100CDB49E /* JSValueInlineMethods.h */,
 				BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
 				14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
+				1442565F15EDE98D0066A49B /* JSWithScope.cpp */,
+				1442566015EDE98D0066A49B /* JSWithScope.h */,
 				65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */,
 				65C7A1720A8EAACB00FA37EA /* JSWrapperObject.h */,
 				A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */,
@@ -2194,9 +2200,6 @@
 				BCD202C00E1706A7002C7E82 /* RegExpPrototype.h */,
 				0F7700911402FF280078EB39 /* SamplingCounter.cpp */,
 				0F77008E1402FDD60078EB39 /* SamplingCounter.h */,
-				9374D3A8038D9D74008635CE /* ScopeChain.cpp */,
-				9374D3A7038D9D74008635CE /* ScopeChain.h */,
-				7E2C6C980D31C6B6002D44E2 /* ScopeChainMark.h */,
 				93303FE80E6A72B500786E6A /* SmallStrings.cpp */,
 				93303FEA0E6A72C000786E6A /* SmallStrings.h */,
 				A781E358141970C700094D90 /* StorageBarrier.h */,
@@ -2223,10 +2226,6 @@
 				5D53726D0E1C546B0021E549 /* Tracing.d */,
 				5D53726E0E1C54880021E549 /* Tracing.h */,
 				866739D113BFDE710023D87C /* Uint16WithFraction.h */,
-				F692A8850255597D01FF60F7 /* UString.cpp */,
-				F692A8860255597D01FF60F7 /* UString.h */,
-				08DDA5BB12645F1D00751732 /* UStringBuilder.h */,
-				0896C29B1265AAF600B1CDD3 /* UStringConcatenate.h */,
 				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
 				A7DCB77912E3D90500911940 /* WriteBarrier.h */,
@@ -2338,8 +2337,6 @@
 				0FFFC95014EF909500C72532 /* DFGPhase.h */,
 				0FFFC95114EF909500C72532 /* DFGPredictionPropagationPhase.cpp */,
 				0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */,
-				0A4337BA1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp */,
-				0A4337BD1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h */,
 				86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
 				0F766D4215B2A3BD008F363E /* DFGRegisterSet.h */,
 				86BB09BE138E381B0056702F /* DFGRepatch.cpp */,
@@ -2528,6 +2525,7 @@
 				86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
 				C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */,
 				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
+				FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */,
 				C21122E215DD9AB300790E3A /* GCThreadSharedData.h in Headers */,
 				C2E526BE1590EF000054E48D /* HeapTimer.h in Headers */,
 				C21122E315DD9AB300790E3A /* MarkStackInlineMethods.h in Headers */,
@@ -2746,7 +2744,6 @@
 				869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */,
 				C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
 				1429D8860ED21C3D00B89619 /* SamplingTool.h in Headers */,
-				BC18C4610E16F5CD00B34460 /* ScopeChain.h in Headers */,
 				86AE64AA135E5E1C00963012 /* SH4Assembler.h in Headers */,
 				14BA78F113AAB88F005B7C2C /* SlotVisitor.h in Headers */,
 				933040040E6A749400786E6A /* SmallStrings.h in Headers */,
@@ -2776,8 +2773,6 @@
 				5D53726F0E1C54880021E549 /* Tracing.h in Headers */,
 				866739D313BFDE710023D87C /* Uint16WithFraction.h in Headers */,
 				0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */,
-				BC18C4760E16F5CD00B34460 /* UString.h in Headers */,
-				08DDA5C11264631700751732 /* UStringBuilder.h in Headers */,
 				0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */,
 				0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */,
 				0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */,
@@ -2850,7 +2845,6 @@
 				0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
 				0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */,
 				0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */,
-				0A4337BE1506219B00991C95 /* DFGRedundantPhiEliminationPhase.h in Headers */,
 				0FA581BB150E953000B9A2D9 /* DFGNodeFlags.h in Headers */,
 				0FA581BC150E953000B9A2D9 /* DFGNodeType.h in Headers */,
 				0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */,
@@ -2903,6 +2897,10 @@
 				0F63945515D07057006A597C /* ArrayProfile.h in Headers */,
 				0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */,
 				0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */,
+				14874AE415EBDE4A002E3587 /* JSNameScope.h in Headers */,
+				14874AE615EBDE4A002E3587 /* JSScope.h in Headers */,
+				FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */,
+				1442566215EDE98D0066A49B /* JSWithScope.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3355,7 +3353,6 @@
 				A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */,
 				95F6E6950E5B5F970091E860 /* JSProfilerPrivate.cpp in Sources */,
 				A727FF6B0DA3092200E548D7 /* JSPropertyNameIterator.cpp in Sources */,
-				140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */,
 				147F39D5107EC37600427A48 /* JSString.cpp in Sources */,
 				2600B5A6152BAAA70091EE5F /* JSStringJoiner.cpp in Sources */,
 				1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */,
@@ -3408,7 +3405,6 @@
 				1428083A107EC0750013E7B2 /* RegisterFile.cpp in Sources */,
 				0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */,
 				1429D8850ED21C3D00B89619 /* SamplingTool.cpp in Sources */,
-				14469DEA107EC7E700650446 /* ScopeChain.cpp in Sources */,
 				9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
 				E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
 				A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */,
@@ -3421,7 +3417,6 @@
 				BCCF0D0C0EF0B8A500413C8F /* StructureStubInfo.cpp in Sources */,
 				A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */,
 				14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */,
-				14469DEE107EC7E700650446 /* UString.cpp in Sources */,
 				0FC81516140511B500CFA603 /* VTableSpectrum.cpp in Sources */,
 				0FC8150B14043C0E00CFA603 /* WriteBarrierSupport.cpp in Sources */,
 				86704B8412DBA33700A9FE7B /* YarrInterpreter.cpp in Sources */,
@@ -3458,7 +3453,6 @@
 				0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */,
 				0FB5467D14F5CFD6002C2989 /* MethodOfGettingAValueProfile.cpp in Sources */,
 				0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
-				0A4337BB1506218800991C95 /* DFGRedundantPhiEliminationPhase.cpp in Sources */,
 				0FA581BA150E952C00B9A2D9 /* DFGNodeFlags.cpp in Sources */,
 				0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */,
 				8642C510151C06A90046D4EF /* RegExpCachedResult.cpp in Sources */,
@@ -3505,6 +3499,10 @@
 				0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */,
 				0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
 				C21122E115DD9AB300790E3A /* GCThreadSharedData.cpp in Sources */,
+				14874AE315EBDE4A002E3587 /* JSNameScope.cpp in Sources */,
+				14874AE515EBDE4A002E3587 /* JSScope.cpp in Sources */,
+				1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */,
+				FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/PlatformEfl.cmake b/Source/JavaScriptCore/PlatformEfl.cmake
index 448834cf7..78a3a1f17 100644
--- a/Source/JavaScriptCore/PlatformEfl.cmake
+++ b/Source/JavaScriptCore/PlatformEfl.cmake
@@ -1,6 +1,8 @@
 LIST(APPEND JavaScriptCore_SOURCES
     jit/ExecutableAllocatorFixedVMPool.cpp
     jit/ExecutableAllocator.cpp
+
+    runtime/MemoryStatistics.cpp
 )
 
 LIST(APPEND JavaScriptCore_LIBRARIES
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index c7e41ab3a..bcbc0363a 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -121,7 +121,6 @@ SOURCES += \
     dfg/DFGOSRExitCompiler32_64.cpp \
     dfg/DFGPhase.cpp \
     dfg/DFGPredictionPropagationPhase.cpp \
-    dfg/DFGRedundantPhiEliminationPhase.cpp \
     dfg/DFGRepatch.cpp \
     dfg/DFGSpeculativeJIT.cpp \
     dfg/DFGSpeculativeJIT32_64.cpp \
@@ -210,7 +209,9 @@ SOURCES += \
     runtime/JSONObject.cpp \
     runtime/JSPropertyNameIterator.cpp \
     runtime/JSSegmentedVariableObject.cpp \
-    runtime/JSStaticScopeObject.cpp \
+    runtime/JSWithScope.cpp \
+    runtime/JSNameScope.cpp \
+    runtime/JSScope.cpp \
     runtime/JSString.cpp \
     runtime/JSStringJoiner.cpp \
     runtime/JSSymbolTableObject.cpp \
@@ -243,7 +244,6 @@ SOURCES += \
     runtime/RegExpPrototype.cpp \
     runtime/RegExpCache.cpp \
     runtime/SamplingCounter.cpp \
-    runtime/ScopeChain.cpp \
     runtime/SmallStrings.cpp \
     runtime/StrictEvalActivation.cpp \
     runtime/StringConstructor.cpp \
@@ -254,7 +254,6 @@ SOURCES += \
     runtime/Structure.cpp \
     runtime/SymbolTable.cpp \
     runtime/TimeoutChecker.cpp \
-    runtime/UString.cpp \
     tools/CodeProfile.cpp \
     tools/CodeProfiling.cpp \
     yarr/YarrJIT.cpp \
diff --git a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index 430147280..5377ef0c7 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -215,7 +215,7 @@ public:
     void flushWithoutBarrier(bool isForced = false)
     {
         // Flush if constant pool is more than 60% full to avoid overuse of this function.
-        if (isForced || 5 * m_numConsts > 3 * maxPoolSize / sizeof(uint32_t))
+        if (isForced || 5 * static_cast<uint32_t>(m_numConsts) > 3 * maxPoolSize / sizeof(uint32_t))
             flushConstantPool(false);
     }
 
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 295354119..e3b0be9da 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -555,7 +555,7 @@ public:
 
     Jump branch32(RelationalCondition cond, RegisterID left, TrustedImm32 right, int useConstantPool = 0)
     {
-        ARMWord tmp = (right.m_value == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
+        ARMWord tmp = (static_cast<unsigned>(right.m_value) == 0x80000000) ? ARMAssembler::InvalidImmediate : m_assembler.getOp2(-right.m_value);
         if (tmp != ARMAssembler::InvalidImmediate)
             m_assembler.cmn(left, tmp);
         else
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index c6db26597..c2af24060 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -28,6 +28,7 @@
 
 #include "Disassembler.h"
 #include "ExecutableAllocator.h"
+#include "LLIntData.h"
 #include <wtf/DataLog.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -289,10 +290,13 @@ public:
         return result;
     }
 
-    static MacroAssemblerCodePtr createLLIntCodePtr(void (*function)())
+#if ENABLE(LLINT)
+    static MacroAssemblerCodePtr createLLIntCodePtr(LLIntCode codeId)
     {
-        return createFromExecutableAddress(bitwise_cast<void*>(function));
+        return createFromExecutableAddress(LLInt::getCodePtr(codeId));
     }
+#endif
+
     explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
         : m_value(ra.value())
     {
@@ -353,12 +357,14 @@ public:
         return MacroAssemblerCodeRef(codePtr);
     }
     
+#if ENABLE(LLINT)
     // Helper for creating self-managed code refs from LLInt.
-    static MacroAssemblerCodeRef createLLIntCodeRef(void (*function)())
+    static MacroAssemblerCodeRef createLLIntCodeRef(LLIntCode codeId)
     {
-        return createSelfManagedCodeRef(MacroAssemblerCodePtr::createFromExecutableAddress(bitwise_cast<void*>(function)));
+        return createSelfManagedCodeRef(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(codeId)));
     }
-    
+#endif
+
     ExecutableMemoryHandle* executableMemory() const
     {
         return m_executableMemory.get();
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
index badf35f81..ca410afa8 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerSH4.h
@@ -47,6 +47,11 @@ public:
 
     static const int MaximumCompactPtrAlignedAddressOffset = 60;
 
+    static bool isCompactPtrAlignedAddressOffset(ptrdiff_t value)
+    {
+        return (value >= 0) && (value <= MaximumCompactPtrAlignedAddressOffset);
+    }
+
     enum RelationalCondition {
         Equal = SH4Assembler::EQ,
         NotEqual = SH4Assembler::NE,
@@ -138,6 +143,14 @@ public:
         releaseScratch(scr);
     }
 
+    void add32(AbsoluteAddress src, RegisterID dest)
+    {
+        RegisterID scr = claimScratch();
+        load32(src.m_ptr, scr);
+        m_assembler.addlRegReg(scr, dest);
+        releaseScratch(scr);
+    }
+
     void and32(RegisterID src, RegisterID dest)
     {
         m_assembler.andlRegReg(src, dest);
@@ -874,6 +887,19 @@ void or32(TrustedImm32 imm, RegisterID src, RegisterID dest)
         return dataLabel;
     }
 
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+
+        RegisterID scr = claimScratch();
+        m_assembler.movImm8(address.offset, scr);
+        m_assembler.addlRegReg(address.base, scr);
+        m_assembler.movlMemReg(scr, dest);
+        releaseScratch(scr);
+
+        return result;
+    }
+
      // Floating-point operations
 
     static bool supportsFloatingPoint() { return true; }
diff --git a/Source/JavaScriptCore/assembler/SH4Assembler.h b/Source/JavaScriptCore/assembler/SH4Assembler.h
index d55d393f2..373f469dc 100644
--- a/Source/JavaScriptCore/assembler/SH4Assembler.h
+++ b/Source/JavaScriptCore/assembler/SH4Assembler.h
@@ -1239,6 +1239,12 @@ public:
         oneShortOp(RTS_OPCODE, false);
     }
 
+    AssemblerLabel labelIgnoringWatchpoints()
+    {
+        m_buffer.ensureSpaceForAnyInstruction();
+        return m_buffer.label();
+    }
+
     AssemblerLabel label()
     {
         m_buffer.ensureSpaceForAnyInstruction();
@@ -2079,6 +2085,30 @@ public:
     static void printBlockInstr(uint16_t* first, unsigned int offset, int nbInstr) {};
 #endif
 
+    static void replaceWithLoad(void* instructionStart)
+    {
+        SH4Word* insPtr = reinterpret_cast<SH4Word*>(instructionStart);
+
+        insPtr += 2; // skip MOV and ADD opcodes
+
+        if (((*insPtr) & 0xf00f) != MOVL_READ_RM_OPCODE) {
+            *insPtr = MOVL_READ_RM_OPCODE | (*insPtr & 0x0ff0);
+            cacheFlush(insPtr, sizeof(SH4Word));
+        }
+    }
+
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        SH4Word* insPtr = reinterpret_cast<SH4Word*>(instructionStart);
+
+        insPtr += 2; // skip MOV and ADD opcodes
+
+        if (((*insPtr) & 0xf00f) != MOV_OPCODE) {
+            *insPtr = MOV_OPCODE | (*insPtr & 0x0ff0);
+            cacheFlush(insPtr, sizeof(SH4Word));
+        }
+    }
+
 private:
     SH4Buffer m_buffer;
     int m_claimscratchReg;
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 2ea969fcf..f15e5b0dd 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -40,12 +40,11 @@
 #include "JITStubs.h"
 #include "JSActivation.h"
 #include "JSFunction.h"
-#include "JSStaticScopeObject.h"
+#include "JSNameScope.h"
 #include "JSValue.h"
 #include "LowLevelInterpreter.h"
 #include "MethodCallLinkStatus.h"
 #include "RepatchBuffer.h"
-#include "UStringConcatenate.h"
 #include <stdio.h>
 #include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
@@ -62,36 +61,36 @@ namespace JSC {
 using namespace DFG;
 #endif
 
-static UString escapeQuotes(const UString& str)
+static String escapeQuotes(const String& str)
 {
-    UString result = str;
+    String result = str;
     size_t pos = 0;
     while ((pos = result.find('\"', pos)) != notFound) {
-        result = makeUString(result.substringSharingImpl(0, pos), "\"\\\"\"", result.substringSharingImpl(pos + 1));
+        result = makeString(result.substringSharingImpl(0, pos), "\"\\\"\"", result.substringSharingImpl(pos + 1));
         pos += 4;
     }
     return result;
 }
 
-static UString valueToSourceString(ExecState* exec, JSValue val)
+static String valueToSourceString(ExecState* exec, JSValue val)
 {
     if (!val)
-        return "0";
+        return ASCIILiteral("0");
 
     if (val.isString())
-        return makeUString("\"", escapeQuotes(val.toString(exec)->value(exec)), "\"");
+        return makeString("\"", escapeQuotes(val.toString(exec)->value(exec)), "\"");
 
     return val.description();
 }
 
 static CString constantName(ExecState* exec, int k, JSValue value)
 {
-    return makeUString(valueToSourceString(exec, value), "(@k", UString::number(k - FirstConstantRegisterIndex), ")").utf8();
+    return makeString(valueToSourceString(exec, value), "(@k", String::number(k - FirstConstantRegisterIndex), ")").utf8();
 }
 
 static CString idName(int id0, const Identifier& ident)
 {
-    return makeUString(ident.ustring(), "(@id", UString::number(id0), ")").utf8();
+    return makeString(ident.string(), "(@id", String::number(id0), ")").utf8();
 }
 
 void CodeBlock::dumpBytecodeCommentAndNewLine(int location)
@@ -114,10 +113,10 @@ CString CodeBlock::registerName(ExecState* exec, int r) const
     if (isConstantRegisterIndex(r))
         return constantName(exec, r, getConstant(r));
 
-    return makeUString("r", UString::number(r)).utf8();
+    return makeString("r", String::number(r)).utf8();
 }
 
-static UString regexpToSourceString(RegExp* regExp)
+static String regexpToSourceString(RegExp* regExp)
 {
     char postfix[5] = { '/', 0, 0, 0, 0 };
     int index = 1;
@@ -128,15 +127,15 @@ static UString regexpToSourceString(RegExp* regExp)
     if (regExp->multiline())
         postfix[index] = 'm';
 
-    return makeUString("/", regExp->pattern(), postfix);
+    return makeString("/", regExp->pattern(), postfix);
 }
 
 static CString regexpName(int re, RegExp* regexp)
 {
-    return makeUString(regexpToSourceString(regexp), "(@re", UString::number(re), ")").utf8();
+    return makeString(regexpToSourceString(regexp), "(@re", String::number(re), ")").utf8();
 }
 
-static UString pointerToSourceString(void* p)
+static String pointerToSourceString(void* p)
 {
     char buffer[2 + 2 * sizeof(void*) + 1]; // 0x [two characters per byte] \0
     snprintf(buffer, sizeof(buffer), "%p", p);
@@ -549,7 +548,7 @@ void CodeBlock::dump(ExecState* exec)
         dataLog("\nIdentifiers:\n");
         size_t i = 0;
         do {
-            dataLog("  id%u = %s\n", static_cast<unsigned>(i), m_identifiers[i].ustring().utf8().data());
+            dataLog("  id%u = %s\n", static_cast<unsigned>(i), m_identifiers[i].string().utf8().data());
             ++i;
         } while (i != m_identifiers.size());
     }
@@ -642,7 +641,7 @@ void CodeBlock::dump(ExecState* exec)
                     continue;
                 ASSERT(!((i + m_rareData->m_characterSwitchJumpTables[i].min) & ~0xFFFF));
                 UChar ch = static_cast<UChar>(entry + m_rareData->m_characterSwitchJumpTables[i].min);
-                dataLog("\t\t\"%s\" => %04d\n", UString(&ch, 1).utf8().data(), *iter);
+                dataLog("\t\t\"%s\" => %04d\n", String(&ch, 1).utf8().data(), *iter);
         }
             dataLog("      }\n");
             ++i;
@@ -656,7 +655,7 @@ void CodeBlock::dump(ExecState* exec)
             dataLog("  %1d = {\n", i);
             StringJumpTable::StringOffsetTable::const_iterator end = m_rareData->m_stringSwitchJumpTables[i].offsetTable.end();
             for (StringJumpTable::StringOffsetTable::const_iterator iter = m_rareData->m_stringSwitchJumpTables[i].offsetTable.begin(); iter != end; ++iter)
-                dataLog("\t\t\"%s\" => %04d\n", UString(iter->first).utf8().data(), iter->second.branchOffset);
+                dataLog("\t\t\"%s\" => %04d\n", String(iter->first).utf8().data(), iter->second.branchOffset);
             dataLog("      }\n");
             ++i;
         } while (i < m_rareData->m_stringSwitchJumpTables.size());
@@ -1480,9 +1479,9 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
-        case op_push_scope: {
+        case op_push_with_scope: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] push_scope\t %s", location, registerName(exec, r0).data());
+            dataLog("[%4d] push_with_scope\t %s", location, registerName(exec, r0).data());
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
@@ -1491,11 +1490,11 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
-        case op_push_new_scope: {
-            int r0 = (++it)->u.operand;
+        case op_push_name_scope: {
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] push_new_scope \t%s, %s, %s", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+            unsigned attributes = (++it)->u.operand;
+            dataLog("[%4d] push_name_scope \t%s, %s, %u", location, idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data(), attributes);
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
@@ -1551,6 +1550,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             dumpBytecodeCommentAndNewLine(location);
             break;
         }
+#if ENABLE(LLINT_C_LOOP)
+        default:
+            ASSERT(false); // We should never get here.
+#endif
     }
 }
 
@@ -1678,7 +1681,7 @@ void CodeBlock::dumpStatistics()
 #endif
 }
 
-CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
+CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other)
     : m_globalObject(other.m_globalObject)
     , m_heap(other.m_heap)
     , m_numCalleeRegisters(other.m_numCalleeRegisters)
@@ -1710,7 +1713,7 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     , m_constantRegisters(other.m_constantRegisters)
     , m_functionDecls(other.m_functionDecls)
     , m_functionExprs(other.m_functionExprs)
-    , m_symbolTable(symTab)
+    , m_symbolTable(*other.m_globalData, other.m_ownerExecutable.get(), other.symbolTable())
     , m_osrExitCounter(0)
     , m_optimizationDelayCounter(0)
     , m_reoptimizationRetryCounter(0)
@@ -1744,11 +1747,12 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     }
 }
 
-CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject *globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, SymbolTable* symTab, bool isConstructor, PassOwnPtr<CodeBlock> alternative)
+CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject *globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, bool isConstructor, PassOwnPtr<CodeBlock> alternative)
     : m_globalObject(globalObject->globalData(), ownerExecutable, globalObject)
     , m_heap(&m_globalObject->globalData().heap)
     , m_numCalleeRegisters(0)
     , m_numVars(0)
+    , m_numCapturedVars(0)
     , m_isConstructor(isConstructor)
     , m_numParameters(0)
     , m_ownerExecutable(globalObject->globalData(), ownerExecutable, ownerExecutable)
@@ -1764,7 +1768,7 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
 #if ENABLE(VALUE_PROFILER)
     , m_executionEntryCount(0)
 #endif
-    , m_symbolTable(symTab)
+    , m_symbolTable(globalObject->globalData(), ownerExecutable, SharedSymbolTable::create(globalObject->globalData()))
     , m_alternative(alternative)
     , m_osrExitCounter(0)
     , m_optimizationDelayCounter(0)
@@ -2030,13 +2034,11 @@ void CodeBlock::visitWeakReferences(SlotVisitor& visitor)
     performTracingFixpointIteration(visitor);
 }
 
-#if ENABLE(JIT)
 #if ENABLE(JIT_VERBOSE_OSR)
 static const bool verboseUnlinking = true;
 #else
 static const bool verboseUnlinking = false;
 #endif
-#endif // ENABLE(JIT)
     
 void CodeBlock::finalizeUnconditionally()
 {
@@ -2222,6 +2224,7 @@ void CodeBlock::stronglyVisitStrongReferences(SlotVisitor& visitor)
 {
     visitor.append(&m_globalObject);
     visitor.append(&m_ownerExecutable);
+    visitor.append(&m_symbolTable);
     if (m_rareData) {
         m_rareData->m_evalCodeCache.visitAggregate(visitor);
         size_t regExpCount = m_rareData->m_regexps.size();
@@ -2531,7 +2534,7 @@ void CodeBlock::createActivation(CallFrame* callFrame)
     ASSERT(!callFrame->uncheckedR(activationRegister()).jsValue());
     JSActivation* activation = JSActivation::create(callFrame->globalData(), callFrame, static_cast<FunctionExecutable*>(ownerExecutable()));
     callFrame->uncheckedR(activationRegister()) = JSValue(activation);
-    callFrame->setScopeChain(callFrame->scopeChain()->push(activation));
+    callFrame->setScope(activation);
 }
 
 unsigned CodeBlock::addOrFindConstant(JSValue v)
@@ -2579,6 +2582,7 @@ void CodeBlock::unlinkIncomingCalls()
     while (m_incomingCalls.begin() != m_incomingCalls.end())
         m_incomingCalls.begin()->unlink(*m_globalData, repatchBuffer);
 }
+#endif // ENABLE(JIT)
 
 #if ENABLE(LLINT)
 Instruction* CodeBlock::adjustPCIfAtCallSite(Instruction* potentialReturnPC)
@@ -2615,7 +2619,7 @@ Instruction* CodeBlock::adjustPCIfAtCallSite(Instruction* potentialReturnPC)
     opcodeLength = OPCODE_LENGTH(op_call_varargs);
     adjustedPC = potentialReturnPC - opcodeLength;
     if ((returnPCOffset >= opcodeLength)
-        && (adjustedPC->u.pointer == bitwise_cast<void*>(llint_op_call_varargs))) {
+        && (adjustedPC->u.pointer == LLInt::getCodePtr(llint_op_call_varargs))) {
         return adjustedPC;
     }
 
@@ -2623,22 +2627,37 @@ Instruction* CodeBlock::adjustPCIfAtCallSite(Instruction* potentialReturnPC)
     opcodeLength = OPCODE_LENGTH(op_call);
     adjustedPC = potentialReturnPC - opcodeLength;
     if ((returnPCOffset >= opcodeLength)
-        && (adjustedPC->u.pointer == bitwise_cast<void*>(llint_op_call)
-            || adjustedPC->u.pointer == bitwise_cast<void*>(llint_op_construct)
-            || adjustedPC->u.pointer == bitwise_cast<void*>(llint_op_call_eval))) {
+        && (adjustedPC->u.pointer == LLInt::getCodePtr(llint_op_call)
+            || adjustedPC->u.pointer == LLInt::getCodePtr(llint_op_construct)
+            || adjustedPC->u.pointer == LLInt::getCodePtr(llint_op_call_eval))) {
         return adjustedPC;
     }
 
     // Not a call site. No need to adjust PC. Just return the original.
     return potentialReturnPC;
 }
-#endif
+#endif // ENABLE(LLINT)
 
 unsigned CodeBlock::bytecodeOffset(ExecState* exec, ReturnAddressPtr returnAddress)
 {
+    UNUSED_PARAM(exec);
+    UNUSED_PARAM(returnAddress);
 #if ENABLE(LLINT)
-    if (returnAddress.value() >= bitwise_cast<void*>(&llint_begin)
-        && returnAddress.value() <= bitwise_cast<void*>(&llint_end)) {
+#if !ENABLE(LLINT_C_LOOP)
+    // When using the JIT, we could have addresses that are not bytecode
+    // addresses. We check if the return address is in the LLint glue and
+    // opcode handlers range here to ensure that we are looking at bytecode
+    // before attempting to convert the return address into a bytecode offset.
+    //
+    // In the case of the C Loop LLInt, the JIT is disabled, and the only
+    // valid return addresses should be bytecode PCs. So, we can and need to
+    // forego this check because when we do not ENABLE(COMPUTED_GOTO_OPCODES),
+    // then the bytecode "PC"s are actually the opcodeIDs and are not bounded
+    // by llint_begin and llint_end.
+    if (returnAddress.value() >= LLInt::getCodePtr(llint_begin)
+        && returnAddress.value() <= LLInt::getCodePtr(llint_end))
+#endif
+    {
         ASSERT(exec->codeBlock());
         ASSERT(exec->codeBlock() == this);
         ASSERT(JITCode::isBaselineCode(getJITType()));
@@ -2646,20 +2665,23 @@ unsigned CodeBlock::bytecodeOffset(ExecState* exec, ReturnAddressPtr returnAddre
         ASSERT(instruction);
 
         instruction = adjustPCIfAtCallSite(instruction);
-        
         return bytecodeOffset(instruction);
     }
-#else
-    UNUSED_PARAM(exec);
-#endif
+#endif // !ENABLE(LLINT)
+
+#if ENABLE(JIT)
     if (!m_rareData)
         return 1;
     Vector<CallReturnOffsetToBytecodeOffset>& callIndices = m_rareData->m_callReturnIndexVector;
     if (!callIndices.size())
         return 1;
     return binarySearch<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callIndices.begin(), callIndices.size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
-}
+#endif // ENABLE(JIT)
+
+#if !ENABLE(LLINT) && !ENABLE(JIT)
+    return 1;
 #endif
+}
 
 void CodeBlock::clearEvalCache()
 {
@@ -2721,27 +2743,27 @@ CodeBlock* FunctionCodeBlock::replacement()
     return &static_cast<FunctionExecutable*>(ownerExecutable())->generatedBytecodeFor(m_isConstructor ? CodeForConstruct : CodeForCall);
 }
 
-JSObject* ProgramCodeBlock::compileOptimized(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* ProgramCodeBlock::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     if (replacement()->getJITType() == JITCode::nextTierJIT(getJITType()))
         return 0;
-    JSObject* error = static_cast<ProgramExecutable*>(ownerExecutable())->compileOptimized(exec, scopeChainNode, bytecodeIndex);
+    JSObject* error = static_cast<ProgramExecutable*>(ownerExecutable())->compileOptimized(exec, scope, bytecodeIndex);
     return error;
 }
 
-JSObject* EvalCodeBlock::compileOptimized(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* EvalCodeBlock::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     if (replacement()->getJITType() == JITCode::nextTierJIT(getJITType()))
         return 0;
-    JSObject* error = static_cast<EvalExecutable*>(ownerExecutable())->compileOptimized(exec, scopeChainNode, bytecodeIndex);
+    JSObject* error = static_cast<EvalExecutable*>(ownerExecutable())->compileOptimized(exec, scope, bytecodeIndex);
     return error;
 }
 
-JSObject* FunctionCodeBlock::compileOptimized(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* FunctionCodeBlock::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     if (replacement()->getJITType() == JITCode::nextTierJIT(getJITType()))
         return 0;
-    JSObject* error = static_cast<FunctionExecutable*>(ownerExecutable())->compileOptimizedFor(exec, scopeChainNode, bytecodeIndex, m_isConstructor ? CodeForConstruct : CodeForCall);
+    JSObject* error = static_cast<FunctionExecutable*>(ownerExecutable())->compileOptimizedFor(exec, scope, bytecodeIndex, m_isConstructor ? CodeForConstruct : CodeForCall);
     return error;
 }
 
@@ -3003,22 +3025,22 @@ bool CodeBlock::usesOpcode(OpcodeID opcodeID)
     return false;
 }
 
-UString CodeBlock::nameForRegister(int registerNumber)
+String CodeBlock::nameForRegister(int registerNumber)
 {
     SymbolTable::iterator end = m_symbolTable->end();
     for (SymbolTable::iterator ptr = m_symbolTable->begin(); ptr != end; ++ptr) {
         if (ptr->second.getIndex() == registerNumber)
-            return UString(ptr->first);
+            return String(ptr->first);
     }
     if (needsActivation() && registerNumber == activationRegister())
-        return "activation";
+        return ASCIILiteral("activation");
     if (registerNumber == thisRegister())
-        return "this";
+        return ASCIILiteral("this");
     if (usesArguments()) {
         if (registerNumber == argumentsRegister())
-            return "arguments";
+            return ASCIILiteral("arguments");
         if (unmodifiedArgumentsRegister(argumentsRegister()) == registerNumber)
-            return "real arguments";
+            return ASCIILiteral("real arguments");
     }
     if (registerNumber < 0) {
         int argumentPosition = -registerNumber;
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index a8b2a5871..1d56999ff 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -64,7 +64,6 @@
 #include "Nodes.h"
 #include "RegExpObject.h"
 #include "StructureStubInfo.h"
-#include "UString.h"
 #include "UnconditionalFinalizer.h"
 #include "ValueProfile.h"
 #include "Watchpoint.h"
@@ -75,6 +74,7 @@
 #include <wtf/RefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 // Set ENABLE_BYTECODE_COMMENTS to 1 to enable recording bytecode generator
 // comments for the bytecodes that it generates. This will allow
@@ -118,9 +118,9 @@ namespace JSC {
     public:
         enum CopyParsedBlockTag { CopyParsedBlock };
     protected:
-        CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable*);
+        CodeBlock(CopyParsedBlockTag, CodeBlock& other);
         
-        CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, SymbolTable*, bool isConstructor, PassOwnPtr<CodeBlock> alternative);
+        CodeBlock(ScriptExecutable* ownerExecutable, CodeType, JSGlobalObject*, PassRefPtr<SourceProvider>, unsigned sourceOffset, bool isConstructor, PassOwnPtr<CodeBlock> alternative);
 
         WriteBarrier<JSGlobalObject> m_globalObject;
         Heap* m_heap;
@@ -229,12 +229,14 @@ namespace JSC {
         {
             return *(binarySearch<MethodCallLinkInfo, unsigned, getMethodCallLinkInfoBytecodeIndex>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), bytecodeIndex));
         }
+#endif // ENABLE(JIT)
 
 #if ENABLE(LLINT)
         Instruction* adjustPCIfAtCallSite(Instruction*);
 #endif
         unsigned bytecodeOffset(ExecState*, ReturnAddressPtr);
 
+#if ENABLE(JIT)
         unsigned bytecodeOffsetForCallAtIndex(unsigned index)
         {
             if (!m_rareData)
@@ -254,6 +256,8 @@ namespace JSC {
         {
             m_incomingCalls.push(incoming);
         }
+#endif // ENABLE(JIT)
+
 #if ENABLE(LLINT)
         void linkIncomingCall(LLIntCallLinkInfo* incoming)
         {
@@ -262,7 +266,6 @@ namespace JSC {
 #endif // ENABLE(LLINT)
         
         void unlinkIncomingCalls();
-#endif // ENABLE(JIT)
 
 #if ENABLE(DFG_JIT) || ENABLE(LLINT)
         void setJITCodeMap(PassOwnPtr<CompactJITCodeMap> jitCodeMap)
@@ -445,7 +448,7 @@ namespace JSC {
         MacroAssemblerCodePtr getJITCodeWithArityCheck() { return m_jitCodeWithArityCheck; }
         JITCode::JITType getJITType() { return m_jitCode.jitType(); }
         ExecutableMemoryHandle* executableMemory() { return getJITCode().getExecutableMemory(); }
-        virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*, unsigned bytecodeIndex) = 0;
+        virtual JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex) = 0;
         virtual void jettison() = 0;
         enum JITCompilationResult { AlreadyCompiled, CouldNotCompile, CompiledSuccessfully };
         JITCompilationResult jitCompile(ExecState* exec)
@@ -583,7 +586,7 @@ namespace JSC {
 
         void clearEvalCache();
         
-        UString nameForRegister(int registerNumber);
+        String nameForRegister(int registerNumber);
         
         void addPropertyAccessInstruction(unsigned propertyAccessInstruction)
         {
@@ -931,7 +934,7 @@ namespace JSC {
             if (!codeOrigin.inlineCallFrame)
                 return globalObject();
             // FIXME: if we ever inline based on executable not function, this code will need to change.
-            return codeOrigin.inlineCallFrame->callee->scope()->globalObject.get();
+            return codeOrigin.inlineCallFrame->callee->scope()->globalObject();
         }
 
         // Jump Tables
@@ -949,8 +952,7 @@ namespace JSC {
         StringJumpTable& stringSwitchJumpTable(int tableIndex) { ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
 
 
-        SymbolTable* symbolTable() { return m_symbolTable; }
-        SharedSymbolTable* sharedSymbolTable() { ASSERT(m_codeType == FunctionCode); return static_cast<SharedSymbolTable*>(m_symbolTable); }
+        SharedSymbolTable* symbolTable() { return m_symbolTable.get(); }
 
         EvalCodeCache& evalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
 
@@ -1361,7 +1363,7 @@ namespace JSC {
         Vector<WriteBarrier<FunctionExecutable> > m_functionDecls;
         Vector<WriteBarrier<FunctionExecutable> > m_functionExprs;
 
-        SymbolTable* m_symbolTable;
+        WriteBarrier<SharedSymbolTable> m_symbolTable;
 
         OwnPtr<CodeBlock> m_alternative;
         
@@ -1423,18 +1425,14 @@ namespace JSC {
     class GlobalCodeBlock : public CodeBlock {
     protected:
         GlobalCodeBlock(CopyParsedBlockTag, GlobalCodeBlock& other)
-            : CodeBlock(CopyParsedBlock, other, &m_unsharedSymbolTable)
-            , m_unsharedSymbolTable(other.m_unsharedSymbolTable)
+            : CodeBlock(CopyParsedBlock, other)
         {
         }
         
         GlobalCodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, PassOwnPtr<CodeBlock> alternative)
-            : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, &m_unsharedSymbolTable, false, alternative)
+            : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, false, alternative)
         {
         }
-
-    private:
-        SymbolTable m_unsharedSymbolTable;
     };
 
     class ProgramCodeBlock : public GlobalCodeBlock {
@@ -1451,7 +1449,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
     protected:
-        virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        virtual JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex);
         virtual void jettison();
         virtual bool jitCompileImpl(ExecState*);
         virtual CodeBlock* replacement();
@@ -1486,7 +1484,7 @@ namespace JSC {
         
 #if ENABLE(JIT)
     protected:
-        virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        virtual JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex);
         virtual void jettison();
         virtual bool jitCompileImpl(ExecState*);
         virtual CodeBlock* replacement();
@@ -1501,30 +1499,18 @@ namespace JSC {
     class FunctionCodeBlock : public CodeBlock {
     public:
         FunctionCodeBlock(CopyParsedBlockTag, FunctionCodeBlock& other)
-            : CodeBlock(CopyParsedBlock, other, other.sharedSymbolTable())
+            : CodeBlock(CopyParsedBlock, other)
         {
-            // The fact that we have to do this is yucky, but is necessary because of the
-            // class hierarchy issues described in the comment block for the main
-            // constructor, below.
-            sharedSymbolTable()->ref();
         }
 
-        // Rather than using the usual RefCounted::create idiom for SharedSymbolTable we just use new
-        // as we need to initialise the CodeBlock before we could initialise any RefPtr to hold the shared
-        // symbol table, so we just pass as a raw pointer with a ref count of 1.  We then manually deref
-        // in the destructor.
         FunctionCodeBlock(FunctionExecutable* ownerExecutable, CodeType codeType, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset, bool isConstructor, PassOwnPtr<CodeBlock> alternative = nullptr)
-            : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, SharedSymbolTable::create().leakRef(), isConstructor, alternative)
-        {
-        }
-        ~FunctionCodeBlock()
+            : CodeBlock(ownerExecutable, codeType, globalObject, sourceProvider, sourceOffset, isConstructor, alternative)
         {
-            sharedSymbolTable()->deref();
         }
         
 #if ENABLE(JIT)
     protected:
-        virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        virtual JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex);
         virtual void jettison();
         virtual bool jitCompileImpl(ExecState*);
         virtual CodeBlock* replacement();
diff --git a/Source/JavaScriptCore/bytecode/DFGExitProfile.h b/Source/JavaScriptCore/bytecode/DFGExitProfile.h
index e0aeba2bd..45947c8af 100644
--- a/Source/JavaScriptCore/bytecode/DFGExitProfile.h
+++ b/Source/JavaScriptCore/bytecode/DFGExitProfile.h
@@ -58,6 +58,8 @@ inline const char* exitKindToString(ExitKind kind)
         return "Overflow";
     case NegativeZero:
         return "NegativeZero";
+    case OutOfBounds:
+        return "OutOfBounds";
     case InadequateCoverage:
         return "InadequateCoverage";
     case ArgumentsEscaped:
diff --git a/Source/JavaScriptCore/bytecode/EvalCodeCache.h b/Source/JavaScriptCore/bytecode/EvalCodeCache.h
index fba1d32f5..29b17dd82 100644
--- a/Source/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/Source/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -34,7 +34,6 @@
 #include "Nodes.h"
 #include "Parser.h"
 #include "SourceCode.h"
-#include "UString.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/StringHash.h>
@@ -45,32 +44,32 @@ namespace JSC {
 
     class EvalCodeCache {
     public:
-        EvalExecutable* tryGet(bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain)
+        EvalExecutable* tryGet(bool inStrictContext, const String& evalSource, JSScope* scope)
         {
-            if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
+            if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && scope->begin()->isVariableObject())
                 return m_cacheMap.get(evalSource.impl()).get();
             return 0;
         }
         
-        EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+        EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const String& evalSource, JSScope* scope, JSValue& exceptionValue)
         {
             EvalExecutable* evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext);
-            exceptionValue = evalExecutable->compile(exec, scopeChain);
+            exceptionValue = evalExecutable->compile(exec, scope);
             if (exceptionValue)
                 return 0;
             
-            if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
+            if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && scope->begin()->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
                 m_cacheMap.set(evalSource.impl(), WriteBarrier<EvalExecutable>(exec->globalData(), owner, evalExecutable));
             
             return evalExecutable;
         }
-        
-        EvalExecutable* get(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+
+        EvalExecutable* get(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, const String& evalSource, JSScope* scope, JSValue& exceptionValue)
         {
-            EvalExecutable* evalExecutable = tryGet(inStrictContext, evalSource, scopeChain);
+            EvalExecutable* evalExecutable = tryGet(inStrictContext, evalSource, scope);
 
             if (!evalExecutable)
-                evalExecutable = getSlow(exec, owner, inStrictContext, evalSource, scopeChain, exceptionValue);
+                evalExecutable = getSlow(exec, owner, inStrictContext, evalSource, scope, exceptionValue);
 
             return evalExecutable;
         }
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
index 0df0f44e7..8f2a46879 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
@@ -27,6 +27,8 @@
 #include "GetByIdStatus.h"
 
 #include "CodeBlock.h"
+#include "JSScope.h"
+#include "LLIntData.h"
 #include "LowLevelInterpreter.h"
 
 namespace JSC {
@@ -39,7 +41,7 @@ GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
 #if ENABLE(LLINT)
     Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
     
-    if (instruction[0].u.opcode == llint_op_method_check)
+    if (instruction[0].u.opcode == LLInt::getOpcode(llint_op_method_check))
         instruction++;
 
     Structure* structure = instruction[4].u.structure.get();
diff --git a/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h b/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
index c466c750d..99292b7f3 100644
--- a/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
+++ b/Source/JavaScriptCore/bytecode/GlobalResolveInfo.h
@@ -40,7 +40,7 @@ struct GlobalResolveInfo {
     }
     
     WriteBarrier<Structure> structure;
-    unsigned offset;
+    PropertyOffset offset;
     unsigned bytecodeOffset; // Only valid in old JIT code. This means nothing in the DFG.
 };
 
diff --git a/Source/JavaScriptCore/bytecode/JumpTable.h b/Source/JavaScriptCore/bytecode/JumpTable.h
index 5bbe04710..a01f90cb0 100644
--- a/Source/JavaScriptCore/bytecode/JumpTable.h
+++ b/Source/JavaScriptCore/bytecode/JumpTable.h
@@ -31,9 +31,9 @@
 #define JumpTable_h
 
 #include "MacroAssembler.h"
-#include "UString.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
+#include <wtf/text/StringImpl.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
index 777b4876f..a63cccaec 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.h
+++ b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -30,6 +30,8 @@
 #ifndef Opcode_h
 #define Opcode_h
 
+#include "LLIntOpcode.h"
+
 #include <algorithm>
 #include <string.h>
 
@@ -186,9 +188,9 @@ namespace JSC {
         macro(op_get_pnames, 6) \
         macro(op_next_pname, 7) \
         \
-        macro(op_push_scope, 2) \
+        macro(op_push_with_scope, 2) \
         macro(op_pop_scope, 1) \
-        macro(op_push_new_scope, 4) \
+        macro(op_push_name_scope, 4) \
         \
         macro(op_catch, 2) \
         macro(op_throw, 2) \
@@ -198,6 +200,8 @@ namespace JSC {
         macro(op_profile_will_call, 2) \
         macro(op_profile_did_call, 2) \
         \
+        FOR_EACH_LLINT_OPCODE_EXTENSION(macro) \
+        \
         macro(op_end, 2) // end must be the last opcode in the list
 
     #define OPCODE_ID_ENUM(opcode, length) opcode,
@@ -221,13 +225,9 @@ namespace JSC {
         FOR_EACH_OPCODE_ID(VERIFY_OPCODE_ID);
     #undef VERIFY_OPCODE_ID
 
-#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
-#if COMPILER(RVCT) || COMPILER(INTEL)
+#if ENABLE(COMPUTED_GOTO_OPCODES)
     typedef void* Opcode;
 #else
-    typedef const void* Opcode;
-#endif
-#else
     typedef OpcodeID Opcode;
 #endif
 
diff --git a/Source/JavaScriptCore/bytecode/Operands.h b/Source/JavaScriptCore/bytecode/Operands.h
index 8ea3e5b60..b0f0e692c 100644
--- a/Source/JavaScriptCore/bytecode/Operands.h
+++ b/Source/JavaScriptCore/bytecode/Operands.h
@@ -28,7 +28,7 @@
 
 #include "CallFrame.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 #include <wtf/Vector.h>
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
index e9456313a..35800f3dd 100644
--- a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
@@ -27,6 +27,7 @@
 #include "PutByIdStatus.h"
 
 #include "CodeBlock.h"
+#include "LLIntData.h"
 #include "LowLevelInterpreter.h"
 #include "Structure.h"
 #include "StructureChain.h"
@@ -45,8 +46,8 @@ PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
     if (!structure)
         return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
     
-    if (instruction[0].u.opcode == llint_op_put_by_id
-        || instruction[0].u.opcode == llint_op_put_by_id_out_of_line) {
+    if (instruction[0].u.opcode == LLInt::getOpcode(llint_op_put_by_id)
+        || instruction[0].u.opcode == LLInt::getOpcode(llint_op_put_by_id_out_of_line)) {
         PropertyOffset offset = structure->get(*profiledBlock->globalData(), ident);
         if (!isValidOffset(offset))
             return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
@@ -56,10 +57,10 @@ PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
     
     ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());
     
-    ASSERT(instruction[0].u.opcode == llint_op_put_by_id_transition_direct
-           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal
-           || instruction[0].u.opcode == llint_op_put_by_id_transition_direct_out_of_line
-           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal_out_of_line);
+    ASSERT(instruction[0].u.opcode == LLInt::getOpcode(llint_op_put_by_id_transition_direct)
+           || instruction[0].u.opcode == LLInt::getOpcode(llint_op_put_by_id_transition_normal)
+           || instruction[0].u.opcode == LLInt::getOpcode(llint_op_put_by_id_transition_direct_out_of_line)
+           || instruction[0].u.opcode == LLInt::getOpcode(llint_op_put_by_id_transition_normal_out_of_line));
     
     Structure* newStructure = instruction[6].u.structure.get();
     StructureChain* chain = instruction[7].u.structureChain.get();
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
index 783e7c615..c9fd7dca2 100644
--- a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
@@ -52,8 +52,8 @@ static ResolveGlobalStatus computeForLLInt(CodeBlock* codeBlock, unsigned byteco
 {
 #if ENABLE(LLINT)
     Instruction* instruction = codeBlock->instructions().begin() + bytecodeIndex;
-    
-    ASSERT(instruction[0].u.opcode == llint_op_resolve_global);
+
+    ASSERT(instruction[0].u.opcode == LLInt::getOpcode(op_resolve_global));
     
     Structure* structure = instruction[3].u.structure.get();
     if (!structure)
diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.h b/Source/JavaScriptCore/bytecode/SpeculatedType.h
index 4ecc53776..9d2c61ae8 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.h
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.h
@@ -82,6 +82,16 @@ inline bool isCellSpeculation(SpeculatedType value)
     return !!(value & SpecCell) && !(value & ~SpecCell);
 }
 
+inline bool isNonStringCellSpeculation(SpeculatedType value)
+{
+    return !!(value & (SpecCell & ~SpecString)) && !(value & ~(SpecCell & ~SpecString));
+}
+
+inline bool isNonStringCellOrOtherSpeculation(SpeculatedType value)
+{
+    return !!(value & ((SpecCell & ~SpecString) | SpecOther)) && !(value & ~((SpecCell & ~SpecString) | SpecOther));
+}
+
 inline bool isObjectSpeculation(SpeculatedType value)
 {
     return !!(value & SpecObjectMask) && !(value & ~SpecObjectMask);
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
index f66860a45..9238fefdc 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
@@ -28,7 +28,7 @@
 
 #include "JSObject.h"
 #include "PolymorphicPutByIdList.h"
-#include "ScopeChain.h"
+
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index c8cfa74b6..52b576da2 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -33,13 +33,13 @@
 
 #include "BatchedTransitionOptimizer.h"
 #include "Comment.h"
+#include "Interpreter.h"
 #include "JSActivation.h"
 #include "JSFunction.h"
-#include "Interpreter.h"
+#include "JSNameScope.h"
 #include "LowLevelInterpreter.h"
-#include "ScopeChain.h"
 #include "StrongInlines.h"
-#include "UString.h"
+#include <wtf/text/WTFString.h>
 
 using namespace std;
 
@@ -188,10 +188,28 @@ JSObject* BytecodeGenerator::generate()
 
     m_scopeNode->emitBytecode(*this);
     
+    for (unsigned i = 0; i < m_tryRanges.size(); ++i) {
+        TryRange& range = m_tryRanges[i];
+        ASSERT(range.tryData->targetScopeDepth != UINT_MAX);
+        HandlerInfo info = {
+            range.start->bind(0, 0), range.end->bind(0, 0),
+            range.tryData->target->bind(0, 0), range.tryData->targetScopeDepth
+#if ENABLE(JIT)
+            ,
+#if ENABLE(LLINT)
+            CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(LLInt::getCodePtr(llint_op_catch)))
+#else
+            CodeLocationLabel()
+#endif
+#endif
+        };
+        m_codeBlock->addExceptionHandler(info);
+    }
+    
     m_codeBlock->instructions() = RefCountedArray<Instruction>(m_instructions);
 
     if (s_dumpsGeneratedCode)
-        m_codeBlock->dump(m_scopeChain->globalObject->globalExec());
+        m_codeBlock->dump(m_scope->globalObject()->globalExec());
 
 #ifdef NDEBUG
     if ((m_codeType == FunctionCode && !m_codeBlock->needsFullScopeChain() && !m_codeBlock->usesArguments()) || m_codeType == EvalCode)
@@ -201,7 +219,7 @@ JSObject* BytecodeGenerator::generate()
     m_codeBlock->shrinkToFit(CodeBlock::EarlyShrink);
 
     if (m_expressionTooDeep)
-        return createOutOfMemoryError(m_scopeChain->globalObject.get());
+        return createOutOfMemoryError(m_scope->globalObject());
     return 0;
 }
 
@@ -242,11 +260,11 @@ void BytecodeGenerator::preserveLastVar()
         m_lastVar = &m_calleeRegisters.last();
 }
 
-BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* scopeChain, SymbolTable* symbolTable, ProgramCodeBlock* codeBlock, CompilationKind compilationKind)
-    : m_shouldEmitDebugHooks(scopeChain->globalObject->debugger())
-    , m_shouldEmitProfileHooks(scopeChain->globalObject->globalObjectMethodTable()->supportsProfiling(scopeChain->globalObject.get()))
-    , m_shouldEmitRichSourceInfo(scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()))
-    , m_scopeChain(*scopeChain->globalData, scopeChain)
+BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, JSScope* scope, SymbolTable* symbolTable, ProgramCodeBlock* codeBlock, CompilationKind compilationKind)
+    : m_shouldEmitDebugHooks(scope->globalObject()->debugger())
+    , m_shouldEmitProfileHooks(scope->globalObject()->globalObjectMethodTable()->supportsProfiling(scope->globalObject()))
+    , m_shouldEmitRichSourceInfo(scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()))
+    , m_scope(*scope->globalData(), scope)
     , m_symbolTable(symbolTable)
 #if ENABLE(BYTECODE_COMMENTS)
     , m_currentCommentString(0)
@@ -263,7 +281,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
     , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(scopeChain->globalData)
+    , m_globalData(scope->globalData())
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
@@ -288,7 +306,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
     if (compilationKind == OptimizingCompilation)
         return;
 
-    JSGlobalObject* globalObject = scopeChain->globalObject.get();
+    JSGlobalObject* globalObject = scope->globalObject();
     ExecState* exec = globalObject->globalExec();
     
     BatchedTransitionOptimizer optimizer(*m_globalData, globalObject);
@@ -306,7 +324,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
         bool propertyDidExist = 
             globalObject->removeDirect(*m_globalData, function->ident()); // Newly declared functions overwrite existing properties.
         
-        JSValue value = JSFunction::create(exec, makeFunction(exec, function), scopeChain);
+        JSValue value = JSFunction::create(exec, FunctionExecutable::create(*m_globalData, function), scope);
         int index = addGlobalVar(
             function->ident(), IsVariable,
             !propertyDidExist ? IsFunctionToSpecialize : NotFunctionOrNotSpecializable);
@@ -323,11 +341,11 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
     }
 }
 
-BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainNode* scopeChain, SymbolTable* symbolTable, CodeBlock* codeBlock, CompilationKind)
-    : m_shouldEmitDebugHooks(scopeChain->globalObject->debugger())
-    , m_shouldEmitProfileHooks(scopeChain->globalObject->globalObjectMethodTable()->supportsProfiling(scopeChain->globalObject.get()))
-    , m_shouldEmitRichSourceInfo(scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()))
-    , m_scopeChain(*scopeChain->globalData, scopeChain)
+BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, JSScope* scope, SymbolTable* symbolTable, CodeBlock* codeBlock, CompilationKind)
+    : m_shouldEmitDebugHooks(scope->globalObject()->debugger())
+    , m_shouldEmitProfileHooks(scope->globalObject()->globalObjectMethodTable()->supportsProfiling(scope->globalObject()))
+    , m_shouldEmitRichSourceInfo(scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()))
+    , m_scope(*scope->globalData(), scope)
     , m_symbolTable(symbolTable)
 #if ENABLE(BYTECODE_COMMENTS)
     , m_currentCommentString(0)
@@ -344,7 +362,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
     , m_hasCreatedActivation(false)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(scopeChain->globalData)
+    , m_globalData(scope->globalData())
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
@@ -401,6 +419,8 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
         }
     }
 
+    RegisterID* calleeRegister = resolveCallee(functionBody); // May push to the scope chain and/or add a captured var.
+
     const DeclarationStacks::FunctionStack& functionStack = functionBody->functionStack();
     const DeclarationStacks::VarStack& varStack = functionBody->varStack();
 
@@ -438,6 +458,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
     }
 
     codeBlock->m_numCapturedVars = codeBlock->m_numVars;
+
     m_firstLazyFunction = codeBlock->m_numVars;
     for (size_t i = 0; i < functionStack.size(); ++i) {
         FunctionBodyNode* function = functionStack[i];
@@ -479,6 +500,9 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
 
     preserveLastVar();
 
+    // We declare the callee's name last because it should lose to a var, function, and/or parameter declaration.
+    addCallee(functionBody, calleeRegister);
+
     if (isConstructor()) {
         prependComment("'this' because we are a Constructor function");
         emitOpcode(op_create_this);
@@ -490,11 +514,11 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
     }
 }
 
-BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeChain, SymbolTable* symbolTable, EvalCodeBlock* codeBlock, CompilationKind)
-    : m_shouldEmitDebugHooks(scopeChain->globalObject->debugger())
-    , m_shouldEmitProfileHooks(scopeChain->globalObject->globalObjectMethodTable()->supportsProfiling(scopeChain->globalObject.get()))
-    , m_shouldEmitRichSourceInfo(scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()))
-    , m_scopeChain(*scopeChain->globalData, scopeChain)
+BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, JSScope* scope, SymbolTable* symbolTable, EvalCodeBlock* codeBlock, CompilationKind)
+    : m_shouldEmitDebugHooks(scope->globalObject()->debugger())
+    , m_shouldEmitProfileHooks(scope->globalObject()->globalObjectMethodTable()->supportsProfiling(scope->globalObject()))
+    , m_shouldEmitRichSourceInfo(scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()))
+    , m_scope(*scope->globalData(), scope)
     , m_symbolTable(symbolTable)
 #if ENABLE(BYTECODE_COMMENTS)
     , m_currentCommentString(0)
@@ -511,7 +535,7 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeCh
     , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
-    , m_globalData(scopeChain->globalData)
+    , m_globalData(scope->globalData())
     , m_lastOpcodeID(op_end)
 #ifndef NDEBUG
     , m_lastOpcodePosition(0)
@@ -531,7 +555,7 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeCh
 
     const DeclarationStacks::FunctionStack& functionStack = evalNode->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i)
-        m_codeBlock->addFunctionDecl(makeFunction(m_globalData, functionStack[i]));
+        m_codeBlock->addFunctionDecl(FunctionExecutable::create(*m_globalData, functionStack[i]));
 
     const DeclarationStacks::VarStack& varStack = evalNode->varStack();
     unsigned numVariables = varStack.size();
@@ -556,6 +580,53 @@ RegisterID* BytecodeGenerator::emitInitLazyRegister(RegisterID* reg)
     return reg;
 }
 
+RegisterID* BytecodeGenerator::resolveCallee(FunctionBodyNode* functionBodyNode)
+{
+    if (functionBodyNode->ident().isNull() || !functionBodyNode->functionNameIsInScope())
+        return 0;
+
+    m_calleeRegister.setIndex(RegisterFile::Callee);
+
+    // If non-strict eval is in play, we use a separate object in the scope chain for the callee's name.
+    if ((m_codeBlock->usesEval() && !m_codeBlock->isStrictMode()) || m_shouldEmitDebugHooks) {
+        emitOpcode(op_push_name_scope);
+        instructions().append(addConstant(functionBodyNode->ident()));
+        instructions().append(m_calleeRegister.index());
+        instructions().append(ReadOnly | DontDelete);
+
+        // Put a mirror object in compilation scope, so compile-time variable resolution sees the property name we'll see at runtime.
+        m_scope.set(*globalData(),
+            JSNameScope::create(
+                m_scope->globalObject()->globalExec(),
+                functionBodyNode->ident(),
+                jsUndefined(),
+                ReadOnly | DontDelete,
+                m_scope.get()
+            )
+        );
+        return 0;
+    }
+
+    if (!functionBodyNode->captures(functionBodyNode->ident()))
+        return &m_calleeRegister;
+
+    // Move the callee into the captured section of the stack.
+    return emitMove(addVar(), &m_calleeRegister);
+}
+
+void BytecodeGenerator::addCallee(FunctionBodyNode* functionBodyNode, RegisterID* calleeRegister)
+{
+    if (functionBodyNode->ident().isNull() || !functionBodyNode->functionNameIsInScope())
+        return;
+
+    // If non-strict eval is in play, we use a separate object in the scope chain for the callee's name.
+    if ((m_codeBlock->usesEval() && !m_codeBlock->isStrictMode()) || m_shouldEmitDebugHooks)
+        return;
+
+    ASSERT(calleeRegister);
+    symbolTable().add(functionBodyNode->ident().impl(), SymbolTableEntry(calleeRegister->index(), ReadOnly));
+}
+
 void BytecodeGenerator::addParameter(const Identifier& ident, int parameterIndex)
 {
     // Parameters overwrite var declarations, but not function declarations.
@@ -624,14 +695,6 @@ RegisterID* BytecodeGenerator::newTemporary()
     return result;
 }
 
-RegisterID* BytecodeGenerator::highestUsedRegister()
-{
-    size_t count = m_codeBlock->m_numCalleeRegisters;
-    while (m_calleeRegisters.size() < count)
-        newRegister();
-    return &m_calleeRegisters.last();
-}
-
 PassRefPtr<LabelScope> BytecodeGenerator::newLabelScope(LabelScope::Type type, const Identifier* name)
 {
     // Reclaim free label scopes.
@@ -1022,7 +1085,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond,
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scopeChain->globalObject->callFunction()));
+    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scope->globalObject()->callFunction()));
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -1033,7 +1096,7 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond
 
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
-    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scopeChain->globalObject->applyFunction()));
+    instructions().append(Instruction(*m_globalData, m_codeBlock->ownerExecutable(), m_scope->globalObject()->applyFunction()));
     instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
@@ -1140,7 +1203,7 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
             && m_codeBlock->constantRegister(src2->index()).get().isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index()).get())->tryGetValue();
+            const String& value = asString(m_codeBlock->constantRegister(src2->index()).get())->tryGetValue();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -1215,7 +1278,7 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, const Identifier& ident
 {
     JSString*& stringInMap = m_stringMap.add(identifier.impl(), 0).iterator->second;
     if (!stringInMap)
-        stringInMap = jsOwnedString(globalData(), identifier.ustring());
+        stringInMap = jsOwnedString(globalData(), identifier.string());
     return emitLoad(dst, JSValue(stringInMap));
 }
 
@@ -1248,19 +1311,19 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
     if (property == propertyNames().arguments || !canOptimizeNonLocals())
         return ResolveResult::dynamicResolve(0);
 
-    ScopeChainIterator iter = m_scopeChain->begin();
-    ScopeChainIterator end = m_scopeChain->end();
+    ScopeChainIterator iter = m_scope->begin();
+    ScopeChainIterator end = m_scope->end();
     size_t depth = 0;
     size_t depthOfFirstScopeWithDynamicChecks = 0;
     unsigned flags = 0;
     for (; iter != end; ++iter, ++depth) {
-        JSObject* currentScope = iter->get();
+        JSObject* currentScope = iter.get();
         if (!currentScope->isVariableObject()) {
             flags |= ResolveResult::DynamicFlag;
             break;
         }
         JSSymbolTableObject* currentVariableObject = jsCast<JSSymbolTableObject*>(currentScope);
-        SymbolTableEntry entry = currentVariableObject->symbolTable().get(property.impl());
+        SymbolTableEntry entry = currentVariableObject->symbolTable()->get(property.impl());
 
         // Found the property
         if (!entry.isNull()) {
@@ -1292,7 +1355,7 @@ ResolveResult BytecodeGenerator::resolve(const Identifier& property)
     }
 
     // Can't locate the property but we're able to avoid a few lookups.
-    JSObject* scope = iter->get();
+    JSObject* scope = iter.get();
     // Step over the function's activation, if it needs one. At this point we
     // know there is no dynamic scope in the function itself, so this is safe to
     // do.
@@ -1319,15 +1382,15 @@ ResolveResult BytecodeGenerator::resolveConstDecl(const Identifier& property)
     }
 
     // Const declarations in eval code or global code.
-    ScopeChainIterator iter = scopeChain()->begin();
-    ScopeChainIterator end = scopeChain()->end();
+    ScopeChainIterator iter = scope()->begin();
+    ScopeChainIterator end = scope()->end();
     size_t depth = 0;
     for (; iter != end; ++iter, ++depth) {
-        JSObject* currentScope = iter->get();
+        JSObject* currentScope = iter.get();
         if (!currentScope->isVariableObject())
             continue;
         JSSymbolTableObject* currentVariableObject = jsCast<JSSymbolTableObject*>(currentScope);
-        SymbolTableEntry entry = currentVariableObject->symbolTable().get(property.impl());
+        SymbolTableEntry entry = currentVariableObject->symbolTable()->get(property.impl());
         if (entry.isNull())
             continue;
         if (++iter == end)
@@ -1583,7 +1646,7 @@ RegisterID* BytecodeGenerator::emitPutStaticVar(const ResolveResult& resolveResu
         emitOpcode(op_put_global_var_check);
         instructions().append(resolveResult.registerPointer());
         instructions().append(value->index());
-        instructions().append(jsCast<JSGlobalObject*>(resolveResult.globalObject())->symbolTable().get(identifier.impl()).addressOfIsWatched());
+        instructions().append(jsCast<JSGlobalObject*>(resolveResult.globalObject())->symbolTable()->get(identifier.impl()).addressOfIsWatched());
         instructions().append(addConstant(identifier));
         return value;
 
@@ -1757,7 +1820,7 @@ JSString* BytecodeGenerator::addStringConstant(const Identifier& identifier)
 {
     JSString*& stringInMap = m_stringMap.add(identifier.impl(), 0).iterator->second;
     if (!stringInMap) {
-        stringInMap = jsString(globalData(), identifier.ustring());
+        stringInMap = jsString(globalData(), identifier.string());
         addConstantValue(stringInMap);
     }
     return stringInMap;
@@ -1820,14 +1883,14 @@ RegisterID* BytecodeGenerator::emitNewArray(RegisterID* dst, ElementNode* elemen
 
 RegisterID* BytecodeGenerator::emitNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
-    return emitNewFunctionInternal(dst, m_codeBlock->addFunctionDecl(makeFunction(m_globalData, function)), false);
+    return emitNewFunctionInternal(dst, m_codeBlock->addFunctionDecl(FunctionExecutable::create(*m_globalData, function)), false);
 }
 
 RegisterID* BytecodeGenerator::emitLazyNewFunction(RegisterID* dst, FunctionBodyNode* function)
 {
     FunctionOffsetMap::AddResult ptr = m_functionOffsets.add(function, 0);
     if (ptr.isNewEntry)
-        ptr.iterator->second = m_codeBlock->addFunctionDecl(makeFunction(m_globalData, function));
+        ptr.iterator->second = m_codeBlock->addFunctionDecl(FunctionExecutable::create(*m_globalData, function));
     return emitNewFunctionInternal(dst, ptr.iterator->second, true);
 }
 
@@ -1852,7 +1915,7 @@ RegisterID* BytecodeGenerator::emitNewRegExp(RegisterID* dst, RegExp* regExp)
 RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* r0, FuncExprNode* n)
 {
     FunctionBodyNode* function = n->body();
-    unsigned index = m_codeBlock->addFunctionExpr(makeFunction(m_globalData, function));
+    unsigned index = m_codeBlock->addFunctionExpr(FunctionExecutable::create(*m_globalData, function));
     
     createActivationIfNecessary();
     emitOpcode(op_new_func_exp);
@@ -1925,6 +1988,7 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     emitExpressionInfo(divot, startOffset, endOffset);
 
     // Emit call.
+    ArrayProfile* arrayProfile = newArrayProfile();
     emitOpcode(opcodeID);
     instructions().append(func->index()); // func
     instructions().append(callArguments.argumentCountIncludingThis()); // argCount
@@ -1934,7 +1998,7 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
 #else
     instructions().append(0);
 #endif
-    instructions().append(0);
+    instructions().append(arrayProfile);
     if (dst != ignoredResult()) {
         ValueProfile* profile = emitProfiledOpcode(op_call_put_result);
         instructions().append(dst->index()); // dst
@@ -2074,15 +2138,14 @@ void BytecodeGenerator::emitToPrimitive(RegisterID* dst, RegisterID* src)
     instructions().append(src->index());
 }
 
-RegisterID* BytecodeGenerator::emitPushScope(RegisterID* scope)
+RegisterID* BytecodeGenerator::emitPushWithScope(RegisterID* scope)
 {
-    ASSERT(scope->isTemporary());
     ControlFlowContext context;
     context.isFinallyBlock = false;
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
 
-    return emitUnaryNoDstOp(op_push_scope, scope);
+    return emitUnaryNoDstOp(op_push_with_scope, scope);
 }
 
 void BytecodeGenerator::emitPopScope()
@@ -2121,6 +2184,7 @@ void BytecodeGenerator::pushFinallyContext(StatementNode* finallyBlock)
         m_scopeContextStack.size(),
         m_switchContextStack.size(),
         m_forInContextStack.size(),
+        m_tryContextStack.size(),
         m_labelScopes.size(),
         m_finallyDepth,
         m_dynamicScopeDepth
@@ -2254,14 +2318,18 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
         Vector<ControlFlowContext> savedScopeContextStack;
         Vector<SwitchInfo> savedSwitchContextStack;
         Vector<ForInContext> savedForInContextStack;
+        Vector<TryContext> poppedTryContexts;
         SegmentedVector<LabelScope, 8> savedLabelScopes;
         while (topScope > bottomScope && topScope->isFinallyBlock) {
+            RefPtr<Label> beforeFinally = emitLabel(newLabel().get());
+            
             // Save the current state of the world while instating the state of the world
             // for the finally block.
             FinallyContext finallyContext = topScope->finallyContext;
             bool flipScopes = finallyContext.scopeContextStackSize != m_scopeContextStack.size();
             bool flipSwitches = finallyContext.switchContextStackSize != m_switchContextStack.size();
             bool flipForIns = finallyContext.forInContextStackSize != m_forInContextStack.size();
+            bool flipTries = finallyContext.tryContextStackSize != m_tryContextStack.size();
             bool flipLabelScopes = finallyContext.labelScopesSize != m_labelScopes.size();
             int topScopeIndex = -1;
             int bottomScopeIndex = -1;
@@ -2279,6 +2347,19 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
                 savedForInContextStack = m_forInContextStack;
                 m_forInContextStack.shrink(finallyContext.forInContextStackSize);
             }
+            if (flipTries) {
+                while (m_tryContextStack.size() != finallyContext.tryContextStackSize) {
+                    ASSERT(m_tryContextStack.size() > finallyContext.tryContextStackSize);
+                    TryContext context = m_tryContextStack.last();
+                    m_tryContextStack.removeLast();
+                    TryRange range;
+                    range.start = context.start;
+                    range.end = beforeFinally;
+                    range.tryData = context.tryData;
+                    m_tryRanges.append(range);
+                    poppedTryContexts.append(context);
+                }
+            }
             if (flipLabelScopes) {
                 savedLabelScopes = m_labelScopes;
                 while (m_labelScopes.size() > finallyContext.labelScopesSize)
@@ -2292,6 +2373,8 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
             // Emit the finally block.
             emitNode(finallyContext.finallyBlock);
             
+            RefPtr<Label> afterFinally = emitLabel(newLabel().get());
+            
             // Restore the state of the world.
             if (flipScopes) {
                 m_scopeContextStack = savedScopeContextStack;
@@ -2302,6 +2385,14 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
                 m_switchContextStack = savedSwitchContextStack;
             if (flipForIns)
                 m_forInContextStack = savedForInContextStack;
+            if (flipTries) {
+                ASSERT(m_tryContextStack.size() == finallyContext.tryContextStackSize);
+                for (unsigned i = poppedTryContexts.size(); i--;) {
+                    TryContext context = poppedTryContexts[i];
+                    context.start = afterFinally;
+                    m_tryContextStack.append(context);
+                }
+            }
             if (flipLabelScopes)
                 m_labelScopes = savedLabelScopes;
             m_finallyDepth = savedFinallyDepth;
@@ -2361,42 +2452,61 @@ RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID*
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* start, Label* end)
+TryData* BytecodeGenerator::pushTry(Label* start)
+{
+    TryData tryData;
+    tryData.target = newLabel();
+    tryData.targetScopeDepth = UINT_MAX;
+    m_tryData.append(tryData);
+    TryData* result = &m_tryData.last();
+    
+    TryContext tryContext;
+    tryContext.start = start;
+    tryContext.tryData = result;
+    
+    m_tryContextStack.append(tryContext);
+    
+    return result;
+}
+
+RegisterID* BytecodeGenerator::popTryAndEmitCatch(TryData* tryData, RegisterID* targetRegister, Label* end)
 {
     m_usesExceptions = true;
-#if ENABLE(JIT)
-#if ENABLE(LLINT)
-    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(bitwise_cast<void*>(&llint_op_catch))) };
-#else
-    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
-#endif
-#else
-    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
-#endif
+    
+    ASSERT_UNUSED(tryData, m_tryContextStack.last().tryData == tryData);
+    
+    TryRange tryRange;
+    tryRange.start = m_tryContextStack.last().start;
+    tryRange.end = end;
+    tryRange.tryData = m_tryContextStack.last().tryData;
+    m_tryRanges.append(tryRange);
+    m_tryContextStack.removeLast();
+    
+    emitLabel(tryRange.tryData->target.get());
+    tryRange.tryData->targetScopeDepth = m_dynamicScopeDepth + m_baseScopeDepth;
 
-    m_codeBlock->addExceptionHandler(info);
     emitOpcode(op_catch);
     instructions().append(targetRegister->index());
     return targetRegister;
 }
 
-void BytecodeGenerator::emitThrowReferenceError(const UString& message)
+void BytecodeGenerator::emitThrowReferenceError(const String& message)
 {
     emitOpcode(op_throw_reference_error);
     instructions().append(addConstantValue(jsString(globalData(), message))->index());
 }
 
-void BytecodeGenerator::emitPushNewScope(RegisterID* dst, const Identifier& property, RegisterID* value)
+void BytecodeGenerator::emitPushNameScope(const Identifier& property, RegisterID* value, unsigned attributes)
 {
     ControlFlowContext context;
     context.isFinallyBlock = false;
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
 
-    emitOpcode(op_push_new_scope);
-    instructions().append(dst->index());
+    emitOpcode(op_push_name_scope);
     instructions().append(addConstant(property));
     instructions().append(value->index());
+    instructions().append(attributes);
 }
 
 void BytecodeGenerator::beginSwitch(RegisterID* scrutineeRegister, SwitchInfo::SwitchType type)
@@ -2537,4 +2647,13 @@ bool BytecodeGenerator::isArgumentNumber(const Identifier& ident, int argumentNu
     return registerID->index() == CallFrame::argumentOffset(argumentNumber);
 }
 
+void BytecodeGenerator::emitReadOnlyExceptionIfNeeded()
+{
+    if (!isStrictMode())
+        return;
+
+    RefPtr<RegisterID> error = emitLoad(newTemporary(), JSValue(createTypeError(scope()->globalObject()->globalExec(), StrictModeReadonlyPropertyWriteError)));
+    emitThrow(error.get());
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 9c094414d..037a2ce25 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -49,7 +49,7 @@ namespace JSC {
 
     class Identifier;
     class Label;
-    class ScopeChainNode;
+    class JSScope;
 
     class CallArguments {
     public:
@@ -75,6 +75,7 @@ namespace JSC {
         unsigned scopeContextStackSize;
         unsigned switchContextStackSize;
         unsigned forInContextStackSize;
+        unsigned tryContextStackSize;
         unsigned labelScopesSize;
         int finallyDepth;
         int dynamicScopeDepth;
@@ -92,6 +93,22 @@ namespace JSC {
         RefPtr<RegisterID> propertyRegister;
     };
 
+    struct TryData {
+        RefPtr<Label> target;
+        unsigned targetScopeDepth;
+    };
+
+    struct TryContext {
+        RefPtr<Label> start;
+        TryData* tryData;
+    };
+
+    struct TryRange {
+        RefPtr<Label> start;
+        RefPtr<Label> end;
+        TryData* tryData;
+    };
+
     class ResolveResult {
     public:
         enum Flags {
@@ -244,9 +261,9 @@ namespace JSC {
         JS_EXPORT_PRIVATE static void setDumpsGeneratedCode(bool dumpsGeneratedCode);
         static bool dumpsGeneratedCode();
 
-        BytecodeGenerator(ProgramNode*, ScopeChainNode*, SymbolTable*, ProgramCodeBlock*, CompilationKind);
-        BytecodeGenerator(FunctionBodyNode*, ScopeChainNode*, SymbolTable*, CodeBlock*, CompilationKind);
-        BytecodeGenerator(EvalNode*, ScopeChainNode*, SymbolTable*, EvalCodeBlock*, CompilationKind);
+        BytecodeGenerator(ProgramNode*, JSScope*, SymbolTable*, ProgramCodeBlock*, CompilationKind);
+        BytecodeGenerator(FunctionBodyNode*, JSScope*, SymbolTable*, CodeBlock*, CompilationKind);
+        BytecodeGenerator(EvalNode*, JSScope*, SymbolTable*, EvalCodeBlock*, CompilationKind);
 
         ~BytecodeGenerator();
         
@@ -279,8 +296,6 @@ namespace JSC {
         // the next instruction may overwrite it.
         RegisterID* newTemporary();
 
-        RegisterID* highestUsedRegister();
-
         // The same as newTemporary(), but this function returns "suggestion" if
         // "suggestion" is a temporary. This function is helpful in situations
         // where you've put "suggestion" in a RefPtr, but you'd like to allow
@@ -492,18 +507,24 @@ namespace JSC {
         RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget);
         RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target);
 
-        RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
+        void emitReadOnlyExceptionIfNeeded();
+
+        // Start a try block. 'start' must have been emitted.
+        TryData* pushTry(Label* start);
+        // End a try block. 'end' must have been emitted.
+        RegisterID* popTryAndEmitCatch(TryData*, RegisterID* targetRegister, Label* end);
+
         void emitThrow(RegisterID* exc)
         { 
             m_usesExceptions = true;
             emitUnaryNoDstOp(op_throw, exc);
         }
 
-        void emitThrowReferenceError(const UString& message);
+        void emitThrowReferenceError(const String& message);
 
-        void emitPushNewScope(RegisterID* dst, const Identifier& property, RegisterID* value);
+        void emitPushNameScope(const Identifier& property, RegisterID* value, unsigned attributes);
 
-        RegisterID* emitPushScope(RegisterID* scope);
+        RegisterID* emitPushWithScope(RegisterID* scope);
         void emitPopScope();
 
         void emitDebugHook(DebugHookID, int firstLine, int lastLine, int column);
@@ -537,7 +558,7 @@ namespace JSC {
         
         bool isStrictMode() const { return m_codeBlock->isStrictMode(); }
         
-        ScopeChainNode* scopeChain() const { return m_scopeChain.get(); }
+        JSScope* scope() const { return m_scope.get(); }
 
     private:
         friend class Label;
@@ -596,7 +617,9 @@ namespace JSC {
         int addGlobalVar(const Identifier&, ConstantMode, FunctionMode);
 
         void addParameter(const Identifier&, int parameterIndex);
-        
+        RegisterID* resolveCallee(FunctionBodyNode*);
+        void addCallee(FunctionBodyNode*, RegisterID*);
+
         void preserveLastVar();
         bool shouldAvoidResolveGlobal();
 
@@ -605,6 +628,9 @@ namespace JSC {
             if (index >= 0)
                 return m_calleeRegisters[index];
 
+            if (index == RegisterFile::Callee)
+                return m_calleeRegister;
+
             ASSERT(m_parameters.size());
             return m_parameters[index + m_parameters.size() + RegisterFile::CallFrameHeaderSize];
         }
@@ -615,16 +641,6 @@ namespace JSC {
 
         unsigned addConstantBuffer(unsigned length);
         
-        FunctionExecutable* makeFunction(ExecState* exec, FunctionBodyNode* body)
-        {
-            return FunctionExecutable::create(exec, body->ident(), body->inferredName(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
-        }
-
-        FunctionExecutable* makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
-        {
-            return FunctionExecutable::create(*globalData, body->ident(), body->inferredName(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
-        }
-
         JSString* addStringConstant(const Identifier&);
 
         void addLineInfo(unsigned lineNo)
@@ -634,7 +650,9 @@ namespace JSC {
 
         RegisterID* emitInitLazyRegister(RegisterID*);
 
+    public:
         Vector<Instruction>& instructions() { return m_instructions; }
+
         SymbolTable& symbolTable() { return *m_symbolTable; }
 #if ENABLE(BYTECODE_COMMENTS)
         Vector<Comment>& comments() { return m_comments; }
@@ -677,7 +695,7 @@ namespace JSC {
         bool m_shouldEmitProfileHooks;
         bool m_shouldEmitRichSourceInfo;
 
-        Strong<ScopeChainNode> m_scopeChain;
+        Strong<JSScope> m_scope;
         SymbolTable* m_symbolTable;
 
 #if ENABLE(BYTECODE_COMMENTS)
@@ -693,6 +711,7 @@ namespace JSC {
         HashSet<RefPtr<StringImpl>, IdentifierRepHash> m_functions;
         RegisterID m_ignoredResultRegister;
         RegisterID m_thisRegister;
+        RegisterID m_calleeRegister;
         RegisterID* m_activationRegister;
         SegmentedVector<RegisterID, 32> m_constantPoolRegisters;
         SegmentedVector<RegisterID, 32> m_calleeRegisters;
@@ -708,6 +727,10 @@ namespace JSC {
         Vector<ControlFlowContext> m_scopeContextStack;
         Vector<SwitchInfo> m_switchContextStack;
         Vector<ForInContext> m_forInContextStack;
+        Vector<TryContext> m_tryContextStack;
+        
+        Vector<TryRange> m_tryRanges;
+        SegmentedVector<TryData, 8> m_tryData;
 
         int m_firstConstantIndex;
         int m_nextConstantOffset;
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 249f822e2..63f4657c9 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -34,7 +34,7 @@
 #include "JIT.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
-#include "JSStaticScopeObject.h"
+#include "JSNameScope.h"
 #include "LabelScope.h"
 #include "Lexer.h"
 #include "Operations.h"
@@ -43,7 +43,6 @@
 #include "RegExpCache.h"
 #include "RegExpObject.h"
 #include "SamplingTool.h"
-#include "UStringConcatenate.h"
 #include <wtf/Assertions.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/Threading.h>
@@ -77,7 +76,7 @@ namespace JSC {
 
 // ------------------------------ ThrowableExpressionData --------------------------------
 
-RegisterID* ThrowableExpressionData::emitThrowReferenceError(BytecodeGenerator& generator, const UString& message)
+RegisterID* ThrowableExpressionData::emitThrowReferenceError(BytecodeGenerator& generator, const String& message)
 {
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitThrowReferenceError(message);
@@ -126,7 +125,7 @@ RegisterID* RegExpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 {
     if (dst == generator.ignoredResult())
         return 0;
-    return generator.emitNewRegExp(generator.finalDestination(dst), RegExp::create(*generator.globalData(), m_pattern.ustring(), regExpFlags(m_flags.ustring())));
+    return generator.emitNewRegExp(generator.finalDestination(dst), RegExp::create(*generator.globalData(), m_pattern.string(), regExpFlags(m_flags.string())));
 }
 
 // ------------------------------ ThisNode -------------------------------------
@@ -591,7 +590,7 @@ RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator,
     return finalDestinationOrIgnored.get();
 }
 
-// ------------------------------ PostfixResolveNode ----------------------------------
+// ------------------------------ PostfixNode ----------------------------------
 
 static RegisterID* emitPreIncOrDec(BytecodeGenerator& generator, RegisterID* srcDst, Operator oper)
 {
@@ -605,14 +604,17 @@ static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* ds
     return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
 }
 
-RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* PostfixNode::emitResolve(BytecodeGenerator& generator, RegisterID* dst)
 {
-    ResolveResult resolveResult = generator.resolve(m_ident);
+    ASSERT(m_expr->isResolveNode());
+    ResolveNode* resolve = static_cast<ResolveNode*>(m_expr);
+    const Identifier& ident = resolve->identifier();
+
+    ResolveResult resolveResult = generator.resolve(ident);
 
     if (RegisterID* local = resolveResult.local()) {
         if (resolveResult.isReadOnly()) {
-            if (dst == generator.ignoredResult())
-                return 0;
+            generator.emitReadOnlyExceptionIfNeeded();
             return generator.emitToJSNumber(generator.finalDestination(dst), local);
         }
         if (dst == generator.ignoredResult())
@@ -621,83 +623,88 @@ RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, Regis
     }
 
     if (resolveResult.isStatic() && !resolveResult.isReadOnly()) {
-        RefPtr<RegisterID> value = generator.emitGetStaticVar(generator.newTemporary(), resolveResult, m_ident);
+        RefPtr<RegisterID> value = generator.emitGetStaticVar(generator.newTemporary(), resolveResult, ident);
         RegisterID* oldValue;
         if (dst == generator.ignoredResult()) {
             oldValue = 0;
             emitPreIncOrDec(generator, value.get(), m_operator);
-        } else {
+        } else
             oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-        }
-        generator.emitPutStaticVar(resolveResult, m_ident, value.get());
+        generator.emitPutStaticVar(resolveResult, ident, value.get());
         return oldValue;
     }
     
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     RefPtr<RegisterID> value = generator.newTemporary();
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), resolveResult, m_ident);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), resolveResult, ident);
     RegisterID* oldValue;
     if (dst == generator.ignoredResult()) {
         oldValue = 0;
         emitPreIncOrDec(generator, value.get(), m_operator);
-    } else {
+    } else
         oldValue = emitPostIncOrDec(generator, generator.finalDestination(dst), value.get(), m_operator);
-    }
-    generator.emitPutById(base.get(), m_ident, value.get());
+    generator.emitPutById(base.get(), ident, value.get());
     return oldValue;
 }
 
-// ------------------------------ PostfixBracketNode ----------------------------------
-
-RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* PostfixNode::emitBracket(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+    ASSERT(m_expr->isBracketAccessorNode());
+    BracketAccessorNode* bracketAccessor = static_cast<BracketAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = bracketAccessor->base();
+    ExpressionNode* subscript = bracketAccessor->subscript();
 
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(baseNode, bracketAccessor->subscriptHasAssignments(), subscript->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNode(subscript);
+
+    generator.emitExpressionInfo(bracketAccessor->divot(), bracketAccessor->startOffset(), bracketAccessor->endOffset());
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
-    RegisterID* oldValue;
     if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+        emitPreIncOrDec(generator, value.get(), m_operator);
+        generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+        generator.emitPutByVal(base.get(), property.get(), value.get());
+        return 0;
     }
+    RegisterID* oldValue = emitPostIncOrDec(generator, generator.tempDestination(dst), value.get(), m_operator);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), value.get());
-    return oldValue;
+    return generator.moveToDestinationIfNeeded(dst, oldValue);
 }
 
-// ------------------------------ PostfixDotNode ----------------------------------
-
-RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* PostfixNode::emitDot(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    ASSERT(m_expr->isDotAccessorNode());
+    DotAccessorNode* dotAccessor = static_cast<DotAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = dotAccessor->base();
+    const Identifier& ident = dotAccessor->identifier();
 
-    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
-    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
-    RegisterID* oldValue;
+    RefPtr<RegisterID> base = generator.emitNode(baseNode);
+
+    generator.emitExpressionInfo(dotAccessor->divot(), dotAccessor->startOffset(), dotAccessor->endOffset());
+    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), ident);
     if (dst == generator.ignoredResult()) {
-        oldValue = 0;
-        if (m_operator == OpPlusPlus)
-            generator.emitPreInc(value.get());
-        else
-            generator.emitPreDec(value.get());
-    } else {
-        oldValue = (m_operator == OpPlusPlus) ? generator.emitPostInc(generator.finalDestination(dst), value.get()) : generator.emitPostDec(generator.finalDestination(dst), value.get());
+        emitPreIncOrDec(generator, value.get(), m_operator);
+        generator.emitExpressionInfo(divot(), startOffset(), endOffset());
+        generator.emitPutById(base.get(), ident, value.get());
+        return 0;
     }
+    RegisterID* oldValue = emitPostIncOrDec(generator, generator.tempDestination(dst), value.get(), m_operator);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value.get());
-    return oldValue;
+    generator.emitPutById(base.get(), ident, value.get());
+    return generator.moveToDestinationIfNeeded(dst, oldValue);
 }
 
-// ------------------------------ PostfixErrorNode -----------------------------------
-
-RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+RegisterID* PostfixNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    if (m_expr->isResolveNode())
+        return emitResolve(generator, dst);
+
+    if (m_expr->isBracketAccessorNode())
+        return emitBracket(generator, dst);
+
+    if (m_expr->isDotAccessorNode())
+        return emitDot(generator, dst);
+
     return emitThrowReferenceError(generator, m_operator == OpPlusPlus
         ? "Postfix ++ operator applied to value that is not a reference."
         : "Postfix -- operator applied to value that is not a reference.");
@@ -789,78 +796,91 @@ RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, Register
     return generator.emitTypeOf(generator.finalDestination(dst), src.get());
 }
 
-// ------------------------------ PrefixResolveNode ----------------------------------
+// ------------------------------ PrefixNode ----------------------------------
 
-RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* PrefixNode::emitResolve(BytecodeGenerator& generator, RegisterID* dst)
 {
-    ResolveResult resolveResult = generator.resolve(m_ident);
+    ASSERT(m_expr->isResolveNode());
+    ResolveNode* resolve = static_cast<ResolveNode*>(m_expr);
+    const Identifier& ident = resolve->identifier();
+
+    ResolveResult resolveResult = generator.resolve(ident);
     if (RegisterID* local = resolveResult.local()) {
         if (resolveResult.isReadOnly()) {
+            generator.emitReadOnlyExceptionIfNeeded();
             if (dst == generator.ignoredResult())
-                return 0;
-            RefPtr<RegisterID> r0 = generator.emitLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
-            return generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+                return generator.emitToJSNumber(generator.newTemporary(), local);
+            RefPtr<RegisterID> r0 = generator.emitLoad(generator.tempDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
+            generator.emitBinaryOp(op_add, r0.get(), local, r0.get(), OperandTypes());
+            return generator.moveToDestinationIfNeeded(dst, r0.get());
         }
         emitPreIncOrDec(generator, local, m_operator);
         return generator.moveToDestinationIfNeeded(dst, local);
     }
 
     if (resolveResult.isStatic() && !resolveResult.isReadOnly()) {
-        RefPtr<RegisterID> propDst = generator.emitGetStaticVar(generator.tempDestination(dst), resolveResult, m_ident);
+        RefPtr<RegisterID> propDst = generator.emitGetStaticVar(generator.tempDestination(dst), resolveResult, ident);
         emitPreIncOrDec(generator, propDst.get(), m_operator);
-        generator.emitPutStaticVar(resolveResult, m_ident, propDst.get());
+        generator.emitPutStaticVar(resolveResult, ident, propDst.get());
         return generator.moveToDestinationIfNeeded(dst, propDst.get());
     }
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
-    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), resolveResult, m_ident);
+    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), propDst.get(), resolveResult, ident);
     emitPreIncOrDec(generator, propDst.get(), m_operator);
-    generator.emitPutById(base.get(), m_ident, propDst.get());
+    generator.emitPutById(base.get(), ident, propDst.get());
     return generator.moveToDestinationIfNeeded(dst, propDst.get());
 }
 
-// ------------------------------ PrefixBracketNode ----------------------------------
-
-RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* PrefixNode::emitBracket(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
+    ASSERT(m_expr->isBracketAccessorNode());
+    BracketAccessorNode* bracketAccessor = static_cast<BracketAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = bracketAccessor->base();
+    ExpressionNode* subscript = bracketAccessor->subscript();
+
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(baseNode, bracketAccessor->subscriptHasAssignments(), subscript->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNode(subscript);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
+    generator.emitExpressionInfo(bracketAccessor->divot(), bracketAccessor->startOffset(), bracketAccessor->endOffset());
     RegisterID* value = generator.emitGetByVal(propDst.get(), base.get(), property.get());
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
+    emitPreIncOrDec(generator, value, m_operator);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), value);
     return generator.moveToDestinationIfNeeded(dst, propDst.get());
 }
 
-// ------------------------------ PrefixDotNode ----------------------------------
-
-RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* PrefixNode::emitDot(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    ASSERT(m_expr->isDotAccessorNode());
+    DotAccessorNode* dotAccessor = static_cast<DotAccessorNode*>(m_expr);
+    ExpressionNode* baseNode = dotAccessor->base();
+    const Identifier& ident = dotAccessor->identifier();
+
+    RefPtr<RegisterID> base = generator.emitNode(baseNode);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
-    generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
-    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), m_ident);
-    if (m_operator == OpPlusPlus)
-        generator.emitPreInc(value);
-    else
-        generator.emitPreDec(value);
+    generator.emitExpressionInfo(dotAccessor->divot(), dotAccessor->startOffset(), dotAccessor->endOffset());
+    RegisterID* value = generator.emitGetById(propDst.get(), base.get(), ident);
+    emitPreIncOrDec(generator, value, m_operator);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    generator.emitPutById(base.get(), m_ident, value);
+    generator.emitPutById(base.get(), ident, value);
     return generator.moveToDestinationIfNeeded(dst, propDst.get());
 }
 
-// ------------------------------ PrefixErrorNode -----------------------------------
-
-RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
+RegisterID* PrefixNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    if (m_expr->isResolveNode())
+        return emitResolve(generator, dst);
+
+    if (m_expr->isBracketAccessorNode())
+        return emitBracket(generator, dst);
+
+    if (m_expr->isDotAccessorNode())
+        return emitDot(generator, dst);
+
     return emitThrowReferenceError(generator, m_operator == OpPlusPlus
         ? "Prefix ++ operator applied to value that is not a reference."
         : "Prefix -- operator applied to value that is not a reference.");
@@ -1213,8 +1233,10 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
     ResolveResult resolveResult = generator.resolve(m_ident);
 
     if (RegisterID *local = resolveResult.local()) {
-        if (resolveResult.isReadOnly())
+        if (resolveResult.isReadOnly()) {
+            generator.emitReadOnlyExceptionIfNeeded();
             return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
+        }
         
         if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
             RefPtr<RegisterID> result = generator.newTemporary();
@@ -1249,8 +1271,10 @@ RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
     ResolveResult resolveResult = generator.resolve(m_ident);
 
     if (RegisterID *local = resolveResult.local()) {
-        if (resolveResult.isReadOnly())
+        if (resolveResult.isReadOnly()) {
+            generator.emitReadOnlyExceptionIfNeeded();
             return generator.emitNode(dst, m_right);
+        }
         RegisterID* result = generator.emitNode(local, m_right);
         return generator.moveToDestinationIfNeeded(dst, result);
     }
@@ -1757,11 +1781,10 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
-    
-    RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
+
+    RefPtr<RegisterID> scope = generator.emitNode(m_expr);
     generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
-    generator.emitPushScope(scope.get());
+    generator.emitPushWithScope(scope.get());
     RegisterID* result = generator.emitNode(dst, m_statement);
     generator.emitPopScope();
     return result;
@@ -1808,7 +1831,7 @@ static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>&
                 typeForTable = SwitchNeither;
                 break;
             }
-            const UString& value = static_cast<StringNode*>(clauseExpression)->value().ustring();
+            const String& value = static_cast<StringNode*>(clauseExpression)->value().string();
             if (singleCharacterSwitch &= value.length() == 1) {
                 int32_t intVal = value[0];
                 if (intVal < min_num)
@@ -1970,11 +1993,15 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine(), column());
 
+    ASSERT(m_catchBlock || m_finallyBlock);
+
     RefPtr<Label> tryStartLabel = generator.newLabel();
+    generator.emitLabel(tryStartLabel.get());
+    
     if (m_finallyBlock)
         generator.pushFinallyContext(m_finallyBlock);
+    TryData* tryData = generator.pushTry(tryStartLabel.get());
 
-    generator.emitLabel(tryStartLabel.get());
     generator.emitNode(dst, m_tryBlock);
 
     if (m_catchBlock) {
@@ -1985,14 +2012,23 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
         // Uncaught exception path: the catch block.
         RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
-        generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
+        RefPtr<RegisterID> exceptionRegister = generator.popTryAndEmitCatch(tryData, generator.newTemporary(), here.get());
+        
+        if (m_finallyBlock) {
+            // If the catch block throws an exception and we have a finally block, then the finally
+            // block should "catch" that exception.
+            tryData = generator.pushTry(here.get());
+        }
+        
+        generator.emitPushNameScope(m_exceptionIdent, exceptionRegister.get(), DontDelete);
         generator.emitNode(dst, m_catchBlock);
         generator.emitPopScope();
         generator.emitLabel(catchEndLabel.get());
     }
 
     if (m_finallyBlock) {
+        RefPtr<Label> preFinallyLabel = generator.emitLabel(generator.newLabel().get());
+        
         generator.popFinallyContext();
 
         RefPtr<Label> finallyEndLabel = generator.newLabel();
@@ -2002,8 +2038,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
         generator.emitJump(finallyEndLabel.get());
 
         // Uncaught exception path: invoke the finally block, then re-throw the exception.
-        RefPtr<Label> here = generator.emitLabel(generator.newLabel().get());
-        RefPtr<RegisterID> tempExceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), here.get());
+        RefPtr<RegisterID> tempExceptionRegister = generator.popTryAndEmitCatch(tryData, generator.newTemporary(), preFinallyLabel.get());
         generator.emitNode(dst, m_finallyBlock);
         generator.emitThrow(tempExceptionRegister.get());
 
diff --git a/Source/JavaScriptCore/config.h b/Source/JavaScriptCore/config.h
index 7f7eda0f1..68ebc960d 100644
--- a/Source/JavaScriptCore/config.h
+++ b/Source/JavaScriptCore/config.h
@@ -57,9 +57,9 @@
 #ifndef _CRT_RAND_S
 #define _CRT_RAND_S
 #endif
-#endif
+#endif // !COMPILER(MSVC7_OR_LOWER) && !OS(WINCE)
 
-#endif
+#endif // OS(WINDOWS)
 
 #define WTF_CHANGES 1
 
diff --git a/Source/JavaScriptCore/debugger/Debugger.cpp b/Source/JavaScriptCore/debugger/Debugger.cpp
index 0a66d6f34..5d7a9b109 100644
--- a/Source/JavaScriptCore/debugger/Debugger.cpp
+++ b/Source/JavaScriptCore/debugger/Debugger.cpp
@@ -59,7 +59,7 @@ inline Recompiler::~Recompiler()
     // JavaScript in the inspector.
     SourceProviderMap::const_iterator end = m_sourceProviders.end();
     for (SourceProviderMap::const_iterator iter = m_sourceProviders.begin(); iter != end; ++iter)
-        m_debugger->sourceParsed(iter->second, iter->first, -1, UString());
+        m_debugger->sourceParsed(iter->second, iter->first, -1, String());
 }
 
 inline void Recompiler::operator()(JSCell* cell)
@@ -78,9 +78,9 @@ inline void Recompiler::operator()(JSCell* cell)
     if (!m_functionExecutables.add(executable).isNewEntry)
         return;
 
-    ExecState* exec = function->scope()->globalObject->JSGlobalObject::globalExec();
+    ExecState* exec = function->scope()->globalObject()->JSGlobalObject::globalExec();
     executable->clearCodeIfNotCompiling();
-    if (m_debugger == function->scope()->globalObject->debugger())
+    if (m_debugger == function->scope()->globalObject()->debugger())
         m_sourceProviders.add(executable->source().provider(), exec);
 }
 
@@ -121,7 +121,7 @@ void Debugger::recompileAllJSFunctions(JSGlobalData* globalData)
     globalData->heap.objectSpace().forEachCell(recompiler);
 }
 
-JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
+JSValue evaluateInGlobalCallFrame(const String& script, JSValue& exception, JSGlobalObject* globalObject)
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
     JSGlobalData& globalData = globalObject->globalData();
@@ -133,7 +133,7 @@ JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSG
         return exception;
     }
 
-    JSValue result = globalData.interpreter->execute(eval, globalCallFrame, globalObject, globalCallFrame->scopeChain());
+    JSValue result = globalData.interpreter->execute(eval, globalCallFrame, globalObject, globalCallFrame->scope());
     if (globalData.exception) {
         exception = globalData.exception;
         globalData.exception = JSValue();
diff --git a/Source/JavaScriptCore/debugger/Debugger.h b/Source/JavaScriptCore/debugger/Debugger.h
index bc743677e..3c4a4ed76 100644
--- a/Source/JavaScriptCore/debugger/Debugger.h
+++ b/Source/JavaScriptCore/debugger/Debugger.h
@@ -32,7 +32,6 @@ namespace JSC {
     class JSGlobalObject;
     class JSValue;
     class SourceProvider;
-    class UString;
 
     class JS_EXPORT_PRIVATE Debugger {
     public:
@@ -41,7 +40,7 @@ namespace JSC {
         void attach(JSGlobalObject*);
         virtual void detach(JSGlobalObject*);
 
-        virtual void sourceParsed(ExecState*, SourceProvider*, int errorLineNumber, const UString& errorMessage) = 0;
+        virtual void sourceParsed(ExecState*, SourceProvider*, int errorLineNumber, const WTF::String& errorMessage) = 0;
 
         virtual void exception(const DebuggerCallFrame&, intptr_t, int, int, bool) = 0;
         virtual void atStatement(const DebuggerCallFrame&, intptr_t, int, int) = 0;
@@ -60,7 +59,7 @@ namespace JSC {
     };
 
     // This function exists only for backwards compatibility with existing WebScriptDebugger clients.
-    JS_EXPORT_PRIVATE JSValue evaluateInGlobalCallFrame(const UString&, JSValue& exception, JSGlobalObject*);
+    JS_EXPORT_PRIVATE JSValue evaluateInGlobalCallFrame(const WTF::String&, JSValue& exception, JSGlobalObject*);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
index 3c8212f46..e23468035 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -53,13 +53,12 @@ void DebuggerActivation::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-    JSObject::visitChildren(thisObject, visitor);
 
-    if (thisObject->m_activation)
-        visitor.append(&thisObject->m_activation);
+    JSObject::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_activation);
 }
 
-UString DebuggerActivation::className(const JSObject* object)
+String DebuggerActivation::className(const JSObject* object)
 {
     const DebuggerActivation* thisObject = jsCast<const DebuggerActivation*>(object);
     return thisObject->m_activation->methodTable()->className(thisObject->m_activation.get());
diff --git a/Source/JavaScriptCore/debugger/DebuggerActivation.h b/Source/JavaScriptCore/debugger/DebuggerActivation.h
index 07d20141f..c934407fc 100644
--- a/Source/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/Source/JavaScriptCore/debugger/DebuggerActivation.h
@@ -42,7 +42,7 @@ namespace JSC {
         }
 
         static void visitChildren(JSCell*, SlotVisitor&);
-        static UString className(const JSObject*);
+        static String className(const JSObject*);
         static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
         static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
         static void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index a48e7d156..97e792b6d 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -36,7 +36,7 @@
 
 namespace JSC {
 
-const UString* DebuggerCallFrame::functionName() const
+const String* DebuggerCallFrame::functionName() const
 {
     if (!m_callFrame->codeBlock())
         return 0;
@@ -50,15 +50,15 @@ const UString* DebuggerCallFrame::functionName() const
     return &jsCast<JSFunction*>(function)->name(m_callFrame);
 }
     
-UString DebuggerCallFrame::calculatedFunctionName() const
+String DebuggerCallFrame::calculatedFunctionName() const
 {
     if (!m_callFrame->codeBlock())
-        return UString();
+        return String();
 
     JSObject* function = m_callFrame->callee();
 
     if (!function)
-        return UString();
+        return String();
 
     return getCalculatedDisplayName(m_callFrame, function);
 }
@@ -84,7 +84,7 @@ JSObject* DebuggerCallFrame::thisObject() const
     return asObject(thisValue);
 }
 
-JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) const
+JSValue DebuggerCallFrame::evaluate(const String& script, JSValue& exception) const
 {
     if (!m_callFrame->codeBlock())
         return JSValue();
@@ -96,7 +96,7 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
         globalData.exception = JSValue();
     }
 
-    JSValue result = globalData.interpreter->execute(eval, m_callFrame, thisObject(), m_callFrame->scopeChain());
+    JSValue result = globalData.interpreter->execute(eval, m_callFrame, thisObject(), m_callFrame->scope());
     if (globalData.exception) {
         exception = globalData.exception;
         globalData.exception = JSValue();
diff --git a/Source/JavaScriptCore/debugger/DebuggerCallFrame.h b/Source/JavaScriptCore/debugger/DebuggerCallFrame.h
index dca7487c0..1a9fb0277 100644
--- a/Source/JavaScriptCore/debugger/DebuggerCallFrame.h
+++ b/Source/JavaScriptCore/debugger/DebuggerCallFrame.h
@@ -50,12 +50,12 @@ namespace JSC {
 
         CallFrame* callFrame() const { return m_callFrame; }
         JSGlobalObject* dynamicGlobalObject() const { return m_callFrame->dynamicGlobalObject(); }
-        ScopeChainNode* scopeChain() const { return m_callFrame->scopeChain(); }
-        JS_EXPORT_PRIVATE const UString* functionName() const;
-        JS_EXPORT_PRIVATE UString calculatedFunctionName() const;
+        JSScope* scope() const { return m_callFrame->scope(); }
+        JS_EXPORT_PRIVATE const String* functionName() const;
+        JS_EXPORT_PRIVATE String calculatedFunctionName() const;
         JS_EXPORT_PRIVATE Type type() const;
         JS_EXPORT_PRIVATE JSObject* thisObject() const;
-        JS_EXPORT_PRIVATE JSValue evaluate(const UString&, JSValue& exception) const;
+        JS_EXPORT_PRIVATE JSValue evaluate(const String&, JSValue& exception) const;
         JSValue exception() const { return m_exception; }
 
     private:
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 43b5a03f3..5f79f666f 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -108,24 +108,6 @@ void AbstractState::initialize(Graph& graph)
             root->valuesAtHead.argument(i).set(SpecInt32);
         else if (isBooleanSpeculation(prediction))
             root->valuesAtHead.argument(i).set(SpecBoolean);
-        else if (isInt8ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecInt8Array);
-        else if (isInt16ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecInt16Array);
-        else if (isInt32ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecInt32Array);
-        else if (isUint8ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecUint8Array);
-        else if (isUint8ClampedArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecUint8ClampedArray);
-        else if (isUint16ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecUint16Array);
-        else if (isUint32ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecUint32Array);
-        else if (isFloat32ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecFloat32Array);
-        else if (isFloat64ArraySpeculation(prediction))
-            root->valuesAtHead.argument(i).set(SpecFloat64Array);
         else if (isCellSpeculation(prediction))
             root->valuesAtHead.argument(i).set(SpecCell);
         else
@@ -626,14 +608,9 @@ bool AbstractState::execute(unsigned indexInBlock)
         Node& child = m_graph[node.child1()];
         if (isBooleanSpeculation(child.prediction()))
             speculateBooleanUnary(node);
-        else if (child.shouldSpeculateFinalObjectOrOther()) {
-            node.setCanExit(
-                !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecFinalObject | SpecOther);
-        } else if (child.shouldSpeculateArrayOrOther()) {
-            node.setCanExit(
-                !isArrayOrOtherSpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecArray | SpecOther);
+        else if (child.shouldSpeculateNonStringCellOrOther()) {
+            node.setCanExit(true);
+            forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
         } else if (child.shouldSpeculateInteger())
             speculateInt32Unary(node);
         else if (child.shouldSpeculateNumber())
@@ -751,45 +728,32 @@ bool AbstractState::execute(unsigned indexInBlock)
                 break;
             }
             
-            if (Node::shouldSpeculateFinalObject(left, right)) {
-                filter = SpecFinalObject;
-                checker = isFinalObjectSpeculation;
-            } else if (Node::shouldSpeculateArray(left, right)) {
-                filter = SpecArray;
-                checker = isArraySpeculation;
-            } else if (left.shouldSpeculateFinalObject() && right.shouldSpeculateFinalObjectOrOther()) {
-                node.setCanExit(
-                    !isFinalObjectSpeculation(forNode(node.child1()).m_type)
-                    || !isFinalObjectOrOtherSpeculation(forNode(node.child2()).m_type));
-                forNode(node.child1()).filter(SpecFinalObject);
-                forNode(node.child2()).filter(SpecFinalObject | SpecOther);
+            if (left.shouldSpeculateString() || right.shouldSpeculateString()) {
+                node.setCanExit(false);
                 break;
-            } else if (right.shouldSpeculateFinalObject() && left.shouldSpeculateFinalObjectOrOther()) {
-                node.setCanExit(
-                    !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type)
-                    || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
-                forNode(node.child1()).filter(SpecFinalObject | SpecOther);
-                forNode(node.child2()).filter(SpecFinalObject);
+            } 
+            if (left.shouldSpeculateNonStringCell() && right.shouldSpeculateNonStringCellOrOther()) {
+                node.setCanExit(true);
+                forNode(node.child1()).filter(SpecCell & ~SpecString);
+                forNode(node.child2()).filter((SpecCell & ~SpecString) | SpecOther);
                 break;
-            } else if (left.shouldSpeculateArray() && right.shouldSpeculateArrayOrOther()) {
-                node.setCanExit(
-                    !isArraySpeculation(forNode(node.child1()).m_type)
-                    || !isArrayOrOtherSpeculation(forNode(node.child2()).m_type));
-                forNode(node.child1()).filter(SpecArray);
-                forNode(node.child2()).filter(SpecArray | SpecOther);
+            }
+            if (left.shouldSpeculateNonStringCellOrOther() && right.shouldSpeculateNonStringCell()) {
+                node.setCanExit(true);
+                forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
+                forNode(node.child2()).filter(SpecCell & ~SpecString);
                 break;
-            } else if (right.shouldSpeculateArray() && left.shouldSpeculateArrayOrOther()) {
-                node.setCanExit(
-                    !isArrayOrOtherSpeculation(forNode(node.child1()).m_type)
-                    || !isArraySpeculation(forNode(node.child2()).m_type));
-                forNode(node.child1()).filter(SpecArray | SpecOther);
-                forNode(node.child2()).filter(SpecArray);
+            }
+            if (left.shouldSpeculateNonStringCell() && right.shouldSpeculateNonStringCell()) {
+                node.setCanExit(true);
+                forNode(node.child1()).filter(SpecCell & ~SpecString);
+                forNode(node.child2()).filter(SpecCell & ~SpecString);
                 break;
-            } else {
-                filter = SpecTop;
-                checker = isAnySpeculation;
-                clobberWorld(node.codeOrigin, indexInBlock);
             }
+ 
+            filter = SpecTop;
+            checker = isAnySpeculation;
+            clobberWorld(node.codeOrigin, indexInBlock);
         } else {
             filter = SpecTop;
             checker = isAnySpeculation;
@@ -837,22 +801,16 @@ bool AbstractState::execute(unsigned indexInBlock)
             speculateNumberBinary(node);
             break;
         }
-        if (Node::shouldSpeculateFinalObject(
-                m_graph[node.child1()], m_graph[node.child2()])) {
-            node.setCanExit(
-                !isFinalObjectSpeculation(forNode(node.child1()).m_type)
-                || !isFinalObjectSpeculation(forNode(node.child2()).m_type));
-            forNode(node.child1()).filter(SpecFinalObject);
-            forNode(node.child2()).filter(SpecFinalObject);
+        Node& leftNode = m_graph[node.child1()];
+        Node& rightNode = m_graph[node.child2()];
+        if (leftNode.shouldSpeculateString() || rightNode.shouldSpeculateString()) {
+            node.setCanExit(false);
             break;
         }
-        if (Node::shouldSpeculateArray(
-                m_graph[node.child1()], m_graph[node.child2()])) {
-            node.setCanExit(
-                !isArraySpeculation(forNode(node.child1()).m_type)
-                || !isArraySpeculation(forNode(node.child2()).m_type));
-            forNode(node.child1()).filter(SpecArray);
-            forNode(node.child2()).filter(SpecArray);
+        if (leftNode.shouldSpeculateNonStringCell() && rightNode.shouldSpeculateNonStringCell()) {
+            node.setCanExit(true);
+            forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
+            forNode(node.child2()).filter((SpecCell & ~SpecString) | SpecOther);
             break;
         }
         node.setCanExit(false);
@@ -887,55 +845,47 @@ bool AbstractState::execute(unsigned indexInBlock)
             forNode(nodeIndex).makeTop();
             break;
         case Array::String:
-            forNode(node.child1()).filter(SpecString);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecString);
             break;
         case Array::Arguments:
-            forNode(node.child1()).filter(SpecArguments);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).makeTop();
             break;
         case Array::JSArray:
+            forNode(node.child2()).filter(SpecInt32);
+            forNode(nodeIndex).makeTop();
+            break;
         case Array::JSArrayOutOfBounds:
-            // FIXME: We should have more conservative handling of the out-of-bounds
-            // case.
-            forNode(node.child1()).filter(SpecCell);
             forNode(node.child2()).filter(SpecInt32);
+            clobberWorld(node.codeOrigin, indexInBlock);
             forNode(nodeIndex).makeTop();
             break;
         case Array::Int8Array:
-            forNode(node.child1()).filter(SpecInt8Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
         case Array::Int16Array:
-            forNode(node.child1()).filter(SpecInt16Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
         case Array::Int32Array:
-            forNode(node.child1()).filter(SpecInt32Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
         case Array::Uint8Array:
-            forNode(node.child1()).filter(SpecUint8Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
         case Array::Uint8ClampedArray:
-            forNode(node.child1()).filter(SpecUint8ClampedArray);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
         case Array::Uint16Array:
-            forNode(node.child1()).filter(SpecUint16Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
         case Array::Uint32Array:
-            forNode(node.child1()).filter(SpecUint32Array);
             forNode(node.child2()).filter(SpecInt32);
             if (node.shouldSpeculateInteger())
                 forNode(nodeIndex).set(SpecInt32);
@@ -943,12 +893,10 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(nodeIndex).set(SpecDouble);
             break;
         case Array::Float32Array:
-            forNode(node.child1()).filter(SpecFloat32Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecDouble);
             break;
         case Array::Float64Array:
-            forNode(node.child1()).filter(SpecFloat64Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecDouble);
             break;
@@ -959,7 +907,6 @@ bool AbstractState::execute(unsigned indexInBlock)
     case PutByVal:
     case PutByValAlias: {
         node.setCanExit(true);
-        Edge child1 = m_graph.varArgChild(node, 0);
         Edge child2 = m_graph.varArgChild(node, 1);
         Edge child3 = m_graph.varArgChild(node, 2);
         switch (modeForPut(node.arrayMode())) {
@@ -970,20 +917,16 @@ bool AbstractState::execute(unsigned indexInBlock)
             clobberWorld(node.codeOrigin, indexInBlock);
             break;
         case Array::JSArray:
-            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             break;
         case Array::JSArrayOutOfBounds:
-            forNode(child1).filter(SpecCell);
             forNode(child2).filter(SpecInt32);
             clobberWorld(node.codeOrigin, indexInBlock);
             break;
         case Array::Arguments:
-            forNode(child1).filter(SpecArguments);
             forNode(child2).filter(SpecInt32);
             break;
         case Array::Int8Array:
-            forNode(child1).filter(SpecInt8Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -991,7 +934,6 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Int16Array:
-            forNode(child1).filter(SpecInt16Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -999,7 +941,6 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Int32Array:
-            forNode(child1).filter(SpecInt32Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -1007,7 +948,6 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint8Array:
-            forNode(child1).filter(SpecUint8Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -1015,7 +955,6 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint8ClampedArray:
-            forNode(child1).filter(SpecUint8ClampedArray);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -1023,7 +962,6 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint16Array:
-            forNode(child1).filter(SpecUint16Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -1031,7 +969,6 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Uint32Array:
-            forNode(child1).filter(SpecUint32Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
                 forNode(child3).filter(SpecInt32);
@@ -1039,12 +976,10 @@ bool AbstractState::execute(unsigned indexInBlock)
                 forNode(child3).filter(SpecNumber);
             break;
         case Array::Float32Array:
-            forNode(child1).filter(SpecFloat32Array);
             forNode(child2).filter(SpecInt32);
             forNode(child3).filter(SpecNumber);
             break;
         case Array::Float64Array:
-            forNode(child1).filter(SpecFloat64Array);
             forNode(child2).filter(SpecInt32);
             forNode(child3).filter(SpecNumber);
             break;
@@ -1057,13 +992,11 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case ArrayPush:
         node.setCanExit(true);
-        forNode(node.child1()).filter(SpecCell);
         forNode(nodeIndex).set(SpecNumber);
         break;
             
     case ArrayPop:
         node.setCanExit(true);
-        forNode(node.child1()).filter(SpecCell);
         forNode(nodeIndex).makeTop();
         break;
             
@@ -1102,14 +1035,9 @@ bool AbstractState::execute(unsigned indexInBlock)
         Node& child = m_graph[node.child1()];
         if (child.shouldSpeculateBoolean())
             speculateBooleanUnary(node);
-        else if (child.shouldSpeculateFinalObjectOrOther()) {
-            node.setCanExit(
-                !isFinalObjectOrOtherSpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecFinalObject | SpecOther);
-        } else if (child.shouldSpeculateArrayOrOther()) {
-            node.setCanExit(
-                !isArrayOrOtherSpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecArray | SpecOther);
+        else if (child.shouldSpeculateNonStringCellOrOther()) {
+            node.setCanExit(true);
+            forNode(node.child1()).filter((SpecCell & ~SpecString) | SpecOther);
         } else if (child.shouldSpeculateInteger())
             speculateInt32Unary(node);
         else if (child.shouldSpeculateNumber())
@@ -1235,7 +1163,7 @@ bool AbstractState::execute(unsigned indexInBlock)
         
     case CreateActivation:
         node.setCanExit(false);
-        forNode(nodeIndex).set(m_graph.m_globalData.activationStructure.get());
+        forNode(nodeIndex).set(m_codeBlock->globalObjectFor(node.codeOrigin)->activationStructure());
         m_haveStructures = true;
         break;
         
@@ -1347,80 +1275,8 @@ bool AbstractState::execute(unsigned indexInBlock)
         break;
             
     case GetArrayLength:
-        switch (node.arrayMode()) {
-        case Array::Undecided:
-            ASSERT_NOT_REACHED();
-            break;
-        case Array::ForceExit:
-            m_isValid = false;
-            break;
-        case Array::Generic:
-            ASSERT_NOT_REACHED();
-            break;
-        case Array::String:
-            node.setCanExit(!isStringSpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecString);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::JSArray:
-            node.setCanExit(true);
-            forNode(node.child1()).filter(SpecCell);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::JSArrayOutOfBounds:
-            ASSERT_NOT_REACHED();
-            break;
-        case Array::Arguments:
-            node.setCanExit(true);
-            forNode(node.child1()).filter(SpecArguments);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Int8Array:
-            node.setCanExit(!isInt8ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecInt8Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Int16Array:
-            node.setCanExit(!isInt16ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecInt16Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Int32Array:
-            node.setCanExit(!isInt32ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecInt32Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Uint8Array:
-            node.setCanExit(!isUint8ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecUint8Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Uint8ClampedArray:
-            node.setCanExit(!isUint8ClampedArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecUint8ClampedArray);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Uint16Array:
-            node.setCanExit(!isUint16ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecUint16Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Uint32Array:
-            node.setCanExit(!isUint32ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecUint32Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Float32Array:
-            node.setCanExit(!isFloat32ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecFloat32Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        case Array::Float64Array:
-            node.setCanExit(!isFloat64ArraySpeculation(forNode(node.child1()).m_type));
-            forNode(node.child1()).filter(SpecFloat64Array);
-            forNode(nodeIndex).set(SpecInt32);
-            break;
-        }
+        node.setCanExit(true); // Lies, but it's true for the common case of JSArray, so it's good enough.
+        forNode(nodeIndex).set(SpecInt32);
         break;
 
     case CheckStructure:
@@ -1492,8 +1348,13 @@ bool AbstractState::execute(unsigned indexInBlock)
         forNode(node.child1()).filter(SpecCell);
         forNode(nodeIndex).clear(); // The result is not a JS value.
         break;
-    case GetIndexedPropertyStorage: {
-        node.setCanExit(true); // Lies, but this is (almost) always followed by GetByVal, which does exit. So no point in trying to be more precise.
+    case CheckArray: {
+        if (modeAlreadyChecked(forNode(node.child1()), node.arrayMode())) {
+            m_foundConstants = true;
+            node.setCanExit(false);
+            break;
+        }
+        node.setCanExit(true); // Lies, but this is followed by operations (like GetByVal) that always exit, so there is no point in us trying to be clever here.
         switch (node.arrayMode()) {
         case Array::String:
             forNode(node.child1()).filter(SpecString);
@@ -1504,6 +1365,9 @@ bool AbstractState::execute(unsigned indexInBlock)
             // CFA tracking of array mode speculations, but we don't have that, yet.
             forNode(node.child1()).filter(SpecCell);
             break;
+        case Array::Arguments:
+            forNode(node.child1()).filter(SpecArguments);
+            break;
         case Array::Int8Array:
             forNode(node.child1()).filter(SpecInt8Array);
             break;
@@ -1535,6 +1399,19 @@ bool AbstractState::execute(unsigned indexInBlock)
             ASSERT_NOT_REACHED();
             break;
         }
+        break;
+    }
+    case GetIndexedPropertyStorage: {
+        switch (node.arrayMode()) {
+        case Array::String:
+            // Strings are weird - we may spec fail if the string was a rope. That is of course
+            // stupid, and we should fix that, but for now let's at least be honest about it.
+            node.setCanExit(true);
+            break;
+        default:
+            node.setCanExit(false);
+            break;
+        }
         forNode(nodeIndex).clear();
         break; 
     }
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index 2f535ba22..640a0a966 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -312,6 +312,7 @@ public:
                 case ForwardCheckStructure:
                 case StructureTransitionWatchpoint:
                 case ForwardStructureTransitionWatchpoint:
+                case CheckArray:
                     // We don't care about these because if we get uses of the relevant
                     // variable then we can safely get rid of these, too. This of course
                     // relies on there not being any information transferred by the CFA
@@ -476,7 +477,8 @@ public:
                 case CheckStructure:
                 case ForwardCheckStructure:
                 case StructureTransitionWatchpoint:
-                case ForwardStructureTransitionWatchpoint: {
+                case ForwardStructureTransitionWatchpoint:
+                case CheckArray: {
                     // We can just get rid of this node, if it references a phantom argument.
                     if (!isOKToOptimize(m_graph[node.child1()]))
                         break;
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
index ec4edc2e8..cd3944fb4 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
@@ -51,6 +51,11 @@ Array::Mode fromObserved(ArrayModes modes, bool makeSafe)
     }
 }
 
+Array::Mode fromStructure(Structure* structure, bool makeSafe)
+{
+    return fromObserved(arrayModeFromStructure(structure), makeSafe);
+}
+
 Array::Mode refineArrayMode(Array::Mode arrayMode, SpeculatedType base, SpeculatedType index)
 {
     if (!base || !index) {
@@ -64,17 +69,8 @@ Array::Mode refineArrayMode(Array::Mode arrayMode, SpeculatedType base, Speculat
     if (!isInt32Speculation(index) || !isCellSpeculation(base))
         return Array::Generic;
     
-    // Pass through any array modes that would have been decided by the array profile, since
-    // the predictions of the inputs will not tell us anything useful that we didn't already
-    // get from the array profile.
-    switch (arrayMode) {
-    case Array::ForceExit:
-    case Array::JSArray:
-    case Array::JSArrayOutOfBounds:
+    if (arrayMode != Array::Undecided)
         return arrayMode;
-    default:
-        break;
-    }
     
     if (isStringSpeculation(base))
         return Array::String;
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.h b/Source/JavaScriptCore/dfg/DFGArrayMode.h
index 6ce62ae72..36a8637f5 100644
--- a/Source/JavaScriptCore/dfg/DFGArrayMode.h
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.h
@@ -63,12 +63,25 @@ enum Mode {
 
 Array::Mode fromObserved(ArrayModes modes, bool makeSafe);
 
+Array::Mode fromStructure(Structure*, bool makeSafe);
+
 Array::Mode refineArrayMode(Array::Mode, SpeculatedType base, SpeculatedType index);
 
 bool modeAlreadyChecked(AbstractValue&, Array::Mode);
 
 const char* modeToString(Array::Mode);
 
+inline bool modeIsJSArray(Array::Mode arrayMode)
+{
+    switch (arrayMode) {
+    case Array::JSArray:
+    case Array::JSArrayOutOfBounds:
+        return true;
+    default:
+        return false;
+    }
+}
+
 inline bool canCSEStorage(Array::Mode arrayMode)
 {
     switch (arrayMode) {
@@ -82,6 +95,11 @@ inline bool canCSEStorage(Array::Mode arrayMode)
     }
 }
 
+inline bool lengthNeedsStorage(Array::Mode arrayMode)
+{
+    return modeIsJSArray(arrayMode);
+}
+
 inline Array::Mode modeForPut(Array::Mode arrayMode)
 {
     switch (arrayMode) {
@@ -115,7 +133,7 @@ inline bool modesCompatibleForStorageLoad(Array::Mode left, Array::Mode right)
     return false;
 }
 
-inline bool modeSupportsLength(Array::Mode mode)
+inline bool modeIsSpecific(Array::Mode mode)
 {
     switch (mode) {
     case Array::Undecided:
@@ -127,6 +145,11 @@ inline bool modeSupportsLength(Array::Mode mode)
     }
 }
 
+inline bool modeSupportsLength(Array::Mode mode)
+{
+    return modeIsSpecific(mode);
+}
+
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeCache.h b/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
index f6a745c66..ab88e99e5 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeCache.h
@@ -141,7 +141,7 @@ public:
         }
     }
     
-    CodeBlock* get(const CodeBlockKey& key, ScopeChainNode* scope)
+    CodeBlock* get(const CodeBlockKey& key, JSScope* scope)
     {
         Map::iterator iter = m_map.find(key);
         if (iter != m_map.end())
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index f9b1db9ab..b96b8d9a3 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -71,6 +71,7 @@ public:
         , m_inlineStackTop(0)
         , m_haveBuiltOperandMaps(false)
         , m_emptyJSValueIndex(UINT_MAX)
+        , m_currentInstruction(0)
     {
         ASSERT(m_profiledBlock);
         
@@ -141,6 +142,9 @@ private:
             return getJSConstant(constant);
         }
 
+        if (operand == RegisterFile::Callee)
+            return getCallee();
+
         // Is this an argument?
         if (operandIsArgument(operand))
             return getArgument(operand);
@@ -364,11 +368,11 @@ private:
             InlineCallFrame* inlineCallFrame = stack->m_inlineCallFrame;
             if (!inlineCallFrame)
                 break;
-            if (operand >= inlineCallFrame->stackOffset - RegisterFile::CallFrameHeaderSize)
+            if (operand >= static_cast<int>(inlineCallFrame->stackOffset - RegisterFile::CallFrameHeaderSize))
                 continue;
             if (operand == inlineCallFrame->stackOffset + CallFrame::thisArgumentOffset())
                 continue;
-            if (static_cast<unsigned>(operand) < inlineCallFrame->stackOffset - RegisterFile::CallFrameHeaderSize - inlineCallFrame->arguments.size())
+            if (operand < static_cast<int>(inlineCallFrame->stackOffset - RegisterFile::CallFrameHeaderSize - inlineCallFrame->arguments.size()))
                 continue;
             int argument = operandToArgument(operand - inlineCallFrame->stackOffset);
             return stack->m_argumentPositions[argument];
@@ -520,6 +524,11 @@ private:
         return resultIndex;
     }
 
+    NodeIndex getCallee()
+    {
+        return addToGraph(GetCallee);
+    }
+
     // Helper functions to get/set the this value.
     NodeIndex getThis()
     {
@@ -818,9 +827,14 @@ private:
         return getPrediction(m_graph.size(), m_currentProfilingIndex);
     }
     
-    Array::Mode getArrayModeWithoutOSRExit(Instruction* currentInstruction, NodeIndex base)
+    Array::Mode getArrayMode(ArrayProfile* profile)
+    {
+        profile->computeUpdatedPrediction();
+        return fromObserved(profile->observedArrayModes(), false);
+    }
+    
+    Array::Mode getArrayModeAndEmitChecks(ArrayProfile* profile, NodeIndex base)
     {
-        ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
         profile->computeUpdatedPrediction();
         if (profile->hasDefiniteStructure())
             addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(profile->expectedStructure())), base);
@@ -838,16 +852,6 @@ private:
         return fromObserved(profile->observedArrayModes(), makeSafe);
     }
     
-    Array::Mode getArrayMode(Instruction* currentInstruction, NodeIndex base)
-    {
-        Array::Mode result = getArrayModeWithoutOSRExit(currentInstruction, base);
-        
-        if (result == Array::ForceExit)
-            addToGraph(ForceOSRExit);
-        
-        return result;
-    }
-
     NodeIndex makeSafe(NodeIndex nodeIndex)
     {
         Node& node = m_graph[nodeIndex];
@@ -1130,7 +1134,10 @@ private:
                 ASSERT(result >= FirstConstantRegisterIndex);
                 return result;
             }
-            
+
+            if (operand == RegisterFile::Callee)
+                return m_calleeVR;
+
             return operand + m_inlineCallFrame->stackOffset;
         }
     };
@@ -1150,6 +1157,8 @@ private:
     
     // Cache of code blocks that we've generated bytecode for.
     ByteCodeCache<canInlineFunctionFor> m_codeBlockCache;
+    
+    Instruction* m_currentInstruction;
 };
 
 #define NEXT_OPCODE(name) \
@@ -1553,7 +1562,10 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
         if (argumentCountIncludingThis != 2)
             return false;
         
-        NodeIndex arrayPush = addToGraph(ArrayPush, OpInfo(0), OpInfo(prediction), get(registerOffset + argumentToOperand(0)), get(registerOffset + argumentToOperand(1)));
+        Array::Mode arrayMode = getArrayMode(m_currentInstruction[5].u.arrayProfile);
+        if (!modeIsJSArray(arrayMode))
+            return false;
+        NodeIndex arrayPush = addToGraph(ArrayPush, OpInfo(arrayMode), OpInfo(prediction), get(registerOffset + argumentToOperand(0)), get(registerOffset + argumentToOperand(1)));
         if (usesResult)
             set(resultOperand, arrayPush);
         
@@ -1564,7 +1576,10 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
         if (argumentCountIncludingThis != 1)
             return false;
         
-        NodeIndex arrayPop = addToGraph(ArrayPop, OpInfo(0), OpInfo(prediction), get(registerOffset + argumentToOperand(0)));
+        Array::Mode arrayMode = getArrayMode(m_currentInstruction[5].u.arrayProfile);
+        if (!modeIsJSArray(arrayMode))
+            return false;
+        NodeIndex arrayPop = addToGraph(ArrayPop, OpInfo(arrayMode), OpInfo(prediction), get(registerOffset + argumentToOperand(0)));
         if (usesResult)
             set(resultOperand, arrayPop);
         return true;
@@ -1792,6 +1807,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         
         // Switch on the current bytecode opcode.
         Instruction* currentInstruction = instructionsBegin + m_currentIndex;
+        m_currentInstruction = currentInstruction; // Some methods want to use this, and we'd rather not thread it through calls.
         OpcodeID opcodeID = interpreter->getOpcodeID(currentInstruction->u.opcode);
         switch (opcodeID) {
 
@@ -1830,10 +1846,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         }
 
         case op_create_this: {
-            if (m_inlineStackTop->m_inlineCallFrame)
-                set(currentInstruction[1].u.operand, addToGraph(CreateThis, getDirect(m_inlineStackTop->m_calleeVR)));
-            else
-                set(currentInstruction[1].u.operand, addToGraph(CreateThis, addToGraph(GetCallee)));
+            set(currentInstruction[1].u.operand, addToGraph(CreateThis, get(RegisterFile::Callee)));
             NEXT_OPCODE(op_create_this);
         }
             
@@ -2177,7 +2190,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             SpeculatedType prediction = getPrediction();
             
             NodeIndex base = get(currentInstruction[2].u.operand);
-            Array::Mode arrayMode = getArrayMode(currentInstruction, base);
+            Array::Mode arrayMode = getArrayModeAndEmitChecks(currentInstruction[4].u.arrayProfile, base);
             NodeIndex property = get(currentInstruction[3].u.operand);
             NodeIndex getByVal = addToGraph(GetByVal, OpInfo(arrayMode), OpInfo(prediction), base, property);
             set(currentInstruction[1].u.operand, getByVal);
@@ -2188,7 +2201,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
         case op_put_by_val: {
             NodeIndex base = get(currentInstruction[1].u.operand);
 
-            Array::Mode arrayMode = getArrayMode(currentInstruction, base);
+            Array::Mode arrayMode = getArrayModeAndEmitChecks(currentInstruction[4].u.arrayProfile, base);
             
             NodeIndex property = get(currentInstruction[2].u.operand);
             NodeIndex value = get(currentInstruction[3].u.operand);
@@ -2196,6 +2209,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             addVarArgChild(base);
             addVarArgChild(property);
             addVarArgChild(value);
+            addVarArgChild(NoNode); // Leave room for property storage.
             addToGraph(Node::VarArg, PutByVal, OpInfo(arrayMode), OpInfo(0));
 
             NEXT_OPCODE(op_put_by_val);
@@ -2406,7 +2420,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             
             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[3].u.operand];
             Identifier identifier = m_codeBlock->identifier(identifierNumber);
-            SymbolTableEntry entry = globalObject->symbolTable().get(identifier.impl());
+            SymbolTableEntry entry = globalObject->symbolTable()->get(identifier.impl());
             if (!entry.couldBeWatched()) {
                 NodeIndex getGlobalVar = addToGraph(
                     GetGlobalVar,
@@ -2459,7 +2473,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             JSGlobalObject* globalObject = codeBlock->globalObject();
             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[4].u.operand];
             Identifier identifier = m_codeBlock->identifier(identifierNumber);
-            SymbolTableEntry entry = globalObject->symbolTable().get(identifier.impl());
+            SymbolTableEntry entry = globalObject->symbolTable()->get(identifier.impl());
             if (!entry.couldBeWatched()) {
                 addToGraph(
                     PutGlobalVar,
diff --git a/Source/JavaScriptCore/dfg/DFGCCallHelpers.h b/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
index fd4e1cae0..5cd0baab2 100644
--- a/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
+++ b/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
@@ -456,6 +456,28 @@ public:
         setupTwoStubArgs<FPRInfo::argumentFPR0, FPRInfo::argumentFPR1>(arg1, arg2);
     }
 #elif CPU(ARM)
+#if CPU(ARM_HARDFP)
+    ALWAYS_INLINE void setupArguments(FPRReg arg1)
+    {
+        moveDouble(arg1, FPRInfo::argumentFPR0);
+    }
+
+    ALWAYS_INLINE void setupArguments(FPRReg arg1, FPRReg arg2)
+    {
+        if (arg2 != FPRInfo::argumentFPR0) {
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+        } else if (arg1 != FPRInfo::argumentFPR1) {
+            moveDouble(arg2, FPRInfo::argumentFPR1);
+            moveDouble(arg1, FPRInfo::argumentFPR0);
+        } else {
+            // Swap arg1, arg2.
+            moveDouble(FPRInfo::argumentFPR0, ARMRegisters::d2);
+            moveDouble(FPRInfo::argumentFPR1, FPRInfo::argumentFPR0);
+            moveDouble(ARMRegisters::d2, FPRInfo::argumentFPR1);
+        }
+    }
+#else
     ALWAYS_INLINE void setupArguments(FPRReg arg1)
     {
         assembler().vmov(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, arg1);
@@ -466,6 +488,7 @@ public:
         assembler().vmov(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, arg1);
         assembler().vmov(GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, arg2);
     }
+#endif // CPU(ARM_HARDFP)
 #else
 #error "DFG JIT not supported on this platform."
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
index aecce83ed..e0d973992 100644
--- a/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
@@ -659,8 +659,10 @@ private:
                 if (node.flags() & NodeHasVarArgs) {
                     for (unsigned childIdx = node.firstChild();
                          childIdx < node.firstChild() + node.numChildren();
-                         ++childIdx)
-                        fixPossibleGetLocal(firstBlock, m_graph.m_varArgChildren[childIdx], changeRef);
+                         ++childIdx) {
+                        if (!!m_graph.m_varArgChildren[childIdx])
+                            fixPossibleGetLocal(firstBlock, m_graph.m_varArgChildren[childIdx], changeRef);
+                    }
                 } else if (!!node.child1()) {
                     fixPossibleGetLocal(firstBlock, node.children.child1(), changeRef);
                     if (!!node.child2()) {
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index dce57d520..b3681975d 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -35,9 +35,8 @@ namespace JSC { namespace DFG {
 
 class CSEPhase : public Phase {
 public:
-    CSEPhase(Graph& graph, OptimizationFixpointState fixpointState)
+    CSEPhase(Graph& graph)
         : Phase(graph, "common subexpression elimination")
-        , m_fixpointState(fixpointState)
     {
         // Replacements are used to implement local common subexpression elimination.
         m_replacements.resize(m_graph.size());
@@ -327,7 +326,7 @@ private:
         return false;
     }
 
-    bool checkStructureLoadElimination(const StructureSet& structureSet, NodeIndex child1)
+    bool checkStructureElimination(const StructureSet& structureSet, NodeIndex child1)
     {
         for (unsigned i = m_indexInBlock; i--;) {
             NodeIndex index = m_currentBlock->at(i);
@@ -624,8 +623,37 @@ private:
         }
         return NoNode;
     }
+    
+    bool checkArrayElimination(NodeIndex child1, Array::Mode arrayMode)
+    {
+        for (unsigned i = m_indexInBlock; i--;) {
+            NodeIndex index = m_currentBlock->at(i);
+            if (index == child1) 
+                break;
 
-    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, bool hasIntegerIndexPrediction)
+            Node& node = m_graph[index];
+            switch (node.op()) {
+            case PutByOffset:
+            case PutStructure:
+                // Changing the structure or putting to the storage cannot
+                // change the property storage pointer.
+                break;
+                
+            case CheckArray:
+                if (node.child1() == child1 && node.arrayMode() == arrayMode)
+                    return true;
+                break;
+                
+            default:
+                if (m_graph.clobbersWorld(index))
+                    return false;
+                break;
+            }
+        }
+        return false;
+    }
+
+    NodeIndex getIndexedPropertyStorageLoadElimination(NodeIndex child1, Array::Mode arrayMode)
     {
         for (unsigned i = m_indexInBlock; i--;) {
             NodeIndex index = m_currentBlock->at(i);
@@ -635,9 +663,7 @@ private:
             Node& node = m_graph[index];
             switch (node.op()) {
             case GetIndexedPropertyStorage: {
-                SpeculatedType basePrediction = m_graph[node.child2()].prediction();
-                bool nodeHasIntegerIndexPrediction = !(!(basePrediction & SpecInt32) && basePrediction);
-                if (node.child1() == child1 && hasIntegerIndexPrediction == nodeHasIntegerIndexPrediction)
+                if (node.child1() == child1 && node.arrayMode() == arrayMode)
                     return index;
                 break;
             }
@@ -988,7 +1014,7 @@ private:
             ASSERT(replacement.variableAccessData() == variableAccessData);
             // FIXME: We should be able to remove SetLocals that can exit; we just need
             // to replace them with appropriate type checks.
-            if (m_fixpointState == FixpointNotConverged) {
+            if (m_graph.m_fixpointState == FixpointNotConverged) {
                 // Need to be conservative at this time; if the SetLocal has any chance of performing
                 // any speculations then we cannot do anything.
                 if (variableAccessData->isCaptured()) {
@@ -1077,7 +1103,7 @@ private:
             
         case PutGlobalVar:
         case PutGlobalVarCheck:
-            if (m_fixpointState == FixpointNotConverged)
+            if (m_graph.m_fixpointState == FixpointNotConverged)
                 break;
             eliminate(globalVarStoreElimination(node.registerPointer()));
             break;
@@ -1103,7 +1129,7 @@ private:
             
         case CheckStructure:
         case ForwardCheckStructure:
-            if (checkStructureLoadElimination(node.structureSet(), node.child1().index()))
+            if (checkStructureElimination(node.structureSet(), node.child1().index()))
                 eliminate();
             break;
             
@@ -1114,7 +1140,7 @@ private:
             break;
             
         case PutStructure:
-            if (m_fixpointState == FixpointNotConverged)
+            if (m_graph.m_fixpointState == FixpointNotConverged)
                 break;
             eliminate(putStructureStoreElimination(node.child1().index()), PhantomPutStructure);
             break;
@@ -1124,10 +1150,13 @@ private:
                 eliminate();
             break;
                 
+        case CheckArray:
+            if (checkArrayElimination(node.child1().index(), node.arrayMode()))
+                eliminate();
+            break;
+            
         case GetIndexedPropertyStorage: {
-            SpeculatedType basePrediction = m_graph[node.child2()].prediction();
-            bool nodeHasIntegerIndexPrediction = !(!(basePrediction & SpecInt32) && basePrediction);
-            setReplacement(getIndexedPropertyStorageLoadElimination(node.child1().index(), nodeHasIntegerIndexPrediction));
+            setReplacement(getIndexedPropertyStorageLoadElimination(node.child1().index(), node.arrayMode()));
             break;
         }
 
@@ -1140,7 +1169,7 @@ private:
             break;
             
         case PutByOffset:
-            if (m_fixpointState == FixpointNotConverged)
+            if (m_graph.m_fixpointState == FixpointNotConverged)
                 break;
             eliminate(putByOffsetStoreElimination(m_graph.m_storageAccessData[node.storageAccessDataIndex()].identifierNumber, node.child1().index()));
             break;
@@ -1178,14 +1207,13 @@ private:
     unsigned m_indexInBlock;
     Vector<NodeIndex, 16> m_replacements;
     FixedArray<unsigned, LastNodeType> m_lastSeen;
-    OptimizationFixpointState m_fixpointState;
     bool m_changed; // Only tracks changes that have a substantive effect on other optimizations.
 };
 
-bool performCSE(Graph& graph, OptimizationFixpointState fixpointState)
+bool performCSE(Graph& graph)
 {
     SamplingRegion samplingRegion("DFG CSE Phase");
-    return runPhase<CSEPhase>(graph, fixpointState);
+    return runPhase<CSEPhase>(graph);
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.h b/Source/JavaScriptCore/dfg/DFGCSEPhase.h
index 7e33c2243..017bf5a4b 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.h
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.h
@@ -41,7 +41,7 @@ class Graph;
 // a wide range of subexpression similarities. It's known to produce big wins
 // on a few benchmarks, and is relatively cheap to run.
 
-bool performCSE(Graph&, OptimizationFixpointState);
+bool performCSE(Graph&);
 
 } } // namespace JSC::DFG
 
diff --git a/Source/JavaScriptCore/dfg/DFGCommon.h b/Source/JavaScriptCore/dfg/DFGCommon.h
index 1a64a248c..ddbefd2d5 100644
--- a/Source/JavaScriptCore/dfg/DFGCommon.h
+++ b/Source/JavaScriptCore/dfg/DFGCommon.h
@@ -132,7 +132,7 @@ enum SpillRegistersMode { NeedToSpill, DontSpill };
 
 enum NoResultTag { NoResult };
 
-enum OptimizationFixpointState { FixpointConverged, FixpointNotConverged };
+enum OptimizationFixpointState { BeforeFixpoint, FixpointNotConverged, FixpointConverged };
 
 inline bool shouldShowDisassembly()
 {
diff --git a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
index 68d5534e0..dfb62cbc4 100644
--- a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
@@ -101,7 +101,16 @@ private:
                     node.convertToStructureTransitionWatchpoint(structureValue.singleton());
                 break;
             }
-                    
+                
+            case CheckArray: {
+                if (!modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()))
+                    break;
+                ASSERT(node.refCount() == 1);
+                node.setOpAndDefaultFlags(Phantom);
+                eliminated = true;
+                break;
+            }
+                
             default:
                 break;
             }
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index ccef65208..eb68fa344 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -28,7 +28,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
-#include "ScopeChain.h"
+
 
 #if ENABLE(DFG_JIT)
 
@@ -41,7 +41,6 @@
 #include "DFGFixupPhase.h"
 #include "DFGJITCompiler.h"
 #include "DFGPredictionPropagationPhase.h"
-#include "DFGRedundantPhiEliminationPhase.h"
 #include "DFGStructureCheckHoistingPhase.h"
 #include "DFGValidate.h"
 #include "DFGVirtualRegisterAllocationPhase.h"
@@ -117,6 +116,7 @@ inline bool compile(CompileMode compileMode, ExecState* exec, CodeBlock* codeBlo
     performFixup(dfg);
     performStructureCheckHoisting(dfg);
     unsigned cnt = 1;
+    dfg.m_fixpointState = FixpointNotConverged;
     for (;; ++cnt) {
 #if DFG_ENABLE(DEBUG_VERBOSE)
         dataLog("DFG beginning optimization fixpoint iteration #%u.\n", cnt);
@@ -126,13 +126,14 @@ inline bool compile(CompileMode compileMode, ExecState* exec, CodeBlock* codeBlo
         changed |= performConstantFolding(dfg);
         changed |= performArgumentsSimplification(dfg);
         changed |= performCFGSimplification(dfg);
-        changed |= performCSE(dfg, FixpointNotConverged);
+        changed |= performCSE(dfg);
         if (!changed)
             break;
         dfg.resetExitStates();
         performFixup(dfg);
     }
-    performCSE(dfg, FixpointConverged);
+    dfg.m_fixpointState = FixpointConverged;
+    performCSE(dfg);
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("DFG optimization fixpoint converged in %u iterations.\n", cnt);
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGFPRInfo.h b/Source/JavaScriptCore/dfg/DFGFPRInfo.h
index e817ed396..5ee87bce1 100644
--- a/Source/JavaScriptCore/dfg/DFGFPRInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGFPRInfo.h
@@ -122,6 +122,11 @@ public:
     // we'll return in d0 for simplicity.
     static const FPRReg returnValueFPR = ARMRegisters::d0; // fpRegT0
 
+#if CPU(ARM_HARDFP)
+    static const FPRReg argumentFPR0 = ARMRegisters::d0; // fpRegT0
+    static const FPRReg argumentFPR1 = ARMRegisters::d1; // fpRegT1
+#endif
+
     // FPRReg mapping is direct, the machine regsiter numbers can
     // be used directly as indices into the FPR RegisterBank.
     COMPILE_ASSERT(ARMRegisters::d0 == 0, d0_is_0);
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index fe7cae8a9..7700b4b86 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -74,6 +74,9 @@ private:
         
         switch (op) {
         case GetById: {
+            if (m_graph.m_fixpointState > BeforeFixpoint)
+                break;
+            
             Node* nodePtr = &node;
             
             if (!isInt32Speculation(m_graph[m_compileIndex].prediction()))
@@ -90,8 +93,7 @@ private:
                     fromObserved(arrayProfile->observedArrayModes(), false),
                     m_graph[node.child1()].prediction(),
                     m_graph[m_compileIndex].prediction());                    
-                if (modeSupportsLength(arrayMode)
-                    && arrayProfile->hasDefiniteStructure()) {
+                if (modeSupportsLength(arrayMode) && arrayProfile->hasDefiniteStructure()) {
                     m_graph.ref(nodePtr->child1());
                     Node checkStructure(CheckStructure, nodePtr->codeOrigin, OpInfo(m_graph.addStructureSet(arrayProfile->expectedStructure())), nodePtr->child1().index());
                     checkStructure.ref();
@@ -113,17 +115,16 @@ private:
             nodePtr->clearFlags(NodeMustGenerate);
             m_graph.deref(m_compileIndex);
             nodePtr->setArrayMode(arrayMode);
+            
+            NodeIndex storage = checkArray(arrayMode, nodePtr->codeOrigin, nodePtr->child1().index(), lengthNeedsStorage, nodePtr->shouldGenerate());
+            if (storage == NoNode)
+                break;
+            
+            nodePtr = &m_graph[m_compileIndex];
+            nodePtr->children.child2() = Edge(storage);
             break;
         }
         case GetIndexedPropertyStorage: {
-            node.setArrayMode(
-                refineArrayMode(
-                    node.arrayMode(),
-                    m_graph[node.child1()].prediction(),
-                    m_graph[node.child2()].prediction()));
-            // Predictions should only become more, rather than less, refined. Hence
-            // if we were ever able to CSE the storage pointer for this operation,
-            // then we should always continue to be able to do so.
             ASSERT(canCSEStorage(node.arrayMode()));
             break;
         }
@@ -136,30 +137,19 @@ private:
                     m_graph[node.child1()].prediction(),
                     m_graph[node.child2()].prediction()));
             
-            if (canCSEStorage(node.arrayMode())) {
-                if (node.child3()) {
-                    ASSERT(m_graph[node.child3()].op() == GetIndexedPropertyStorage);
-                    ASSERT(modesCompatibleForStorageLoad(m_graph[node.child3()].arrayMode(), node.arrayMode()));
-                } else {
-                    // Make sure we don't use the node reference after we do the append.
-                    Node getIndexedPropertyStorage(
-                        GetIndexedPropertyStorage, node.codeOrigin, OpInfo(node.arrayMode()),
-                        node.child1().index(), node.child2().index());
-                    NodeIndex getIndexedPropertyStorageIndex = m_graph.size();
-                    node.children.child3() = Edge(getIndexedPropertyStorageIndex);
-                    m_graph.append(getIndexedPropertyStorage);
-                    m_graph.ref(getIndexedPropertyStorageIndex); // Once because it's MustGenerate.
-                    m_graph.ref(getIndexedPropertyStorageIndex); // And again because it's referenced from the GetByVal.
-                    m_insertionSet.append(m_indexInBlock, getIndexedPropertyStorageIndex);
-                }
-            } else {
-                // See above. Continued fixup of the graph should not regress our ability
-                // to speculate.
-                ASSERT(!node.child3());
-            }
+            blessArrayOperation(node.child1(), 2);
+            break;
+        }
+            
+        case ArrayPush: {
+            blessArrayOperation(node.child1(), 2);
             break;
         }
             
+        case ArrayPop: {
+            blessArrayOperation(node.child1(), 1);
+        }
+            
         case ValueToInt32: {
             if (m_graph[node.child1()].shouldSpeculateNumber()
                 && node.mustGenerate()) {
@@ -330,11 +320,18 @@ private:
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
             Edge child3 = m_graph.varArgChild(node, 2);
+
             node.setArrayMode(
                 refineArrayMode(
-                    node.arrayMode(), m_graph[child1].prediction(), m_graph[child2].prediction()));
+                    node.arrayMode(),
+                    m_graph[child1].prediction(),
+                    m_graph[child2].prediction()));
+            
+            blessArrayOperation(child1, 3);
             
-            switch (modeForPut(node.arrayMode())) {
+            Node* nodePtr = &m_graph[m_compileIndex];
+            
+            switch (modeForPut(nodePtr->arrayMode())) {
             case Array::Int8Array:
             case Array::Int16Array:
             case Array::Int32Array:
@@ -368,6 +365,59 @@ private:
 #endif
     }
     
+    NodeIndex checkArray(Array::Mode arrayMode, CodeOrigin codeOrigin, NodeIndex array, bool (*storageCheck)(Array::Mode) = canCSEStorage, bool shouldGenerate = true)
+    {
+        ASSERT(modeIsSpecific(arrayMode));
+        
+        m_graph.ref(array);
+        Node checkArray(CheckArray, codeOrigin, OpInfo(arrayMode), array);
+        checkArray.ref();
+        NodeIndex checkArrayIndex = m_graph.size();
+        m_graph.append(checkArray);
+        m_insertionSet.append(m_indexInBlock, checkArrayIndex);
+
+        if (!storageCheck(arrayMode))
+            return NoNode;
+        
+        if (shouldGenerate)
+            m_graph.ref(array);
+        Node getIndexedPropertyStorage(
+            GetIndexedPropertyStorage, codeOrigin, OpInfo(arrayMode), array);
+        if (shouldGenerate)
+            getIndexedPropertyStorage.ref();
+        NodeIndex getIndexedPropertyStorageIndex = m_graph.size();
+        m_graph.append(getIndexedPropertyStorage);
+        m_insertionSet.append(m_indexInBlock, getIndexedPropertyStorageIndex);
+        
+        return getIndexedPropertyStorageIndex;
+    }
+    
+    void blessArrayOperation(Edge base, unsigned storageChildIdx)
+    {
+        if (m_graph.m_fixpointState > BeforeFixpoint)
+            return;
+            
+        Node* nodePtr = &m_graph[m_compileIndex];
+        
+        if (nodePtr->arrayMode() == Array::ForceExit) {
+            Node forceExit(ForceOSRExit, nodePtr->codeOrigin);
+            forceExit.ref();
+            NodeIndex forceExitIndex = m_graph.size();
+            m_graph.append(forceExit);
+            m_insertionSet.append(m_indexInBlock, forceExitIndex);
+            return;
+        }
+        
+        if (!modeIsSpecific(nodePtr->arrayMode()))
+            return;
+            
+        NodeIndex storage = checkArray(nodePtr->arrayMode(), nodePtr->codeOrigin, base.index());
+        if (storage == NoNode)
+            return;
+            
+        m_graph.child(m_graph[m_compileIndex], storageChildIdx) = Edge(storage);
+    }
+    
     void fixIntEdge(Edge& edge)
     {
         Node& node = m_graph[edge];
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index 8e80ff2fc..f4d260b9e 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -40,6 +40,18 @@ static const char* dfgOpNames[] = {
 #undef STRINGIZE_DFG_OP_ENUM
 };
 
+Graph::Graph(JSGlobalData& globalData, CodeBlock* codeBlock, unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues)
+    : m_globalData(globalData)
+    , m_codeBlock(codeBlock)
+    , m_profiledBlock(codeBlock->alternative())
+    , m_hasArguments(false)
+    , m_osrEntryBytecodeIndex(osrEntryBytecodeIndex)
+    , m_mustHandleValues(mustHandleValues)
+    , m_fixpointState(BeforeFixpoint)
+{
+    ASSERT(m_profiledBlock);
+}
+
 const char *Graph::opName(NodeType op)
 {
     return dfgOpNames[op];
@@ -179,6 +191,8 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
                 dataLog(", ");
             else
                 hasPrinted = true;
+            if (!m_varArgChildren[childIdx])
+                continue;
             dataLog("%s@%u%s",
                     useKindToString(m_varArgChildren[childIdx].useKind()),
                     m_varArgChildren[childIdx].index(),
@@ -227,7 +241,7 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
         hasPrinted = true;
     }
     if (node.hasIdentifier()) {
-        dataLog("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), m_codeBlock->identifier(node.identifierNumber()).ustring().utf8().data());
+        dataLog("%sid%u{%s}", hasPrinted ? ", " : "", node.identifierNumber(), m_codeBlock->identifier(node.identifierNumber()).string().utf8().data());
         hasPrinted = true;
     }
     if (node.hasStructureSet()) {
@@ -246,7 +260,7 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
     }
     if (node.hasStorageAccessData()) {
         StorageAccessData& storageAccessData = m_storageAccessData[node.storageAccessDataIndex()];
-        dataLog("%sid%u{%s}", hasPrinted ? ", " : "", storageAccessData.identifierNumber, m_codeBlock->identifier(storageAccessData.identifierNumber).ustring().utf8().data());
+        dataLog("%sid%u{%s}", hasPrinted ? ", " : "", storageAccessData.identifierNumber, m_codeBlock->identifier(storageAccessData.identifierNumber).string().utf8().data());
         
         dataLog(", %lu", static_cast<unsigned long>(storageAccessData.offset));
         hasPrinted = true;
@@ -392,8 +406,10 @@ void Graph::dump()
         if (_node.flags() & NodeHasVarArgs) {                           \
             for (unsigned _childIdx = _node.firstChild();               \
                  _childIdx < _node.firstChild() + _node.numChildren();  \
-                 _childIdx++)                                           \
-                thingToDo(m_varArgChildren[_childIdx]);                 \
+                 _childIdx++) {                                         \
+                if (!!m_varArgChildren[_childIdx])                      \
+                    thingToDo(m_varArgChildren[_childIdx]);             \
+            }                                                           \
         } else {                                                        \
             if (!_node.child1()) {                                      \
                 ASSERT(!_node.child2()                                  \
@@ -483,6 +499,8 @@ void Graph::collectGarbage()
             for (unsigned childIdx = node.firstChild();
                  childIdx < node.firstChild() + node.numChildren();
                  ++childIdx) {
+                if (!m_varArgChildren[childIdx])
+                    continue;
                 NodeIndex childNodeIndex = m_varArgChildren[childIdx].index();
                 if (!at(childNodeIndex).ref())
                     continue;
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index ba5d86f81..70cbbaf07 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -53,14 +53,6 @@ namespace DFG {
 struct StorageAccessData {
     size_t offset;
     unsigned identifierNumber;
-    
-    // NOTE: the offset and identifierNumber do not by themselves
-    // uniquely identify a property. The identifierNumber and a
-    // Structure* do. If those two match, then the offset should
-    // be the same, as well. For any Node that has a StorageAccessData,
-    // it is possible to retrieve the Structure* by looking at the
-    // first child. It should be a CheckStructure, which has the
-    // Structure*.
 };
 
 struct ResolveGlobalData {
@@ -76,16 +68,7 @@ struct ResolveGlobalData {
 // Nodes that are 'dead' remain in the vector with refCount 0.
 class Graph : public Vector<Node, 64> {
 public:
-    Graph(JSGlobalData& globalData, CodeBlock* codeBlock, unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues)
-        : m_globalData(globalData)
-        , m_codeBlock(codeBlock)
-        , m_profiledBlock(codeBlock->alternative())
-        , m_hasArguments(false)
-        , m_osrEntryBytecodeIndex(osrEntryBytecodeIndex)
-        , m_mustHandleValues(mustHandleValues)
-    {
-        ASSERT(m_profiledBlock);
-    }
+    Graph(JSGlobalData&, CodeBlock*, unsigned osrEntryBytecodeIndex, const Operands<JSValue>& mustHandleValues);
     
     using Vector<Node, 64>::operator[];
     using Vector<Node, 64>::at;
@@ -585,8 +568,10 @@ public:
         if (node.flags() & NodeHasVarArgs) {
             for (unsigned childIdx = node.firstChild();
                  childIdx < node.firstChild() + node.numChildren();
-                 childIdx++)
-                vote(m_varArgChildren[childIdx], ballot);
+                 childIdx++) {
+                if (!!m_varArgChildren[childIdx])
+                    vote(m_varArgChildren[childIdx], ballot);
+            }
             return;
         }
         
@@ -608,8 +593,10 @@ public:
             NodeIndex nodeIndex = block[indexInBlock];
             Node& node = at(nodeIndex);
             if (node.flags() & NodeHasVarArgs) {
-                for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); ++childIdx)
-                    compareAndSwap(m_varArgChildren[childIdx], oldThing, newThing, node.shouldGenerate());
+                for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); ++childIdx) {
+                    if (!!m_varArgChildren[childIdx])
+                        compareAndSwap(m_varArgChildren[childIdx], oldThing, newThing, node.shouldGenerate());
+                }
                 continue;
             }
             if (!node.child1())
@@ -685,6 +672,8 @@ public:
     unsigned m_parameterSlots;
     unsigned m_osrEntryBytecodeIndex;
     Operands<JSValue> m_mustHandleValues;
+    
+    OptimizationFixpointState m_fixpointState;
 private:
     
     void handleSuccessor(Vector<BlockIndex, 16>& worklist, BlockIndex blockIndex, BlockIndex successorIndex);
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 7ca4d8d48..fb31f935e 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -743,6 +743,9 @@ struct Node {
         case GetByVal:
         case StringCharAt:
         case StringCharCodeAt:
+        case CheckArray:
+        case ArrayPush:
+        case ArrayPop:
             return true;
         default:
             return false;
@@ -755,10 +758,13 @@ struct Node {
         return static_cast<Array::Mode>(m_opInfo);
     }
     
-    void setArrayMode(Array::Mode arrayMode)
+    bool setArrayMode(Array::Mode arrayMode)
     {
         ASSERT(hasArrayMode());
+        if (this->arrayMode() == arrayMode)
+            return false;
         m_opInfo = arrayMode;
+        return true;
     }
     
     bool hasVirtualRegister()
@@ -910,12 +916,27 @@ struct Node {
     {
         return isBooleanSpeculation(prediction());
     }
-    
+   
+    bool shouldSpeculateString()
+    {
+        return isStringSpeculation(prediction());
+    }
+ 
     bool shouldSpeculateFinalObject()
     {
         return isFinalObjectSpeculation(prediction());
     }
     
+    bool shouldSpeculateNonStringCell()
+    {
+        return isNonStringCellSpeculation(prediction());
+    }
+
+    bool shouldSpeculateNonStringCellOrOther()
+    {
+        return isNonStringCellOrOtherSpeculation(prediction());
+    }
+
     bool shouldSpeculateFinalObjectOrOther()
     {
         return isFinalObjectOrOtherSpeculation(prediction());
diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
index ee5ad9013..d86b9b356 100644
--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
@@ -138,7 +138,8 @@ namespace JSC { namespace DFG {
     macro(AllocatePropertyStorage, NodeMustGenerate | NodeDoesNotExit | NodeResultStorage) \
     macro(ReallocatePropertyStorage, NodeMustGenerate | NodeDoesNotExit | NodeResultStorage) \
     macro(GetPropertyStorage, NodeResultStorage) \
-    macro(GetIndexedPropertyStorage, NodeMustGenerate | NodeResultStorage) \
+    macro(CheckArray, NodeMustGenerate) \
+    macro(GetIndexedPropertyStorage, NodeResultStorage) \
     macro(GetByOffset, NodeResultJS) \
     macro(PutByOffset, NodeMustGenerate) \
     macro(GetArrayLength, NodeResultInt32) \
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index b5c3b961b..824a0a37a 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -39,11 +39,13 @@
 #include "JITExceptions.h"
 #include "JSActivation.h"
 #include "JSGlobalData.h"
-#include "JSStaticScopeObject.h"
+#include "JSNameScope.h"
 #include "NameInstance.h"
 #include "Operations.h"
 #include <wtf/InlineASM.h>
 
+#if ENABLE(JIT)
+
 #if ENABLE(DFG_JIT)
 
 #if CPU(X86_64)
@@ -407,6 +409,20 @@ EncodedJSValue DFG_OPERATION operationGetByValCell(ExecState* exec, JSCell* base
     return JSValue::encode(JSValue(base).get(exec, ident));
 }
 
+EncodedJSValue DFG_OPERATION operationGetByValArrayInt(ExecState* exec, JSArray* base, int32_t index)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    if (index < 0) {
+        // Go the slowest way possible becase negative indices don't use indexed storage.
+        return JSValue::encode(JSValue(base).get(exec, Identifier::from(exec, index)));
+    }
+
+    // Use this since we know that the value is out of bounds.
+    return JSValue::encode(JSValue(base).get(exec, index));
+}
+
 EncodedJSValue DFG_OPERATION operationGetById(ExecState* exec, EncodedJSValue base, Identifier* propertyName)
 {
     JSGlobalData* globalData = &exec->globalData();
@@ -575,6 +591,14 @@ EncodedJSValue DFG_OPERATION operationArrayPush(ExecState* exec, EncodedJSValue
     return JSValue::encode(jsNumber(array->length()));
 }
 
+EncodedJSValue DFG_OPERATION operationArrayPop(ExecState* exec, JSArray* array)
+{
+    JSGlobalData* globalData = &exec->globalData();
+    NativeCallFrameTracer tracer(globalData, exec);
+    
+    return JSValue::encode(array->pop(exec));
+}
+        
 EncodedJSValue DFG_OPERATION operationRegExpExec(ExecState* exec, JSCell* base, JSCell* argument)
 {
     JSGlobalData& globalData = exec->globalData();
@@ -603,14 +627,6 @@ size_t DFG_OPERATION operationRegExpTest(ExecState* exec, JSCell* base, JSCell*
     return asRegExpObject(base)->test(exec, input);
 }
         
-EncodedJSValue DFG_OPERATION operationArrayPop(ExecState* exec, JSArray* array)
-{
-    JSGlobalData* globalData = &exec->globalData();
-    NativeCallFrameTracer tracer(globalData, exec);
-    
-    return JSValue::encode(array->pop(exec));
-}
-        
 void DFG_OPERATION operationPutByIdStrict(ExecState* exec, EncodedJSValue encodedValue, JSCell* base, Identifier* propertyName)
 {
     JSGlobalData* globalData = &exec->globalData();
@@ -899,7 +915,7 @@ static void* handleHostCall(ExecState* execCallee, JSValue callee, CodeSpecializ
     ExecState* exec = execCallee->callerFrame();
     JSGlobalData* globalData = &exec->globalData();
 
-    execCallee->setScopeChain(exec->scopeChain());
+    execCallee->setScope(exec->scope());
     execCallee->setCodeBlock(0);
 
     if (kind == CodeForCall) {
@@ -957,7 +973,7 @@ inline char* linkFor(ExecState* execCallee, CodeSpecializationKind kind)
         return reinterpret_cast<char*>(handleHostCall(execCallee, calleeAsValue, kind));
 
     JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
-    execCallee->setScopeChain(callee->scopeUnchecked());
+    execCallee->setScope(callee->scopeUnchecked());
     ExecutableBase* executable = callee->executable();
 
     MacroAssemblerCodePtr codePtr;
@@ -1007,7 +1023,7 @@ inline char* virtualFor(ExecState* execCallee, CodeSpecializationKind kind)
         return reinterpret_cast<char*>(handleHostCall(execCallee, calleeAsValue, kind));
     
     JSFunction* function = jsCast<JSFunction*>(calleeAsFunctionCell);
-    execCallee->setScopeChain(function->scopeUnchecked());
+    execCallee->setScope(function->scopeUnchecked());
     ExecutableBase* executable = function->executable();
     if (UNLIKELY(!executable->hasJITCodeFor(kind))) {
         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
@@ -1039,20 +1055,7 @@ EncodedJSValue DFG_OPERATION operationResolve(ExecState* exec, Identifier* prope
 {
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
-    
-    ScopeChainNode* scopeChain = exec->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    do {
-        JSObject* record = iter->get();
-        PropertySlot slot(record);
-        if (record->getPropertySlot(exec, *propertyName, slot))
-            return JSValue::encode(slot.getValue(exec, *propertyName));
-    } while (++iter != end);
-
-    return throwVMError(exec, createUndefinedVariableError(exec, *propertyName));
+    return JSValue::encode(JSScope::resolve(exec, *propertyName));
 }
 
 EncodedJSValue DFG_OPERATION operationResolveBase(ExecState* exec, Identifier* propertyName)
@@ -1060,7 +1063,7 @@ EncodedJSValue DFG_OPERATION operationResolveBase(ExecState* exec, Identifier* p
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
-    return JSValue::encode(resolveBase(exec, *propertyName, exec->scopeChain(), false));
+    return JSValue::encode(JSScope::resolveBase(exec, *propertyName, false));
 }
 
 EncodedJSValue DFG_OPERATION operationResolveBaseStrictPut(ExecState* exec, Identifier* propertyName)
@@ -1068,30 +1071,15 @@ EncodedJSValue DFG_OPERATION operationResolveBaseStrictPut(ExecState* exec, Iden
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
     
-    JSValue base = resolveBase(exec, *propertyName, exec->scopeChain(), true);
-    if (!base)
-        throwError(exec, createErrorForInvalidGlobalAssignment(exec, propertyName->ustring()));
-    return JSValue::encode(base);
+    return JSValue::encode(JSScope::resolveBase(exec, *propertyName, true));
 }
 
 EncodedJSValue DFG_OPERATION operationResolveGlobal(ExecState* exec, GlobalResolveInfo* resolveInfo, JSGlobalObject* globalObject, Identifier* propertyName)
 {
     JSGlobalData* globalData = &exec->globalData();
     NativeCallFrameTracer tracer(globalData, exec);
-    
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(exec, *propertyName, slot)) {
-        JSValue result = slot.getValue(exec, *propertyName);
-
-        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            resolveInfo->structure.set(exec->globalData(), exec->codeBlock()->ownerExecutable(), globalObject->structure());
-            resolveInfo->offset = slot.cachedOffset();
-        }
 
-        return JSValue::encode(result);
-    }
-
-    return throwVMError(exec, createUndefinedVariableError(exec, *propertyName));
+    return JSValue::encode(JSScope::resolveGlobal(exec, *propertyName, globalObject, &resolveInfo->structure, &resolveInfo->offset));
 }
 
 EncodedJSValue DFG_OPERATION operationToPrimitive(ExecState* exec, EncodedJSValue value)
@@ -1154,7 +1142,7 @@ JSCell* DFG_OPERATION operationCreateActivation(ExecState* exec)
     NativeCallFrameTracer tracer(&globalData, exec);
     JSActivation* activation = JSActivation::create(
         globalData, exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
-    exec->setScopeChain(exec->scopeChain()->push(activation));
+    exec->setScope(activation);
     return activation;
 }
 
@@ -1255,7 +1243,7 @@ JSCell* DFG_OPERATION operationNewFunction(ExecState* exec, JSCell* functionExec
     ASSERT(functionExecutable->inherits(&FunctionExecutable::s_info));
     JSGlobalData& globalData = exec->globalData();
     NativeCallFrameTracer tracer(&globalData, exec);
-    return static_cast<FunctionExecutable*>(functionExecutable)->make(exec, exec->scopeChain());
+    return JSFunction::create(exec, static_cast<FunctionExecutable*>(functionExecutable), exec->scope());
 }
 
 JSCell* DFG_OPERATION operationNewFunctionExpression(ExecState* exec, JSCell* functionExecutableAsCell)
@@ -1263,14 +1251,7 @@ JSCell* DFG_OPERATION operationNewFunctionExpression(ExecState* exec, JSCell* fu
     ASSERT(functionExecutableAsCell->inherits(&FunctionExecutable::s_info));
     FunctionExecutable* functionExecutable =
         static_cast<FunctionExecutable*>(functionExecutableAsCell);
-    JSFunction *function = functionExecutable->make(exec, exec->scopeChain());
-    if (!functionExecutable->name().isNull()) {
-        JSStaticScopeObject* functionScopeObject =
-            JSStaticScopeObject::create(
-                exec, functionExecutable->name(), function, ReadOnly | DontDelete);
-        function->setScope(exec->globalData(), function->scope()->push(functionScopeObject));
-    }
-    return function;
+    return JSFunction::create(exec, functionExecutable, exec->scope());
 }
 
 size_t DFG_OPERATION operationIsObject(ExecState* exec, EncodedJSValue value)
@@ -1416,7 +1397,7 @@ extern "C" void DFG_OPERATION triggerReoptimizationNow(CodeBlock* codeBlock)
 } // extern "C"
 } } // namespace JSC::DFG
 
-#endif
+#endif // ENABLE(DFG_JIT)
 
 #if COMPILER(GCC)
 
@@ -1478,3 +1459,4 @@ extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWi
 
 #endif // COMPILER(GCC)
 
+#endif // ENABLE(JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index 455c2bcc3..82babe875 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -62,6 +62,7 @@ extern "C" {
 */
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_E)(ExecState*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EA)(ExecState*, JSArray*);
+typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_EAZ)(ExecState*, JSArray*, int32_t);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECC)(ExecState*, JSCell*, JSCell*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECI)(ExecState*, JSCell*, Identifier*);
 typedef EncodedJSValue DFG_OPERATION (*J_DFGOperation_ECJ)(ExecState*, JSCell*, EncodedJSValue);
@@ -116,6 +117,7 @@ EncodedJSValue DFG_OPERATION operationValueAdd(ExecState*, EncodedJSValue encode
 EncodedJSValue DFG_OPERATION operationValueAddNotNumber(ExecState*, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationGetByVal(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedProperty) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationGetByValCell(ExecState*, JSCell*, EncodedJSValue encodedProperty) WTF_INTERNAL;
+EncodedJSValue DFG_OPERATION operationGetByValArrayInt(ExecState*, JSArray*, int32_t) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationGetById(ExecState*, EncodedJSValue, Identifier*) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationGetByIdBuildList(ExecState*, EncodedJSValue, Identifier*) WTF_INTERNAL;
 EncodedJSValue DFG_OPERATION operationGetByIdProtoBuildList(ExecState*, EncodedJSValue, Identifier*) WTF_INTERNAL;
diff --git a/Source/JavaScriptCore/dfg/DFGPhase.h b/Source/JavaScriptCore/dfg/DFGPhase.h
index 80fd6914a..a73d26baf 100644
--- a/Source/JavaScriptCore/dfg/DFGPhase.h
+++ b/Source/JavaScriptCore/dfg/DFGPhase.h
@@ -95,13 +95,6 @@ bool runPhase(Graph& graph)
     return runAndLog(phase);
 }
 
-template<typename PhaseType, typename ArgumentType1>
-bool runPhase(Graph& graph, ArgumentType1 arg1)
-{
-    PhaseType phase(graph, arg1);
-    return runAndLog(phase);
-}
-
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index 258d1199a..af57ab8fe 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -618,7 +618,8 @@ private:
         case GetMyArgumentsLength:
         case GetMyArgumentByVal:
         case PhantomPutStructure:
-        case PhantomArguments: {
+        case PhantomArguments:
+        case CheckArray: {
             // This node should never be visible at this stage of compilation. It is
             // inserted by fixup(), which follows this phase.
             ASSERT_NOT_REACHED();
@@ -703,8 +704,10 @@ private:
         if (node.flags() & NodeHasVarArgs) {
             for (unsigned childIdx = node.firstChild();
                  childIdx < node.firstChild() + node.numChildren();
-                 childIdx++)
-                changed |= m_graph[m_graph.m_varArgChildren[childIdx]].mergeFlags(NodeUsedAsValue);
+                 childIdx++) {
+                if (!!m_graph.m_varArgChildren[childIdx])
+                    changed |= m_graph[m_graph.m_varArgChildren[childIdx]].mergeFlags(NodeUsedAsValue);
+            }
         } else {
             if (!node.child1())
                 return changed;
diff --git a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
deleted file mode 100644
index 32e4ef157..000000000
--- a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
+++ /dev/null
@@ -1,178 +0,0 @@
-/*
- * Copyright (C) 2012 Intel Corporation. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "DFGRedundantPhiEliminationPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGGraph.h"
-
-namespace JSC { namespace DFG {
-
-class RedundantPhiEliminationPhase : public Phase {
-public:
-    RedundantPhiEliminationPhase(Graph& graph)
-        : Phase(graph, "redundant phi elimination")
-    {
-    }
-    
-    bool run()
-    {
-        bool changed = false;
-        do {
-            changed = fixupPhis();
-        } while (changed);
-
-        updateBlockVariableInformation();
-
-        // Update the Phi references from non-Phi nodes, e.g., the GetLocals.
-        for (NodeIndex index = 0; index < m_graph.size(); ++index) {
-            Node& node = m_graph[index];
-
-            if (!node.shouldGenerate())
-                continue;
-
-            switch (node.op()) {
-            case GetLocal:
-                replacePhiChild(node, 0);
-                break;
-            default:
-                break;
-            }
-        }
-        
-        return true;
-    }
-
-private:
-    NodeIndex getRedundantReplacement(NodeIndex phi)
-    {
-        NodeIndex child1 = m_graph[phi].child1().indexUnchecked();
-        NodeIndex candidate = child1 == phi ? NoNode : child1;
-
-        NodeIndex child2 = m_graph[phi].child2().indexUnchecked();
-        if (candidate != NoNode) {
-            if (child2 != NoNode && child2 != candidate && child2 != phi)
-                return NoNode;
-        } else if (child2 != phi)
-            candidate = child2;
-
-        NodeIndex child3 = m_graph[phi].child3().indexUnchecked();
-        if (candidate != NoNode) {
-            if (child3 != NoNode && child3 != candidate && child3 != phi)
-                return NoNode;
-        } else if (child3 != phi)
-            candidate = child3;
-        
-        return candidate;
-    }
-
-    bool replacePhiChild(Node& node, unsigned childIndex)
-    {
-        ASSERT(childIndex < 3);
-
-        bool replaced = false;
-        NodeIndex child = node.children.child(childIndex).indexUnchecked();
-        if (child != NoNode && m_graph[child].op() == Phi) {
-            NodeIndex childReplacement = getRedundantReplacement(child);
-            if (childReplacement != NoNode) {
-                node.children.child(childIndex).setIndex(childReplacement);
-                replaced = true;
-                if (node.refCount()) {
-                    m_graph[childReplacement].ref();
-                    m_graph.deref(child);
-                }
-            }
-        }
-        return replaced;
-    }
-
-    bool fixupPhis()
-    {
-        bool changed = false;
-
-        for (BlockIndex block = 0; block < m_graph.m_blocks.size(); ++block) {
-            Vector<NodeIndex>& phis = m_graph.m_blocks[block]->phis;
-
-            for (size_t i = 0; i < phis.size(); ++i) {
-                NodeIndex phi = phis[i];
-                Node& phiNode = m_graph[phi];
-
-                changed |= (replacePhiChild(phiNode, 0) && phiNode.refCount());
-                changed |= (replacePhiChild(phiNode, 1) && phiNode.refCount());
-                changed |= (replacePhiChild(phiNode, 2) && phiNode.refCount());
-            }
-        }
-
-        return changed;
-    }
-
-    void updateBlockVariableInformation()
-    {
-        // Redundant Phi nodes are eliminated, we need to update
-        // the variable information if it references them.
-        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
-            BasicBlock* basicBlock = m_graph.m_blocks[blockIndex].get();
-
-            for (size_t arg = 0; arg < basicBlock->variablesAtHead.numberOfArguments(); ++arg) {
-                NodeIndex nodeIndex = basicBlock->variablesAtHead.argument(arg);
-                if (nodeIndex != NoNode && m_graph[nodeIndex].op() == Phi && !m_graph[nodeIndex].refCount()) {
-                    NodeIndex replacement = getRedundantReplacement(nodeIndex);
-                    if (replacement != NoNode) {
-                        // This argument must be unused in this block.
-                        ASSERT(basicBlock->variablesAtTail.argument(arg) == nodeIndex);
-                        basicBlock->variablesAtHead.argument(arg) = replacement;
-                        basicBlock->variablesAtTail.argument(arg) = replacement;
-                    }
-                }
-            }
-
-            for (size_t local = 0; local < basicBlock->variablesAtHead.numberOfLocals(); ++local) {
-                NodeIndex nodeIndex = basicBlock->variablesAtHead.local(local);
-                if (nodeIndex != NoNode && m_graph[nodeIndex].op() == Phi && !m_graph[nodeIndex].refCount()) {
-                    NodeIndex replacement = getRedundantReplacement(nodeIndex);
-                    if (replacement != NoNode) {
-                        // This local variable must be unused in this block.
-                        ASSERT(basicBlock->variablesAtTail.local(local) == nodeIndex);
-                        basicBlock->variablesAtHead.local(local) = replacement;
-                        basicBlock->variablesAtTail.local(local) = replacement;
-                    }
-                }
-            }
-        }
-    }
-
-};
-
-bool performRedundantPhiElimination(Graph& graph)
-{
-    SamplingRegion samplingRegion("DFG Redundant Phi Elimination Phase");
-    return runPhase<RedundantPhiEliminationPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
index 23e8db03b..1af4999e8 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
@@ -252,8 +252,12 @@ static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier
         }
         
         MacroAssembler::JumpList failureCases;
-        
-        failureCases.append(stubJit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+       
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSCell::structureOffset()), scratchGPR); 
+        failureCases.append(stubJit.branchPtr(
+            MacroAssembler::NotEqual, 
+            MacroAssembler::Address(scratchGPR, Structure::classInfoOffset()), 
+            MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
         
         stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), scratchGPR);
         stubJit.load32(MacroAssembler::Address(scratchGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), scratchGPR);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index d74207420..c9c07da80 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -295,20 +295,23 @@ const TypedArrayDescriptor* SpeculativeJIT::typedArrayDescriptor(Array::Mode arr
     }
 }
 
-const TypedArrayDescriptor* SpeculativeJIT::speculateArray(Array::Mode arrayMode, Edge edge, GPRReg baseReg)
+void SpeculativeJIT::checkArray(Node& node)
 {
-    const TypedArrayDescriptor* result = typedArrayDescriptor(arrayMode);
+    ASSERT(modeIsSpecific(node.arrayMode()));
     
-    if (modeAlreadyChecked(m_state.forNode(edge), arrayMode))
-        return result;
+    SpeculateCellOperand base(this, node.child1());
+    GPRReg baseReg = base.gpr();
+    
+    const TypedArrayDescriptor* result = typedArrayDescriptor(node.arrayMode());
+    
+    if (modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode())) {
+        noResult(m_compileIndex);
+        return;
+    }
     
     const ClassInfo* expectedClassInfo = 0;
     
-    switch (arrayMode) {
-    case Array::ForceExit:
-        ASSERT_NOT_REACHED();
-        terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
-        return result;
+    switch (node.arrayMode()) {
     case Array::String:
         expectedClassInfo = &JSString::s_info;
         break;
@@ -325,7 +328,9 @@ const TypedArrayDescriptor* SpeculativeJIT::speculateArray(Array::Mode arrayMode
                 MacroAssembler::NotEqual,
                 MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
                 MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
-        return result;
+        
+        noResult(m_compileIndex);
+        return;
     }
     case Array::Arguments:
         expectedClassInfo = &Arguments::s_info;
@@ -356,7 +361,7 @@ const TypedArrayDescriptor* SpeculativeJIT::speculateArray(Array::Mode arrayMode
             MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
             MacroAssembler::TrustedImmPtr(expectedClassInfo)));
     
-    return result;
+    noResult(m_compileIndex);
 }
 
 GPRReg SpeculativeJIT::fillStorage(NodeIndex nodeIndex)
@@ -393,8 +398,10 @@ GPRReg SpeculativeJIT::fillStorage(NodeIndex nodeIndex)
 void SpeculativeJIT::useChildren(Node& node)
 {
     if (node.flags() & NodeHasVarArgs) {
-        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++)
-            use(m_jit.graph().m_varArgChildren[childIdx]);
+        for (unsigned childIdx = node.firstChild(); childIdx < node.firstChild() + node.numChildren(); childIdx++) {
+            if (!!m_jit.graph().m_varArgChildren[childIdx])
+                use(m_jit.graph().m_varArgChildren[childIdx]);
+        }
     } else {
         Edge child1 = node.child1();
         if (!child1) {
@@ -1065,7 +1072,7 @@ void SpeculativeJIT::compilePeepHoleDoubleBranch(Node& node, NodeIndex branchNod
     jump(notTaken);
 }
 
-void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchNodeIndex, const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchNodeIndex)
 {
     Node& branchNode = at(branchNodeIndex);
     BlockIndex taken = branchNode.takenBlockIndex();
@@ -1086,11 +1093,47 @@ void SpeculativeJIT::compilePeepHoleObjectEquality(Node& node, NodeIndex branchN
     GPRReg op1GPR = op1.gpr();
     GPRReg op2GPR = op2.gpr();
     
-    if (!speculatedTypeChecker(m_state.forNode(node.child1()).m_type))
-        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    if (!speculatedTypeChecker(m_state.forNode(node.child2()).m_type))
-        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    
+    if (m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1().index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2().index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
+
     branchPtr(condition, op1GPR, op2GPR, taken);
     jump(notTaken);
 }
@@ -1144,37 +1187,17 @@ bool SpeculativeJIT::compilePeepHoleBranch(Node& node, MacroAssembler::Relationa
         else if (Node::shouldSpeculateNumber(at(node.child1()), at(node.child2())))
             compilePeepHoleDoubleBranch(node, branchNodeIndex, doubleCondition);
         else if (node.op() == CompareEq) {
-            if (Node::shouldSpeculateFinalObject(
-                    at(node.child1()), at(node.child2()))) {
-                compilePeepHoleObjectEquality(
-                    node, branchNodeIndex, &JSFinalObject::s_info,
-                    isFinalObjectSpeculation);
-            } else if (Node::shouldSpeculateArray(
-                           at(node.child1()), at(node.child2()))) {
-                compilePeepHoleObjectEquality(
-                    node, branchNodeIndex, &JSArray::s_info,
-                    isArraySpeculation);
-            } else if (at(node.child1()).shouldSpeculateFinalObject()
-                       && at(node.child2()).shouldSpeculateFinalObjectOrOther()) {
-                compilePeepHoleObjectToObjectOrOtherEquality(
-                    node.child1(), node.child2(), branchNodeIndex,
-                    &JSFinalObject::s_info, isFinalObjectSpeculation);
-            } else if (at(node.child1()).shouldSpeculateFinalObjectOrOther()
-                       && at(node.child2()).shouldSpeculateFinalObject()) {
-                compilePeepHoleObjectToObjectOrOtherEquality(
-                    node.child2(), node.child1(), branchNodeIndex,
-                    &JSFinalObject::s_info, isFinalObjectSpeculation);
-            } else if (at(node.child1()).shouldSpeculateArray()
-                       && at(node.child2()).shouldSpeculateArrayOrOther()) {
-                compilePeepHoleObjectToObjectOrOtherEquality(
-                    node.child1(), node.child2(), branchNodeIndex,
-                    &JSArray::s_info, isArraySpeculation);
-            } else if (at(node.child1()).shouldSpeculateArrayOrOther()
-                       && at(node.child2()).shouldSpeculateArray()) {
-                compilePeepHoleObjectToObjectOrOtherEquality(
-                    node.child2(), node.child1(), branchNodeIndex,
-                    &JSArray::s_info, isArraySpeculation);
-            } else {
+            if (at(node.child1()).shouldSpeculateString() || at(node.child2()).shouldSpeculateString()) {
+                nonSpeculativePeepholeBranch(node, branchNodeIndex, condition, operation);
+                return true;
+            }
+            if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCellOrOther())
+                compilePeepHoleObjectToObjectOrOtherEquality(node.child1(), node.child2(), branchNodeIndex);
+            else if (at(node.child1()).shouldSpeculateNonStringCellOrOther() && at(node.child2()).shouldSpeculateNonStringCell())
+                compilePeepHoleObjectToObjectOrOtherEquality(node.child2(), node.child1(), branchNodeIndex);
+            else if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCell())
+                compilePeepHoleObjectEquality(node, branchNodeIndex);
+            else {
                 nonSpeculativePeepholeBranch(node, branchNodeIndex, condition, operation);
                 return true;
             }
@@ -1461,51 +1484,6 @@ void SpeculativeJIT::checkArgumentTypes()
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
             m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), temp.gpr());
             speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), TrustedImm32(static_cast<int32_t>(~1))));
-        } else if (isInt8ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int8ArrayDescriptor().m_classInfo)));
-        } else if (isInt16ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int16ArrayDescriptor().m_classInfo)));
-        } else if (isInt32ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int32ArrayDescriptor().m_classInfo)));
-        } else if (isUint8ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ArrayDescriptor().m_classInfo)));
-        } else if (isUint8ClampedArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ClampedArrayDescriptor().m_classInfo)));
-        } else if (isUint16ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint16ArrayDescriptor().m_classInfo)));
-        } else if (isUint32ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint32ArrayDescriptor().m_classInfo)));
-        } else if (isFloat32ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float32ArrayDescriptor().m_classInfo)));
-        } else if (isFloat64ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, temp.gpr(), GPRInfo::tagMaskRegister));
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float64ArrayDescriptor().m_classInfo)));
         } else if (isCellSpeculation(predictedType))
             speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, JITCompiler::addressFor(virtualRegister), GPRInfo::tagMaskRegister));
 #else
@@ -1513,61 +1491,7 @@ void SpeculativeJIT::checkArgumentTypes()
             speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::Int32Tag)));
         else if (isBooleanSpeculation(predictedType))
             speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::BooleanTag)));
-        else if (isInt8ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int8ArrayDescriptor().m_classInfo)));
-        } else if (isInt16ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int16ArrayDescriptor().m_classInfo)));
-        } else if (isInt32ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->int32ArrayDescriptor().m_classInfo)));
-        } else if (isUint8ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ArrayDescriptor().m_classInfo)));
-        } else if (isUint8ClampedArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint8ClampedArrayDescriptor().m_classInfo)));
-        } else if (isUint16ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint16ArrayDescriptor().m_classInfo)));
-        }  else if (isUint32ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->uint32ArrayDescriptor().m_classInfo)));
-        }  else if (isFloat32ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float32ArrayDescriptor().m_classInfo)));
-        }   else if (isFloat64ArraySpeculation(predictedType)) {
-            GPRTemporary temp(this);
-            m_jit.load32(JITCompiler::tagFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, temp.gpr(), TrustedImm32(JSValue::CellTag)));
-            m_jit.load32(JITCompiler::payloadFor(virtualRegister), temp.gpr());
-            speculationCheck(BadType, valueSource, nodeIndex, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp.gpr(), JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->float64ArrayDescriptor().m_classInfo)));
-        }   else if (isCellSpeculation(predictedType))
+        else if (isCellSpeculation(predictedType))
             speculationCheck(BadType, valueSource, nodeIndex, m_jit.branch32(MacroAssembler::NotEqual, JITCompiler::tagFor(virtualRegister), TrustedImm32(JSValue::CellTag)));
 #endif
     }
@@ -2146,6 +2070,9 @@ void SpeculativeJIT::compileGetByValOnIntTypedArray(const TypedArrayDescriptor&
 
 void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySignedness signedness, TypedArrayRounding rounding)
 {
+    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    GPRReg storageReg = storage.gpr();
+    
     Edge valueUse = m_jit.graph().varArgChild(node, 2);
     
     GPRTemporary value;
@@ -2213,10 +2140,7 @@ void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor&
     }
     ASSERT_UNUSED(valueGPR, valueGPR != property);
     ASSERT(valueGPR != base);
-    GPRTemporary storage(this);
-    GPRReg storageReg = storage.gpr();
     ASSERT(valueGPR != storageReg);
-    m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
     MacroAssembler::Jump outOfBounds;
     if (node.op() == PutByVal)
         outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
@@ -2278,6 +2202,9 @@ void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor
 
 void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize)
 {
+    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    GPRReg storageReg = storage.gpr();
+    
     Edge baseUse = m_jit.graph().varArgChild(node, 0);
     Edge valueUse = m_jit.graph().varArgChild(node, 2);
     
@@ -2287,10 +2214,6 @@ void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescripto
     
     GPRTemporary result(this);
     
-    GPRTemporary storage(this);
-    GPRReg storageReg = storage.gpr();
-    
-    m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
     MacroAssembler::Jump outOfBounds;
     if (node.op() == PutByVal)
         outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
@@ -2892,45 +2815,23 @@ bool SpeculativeJIT::compare(Node& node, MacroAssembler::RelationalCondition con
     }
     
     if (node.op() == CompareEq) {
-        if (Node::shouldSpeculateFinalObject(at(node.child1()), at(node.child2()))) {
-            compileObjectEquality(node, &JSFinalObject::s_info, isFinalObjectSpeculation);
-            return false;
-        }
-        
-        if (Node::shouldSpeculateArray(at(node.child1()), at(node.child2()))) {
-            compileObjectEquality(node, &JSArray::s_info, isArraySpeculation);
-            return false;
-        }
-        
-        if (at(node.child1()).shouldSpeculateFinalObject()
-            && at(node.child2()).shouldSpeculateFinalObjectOrOther()) {
-            compileObjectToObjectOrOtherEquality(
-                node.child1(), node.child2(), &JSFinalObject::s_info,
-                isFinalObjectSpeculation);
+        if (at(node.child1()).shouldSpeculateString() || at(node.child2()).shouldSpeculateString()) {
+            nonSpeculativeNonPeepholeCompare(node, condition, operation);
             return false;
         }
         
-        if (at(node.child1()).shouldSpeculateFinalObjectOrOther()
-            && at(node.child2()).shouldSpeculateFinalObject()) {
-            compileObjectToObjectOrOtherEquality(
-                node.child2(), node.child1(), &JSFinalObject::s_info,
-                isFinalObjectSpeculation);
+        if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCellOrOther()) {
+            compileObjectToObjectOrOtherEquality(node.child1(), node.child2());
             return false;
         }
         
-        if (at(node.child1()).shouldSpeculateArray()
-            && at(node.child2()).shouldSpeculateArrayOrOther()) {
-            compileObjectToObjectOrOtherEquality(
-                node.child1(), node.child2(), &JSArray::s_info,
-                isArraySpeculation);
+        if (at(node.child1()).shouldSpeculateNonStringCellOrOther() && at(node.child2()).shouldSpeculateNonStringCell()) {
+            compileObjectToObjectOrOtherEquality(node.child2(), node.child1());
             return false;
         }
-        
-        if (at(node.child1()).shouldSpeculateArrayOrOther()
-            && at(node.child2()).shouldSpeculateArray()) {
-            compileObjectToObjectOrOtherEquality(
-                node.child2(), node.child1(), &JSArray::s_info,
-                isArraySpeculation);
+
+        if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCell()) {
+            compileObjectEquality(node);
             return false;
         }
     }
@@ -3063,36 +2964,20 @@ bool SpeculativeJIT::compileStrictEq(Node& node)
         return false;
     }
     
-    // 4) If the operands are predicted final object or array, then do a final object
-    //    or array comparison.
-    
-    if (Node::shouldSpeculateFinalObject(at(node.child1()), at(node.child2()))) {
+    if (at(node.child1()).shouldSpeculateString() || at(node.child2()).shouldSpeculateString())
+        return nonSpeculativeStrictEq(node);
+    if (at(node.child1()).shouldSpeculateNonStringCell() && at(node.child2()).shouldSpeculateNonStringCell()) {
         unsigned branchIndexInBlock = detectPeepHoleBranch();
         if (branchIndexInBlock != UINT_MAX) {
             NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
-            compilePeepHoleObjectEquality(node, branchNodeIndex, &JSFinalObject::s_info, isFinalObjectSpeculation);
+            compilePeepHoleObjectEquality(node, branchNodeIndex);
             use(node.child1());
             use(node.child2());
             m_indexInBlock = branchIndexInBlock;
             m_compileIndex = branchNodeIndex;
             return true;
         }
-        compileObjectEquality(node, &JSFinalObject::s_info, isFinalObjectSpeculation);
-        return false;
-    }
-    
-    if (Node::shouldSpeculateArray(at(node.child1()), at(node.child2()))) {
-        unsigned branchIndexInBlock = detectPeepHoleBranch();
-        if (branchIndexInBlock != UINT_MAX) {
-            NodeIndex branchNodeIndex = m_jit.graph().m_blocks[m_block]->at(branchIndexInBlock);
-            compilePeepHoleObjectEquality(node, branchNodeIndex, &JSArray::s_info, isArraySpeculation);
-            use(node.child1());
-            use(node.child2());
-            m_indexInBlock = branchIndexInBlock;
-            m_compileIndex = branchNodeIndex;
-            return true;
-        }
-        compileObjectEquality(node, &JSArray::s_info, isArraySpeculation);
+        compileObjectEquality(node);
         return false;
     }
     
@@ -3109,8 +2994,7 @@ void SpeculativeJIT::compileGetIndexedPropertyStorage(Node& node)
     GPRTemporary storage(this);
     GPRReg storageReg = storage.gpr();
     
-    const TypedArrayDescriptor* descriptor =
-        speculateArray(node.arrayMode(), node.child1(), baseReg);
+    const TypedArrayDescriptor* descriptor = typedArrayDescriptor(node.arrayMode());
     
     switch (node.arrayMode()) {
     case Array::String:
@@ -3156,15 +3040,8 @@ void SpeculativeJIT::compileGetByValOnArguments(Node& node)
     
     if (!m_compileOkay)
         return;
-    
-    if (!isArgumentsSpeculation(m_state.forNode(node.child1()).m_type)) {
-        speculationCheck(
-            BadType, JSValueSource::unboxedCell(baseReg), node.child1(),
-            m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(baseReg, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(&Arguments::s_info)));
-    }
+  
+    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), Array::Arguments));
     
     m_jit.loadPtr(
         MacroAssembler::Address(baseReg, Arguments::offsetOfData()),
@@ -3225,14 +3102,7 @@ void SpeculativeJIT::compileGetArgumentsLength(Node& node)
     if (!m_compileOkay)
         return;
     
-    if (!isArgumentsSpeculation(m_state.forNode(node.child1()).m_type)) {
-        speculationCheck(
-            BadType, JSValueSource::unboxedCell(baseReg), node.child1(),
-            m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(baseReg, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(&Arguments::s_info)));
-    }
+    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), Array::Arguments));
     
     m_jit.loadPtr(
         MacroAssembler::Address(baseReg, Arguments::offsetOfData()),
@@ -3252,33 +3122,40 @@ void SpeculativeJIT::compileGetArgumentsLength(Node& node)
 
 void SpeculativeJIT::compileGetArrayLength(Node& node)
 {
-    SpeculateCellOperand base(this, node.child1());
-    GPRTemporary result(this);
-        
-    GPRReg baseGPR = base.gpr();
-    GPRReg resultGPR = result.gpr();
-        
-    const TypedArrayDescriptor* descriptor =
-        speculateArray(node.arrayMode(), node.child1(), baseGPR);
+    const TypedArrayDescriptor* descriptor = typedArrayDescriptor(node.arrayMode());
 
     switch (node.arrayMode()) {
     case Array::JSArray:
-    case Array::JSArrayOutOfBounds:
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), resultGPR);
-        m_jit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), resultGPR);
+    case Array::JSArrayOutOfBounds: {
+        StorageOperand storage(this, node.child2());
+        GPRTemporary result(this, storage);
+        GPRReg storageReg = storage.gpr();
+        GPRReg resultReg = result.gpr();
+        m_jit.load32(MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)), resultReg);
             
-        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::LessThan, resultGPR, MacroAssembler::TrustedImm32(0)));
+        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::LessThan, resultReg, MacroAssembler::TrustedImm32(0)));
             
-        integerResult(resultGPR, m_compileIndex);
+        integerResult(resultReg, m_compileIndex);
         break;
-    case Array::String:
+    }
+    case Array::String: {
+        SpeculateCellOperand base(this, node.child1());
+        GPRTemporary result(this, base);
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultGPR = result.gpr();
         m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
         integerResult(resultGPR, m_compileIndex);
         break;
-    case Array::Arguments:
+    }
+    case Array::Arguments: {
         compileGetArgumentsLength(node);
         break;
+    }
     default:
+        SpeculateCellOperand base(this, node.child1());
+        GPRTemporary result(this, base);
+        GPRReg baseGPR = base.gpr();
+        GPRReg resultGPR = result.gpr();
         ASSERT(descriptor);
         m_jit.load32(MacroAssembler::Address(baseGPR, descriptor->m_lengthOffset), resultGPR);
         integerResult(resultGPR, m_compileIndex);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 69a30a974..f7b125e1b 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -1198,6 +1198,11 @@ public:
         m_jit.setupArgumentsWithExecState(arg1);
         return appendCallWithExceptionCheckSetResult(operation, result);
     }
+    JITCompiler::Call callOperation(J_DFGOperation_EAZ operation, GPRReg result, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallWithExceptionCheckSetResult(operation, result);
+    }
     JITCompiler::Call callOperation(J_DFGOperation_ESt operation, GPRReg result, Structure* structure)
     {
         m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure));
@@ -1481,6 +1486,11 @@ public:
         m_jit.setupArgumentsWithExecState(arg1);
         return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
     }
+    JITCompiler::Call callOperation(J_DFGOperation_EAZ operation, GPRReg resultTag, GPRReg resultPayload, GPRReg arg1, GPRReg arg2)
+    {
+        m_jit.setupArgumentsWithExecState(arg1, arg2);
+        return appendCallWithExceptionCheckSetResult(operation, resultPayload, resultTag);
+    }
     JITCompiler::Call callOperation(J_DFGOperation_ESt operation, GPRReg resultTag, GPRReg resultPayload, Structure* structure)
     {
         m_jit.setupArgumentsWithExecState(TrustedImmPtr(structure));
@@ -1825,9 +1835,23 @@ public:
         return call;
     }
 #elif CPU(ARM)
+#if CPU(ARM_HARDFP)
     JITCompiler::Call appendCallWithExceptionCheckSetResult(const FunctionPtr& function, FPRReg result)
     {
         JITCompiler::Call call = appendCallWithExceptionCheck(function);
+        m_jit.moveDouble(result, FPRInfo::argumentFPR0);
+        return call;
+    }
+    JITCompiler::Call appendCallSetResult(const FunctionPtr& function, FPRReg result)
+    {
+        JITCompiler::Call call = m_jit.appendCall(function);
+        m_jit.moveDouble(result, FPRInfo::argumentFPR0);
+        return call;
+    }
+#else
+        JITCompiler::Call appendCallWithExceptionCheckSetResult(const FunctionPtr& function, FPRReg result)
+    {
+        JITCompiler::Call call = appendCallWithExceptionCheck(function);
         m_jit.assembler().vmov(result, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
         return call;
     }
@@ -1837,6 +1861,7 @@ public:
         m_jit.assembler().vmov(result, GPRInfo::returnValueGPR, GPRInfo::returnValueGPR2);
         return call;
     }
+#endif // CPU(ARM_HARDFP)
 #else
     JITCompiler::Call appendCallWithExceptionCheckSetResult(const FunctionPtr& function, FPRReg result)
     {
@@ -2054,16 +2079,14 @@ public:
     bool compilePeepHoleBranch(Node&, MacroAssembler::RelationalCondition, MacroAssembler::DoubleCondition, S_DFGOperation_EJJ);
     void compilePeepHoleIntegerBranch(Node&, NodeIndex branchNodeIndex, JITCompiler::RelationalCondition);
     void compilePeepHoleDoubleBranch(Node&, NodeIndex branchNodeIndex, JITCompiler::DoubleCondition);
-    void compilePeepHoleObjectEquality(Node&, NodeIndex branchNodeIndex, const ClassInfo*, SpeculatedTypeChecker);
-    void compilePeepHoleObjectToObjectOrOtherEquality(
-        Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex, const ClassInfo*, SpeculatedTypeChecker);
-    void compileObjectEquality(Node&, const ClassInfo*, SpeculatedTypeChecker);
-    void compileObjectToObjectOrOtherEquality(
-        Edge leftChild, Edge rightChild, const ClassInfo*, SpeculatedTypeChecker);
+    void compilePeepHoleObjectEquality(Node&, NodeIndex branchNodeIndex);
+    void compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex);
+    void compileObjectEquality(Node&);
+    void compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild);
     void compileValueAdd(Node&);
-    void compileObjectOrOtherLogicalNot(Edge value, const ClassInfo*, bool needSpeculationCheck);
+    void compileNonStringCellOrOtherLogicalNot(Edge value, bool needSpeculationCheck);
     void compileLogicalNot(Node&);
-    void emitObjectOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken, const ClassInfo*, bool needSpeculationCheck);
+    void emitNonStringCellOrOtherBranch(Edge value, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck);
     void emitBranch(Node&);
     
     void compileIntegerCompare(Node&, MacroAssembler::RelationalCondition);
@@ -2197,7 +2220,7 @@ public:
     
     const TypedArrayDescriptor* typedArrayDescriptor(Array::Mode);
     
-    const TypedArrayDescriptor* speculateArray(Array::Mode, Edge baseEdge, GPRReg baseReg);
+    void checkArray(Node&);
     
     template<bool strict>
     GPRReg fillSpeculateIntInternal(NodeIndex, DataFormat& returnFormat);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 846d078ba..34b8dae46 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -1048,7 +1048,7 @@ void SpeculativeJIT::emitCall(Node& node)
     
     slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));
     slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, calleeTagGPR, TrustedImm32(JSValue::CellTag)));
-    m_jit.loadPtr(MacroAssembler::Address(calleePayloadGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultPayloadGPR);
+    m_jit.loadPtr(MacroAssembler::Address(calleePayloadGPR, OBJECT_OFFSETOF(JSFunction, m_scope)), resultPayloadGPR);
     m_jit.storePtr(resultPayloadGPR, MacroAssembler::Address(GPRInfo::callFrameRegister, static_cast<ptrdiff_t>(sizeof(Register)) * RegisterFile::ScopeChain + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
     m_jit.store32(MacroAssembler::TrustedImm32(JSValue::CellTag), MacroAssembler::Address(GPRInfo::callFrameRegister, static_cast<ptrdiff_t>(sizeof(Register)) * RegisterFile::ScopeChain + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
 
@@ -1489,17 +1489,53 @@ JITCompiler::Jump SpeculativeJIT::convertToDouble(JSValueOperand& op, FPRReg res
     return notNumber;
 }
 
-void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectEquality(Node& node)
 {
     SpeculateCellOperand op1(this, node.child1());
     SpeculateCellOperand op2(this, node.child2());
     GPRReg op1GPR = op1.gpr();
     GPRReg op2GPR = op2.gpr();
     
-    if (!speculatedTypeChecker(m_state.forNode(node.child1()).m_type))
-        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    if (!speculatedTypeChecker(m_state.forNode(node.child2()).m_type))
-        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+    if (m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint()); 
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), node.child1(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op2GPR), node.child2(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
     
     GPRTemporary resultPayload(this, op2);
     GPRReg resultPayloadGPR = resultPayload.gpr();
@@ -1514,10 +1550,9 @@ void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInf
     booleanResult(resultPayloadGPR, m_compileIndex);
 }
 
-void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
-    Edge leftChild, Edge rightChild,
-    const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
 {
+    Node& leftNode = m_jit.graph()[leftChild.index()];
     SpeculateCellOperand op1(this, leftChild);
     JSValueOperand op2(this, rightChild);
     GPRTemporary result(this);
@@ -1527,31 +1562,59 @@ void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
     GPRReg op2PayloadGPR = op2.payloadGPR();
     GPRReg resultGPR = result.gpr();
     
-    if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
-        speculationCheck(
-            BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+    if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 
+        m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal,
+                structureGPR,
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
+    
     // It seems that most of the time when programs do a == b where b may be either null/undefined
     // or an object, b is usually an object. Balance the branches to make that case fast.
     MacroAssembler::Jump rightNotCell =
         m_jit.branch32(MacroAssembler::NotEqual, op2TagGPR, TrustedImm32(JSValue::CellTag));
     
-    // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
-    // proof, when filtered on cell, demonstrates that we have an object of the desired type
-    // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
-    // speculation.
-    if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
-        speculationCheck(
-            BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+    // We know that within this branch, rightChild must be a cell.
+    if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 
+        m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op2PayloadGPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal,
+                structureGPR,
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // At this point we know that we can perform a straight-forward equality comparison on pointer
@@ -1585,9 +1648,7 @@ void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
     booleanResult(resultGPR, m_compileIndex);
 }
 
-void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
-    Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex,
-    const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex)
 {
     Node& branchNode = at(branchNodeIndex);
     BlockIndex taken = branchNode.takenBlockIndex();
@@ -1602,13 +1663,28 @@ void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
     GPRReg op2PayloadGPR = op2.payloadGPR();
     GPRReg resultGPR = result.gpr();
     
-    if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
-        speculationCheck(
-            BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(),
+    if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueSource::unboxedCell(op1GPR), leftChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // It seems that most of the time when programs do a == b where b may be either null/undefined
@@ -1616,17 +1692,29 @@ void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
     MacroAssembler::Jump rightNotCell =
         m_jit.branch32(MacroAssembler::NotEqual, op2TagGPR, TrustedImm32(JSValue::CellTag));
     
-    // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
-    // proof, when filtered on cell, demonstrates that we have an object of the desired type
-    // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
-    // speculation.
-    if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
-        speculationCheck(
-            BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(),
+    // We know that within this branch, rightChild must be a cell.
+    if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op2PayloadGPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op2PayloadGPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op2TagGPR, op2PayloadGPR), rightChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // At this point we know that we can perform a straight-forward equality comparison on pointer
@@ -1703,7 +1791,7 @@ void SpeculativeJIT::compileValueAdd(Node& node)
     jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
 }
 
-void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::compileNonStringCellOrOtherLogicalNot(Edge nodeUse, bool needSpeculationCheck)
 {
     JSValueOperand value(this, nodeUse);
     GPRTemporary resultPayload(this);
@@ -1712,8 +1800,44 @@ void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInf
     GPRReg resultPayloadGPR = resultPayload.gpr();
     
     MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
-    if (needSpeculationCheck)
-        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valuePayloadGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+    if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+                m_jit.branchPtr(
+                    MacroAssembler::Equal,
+                    MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()),
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), structureGPR);
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse,
+                m_jit.branchPtr(
+                    MacroAssembler::Equal,
+                    structureGPR,
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+
+        MacroAssembler::Jump isNotMasqueradesAsUndefined = 
+            m_jit.branchTest8(
+                MacroAssembler::Zero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+
+        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
     m_jit.move(TrustedImm32(0), resultPayloadGPR);
     MacroAssembler::Jump done = m_jit.jump();
     
@@ -1723,7 +1847,11 @@ void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInf
     if (needSpeculationCheck) {
         m_jit.move(valueTagGPR, resultPayloadGPR);
         m_jit.or32(TrustedImm32(1), resultPayloadGPR);
-        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branch32(MacroAssembler::NotEqual, resultPayloadGPR, TrustedImm32(JSValue::NullTag)));
+        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, 
+            m_jit.branch32(
+                MacroAssembler::NotEqual, 
+                resultPayloadGPR, 
+                TrustedImm32(JSValue::NullTag)));
     }
     m_jit.move(TrustedImm32(1), resultPayloadGPR);
     
@@ -1741,12 +1869,9 @@ void SpeculativeJIT::compileLogicalNot(Node& node)
         booleanResult(result.gpr(), m_compileIndex);
         return;
     }
-    if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
-        compileObjectOrOtherLogicalNot(node.child1(), &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
-        return;
-    }
-    if (at(node.child1()).shouldSpeculateArrayOrOther()) {
-        compileObjectOrOtherLogicalNot(node.child1(), &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+    if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+        compileNonStringCellOrOtherLogicalNot(node.child1(), 
+            !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
         return;
     }
     if (at(node.child1()).shouldSpeculateInteger()) {
@@ -1789,7 +1914,7 @@ void SpeculativeJIT::compileLogicalNot(Node& node)
     booleanResult(resultPayloadGPR, m_compileIndex, UseChildrenCalledExplicitly);
 }
 
-void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::emitNonStringCellOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck)
 {
     JSValueOperand value(this, nodeUse);
     GPRTemporary scratch(this);
@@ -1798,8 +1923,37 @@ void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, Blo
     GPRReg scratchGPR = scratch.gpr();
     
     MacroAssembler::Jump notCell = m_jit.branch32(MacroAssembler::NotEqual, valueTagGPR, TrustedImm32(JSValue::CellTag));
-    if (needSpeculationCheck)
-        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valuePayloadGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+    if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse, 
+                m_jit.branchPtr(
+                    MacroAssembler::Equal, 
+                    MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), 
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+    } else {
+        m_jit.loadPtr(MacroAssembler::Address(valuePayloadGPR, JSCell::structureOffset()), scratchGPR);
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse.index(), 
+                m_jit.branchPtr(
+                    MacroAssembler::Equal, 
+                    scratchGPR,
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+
+        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+
+        speculationCheck(BadType, JSValueRegs(valueTagGPR, valuePayloadGPR), nodeUse.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(scratchGPR, Structure::globalObjectOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
     jump(taken, ForceJump);
     
     notCell.link(&m_jit);
@@ -1836,10 +1990,9 @@ void SpeculativeJIT::emitBranch(Node& node)
         jump(notTaken);
 
         noResult(m_compileIndex);
-    } else if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
-        emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
-    } else if (at(node.child1()).shouldSpeculateArrayOrOther()) {
-        emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+    } else if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+        emitNonStringCellOrOtherBranch(node.child1(), taken, notTaken, 
+            !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
     } else if (at(node.child1()).shouldSpeculateNumber()) {
         if (at(node.child1()).shouldSpeculateInteger()) {
             bool invert = false;
@@ -2373,6 +2526,11 @@ void SpeculativeJIT::compile(Node& node)
         compileGetByValOnString(node);
         break;
     }
+        
+    case CheckArray: {
+        checkArray(node);
+        break;
+    }
 
     case GetByVal: {
         switch (node.arrayMode()) {
@@ -2396,8 +2554,7 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
             break;
         }
-        case Array::JSArray:
-        case Array::JSArrayOutOfBounds: {
+        case Array::JSArray: {
             SpeculateStrictInt32Operand property(this, node.child2());
             StorageOperand storage(this, node.child3());
             GPRReg propertyReg = property.gpr();
@@ -2412,19 +2569,59 @@ void SpeculativeJIT::compile(Node& node)
                 SpeculateCellOperand base(this, node.child1());
                 GPRReg baseReg = base.gpr();
                 // We've already speculated that it's some kind of array, at this point.
-                speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
             }
 
             GPRTemporary resultTag(this);
             GPRTemporary resultPayload(this);
 
             m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
+            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
             m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
-
+            
             jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
             break;
         }
+        case Array::JSArrayOutOfBounds: {
+            SpeculateCellOperand base(this, node.child1());
+            SpeculateStrictInt32Operand property(this, node.child2());
+            StorageOperand storage(this, node.child3());
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+
+            if (!m_compileOkay)
+                return;
+
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+            GPRReg resultTagReg = resultTag.gpr();
+            GPRReg resultPayloadReg = resultPayload.gpr();
+
+            // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+            // If we have predicted the base to be type array, we can skip the check.
+            GPRReg baseReg = base.gpr();
+            // We've already speculated that it's some kind of array, at this point.
+            JITCompiler::Jump outOfBounds = m_jit.branch32(
+                MacroAssembler::AboveOrEqual, propertyReg,
+                MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
+
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagReg);
+            JITCompiler::Jump hole = m_jit.branch32(
+                MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag));
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadReg);
+            
+            JITCompiler::JumpList slowCases;
+            slowCases.append(outOfBounds);
+            slowCases.append(hole);
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowCases, this, operationGetByValArrayInt,
+                    JSValueRegs(resultTagReg, resultPayloadReg),
+                    baseReg, propertyReg));
+
+            jsValueResult(resultTagReg, resultPayloadReg, m_compileIndex);
+            break;
+        }
         case Array::String:
             compileGetByValOnString(node);
             break;
@@ -2470,6 +2667,7 @@ void SpeculativeJIT::compile(Node& node)
         Edge child1 = m_jit.graph().varArgChild(node, 0);
         Edge child2 = m_jit.graph().varArgChild(node, 1);
         Edge child3 = m_jit.graph().varArgChild(node, 2);
+        Edge child4 = m_jit.graph().varArgChild(node, 3);
         
         Array::Mode arrayMode = modeForPut(node.arrayMode());
         bool alreadyHandled = false;
@@ -2513,8 +2711,6 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg baseReg = base.gpr();
         GPRReg propertyReg = property.gpr();
 
-        speculateArray(arrayMode, child1, baseReg);
-
         switch (arrayMode) {
         case Array::JSArray:
         case Array::JSArrayOutOfBounds: {
@@ -2531,13 +2727,11 @@ void SpeculativeJIT::compile(Node& node)
                 GPRReg scratchReg = scratch.gpr();
                 writeBarrier(baseReg, valueTagReg, child3, WriteBarrierForPropertyAccess, scratchReg);
             }
+            
+            StorageOperand storage(this, child4);
+            GPRReg storageReg = storage.gpr();
 
             if (node.op() == PutByValAlias) {
-                // Get the array storage.
-                GPRTemporary storage(this);
-                GPRReg storageReg = storage.gpr();
-                m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-                
                 // Store the value to the array.
                 GPRReg propertyReg = property.gpr();
                 m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
@@ -2554,12 +2748,8 @@ void SpeculativeJIT::compile(Node& node)
             base.use();
             property.use();
             value.use();
+            storage.use();
             
-            // Get the array storage.
-            GPRTemporary storage(this);
-            GPRReg storageReg = storage.gpr();
-            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
             // Check if we're writing to a hole; if so increment m_numValuesInVector.
             MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
             m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
@@ -2688,6 +2878,8 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPush: {
+        ASSERT(modeIsJSArray(node.arrayMode()));
+        
         SpeculateCellOperand base(this, node.child1());
         JSValueOperand value(this, node.child2());
         GPRTemporary storageLength(this);
@@ -2697,17 +2889,14 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg valuePayloadGPR = value.payloadGPR();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        {
+        if (Heap::isWriteBarrierEnabled()) {
             GPRTemporary scratch(this);
             writeBarrier(baseGPR, valueTagGPR, node.child2(), WriteBarrierForPropertyAccess, scratch.gpr(), storageLengthGPR);
         }
 
-        speculateArray(Array::JSArray, node.child1(), baseGPR);
-        
-        GPRTemporary storage(this);
+        StorageOperand storage(this, node.child3());
         GPRReg storageGPR = storage.gpr();
 
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
         
         // Refuse to handle bizarre lengths.
@@ -2730,10 +2919,12 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPop: {
+        ASSERT(modeIsJSArray(node.arrayMode()));
+        
         SpeculateCellOperand base(this, node.child1());
+        StorageOperand storage(this, node.child2());
         GPRTemporary valueTag(this);
         GPRTemporary valuePayload(this);
-        GPRTemporary storage(this);
         GPRTemporary storageLength(this);
         
         GPRReg baseGPR = base.gpr();
@@ -2742,9 +2933,6 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg storageGPR = storage.gpr();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        speculateArray(Array::JSArray, node.child1(), baseGPR);
-        
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
         
         JITCompiler::JumpList setUndefinedCases;
@@ -3163,38 +3351,36 @@ void SpeculativeJIT::compile(Node& node)
             JITCompiler::Jump activationNotCreated;
             if (checkTopLevel)
                 activationNotCreated = m_jit.branchTestPtr(JITCompiler::Zero, JITCompiler::addressFor(static_cast<VirtualRegister>(m_jit.codeBlock()->activationRegister())));
-            m_jit.loadPtr(JITCompiler::Address(resultGPR, OBJECT_OFFSETOF(ScopeChainNode, next)), resultGPR);
+            m_jit.loadPtr(JITCompiler::Address(resultGPR, JSScope::offsetOfNext()), resultGPR);
             activationNotCreated.link(&m_jit);
         }
         while (skip--)
-            m_jit.loadPtr(JITCompiler::Address(resultGPR, OBJECT_OFFSETOF(ScopeChainNode, next)), resultGPR);
+            m_jit.loadPtr(JITCompiler::Address(resultGPR, JSScope::offsetOfNext()), resultGPR);
         
-        m_jit.loadPtr(JITCompiler::Address(resultGPR, OBJECT_OFFSETOF(ScopeChainNode, object)), resultGPR);
-
         cellResult(resultGPR, m_compileIndex);
         break;
     }
     case GetScopedVar: {
-        SpeculateCellOperand scopeChain(this, node.child1());
+        SpeculateCellOperand scope(this, node.child1());
         GPRTemporary resultTag(this);
         GPRTemporary resultPayload(this);
         GPRReg resultTagGPR = resultTag.gpr();
         GPRReg resultPayloadGPR = resultPayload.gpr();
-        m_jit.loadPtr(JITCompiler::Address(scopeChain.gpr(), JSVariableObject::offsetOfRegisters()), resultPayloadGPR);
+        m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSVariableObject::offsetOfRegisters()), resultPayloadGPR);
         m_jit.load32(JITCompiler::Address(resultPayloadGPR, node.varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
         m_jit.load32(JITCompiler::Address(resultPayloadGPR, node.varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
         jsValueResult(resultTagGPR, resultPayloadGPR, m_compileIndex);
         break;
     }
     case PutScopedVar: {
-        SpeculateCellOperand scopeChain(this, node.child1());
+        SpeculateCellOperand scope(this, node.child1());
         GPRTemporary scratchRegister(this);
         GPRReg scratchGPR = scratchRegister.gpr();
-        m_jit.loadPtr(JITCompiler::Address(scopeChain.gpr(), JSVariableObject::offsetOfRegisters()), scratchGPR);
+        m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSVariableObject::offsetOfRegisters()), scratchGPR);
         JSValueOperand value(this, node.child2());
         m_jit.store32(value.tagGPR(), JITCompiler::Address(scratchGPR, node.varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
         m_jit.store32(value.payloadGPR(), JITCompiler::Address(scratchGPR, node.varNumber() * sizeof(Register) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-        writeBarrier(scopeChain.gpr(), value.tagGPR(), node.child2(), WriteBarrierForVariableAccess, scratchGPR);
+        writeBarrier(scope.gpr(), value.tagGPR(), node.child2(), WriteBarrierForVariableAccess, scratchGPR);
         noResult(m_compileIndex);
         break;
     }
@@ -3535,7 +3721,7 @@ void SpeculativeJIT::compile(Node& node)
         JSValueOperand value(this, node.child1());
         
         WatchpointSet* watchpointSet =
-            m_jit.globalObjectFor(node.codeOrigin)->symbolTable().get(
+            m_jit.globalObjectFor(node.codeOrigin)->symbolTable()->get(
                 identifier(node.identifierNumberForCheck())->impl()).watchpointSet();
         addSlowPathGenerator(
             slowPathCall(
@@ -3563,7 +3749,7 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case GlobalVarWatchpoint: {
-        m_jit.globalObjectFor(node.codeOrigin)->symbolTable().get(
+        m_jit.globalObjectFor(node.codeOrigin)->symbolTable()->get(
             identifier(node.identifierNumberForCheck())->impl()).addWatchpoint(
                 speculationWatchpoint());
         
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index b69d53600..a1ac899a2 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -1032,7 +1032,7 @@ void SpeculativeJIT::emitCall(Node& node)
     m_jit.addPtr(TrustedImm32(m_jit.codeBlock()->m_numCalleeRegisters * sizeof(Register)), GPRInfo::callFrameRegister);
     
     slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleeGPR, targetToCheck, MacroAssembler::TrustedImmPtr(JSValue::encode(JSValue())));
-    m_jit.loadPtr(MacroAssembler::Address(calleeGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultGPR);
+    m_jit.loadPtr(MacroAssembler::Address(calleeGPR, OBJECT_OFFSETOF(JSFunction, m_scope)), resultGPR);
     m_jit.storePtr(resultGPR, MacroAssembler::Address(GPRInfo::callFrameRegister, static_cast<ptrdiff_t>(sizeof(Register)) * RegisterFile::ScopeChain));
 
     CodeOrigin codeOrigin = at(m_compileIndex).codeOrigin;
@@ -1538,7 +1538,7 @@ JITCompiler::Jump SpeculativeJIT::convertToDouble(GPRReg value, FPRReg result, G
     return notNumber;
 }
 
-void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectEquality(Node& node)
 {
     SpeculateCellOperand op1(this, node.child1());
     SpeculateCellOperand op2(this, node.child2());
@@ -1547,11 +1547,47 @@ void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInf
     GPRReg op1GPR = op1.gpr();
     GPRReg op2GPR = op2.gpr();
     GPRReg resultGPR = result.gpr();
-    
-    if (!speculatedTypeChecker(m_state.forNode(node.child1()).m_type))
-        speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    if (!speculatedTypeChecker(m_state.forNode(node.child2()).m_type))
-        speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+   
+    if (m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(node.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint()); 
+        speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op1GPR), node.child1().index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+
+        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op2GPR), node.child2().index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
+    }
     
     MacroAssembler::Jump falseCase = m_jit.branchPtr(MacroAssembler::NotEqual, op1GPR, op2GPR);
     m_jit.move(TrustedImm32(ValueTrue), resultGPR);
@@ -1563,10 +1599,9 @@ void SpeculativeJIT::compileObjectEquality(Node& node, const ClassInfo* classInf
     jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);
 }
 
-void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
-    Edge leftChild, Edge rightChild,
-    const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compileObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild)
 {
+    Node& leftNode = m_jit.graph()[leftChild.index()];
     SpeculateCellOperand op1(this, leftChild);
     JSValueOperand op2(this, rightChild);
     GPRTemporary result(this);
@@ -1574,14 +1609,29 @@ void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
     GPRReg op1GPR = op1.gpr();
     GPRReg op2GPR = op2.gpr();
     GPRReg resultGPR = result.gpr();
-    
-    if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
-        speculationCheck(
-            BadType, JSValueRegs(op1GPR), leftChild.index(),
+   
+    if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 
+        m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal,
+                structureGPR,
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // It seems that most of the time when programs do a == b where b may be either null/undefined
@@ -1589,17 +1639,29 @@ void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
     MacroAssembler::Jump rightNotCell =
         m_jit.branchTestPtr(MacroAssembler::NonZero, op2GPR, GPRInfo::tagMaskRegister);
     
-    // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
-    // proof, when filtered on cell, demonstrates that we have an object of the desired type
-    // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
-    // speculation.
-    if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
-        speculationCheck(
-            BadType, JSValueRegs(op2GPR), rightChild.index(),
+    // We know that within this branch, rightChild must be a cell. 
+    if (m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) { 
+        m_jit.graph().globalObjectFor(leftNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal,
+                structureGPR,
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // At this point we know that we can perform a straight-forward equality comparison on pointer
@@ -1633,9 +1695,7 @@ void SpeculativeJIT::compileObjectToObjectOrOtherEquality(
     jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean);
 }
 
-void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
-    Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex,
-    const ClassInfo* classInfo, SpeculatedTypeChecker speculatedTypeChecker)
+void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(Edge leftChild, Edge rightChild, NodeIndex branchNodeIndex)
 {
     Node& branchNode = at(branchNodeIndex);
     BlockIndex taken = branchNode.takenBlockIndex();
@@ -1649,13 +1709,28 @@ void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
     GPRReg op2GPR = op2.gpr();
     GPRReg resultGPR = result.gpr();
     
-    if (!speculatedTypeChecker(m_state.forNode(leftChild).m_type)) {
-        speculationCheck(
-            BadType, JSValueRegs(op1GPR), leftChild.index(),
+    if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op1GPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op1GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op1GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op1GPR), leftChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // It seems that most of the time when programs do a == b where b may be either null/undefined
@@ -1663,17 +1738,29 @@ void SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality(
     MacroAssembler::Jump rightNotCell =
         m_jit.branchTestPtr(MacroAssembler::NonZero, op2GPR, GPRInfo::tagMaskRegister);
     
-    // We know that within this branch, rightChild must be a cell. If the CFA can tell us that the
-    // proof, when filtered on cell, demonstrates that we have an object of the desired type
-    // (speculationCheck() will test for FinalObject or Array, currently), then we can skip the
-    // speculation.
-    if (!speculatedTypeChecker(m_state.forNode(rightChild).m_type & SpecCell)) {
-        speculationCheck(
-            BadType, JSValueRegs(op2GPR), rightChild.index(),
+    // We know that within this branch, rightChild must be a cell. 
+    if (m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(branchNode.codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(), 
             m_jit.branchPtr(
-                MacroAssembler::NotEqual,
-                MacroAssembler::Address(op2GPR, JSCell::classInfoOffset()),
-                MacroAssembler::TrustedImmPtr(classInfo)));
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(op2GPR, JSCell::structureOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(op2GPR, JSCell::structureOffset()), structureGPR);
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                structureGPR, 
+                MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        speculationCheck(BadType, JSValueRegs(op2GPR), rightChild.index(), 
+            m_jit.branchTest8(
+                MacroAssembler::NonZero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined)));
     }
     
     // At this point we know that we can perform a straight-forward equality comparison on pointer
@@ -1748,7 +1835,7 @@ void SpeculativeJIT::compileValueAdd(Node& node)
     jsValueResult(result.gpr(), m_compileIndex);
 }
 
-void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::compileNonStringCellOrOtherLogicalNot(Edge nodeUse, bool needSpeculationCheck)
 {
     JSValueOperand value(this, nodeUse);
     GPRTemporary result(this);
@@ -1756,19 +1843,59 @@ void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInf
     GPRReg resultGPR = result.gpr();
     
     MacroAssembler::Jump notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, valueGPR, GPRInfo::tagMaskRegister);
-    if (needSpeculationCheck)
-        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valueGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
-    m_jit.move(TrustedImm32(static_cast<int32_t>(ValueFalse)), resultGPR);
+    if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+                m_jit.branchPtr(
+                    MacroAssembler::Equal,
+                    MacroAssembler::Address(valueGPR, JSCell::structureOffset()),
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+    } else {
+        GPRTemporary structure(this);
+        GPRReg structureGPR = structure.gpr();
+
+        m_jit.loadPtr(MacroAssembler::Address(valueGPR, JSCell::structureOffset()), structureGPR);
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse,
+                m_jit.branchPtr(
+                    MacroAssembler::Equal,
+                    structureGPR,
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+
+        MacroAssembler::Jump isNotMasqueradesAsUndefined = 
+            m_jit.branchTest8(
+                MacroAssembler::Zero, 
+                MacroAssembler::Address(structureGPR, Structure::typeInfoFlagsOffset()), 
+                MacroAssembler::TrustedImm32(MasqueradesAsUndefined));
+
+        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(structureGPR, Structure::globalObjectOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
+    m_jit.move(TrustedImm32(ValueFalse), resultGPR);
     MacroAssembler::Jump done = m_jit.jump();
     
     notCell.link(&m_jit);
-    
+
     if (needSpeculationCheck) {
         m_jit.move(valueGPR, resultGPR);
         m_jit.andPtr(MacroAssembler::TrustedImm32(~TagBitUndefined), resultGPR);
-        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, m_jit.branchPtr(MacroAssembler::NotEqual, resultGPR, MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))));
+        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse, 
+            m_jit.branchPtr(
+                MacroAssembler::NotEqual, 
+                resultGPR, 
+                MacroAssembler::TrustedImmPtr(reinterpret_cast<void*>(ValueNull))));
     }
-    m_jit.move(TrustedImm32(static_cast<int32_t>(ValueTrue)), resultGPR);
+    m_jit.move(TrustedImm32(ValueTrue), resultGPR);
     
     done.link(&m_jit);
     
@@ -1777,12 +1904,9 @@ void SpeculativeJIT::compileObjectOrOtherLogicalNot(Edge nodeUse, const ClassInf
 
 void SpeculativeJIT::compileLogicalNot(Node& node)
 {
-    if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
-        compileObjectOrOtherLogicalNot(node.child1(), &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
-        return;
-    }
-    if (at(node.child1()).shouldSpeculateArrayOrOther()) {
-        compileObjectOrOtherLogicalNot(node.child1(), &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+    if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+        compileNonStringCellOrOtherLogicalNot(node.child1(),
+            !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
         return;
     }
     if (at(node.child1()).shouldSpeculateInteger()) {
@@ -1850,7 +1974,7 @@ void SpeculativeJIT::compileLogicalNot(Node& node)
     jsValueResult(resultGPR, m_compileIndex, DataFormatJSBoolean, UseChildrenCalledExplicitly);
 }
 
-void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, const ClassInfo* classInfo, bool needSpeculationCheck)
+void SpeculativeJIT::emitNonStringCellOrOtherBranch(Edge nodeUse, BlockIndex taken, BlockIndex notTaken, bool needSpeculationCheck)
 {
     JSValueOperand value(this, nodeUse);
     GPRTemporary scratch(this);
@@ -1858,8 +1982,37 @@ void SpeculativeJIT::emitObjectOrOtherBranch(Edge nodeUse, BlockIndex taken, Blo
     GPRReg scratchGPR = scratch.gpr();
     
     MacroAssembler::Jump notCell = m_jit.branchTestPtr(MacroAssembler::NonZero, valueGPR, GPRInfo::tagMaskRegister);
-    if (needSpeculationCheck)
-        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(valueGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(classInfo)));
+    if (m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid()) {
+        m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin)->masqueradesAsUndefinedWatchpoint()->add(speculationWatchpoint());
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), 
+                m_jit.branchPtr(
+                    MacroAssembler::Equal, 
+                    MacroAssembler::Address(valueGPR, JSCell::structureOffset()),
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+    } else {
+        m_jit.loadPtr(MacroAssembler::Address(valueGPR, JSCell::structureOffset()), scratchGPR);
+
+        if (needSpeculationCheck) {
+            speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), 
+                m_jit.branchPtr(
+                    MacroAssembler::Equal, 
+                    scratchGPR,
+                    MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
+        }
+
+        JITCompiler::Jump isNotMasqueradesAsUndefined = m_jit.branchTest8(JITCompiler::Zero, MacroAssembler::Address(scratchGPR, Structure::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
+
+        speculationCheck(BadType, JSValueRegs(valueGPR), nodeUse.index(), 
+            m_jit.branchPtr(
+                MacroAssembler::Equal, 
+                MacroAssembler::Address(scratchGPR, Structure::globalObjectOffset()), 
+                MacroAssembler::TrustedImmPtr(m_jit.graph().globalObjectFor(m_jit.graph()[nodeUse.index()].codeOrigin))));
+
+        isNotMasqueradesAsUndefined.link(&m_jit);
+    }
     jump(taken, ForceJump);
     
     notCell.link(&m_jit);
@@ -1879,10 +2032,9 @@ void SpeculativeJIT::emitBranch(Node& node)
     BlockIndex taken = node.takenBlockIndex();
     BlockIndex notTaken = node.notTakenBlockIndex();
     
-    if (at(node.child1()).shouldSpeculateFinalObjectOrOther()) {
-        emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSFinalObject::s_info, !isFinalObjectOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
-    } else if (at(node.child1()).shouldSpeculateArrayOrOther()) {
-        emitObjectOrOtherBranch(node.child1(), taken, notTaken, &JSArray::s_info, !isArrayOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
+    if (at(node.child1()).shouldSpeculateNonStringCellOrOther()) {
+        emitNonStringCellOrOtherBranch(node.child1(), taken, notTaken, 
+            !isNonStringCellOrOtherSpeculation(m_state.forNode(node.child1()).m_type));
     } else if (at(node.child1()).shouldSpeculateNumber()) {
         if (at(node.child1()).shouldSpeculateInteger()) {
             bool invert = false;
@@ -2406,6 +2558,11 @@ void SpeculativeJIT::compile(Node& node)
         compileGetByValOnString(node);
         break;
     }
+        
+    case CheckArray: {
+        checkArray(node);
+        break;
+    }
 
     case GetByVal: {
         switch (node.arrayMode()) {
@@ -2443,11 +2600,24 @@ void SpeculativeJIT::compile(Node& node)
             // We will have already speculated that the base is some kind of array,
             // at this point.
             
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+            MacroAssembler::Jump outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
+            if (node.arrayMode() == Array::JSArray)
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, outOfBounds);
             
             GPRTemporary result(this);
             m_jit.loadPtr(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.gpr());
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::Zero, result.gpr()));
+            MacroAssembler::Jump hole = m_jit.branchTestPtr(MacroAssembler::Zero, result.gpr());
+            if (node.arrayMode() == Array::JSArray)
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, hole);
+            else {
+                MacroAssembler::JumpList slowCases;
+                slowCases.append(outOfBounds);
+                slowCases.append(hole);
+                addSlowPathGenerator(
+                    slowPathCall(
+                        slowCases, this, operationGetByValArrayInt,
+                        result.gpr(), baseReg, propertyReg));
+            }
             
             jsValueResult(result.gpr(), m_compileIndex);
             break;
@@ -2497,6 +2667,7 @@ void SpeculativeJIT::compile(Node& node)
         Edge child1 = m_jit.graph().varArgChild(node, 0);
         Edge child2 = m_jit.graph().varArgChild(node, 1);
         Edge child3 = m_jit.graph().varArgChild(node, 2);
+        Edge child4 = m_jit.graph().varArgChild(node, 3);
         
         Array::Mode arrayMode = modeForPut(node.arrayMode());
         bool alreadyHandled = false;
@@ -2538,27 +2709,26 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg baseReg = base.gpr();
         GPRReg propertyReg = property.gpr();
 
-        speculateArray(arrayMode, child1, baseReg);
-
         switch (arrayMode) {
         case Array::JSArray:
         case Array::JSArrayOutOfBounds: {
             JSValueOperand value(this, child3);
-            GPRTemporary scratch(this);
 
             // Map base, property & value into registers, allocate a scratch register.
             GPRReg valueReg = value.gpr();
-            GPRReg scratchReg = scratch.gpr();
         
             if (!m_compileOkay)
                 return;
         
-            writeBarrier(baseReg, value.gpr(), child3, WriteBarrierForPropertyAccess, scratchReg);
+            if (Heap::isWriteBarrierEnabled()) {
+                GPRTemporary scratch(this);
+                writeBarrier(baseReg, value.gpr(), child3, WriteBarrierForPropertyAccess, scratch.gpr());
+            }
+
+            StorageOperand storage(this, child4);
+            GPRReg storageReg = storage.gpr();
 
             if (node.op() == PutByValAlias) {
-                GPRReg storageReg = scratchReg;
-                m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-                
                 // Store the value to the array.
                 GPRReg propertyReg = property.gpr();
                 GPRReg valueReg = value.gpr();
@@ -2575,11 +2745,8 @@ void SpeculativeJIT::compile(Node& node)
             base.use();
             property.use();
             value.use();
+            storage.use();
         
-            // Get the array storage.
-            GPRReg storageReg = scratchReg;
-            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
             // Check if we're writing to a hole; if so increment m_numValuesInVector.
             MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
             m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
@@ -2747,21 +2914,24 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPush: {
+        ASSERT(modeIsJSArray(node.arrayMode()));
+        
         SpeculateCellOperand base(this, node.child1());
         JSValueOperand value(this, node.child2());
-        GPRTemporary storage(this);
         GPRTemporary storageLength(this);
         
         GPRReg baseGPR = base.gpr();
         GPRReg valueGPR = value.gpr();
-        GPRReg storageGPR = storage.gpr();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        writeBarrier(baseGPR, valueGPR, node.child2(), WriteBarrierForPropertyAccess, storageGPR, storageLengthGPR);
+        if (Heap::isWriteBarrierEnabled()) {
+            GPRTemporary scratch(this);
+            writeBarrier(baseGPR, valueGPR, node.child2(), WriteBarrierForPropertyAccess, scratch.gpr(), storageLengthGPR);
+        }
 
-        speculateArray(Array::JSArray, node.child1(), baseGPR);
+        StorageOperand storage(this, node.child3());
+        GPRReg storageGPR = storage.gpr();
 
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
         
         // Refuse to handle bizarre lengths.
@@ -2786,19 +2956,18 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case ArrayPop: {
+        ASSERT(modeIsJSArray(node.arrayMode()));
+
         SpeculateCellOperand base(this, node.child1());
+        StorageOperand storage(this, node.child2());
         GPRTemporary value(this);
-        GPRTemporary storage(this);
         GPRTemporary storageLength(this);
         
         GPRReg baseGPR = base.gpr();
-        GPRReg valueGPR = value.gpr();
         GPRReg storageGPR = storage.gpr();
+        GPRReg valueGPR = value.gpr();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        speculateArray(Array::JSArray, node.child1(), baseGPR);
-
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
         
         JITCompiler::JumpList setUndefinedCases;
@@ -3175,34 +3344,32 @@ void SpeculativeJIT::compile(Node& node)
             JITCompiler::Jump activationNotCreated;
             if (checkTopLevel)
                 activationNotCreated = m_jit.branchTestPtr(JITCompiler::Zero, JITCompiler::addressFor(static_cast<VirtualRegister>(m_jit.codeBlock()->activationRegister())));
-            m_jit.loadPtr(JITCompiler::Address(resultGPR, OBJECT_OFFSETOF(ScopeChainNode, next)), resultGPR);
+            m_jit.loadPtr(JITCompiler::Address(resultGPR, JSScope::offsetOfNext()), resultGPR);
             activationNotCreated.link(&m_jit);
         }
         while (skip--)
-            m_jit.loadPtr(JITCompiler::Address(resultGPR, OBJECT_OFFSETOF(ScopeChainNode, next)), resultGPR);
+            m_jit.loadPtr(JITCompiler::Address(resultGPR, JSScope::offsetOfNext()), resultGPR);
         
-        m_jit.loadPtr(JITCompiler::Address(resultGPR, OBJECT_OFFSETOF(ScopeChainNode, object)), resultGPR);
-
         cellResult(resultGPR, m_compileIndex);
         break;
     }
     case GetScopedVar: {
-        SpeculateCellOperand scopeChain(this, node.child1());
+        SpeculateCellOperand scope(this, node.child1());
         GPRTemporary result(this);
         GPRReg resultGPR = result.gpr();
-        m_jit.loadPtr(JITCompiler::Address(scopeChain.gpr(), JSVariableObject::offsetOfRegisters()), resultGPR);
+        m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSVariableObject::offsetOfRegisters()), resultGPR);
         m_jit.loadPtr(JITCompiler::Address(resultGPR, node.varNumber() * sizeof(Register)), resultGPR);
         jsValueResult(resultGPR, m_compileIndex);
         break;
     }
     case PutScopedVar: {
-        SpeculateCellOperand scopeChain(this, node.child1());
+        SpeculateCellOperand scope(this, node.child1());
         GPRTemporary scratchRegister(this);
         GPRReg scratchGPR = scratchRegister.gpr();
-        m_jit.loadPtr(JITCompiler::Address(scopeChain.gpr(), JSVariableObject::offsetOfRegisters()), scratchGPR);
+        m_jit.loadPtr(JITCompiler::Address(scope.gpr(), JSVariableObject::offsetOfRegisters()), scratchGPR);
         JSValueOperand value(this, node.child2());
         m_jit.storePtr(value.gpr(), JITCompiler::Address(scratchGPR, node.varNumber() * sizeof(Register)));
-        writeBarrier(scopeChain.gpr(), value.gpr(), node.child2(), WriteBarrierForVariableAccess, scratchGPR);
+        writeBarrier(scope.gpr(), value.gpr(), node.child2(), WriteBarrierForVariableAccess, scratchGPR);
         noResult(m_compileIndex);
         break;
     }
@@ -3518,7 +3685,7 @@ void SpeculativeJIT::compile(Node& node)
         JSValueOperand value(this, node.child1());
         
         WatchpointSet* watchpointSet =
-            m_jit.globalObjectFor(node.codeOrigin)->symbolTable().get(
+            m_jit.globalObjectFor(node.codeOrigin)->symbolTable()->get(
                 identifier(node.identifierNumberForCheck())->impl()).watchpointSet();
         addSlowPathGenerator(
             slowPathCall(
@@ -3541,7 +3708,7 @@ void SpeculativeJIT::compile(Node& node)
     }
         
     case GlobalVarWatchpoint: {
-        m_jit.globalObjectFor(node.codeOrigin)->symbolTable().get(
+        m_jit.globalObjectFor(node.codeOrigin)->symbolTable()->get(
             identifier(node.identifierNumberForCheck())->impl()).addWatchpoint(
                 speculationWatchpoint());
         
diff --git a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
index eb04a6747..dec2e49f7 100644
--- a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
@@ -99,6 +99,8 @@ public:
                 case PutByVal:
                 case PutByValAlias:
                 case GetArrayLength:
+                case CheckArray:
+                case GetIndexedPropertyStorage:
                 case Phantom:
                     // Don't count these uses.
                     break;
@@ -128,6 +130,50 @@ public:
 #endif
             iter->second.m_structure = 0;
         }
+        
+        // Disable structure check hoisting for variables that cross the OSR entry that
+        // we're currently taking, and where the value currently does not have the
+        // structure we want.
+        
+        for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+            BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+            if (!block)
+                continue;
+            ASSERT(block->isReachable);
+            if (!block->isOSRTarget)
+                continue;
+            if (block->bytecodeBegin != m_graph.m_osrEntryBytecodeIndex)
+                continue;
+            for (size_t i = 0; i < m_graph.m_mustHandleValues.size(); ++i) {
+                int operand = m_graph.m_mustHandleValues.operandForIndex(i);
+                NodeIndex nodeIndex = block->variablesAtHead.operand(operand);
+                if (nodeIndex == NoNode)
+                    continue;
+                VariableAccessData* variable = m_graph[nodeIndex].variableAccessData();
+                HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+                if (iter == m_map.end())
+                    continue;
+                if (!iter->second.m_structure)
+                    continue;
+                JSValue value = m_graph.m_mustHandleValues[i];
+                if (!value || !value.isCell()) {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+                    dataLog("Zeroing the structure to hoist for %s because the OSR entry value is not a cell: %s.\n",
+                            m_graph.nameOfVariableAccessData(variable), value.description());
+#endif
+                    iter->second.m_structure = 0;
+                    continue;
+                }
+                if (value.asCell()->structure() != iter->second.m_structure) {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+                    dataLog("Zeroing the structure to hoist for %s because the OSR entry value has structure %p and we wanted %p.\n",
+                            m_graph.nameOfVariableAccessData(variable), value.asCell()->structure(), iter->second.m_structure);
+#endif
+                    iter->second.m_structure = 0;
+                    continue;
+                }
+            }
+        }
 
         // Identify the set of variables that are live across a structure clobber.
         
diff --git a/Source/JavaScriptCore/dfg/DFGThunks.cpp b/Source/JavaScriptCore/dfg/DFGThunks.cpp
index b056de79c..546aec256 100644
--- a/Source/JavaScriptCore/dfg/DFGThunks.cpp
+++ b/Source/JavaScriptCore/dfg/DFGThunks.cpp
@@ -219,10 +219,11 @@ static MacroAssemblerCodeRef virtualForThunkGenerator(
             CCallHelpers::NotEqual, GPRInfo::nonArgGPR1,
             CCallHelpers::TrustedImm32(JSValue::CellTag)));
 #endif
+    jit.loadPtr(CCallHelpers::Address(GPRInfo::nonArgGPR0, JSCell::structureOffset()), GPRInfo::nonArgGPR2);
     slowCase.append(
         jit.branchPtr(
             CCallHelpers::NotEqual,
-            CCallHelpers::Address(GPRInfo::nonArgGPR0, JSCell::classInfoOffset()),
+            CCallHelpers::Address(GPRInfo::nonArgGPR2, Structure::classInfoOffset()),
             CCallHelpers::TrustedImmPtr(&JSFunction::s_info)));
     
     // Now we know we have a JSFunction.
diff --git a/Source/JavaScriptCore/heap/Handle.h b/Source/JavaScriptCore/heap/Handle.h
index 62f267e12..3b62e2054 100644
--- a/Source/JavaScriptCore/heap/Handle.h
+++ b/Source/JavaScriptCore/heap/Handle.h
@@ -102,7 +102,7 @@ template <typename Base> struct HandleConverter<Base, Unknown> {
     Handle<JSObject> asObject() const;
     bool isObject() const { return jsValue().isObject(); }
     bool getNumber(double number) const { return jsValue().getNumber(number); }
-    UString getString(ExecState*) const;
+    WTF::String getString(ExecState*) const;
     bool isUndefinedOrNull() const { return jsValue().isUndefinedOrNull(); }
 
 private:
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 669178804..4ab8ccb31 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -753,6 +753,9 @@ void Heap::collect(SweepToggle sweepToggle)
         m_objectSpace.resetAllocators();
     }
     
+    if (Options::useZombieMode())
+        zombifyDeadObjects();
+
     size_t currentHeapSize = size();
     if (fullGC) {
         m_sizeAfterLastCollect = currentHeapSize;
@@ -844,4 +847,49 @@ void Heap::didStartVMShutdown()
     lastChanceToFinalize();
 }
 
+class ZombifyCellFunctor : public MarkedBlock::VoidFunctor {
+public:
+    ZombifyCellFunctor(size_t cellSize)
+        : m_cellSize(cellSize)
+    {
+    }
+
+    void operator()(JSCell* cell)
+    {
+        if (Options::zombiesAreImmortal())
+            MarkedBlock::blockFor(cell)->setMarked(cell);
+
+        void** current = reinterpret_cast<void**>(cell);
+
+        // We want to maintain zapped-ness because that's how we know if we've called 
+        // the destructor.
+        if (cell->isZapped())
+            current++;
+
+        void* limit = static_cast<void*>(reinterpret_cast<char*>(cell) + m_cellSize);
+        for (; current < limit; current++)
+            *current = reinterpret_cast<void*>(0xbbadbeef);
+    }
+
+private:
+    size_t m_cellSize;
+};
+
+class ZombifyBlockFunctor : public MarkedBlock::VoidFunctor {
+public:
+    void operator()(MarkedBlock* block)
+    {
+        ZombifyCellFunctor functor(block->cellSize());
+        block->forEachDeadCell(functor);
+    }
+};
+
+void Heap::zombifyDeadObjects()
+{
+    m_objectSpace.sweep();
+
+    ZombifyBlockFunctor functor;
+    m_objectSpace.forEachBlock(functor);
+}
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 6f13afb72..69aa97e33 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -59,11 +59,10 @@ namespace JSC {
     class LLIntOffsetsExtractor;
     class MarkedArgumentBuffer;
     class RegisterFile;
-    class UString;
     class WeakGCHandlePool;
     class SlotVisitor;
 
-    typedef std::pair<JSValue, UString> ValueStringPair;
+    typedef std::pair<JSValue, WTF::String> ValueStringPair;
     typedef HashCountedSet<JSCell*> ProtectCountSet;
     typedef HashCountedSet<const char*> TypeCountSet;
 
@@ -204,7 +203,8 @@ namespace JSC {
         void harvestWeakReferences();
         void finalizeUnconditionalFinalizers();
         void deleteUnmarkedCompiledCode();
-        
+        void zombifyDeadObjects();
+ 
         RegisterFile& registerFile();
         BlockAllocator& blockAllocator();
 
diff --git a/Source/JavaScriptCore/heap/HeapTimer.cpp b/Source/JavaScriptCore/heap/HeapTimer.cpp
index fa979781e..214f86757 100644
--- a/Source/JavaScriptCore/heap/HeapTimer.cpp
+++ b/Source/JavaScriptCore/heap/HeapTimer.cpp
@@ -29,7 +29,8 @@
 #include "APIShims.h"
 #include "JSObject.h"
 #include "JSString.h"
-#include "ScopeChain.h"
+
+#include <wtf/MainThread.h>
 #include <wtf/Threading.h>
 
 namespace JSC {
@@ -104,6 +105,9 @@ HeapTimer::HeapTimer(JSGlobalData* globalData)
     : m_globalData(globalData)
     , m_timer(this, &HeapTimer::timerDidFire)
 {
+    // FIXME: Implement HeapTimer for other threads.
+    if (WTF::isMainThread() && !m_timer.tryCreateClient())
+        CRASH();
 }
 
 HeapTimer::~HeapTimer()
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
index f284d8b57..bd1342f2a 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
@@ -31,22 +31,19 @@
 #include "JSObject.h"
 #include "JSString.h"
 #include "MarkedBlock.h"
-#include "ScopeChain.h"
+
 #include <wtf/HashSet.h>
 #include <wtf/WTFThreadData.h>
 
 namespace JSC {
 
-#if USE(CF)
+#if USE(CF) || PLATFORM(BLACKBERRY)
 
-static const CFTimeInterval sweepTimeSlice = .01; // seconds
-static const CFTimeInterval sweepTimeTotal = .10;
-static const CFTimeInterval sweepTimeMultiplier = 1.0 / sweepTimeTotal;
+static const double sweepTimeSlice = .01; // seconds
+static const double sweepTimeTotal = .10;
+static const double sweepTimeMultiplier = 1.0 / sweepTimeTotal;
 
-void IncrementalSweeper::doWork()
-{
-    doSweep(WTF::monotonicallyIncreasingTime());
-}
+#if USE(CF)
     
 IncrementalSweeper::IncrementalSweeper(Heap* heap, CFRunLoopRef runLoop)
     : HeapTimer(heap->globalData(), runLoop)
@@ -70,12 +67,43 @@ void IncrementalSweeper::cancelTimer()
     CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() + s_decade);
 }
 
+#elif PLATFORM(BLACKBERRY)
+   
+IncrementalSweeper::IncrementalSweeper(Heap* heap)
+    : HeapTimer(heap->globalData())
+    , m_currentBlockToSweepIndex(0)
+    , m_structuresCanBeSwept(false)
+{
+}
+
+IncrementalSweeper* IncrementalSweeper::create(Heap* heap)
+{
+    return new IncrementalSweeper(heap);
+}
+
+void IncrementalSweeper::scheduleTimer()
+{
+    m_timer.start(sweepTimeSlice * sweepTimeMultiplier);
+}
+
+void IncrementalSweeper::cancelTimer()
+{
+    m_timer.stop();
+}
+
+#endif
+
+void IncrementalSweeper::doWork()
+{
+    doSweep(WTF::monotonicallyIncreasingTime());
+}
+
 void IncrementalSweeper::doSweep(double sweepBeginTime)
 {
     while (m_currentBlockToSweepIndex < m_blocksToSweep.size()) {
         sweepNextBlock();
 
-        CFTimeInterval elapsedTime = WTF::monotonicallyIncreasingTime() - sweepBeginTime;
+        double elapsedTime = WTF::monotonicallyIncreasingTime() - sweepBeginTime;
         if (elapsedTime < sweepTimeSlice)
             continue;
 
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.h b/Source/JavaScriptCore/heap/IncrementalSweeper.h
index c8005b071..03c620f9c 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.h
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.h
@@ -60,8 +60,12 @@ public:
     void willFinishSweeping();
 
 private:
+#if USE(CF) || PLATFORM(BLACKBERRY)
 #if USE(CF)
     IncrementalSweeper(Heap*, CFRunLoopRef);
+#else
+    IncrementalSweeper(Heap*);
+#endif
     
     void doSweep(double startTime);
     void scheduleTimer();
diff --git a/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp b/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp
index 054bf06dd..5e4ca36e0 100644
--- a/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp
+++ b/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp
@@ -29,7 +29,7 @@
 #if ENABLE(JIT)
 
 #include "GCAwareJITStubRoutine.h"
-#include "ScopeChain.h"
+
 #include "SlotVisitor.h"
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 3c7ff9c3e..26453c4f3 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -107,6 +107,7 @@ static void pthreadSignalHandlerSuspendResume(int signo)
 #endif
 
 class MachineThreads::Thread {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     Thread(const PlatformThread& platThread, void* base)
         : platformThread(platThread)
diff --git a/Source/JavaScriptCore/heap/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
index 9d3062154..9a4a01f04 100644
--- a/Source/JavaScriptCore/heap/MarkStack.cpp
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -35,10 +35,9 @@
 #include "JSArray.h"
 #include "JSCell.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 #include "SlotVisitorInlineMethods.h"
 #include "Structure.h"
-#include "UString.h"
 #include "WriteBarrier.h"
 #include <wtf/Atomics.h>
 #include <wtf/DataLog.h>
@@ -523,6 +522,8 @@ ALWAYS_INLINE void MarkStack::internalAppend(JSValue* slot)
         return;
 
     JSCell* cell = value.asCell();
+    if (!cell)
+        return;
 
     if (m_shouldHashConst && cell->isString()) {
         JSString* string = jsCast<JSString*>(cell);
diff --git a/Source/JavaScriptCore/heap/MarkStackInlineMethods.h b/Source/JavaScriptCore/heap/MarkStackInlineMethods.h
index 8b420d637..031dfff39 100644
--- a/Source/JavaScriptCore/heap/MarkStackInlineMethods.h
+++ b/Source/JavaScriptCore/heap/MarkStackInlineMethods.h
@@ -35,8 +35,6 @@ ALWAYS_INLINE void MarkStack::append(JSValue* slot, size_t count)
 {
     for (size_t i = 0; i < count; ++i) {
         JSValue& value = slot[i];
-        if (!value)
-            continue;
         internalAppend(value);
     }
 }
@@ -46,8 +44,7 @@ inline void MarkStack::appendUnbarrieredPointer(T** slot)
 {
     ASSERT(slot);
     JSCell* cell = *slot;
-    if (cell)
-        internalAppend(cell);
+    internalAppend(cell);
 }
 
 ALWAYS_INLINE void MarkStack::append(JSValue* slot)
@@ -70,8 +67,7 @@ ALWAYS_INLINE void MarkStack::append(JSCell** slot)
 
 ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
 {
-    ASSERT(value);
-    if (!value.isCell())
+    if (!value || !value.isCell())
         return;
     internalAppend(value.asCell());
 }
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.cpp b/Source/JavaScriptCore/heap/MarkedBlock.cpp
index 95ea2f414..b0f3b88d5 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.cpp
+++ b/Source/JavaScriptCore/heap/MarkedBlock.cpp
@@ -29,7 +29,7 @@
 #include "IncrementalSweeper.h"
 #include "JSCell.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 
 namespace JSC {
 
@@ -45,7 +45,7 @@ MarkedBlock::MarkedBlock(const PageAllocationAligned& allocation, Heap* heap, si
     , m_cellsNeedDestruction(cellsNeedDestruction)
     , m_onlyContainsStructures(onlyContainsStructures)
     , m_state(New) // All cells start out unmarked.
-    , m_weakSet(heap)
+    , m_weakSet(heap->globalData())
 {
     ASSERT(heap);
     HEAP_LOG_BLOCK_STATE_TRANSITION(this);
diff --git a/Source/JavaScriptCore/heap/MarkedBlock.h b/Source/JavaScriptCore/heap/MarkedBlock.h
index ab2abd753..8c03d5b4f 100644
--- a/Source/JavaScriptCore/heap/MarkedBlock.h
+++ b/Source/JavaScriptCore/heap/MarkedBlock.h
@@ -121,6 +121,7 @@ namespace JSC {
         void lastChanceToFinalize();
 
         Heap* heap() const;
+        JSGlobalData* globalData() const;
         WeakSet& weakSet();
         
         enum SweepMode { SweepOnly, SweepToFreeList };
@@ -185,6 +186,7 @@ namespace JSC {
 #endif
 
         template <typename Functor> void forEachCell(Functor&);
+        template <typename Functor> void forEachDeadCell(Functor&);
 
     private:
         static const size_t atomAlignmentMask = atomSize - 1; // atomSize must be a power of two.
@@ -262,6 +264,11 @@ namespace JSC {
         return m_weakSet.heap();
     }
 
+    inline JSGlobalData* MarkedBlock::globalData() const
+    {
+        return m_weakSet.globalData();
+    }
+
     inline WeakSet& MarkedBlock::weakSet()
     {
         return m_weakSet;
@@ -411,6 +418,17 @@ namespace JSC {
         }
     }
 
+    template <typename Functor> inline void MarkedBlock::forEachDeadCell(Functor& functor)
+    {
+        for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+            JSCell* cell = reinterpret_cast_ptr<JSCell*>(&atoms()[i]);
+            if (isLive(cell))
+                continue;
+
+            functor(cell);
+        }
+    }
+
     inline bool MarkedBlock::needsSweeping()
     {
         return m_state == Marked || m_state == Zapped;
diff --git a/Source/JavaScriptCore/heap/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
index cd6be001c..68b059c36 100644
--- a/Source/JavaScriptCore/heap/MarkedSpace.cpp
+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
@@ -25,7 +25,7 @@
 #include "JSGlobalObject.h"
 #include "JSLock.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/heap/WeakBlock.cpp b/Source/JavaScriptCore/heap/WeakBlock.cpp
index 05a44ea7e..13039e702 100644
--- a/Source/JavaScriptCore/heap/WeakBlock.cpp
+++ b/Source/JavaScriptCore/heap/WeakBlock.cpp
@@ -29,7 +29,7 @@
 #include "Heap.h"
 #include "HeapRootVisitor.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 #include "Structure.h"
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/heap/WeakSet.cpp b/Source/JavaScriptCore/heap/WeakSet.cpp
index 4a510b899..2804968f8 100644
--- a/Source/JavaScriptCore/heap/WeakSet.cpp
+++ b/Source/JavaScriptCore/heap/WeakSet.cpp
@@ -27,6 +27,7 @@
 #include "WeakSet.h"
 
 #include "Heap.h"
+#include "JSGlobalData.h"
 
 namespace JSC {
 
@@ -73,7 +74,7 @@ WeakBlock::FreeCell* WeakSet::tryFindAllocator()
 WeakBlock::FreeCell* WeakSet::addAllocator()
 {
     WeakBlock* block = WeakBlock::create();
-    m_heap->didAllocate(WeakBlock::blockSize);
+    heap()->didAllocate(WeakBlock::blockSize);
     m_blocks.append(block);
     WeakBlock::SweepResult sweepResult = block->takeSweepResult();
     ASSERT(!sweepResult.isNull() && sweepResult.freeList);
diff --git a/Source/JavaScriptCore/heap/WeakSet.h b/Source/JavaScriptCore/heap/WeakSet.h
index 291d0aebd..06514eb69 100644
--- a/Source/JavaScriptCore/heap/WeakSet.h
+++ b/Source/JavaScriptCore/heap/WeakSet.h
@@ -38,11 +38,12 @@ public:
     static WeakImpl* allocate(JSValue, WeakHandleOwner* = 0, void* context = 0);
     static void deallocate(WeakImpl*);
 
-    WeakSet(Heap*);
+    WeakSet(JSGlobalData*);
     ~WeakSet();
     void lastChanceToFinalize();
 
     Heap* heap() const;
+    JSGlobalData* globalData() const;
 
     bool isEmpty() const;
 
@@ -61,19 +62,19 @@ private:
     WeakBlock::FreeCell* m_allocator;
     WeakBlock* m_nextAllocator;
     DoublyLinkedList<WeakBlock> m_blocks;
-    Heap* m_heap;
+    JSGlobalData* m_globalData;
 };
 
-inline WeakSet::WeakSet(Heap* heap)
+inline WeakSet::WeakSet(JSGlobalData* globalData)
     : m_allocator(0)
     , m_nextAllocator(0)
-    , m_heap(heap)
+    , m_globalData(globalData)
 {
 }
 
-inline Heap* WeakSet::heap() const
+inline JSGlobalData* WeakSet::globalData() const
 {
-    return m_heap;
+    return m_globalData;
 }
 
 inline bool WeakSet::isEmpty() const
diff --git a/Source/JavaScriptCore/interpreter/AbstractPC.cpp b/Source/JavaScriptCore/interpreter/AbstractPC.cpp
index 755a0e303..f986e8872 100644
--- a/Source/JavaScriptCore/interpreter/AbstractPC.cpp
+++ b/Source/JavaScriptCore/interpreter/AbstractPC.cpp
@@ -29,13 +29,14 @@
 #include "CallFrame.h"
 #include "JSGlobalData.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 
 namespace JSC {
 
 AbstractPC::AbstractPC(JSGlobalData& globalData, ExecState* exec)
 {
     UNUSED_PARAM(globalData);
+    UNUSED_PARAM(exec);
     
 #if ENABLE(JIT)
     if (globalData.canUseJIT()) {
diff --git a/Source/JavaScriptCore/interpreter/CachedCall.h b/Source/JavaScriptCore/interpreter/CachedCall.h
index ea55d90e5..b2513ba6e 100644
--- a/Source/JavaScriptCore/interpreter/CachedCall.h
+++ b/Source/JavaScriptCore/interpreter/CachedCall.h
@@ -38,7 +38,7 @@ namespace JSC {
         CachedCall(CallFrame* callFrame, JSFunction* function, int argumentCount)
             : m_valid(false)
             , m_interpreter(callFrame->interpreter())
-            , m_globalObjectScope(callFrame->globalData(), function->scope()->globalObject.get())
+            , m_globalObjectScope(callFrame->globalData(), function->scope()->globalObject())
         {
             ASSERT(!function->isHostFunction());
             m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, function, argumentCount + 1, function->scope());
@@ -56,7 +56,7 @@ namespace JSC {
         CallFrame* newCallFrame(ExecState* exec)
         {
             CallFrame* callFrame = m_closure.newCallFrame;
-            callFrame->setScopeChain(exec->scopeChain());
+            callFrame->setScope(exec->scope());
             return callFrame;
         }
 
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.cpp b/Source/JavaScriptCore/interpreter/CallFrame.cpp
index cfbfb3e3a..63bc93aeb 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.cpp
+++ b/Source/JavaScriptCore/interpreter/CallFrame.cpp
@@ -36,7 +36,7 @@ void CallFrame::dumpCaller()
 {
     int signedLineNumber;
     intptr_t sourceID;
-    UString urlString;
+    String urlString;
     JSValue function;
     
     interpreter()->retrieveLastCaller(this, signedLineNumber, sourceID, urlString, function);
@@ -139,7 +139,7 @@ CallFrame* CallFrame::trueCallFrame(AbstractPC pc)
         // Fill in the inlinedCaller
         inlinedCaller->setCodeBlock(machineCodeBlock);
         
-        inlinedCaller->setScopeChain(calleeAsFunction->scope());
+        inlinedCaller->setScope(calleeAsFunction->scope());
         if (nextInlineCallFrame)
             inlinedCaller->setCallerFrame(this + nextInlineCallFrame->stackOffset);
         else
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index ea98f6652..0db485214 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -33,7 +33,7 @@ namespace JSC  {
     class Arguments;
     class JSActivation;
     class Interpreter;
-    class ScopeChainNode;
+    class JSScope;
 
     // Represents the current state of script execution.
     // Passed as the first argument to most functions.
@@ -42,10 +42,10 @@ namespace JSC  {
         JSValue calleeAsValue() const { return this[RegisterFile::Callee].jsValue(); }
         JSObject* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
-        ScopeChainNode* scopeChain() const
+        JSScope* scope() const
         {
-            ASSERT(this[RegisterFile::ScopeChain].Register::scopeChain());
-            return this[RegisterFile::ScopeChain].Register::scopeChain();
+            ASSERT(this[RegisterFile::ScopeChain].Register::scope());
+            return this[RegisterFile::ScopeChain].Register::scope();
         }
 
         // Global object in which execution began.
@@ -53,13 +53,13 @@ namespace JSC  {
 
         // Global object in which the currently executing code was defined.
         // Differs from dynamicGlobalObject() during function calls across web browser frames.
-        inline JSGlobalObject* lexicalGlobalObject() const;
+        JSGlobalObject* lexicalGlobalObject() const;
 
         // Differs from lexicalGlobalObject because this will have DOM window shell rather than
         // the actual DOM window, which can't be "this" for security reasons.
-        inline JSObject* globalThisValue() const;
+        JSObject* globalThisValue() const;
 
-        inline JSGlobalData& globalData() const;
+        JSGlobalData& globalData() const;
 
         // Convenience functions for access to global data.
         // It takes a few memory references to get from a call frame to the global data
@@ -103,7 +103,7 @@ namespace JSC  {
         CallFrame& operator=(const Register& r) { *static_cast<Register*>(this) = r; return *this; }
 
         CallFrame* callerFrame() const { return this[RegisterFile::CallerFrame].callFrame(); }
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
         ReturnAddressPtr returnPC() const { return ReturnAddressPtr(this[RegisterFile::ReturnPC].vPC()); }
         bool hasReturnPC() const { return !!this[RegisterFile::ReturnPC].vPC(); }
         void clearReturnPC() { registers()[RegisterFile::ReturnPC] = static_cast<Instruction*>(0); }
@@ -166,16 +166,16 @@ namespace JSC  {
 #endif
 
         void setCallerFrame(CallFrame* callerFrame) { static_cast<Register*>(this)[RegisterFile::CallerFrame] = callerFrame; }
-        void setScopeChain(ScopeChainNode* scopeChain) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scopeChain; }
+        void setScope(JSScope* scope) { static_cast<Register*>(this)[RegisterFile::ScopeChain] = scope; }
 
-        ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
+        ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, JSScope* scope,
             CallFrame* callerFrame, int argc, JSObject* callee)
         {
             ASSERT(callerFrame); // Use noCaller() rather than 0 for the outer host call frame caller.
             ASSERT(callerFrame == noCaller() || callerFrame->removeHostCallFrameFlag()->registerFile()->end() >= this);
 
             setCodeBlock(codeBlock);
-            setScopeChain(scopeChain);
+            setScope(scope);
             setCallerFrame(callerFrame);
             setReturnPC(vPC); // This is either an Instruction* or a pointer into JIT generated code stored as an Instruction*.
             setArgumentCountIncludingThis(argc); // original argument count (for the sake of the "arguments" object)
@@ -183,9 +183,9 @@ namespace JSC  {
         }
 
         // Read a register from the codeframe (or constant from the CodeBlock).
-        inline Register& r(int);
+        Register& r(int);
         // Read a register for a non-constant 
-        inline Register& uncheckedR(int);
+        Register& uncheckedR(int);
 
         // Access to arguments.
         size_t argumentCount() const { return argumentCountIncludingThis() - 1; }
diff --git a/Source/JavaScriptCore/interpreter/CallFrameClosure.h b/Source/JavaScriptCore/interpreter/CallFrameClosure.h
index 2a841511a..125193258 100644
--- a/Source/JavaScriptCore/interpreter/CallFrameClosure.h
+++ b/Source/JavaScriptCore/interpreter/CallFrameClosure.h
@@ -35,7 +35,7 @@ struct CallFrameClosure {
     FunctionExecutable* functionExecutable;
     JSGlobalData* globalData;
     Register* oldEnd;
-    ScopeChainNode* scopeChain;
+    JSScope* scope;
     int parameterCountIncludingThis;
     int argumentCountIncludingThis;
     
@@ -51,7 +51,7 @@ struct CallFrameClosure {
 
     void resetCallFrame()
     {
-        newCallFrame->setScopeChain(scopeChain);
+        newCallFrame->setScope(scope);
         for (int i = argumentCountIncludingThis; i < parameterCountIncludingThis; ++i)
             newCallFrame->setArgument(i, jsUndefined());
     }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index f6a197ef0..87b77d639 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -45,11 +45,13 @@
 #include "JSActivation.h"
 #include "JSArray.h"
 #include "JSBoundFunction.h"
+#include "JSNameScope.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
-#include "LiteralParser.h"
-#include "JSStaticScopeObject.h"
 #include "JSString.h"
+#include "JSWithScope.h"
+#include "LLIntCLoop.h"
+#include "LiteralParser.h"
 #include "NameInstance.h"
 #include "ObjectPrototype.h"
 #include "Operations.h"
@@ -61,7 +63,6 @@
 #include "SamplingTool.h"
 #include "StrictEvalActivation.h"
 #include "StrongInlines.h"
-#include "UStringConcatenate.h"
 #include <limits.h>
 #include <stdio.h>
 #include <wtf/Threading.h>
@@ -80,7 +81,7 @@ namespace JSC {
 static CallFrame* getCallerInfo(JSGlobalData*, CallFrame*, int& lineNumber, unsigned& bytecodeOffset);
 
 // Returns the depth of the scope chain within a given call frame.
-static int depth(CodeBlock* codeBlock, ScopeChainNode* sc)
+static int depth(CodeBlock* codeBlock, JSScope* sc)
 {
     if (!codeBlock->needsFullScopeChain())
         return 0;
@@ -93,282 +94,6 @@ static NEVER_INLINE JSValue concatenateStrings(ExecState* exec, Register* string
     return jsString(exec, strings, count);
 }
 
-NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int dst = vPC[1].u.operand;
-    int property = vPC[2].u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& ident = codeBlock->identifier(property);
-    do {
-        JSObject* o = iter->get();
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-            callFrame->uncheckedR(dst) = JSValue(result);
-            return true;
-        }
-    } while (++iter != end);
-    exceptionValue = createUndefinedVariableError(callFrame, ident);
-    return false;
-}
-
-NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    int dst = vPC[1].u.operand;
-    int property = vPC[2].u.operand;
-    int skip = vPC[3].u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel && skip--) {
-        if (callFrame->uncheckedR(codeBlock->activationRegister()).jsValue())
-            ++iter;
-    }
-    while (skip--) {
-        ++iter;
-        ASSERT(iter != end);
-    }
-    Identifier& ident = codeBlock->identifier(property);
-    do {
-        JSObject* o = iter->get();
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-            ASSERT(result);
-            callFrame->uncheckedR(dst) = JSValue(result);
-            return true;
-        }
-    } while (++iter != end);
-    exceptionValue = createUndefinedVariableError(callFrame, ident);
-    return false;
-}
-
-NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int dst = vPC[1].u.operand;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalObject* globalObject = codeBlock->globalObject();
-    ASSERT(globalObject->isGlobalObject());
-    int property = vPC[2].u.operand;
-    Structure* structure = vPC[3].u.structure.get();
-    int offset = vPC[4].u.operand;
-
-    if (structure == globalObject->structure()) {
-        callFrame->uncheckedR(dst) = JSValue(globalObject->getDirectOffset(offset));
-        return true;
-    }
-
-    Identifier& ident = codeBlock->identifier(property);
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            vPC[3].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
-            vPC[4] = slot.cachedOffset();
-            callFrame->uncheckedR(dst) = JSValue(result);
-            return true;
-        }
-
-        exceptionValue = callFrame->globalData().exception;
-        if (exceptionValue)
-            return false;
-        callFrame->uncheckedR(dst) = JSValue(result);
-        return true;
-    }
-
-    exceptionValue = createUndefinedVariableError(callFrame, ident);
-    return false;
-}
-
-NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int dst = vPC[1].u.operand;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalObject* globalObject = codeBlock->globalObject();
-    ASSERT(globalObject->isGlobalObject());
-    int property = vPC[2].u.operand;
-    Structure* structure = vPC[3].u.structure.get();
-    int offset = vPC[4].u.operand;
-    int skip = vPC[5].u.operand;
-    
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel && skip--) {
-        if (callFrame->uncheckedR(codeBlock->activationRegister()).jsValue())
-            ++iter;
-    }
-    while (skip--) {
-        JSObject* o = iter->get();
-        if (o->hasCustomProperties()) {
-            Identifier& ident = codeBlock->identifier(property);
-            do {
-                PropertySlot slot(o);
-                if (o->getPropertySlot(callFrame, ident, slot)) {
-                    JSValue result = slot.getValue(callFrame, ident);
-                    exceptionValue = callFrame->globalData().exception;
-                    if (exceptionValue)
-                        return false;
-                    ASSERT(result);
-                    callFrame->uncheckedR(dst) = JSValue(result);
-                    return true;
-                }
-                if (iter == end)
-                    break;
-                o = iter->get();
-                ++iter;
-            } while (true);
-            exceptionValue = createUndefinedVariableError(callFrame, ident);
-            return false;
-        }
-        ++iter;
-    }
-    
-    if (structure == globalObject->structure()) {
-        callFrame->uncheckedR(dst) = JSValue(globalObject->getDirectOffset(offset));
-        ASSERT(callFrame->uncheckedR(dst).jsValue());
-        return true;
-    }
-
-    Identifier& ident = codeBlock->identifier(property);
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            vPC[3].u.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
-            vPC[4] = slot.cachedOffset();
-            ASSERT(result);
-            callFrame->uncheckedR(dst) = JSValue(result);
-            return true;
-        }
-        
-        exceptionValue = callFrame->globalData().exception;
-        if (exceptionValue)
-            return false;
-        ASSERT(result);
-        callFrame->uncheckedR(dst) = JSValue(result);
-        return true;
-    }
-    
-    exceptionValue = createUndefinedVariableError(callFrame, ident);
-    return false;
-}
-
-NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vPC)
-{
-    int dst = vPC[1].u.operand;
-    int property = vPC[2].u.operand;
-    bool isStrictPut = vPC[3].u.operand;
-    Identifier ident = callFrame->codeBlock()->identifier(property);
-    JSValue result = JSC::resolveBase(callFrame, ident, callFrame->scopeChain(), isStrictPut);
-    if (result) {
-        callFrame->uncheckedR(dst) = result;
-        ASSERT(callFrame->uncheckedR(dst).jsValue());
-    } else
-        callFrame->globalData().exception = createErrorForInvalidGlobalAssignment(callFrame, ident.ustring());
-}
-
-NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int baseDst = vPC[1].u.operand;
-    int propDst = vPC[2].u.operand;
-    int property = vPC[3].u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& ident = codeBlock->identifier(property);
-    JSObject* base;
-    do {
-        base = iter->get();
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-            callFrame->uncheckedR(propDst) = JSValue(result);
-            callFrame->uncheckedR(baseDst) = JSValue(base);
-            return true;
-        }
-        ++iter;
-    } while (iter != end);
-
-    exceptionValue = createUndefinedVariableError(callFrame, ident);
-    return false;
-}
-
-NEVER_INLINE bool Interpreter::resolveThisAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int thisDst = vPC[1].u.operand;
-    int propDst = vPC[2].u.operand;
-    int property = vPC[3].u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& ident = codeBlock->identifier(property);
-    JSObject* base;
-    do {
-        base = iter->get();
-        ++iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-            callFrame->uncheckedR(propDst) = JSValue(result);
-            // All entries on the scope chain should be EnvironmentRecords (activations etc),
-            // other then 'with' object, which are directly referenced from the scope chain,
-            // and the global object. If we hit either an EnvironmentRecord or a global
-            // object at the end of the scope chain, this is undefined. If we hit a non-
-            // EnvironmentRecord within the scope chain, pass the base as the this value.
-            if (iter == end || base->structure()->typeInfo().isEnvironmentRecord())
-                callFrame->uncheckedR(thisDst) = jsUndefined();
-            else
-                callFrame->uncheckedR(thisDst) = JSValue(base);
-            return true;
-        }
-    } while (iter != end);
-
-    exceptionValue = createUndefinedVariableError(callFrame, ident);
-    return false;
-}
-
 #endif // ENABLE(CLASSIC_INTERPRETER)
 
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argumentCountIncludingThis)
@@ -426,13 +151,13 @@ JSValue eval(CallFrame* callFrame)
         return program;
     
     TopCallFrameSetter topCallFrame(callFrame->globalData(), callFrame);
-    UString programSource = asString(program)->value(callFrame);
+    String programSource = asString(program)->value(callFrame);
     if (callFrame->hadException())
         return JSValue();
     
     CallFrame* callerFrame = callFrame->callerFrame();
     CodeBlock* callerCodeBlock = callerFrame->codeBlock();
-    ScopeChainNode* callerScopeChain = callerFrame->scopeChain();
+    JSScope* callerScopeChain = callerFrame->scope();
     EvalExecutable* eval = callerCodeBlock->evalCodeCache().tryGet(callerCodeBlock->isStrictMode(), programSource, callerScopeChain);
 
     if (!eval) {
@@ -554,15 +279,14 @@ Interpreter::Interpreter()
 
 Interpreter::~Interpreter()
 {
-#if ENABLE(LLINT)
+#if ENABLE(LLINT) && ENABLE(COMPUTED_GOTO_OPCODES)
     if (m_classicEnabled)
         delete[] m_opcodeTable;
 #endif
 }
 
-void Interpreter::initialize(LLInt::Data* llintData, bool canUseJIT)
+void Interpreter::initialize(bool canUseJIT)
 {
-    UNUSED_PARAM(llintData);
     UNUSED_PARAM(canUseJIT);
 
     // If we have LLInt, then we shouldn't be building any kind of classic interpreter.
@@ -570,15 +294,16 @@ void Interpreter::initialize(LLInt::Data* llintData, bool canUseJIT)
 #error "Building both LLInt and the Classic Interpreter is not supported because it doesn't make sense."
 #endif
 
+#if ENABLE(COMPUTED_GOTO_OPCODES)
 #if ENABLE(LLINT)
-    m_opcodeTable = llintData->opcodeMap();
+    m_opcodeTable = LLInt::opcodeMap();
     for (int i = 0; i < numOpcodeIDs; ++i)
         m_opcodeIDTable.add(m_opcodeTable[i], static_cast<OpcodeID>(i));
     m_classicEnabled = false;
+
 #elif ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     if (canUseJIT) {
         // If the JIT is present, don't use jump destinations for opcodes.
-        
         for (int i = 0; i < numOpcodeIDs; ++i) {
             Opcode opcode = bitwise_cast<void*>(static_cast<uintptr_t>(i));
             m_opcodeTable[i] = opcode;
@@ -592,13 +317,16 @@ void Interpreter::initialize(LLInt::Data* llintData, bool canUseJIT)
         
         m_classicEnabled = true;
     }
-#else
+#endif // ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
+
+#else // !ENABLE(COMPUTED_GOTO_OPCODES)
 #if ENABLE(CLASSIC_INTERPRETER)
     m_classicEnabled = true;
 #else
     m_classicEnabled = false;
 #endif
-#endif // ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
+#endif // !ENABLE(COMPUTED_GOTO_OPCODES)
+
 #if !ASSERT_DISABLED
     m_initialized = true;
 #endif
@@ -638,7 +366,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
     while (it < end) {
         JSValue v = it->jsValue();
         int registerNumber = it - callFrame->registers();
-        UString name = codeBlock->nameForRegister(registerNumber);
+        String name = codeBlock->nameForRegister(registerNumber);
 #if USE(JSVALUE32_64)
         dataLog("[r% 3d %14s]      | %10p | %-16s 0x%llx \n", registerNumber, name.ascii().data(), it, v.description(), JSValue::encode(v));
 #else
@@ -654,7 +382,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
     ++it;
     dataLog("[Callee]                   | %10p | %p \n", it, callFrame->callee());
     ++it;
-    dataLog("[ScopeChain]               | %10p | %p \n", it, callFrame->scopeChain());
+    dataLog("[ScopeChain]               | %10p | %p \n", it, callFrame->scope());
     ++it;
 #if ENABLE(JIT)
     AbstractPC pc = callFrame->abstractReturnPC(callFrame->globalData());
@@ -677,7 +405,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
         do {
             JSValue v = it->jsValue();
             int registerNumber = it - callFrame->registers();
-            UString name = codeBlock->nameForRegister(registerNumber);
+            String name = codeBlock->nameForRegister(registerNumber);
 #if USE(JSVALUE32_64)
             dataLog("[r% 3d %14s]      | %10p | %-16s 0x%llx \n", registerNumber, name.ascii().data(), it, v.description(), JSValue::encode(v));
 #else
@@ -709,7 +437,7 @@ void Interpreter::dumpRegisters(CallFrame* callFrame)
 
 bool Interpreter::isOpcode(Opcode opcode)
 {
-#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
+#if ENABLE(COMPUTED_GOTO_OPCODES)
 #if !ENABLE(LLINT)
     if (!m_classicEnabled)
         return static_cast<OpcodeID>(bitwise_cast<uintptr_t>(opcode)) <= op_end;
@@ -725,7 +453,7 @@ bool Interpreter::isOpcode(Opcode opcode)
 NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
 {
     CodeBlock* oldCodeBlock = codeBlock;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
+    JSScope* scope = callFrame->scope();
 
     if (Debugger* debugger = callFrame->dynamicGlobalObject()->debugger()) {
         DebuggerCallFrame debuggerCallFrame(callFrame, exceptionValue);
@@ -739,14 +467,14 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
     if (oldCodeBlock->codeType() == FunctionCode && oldCodeBlock->needsFullScopeChain()) {
         if (!callFrame->uncheckedR(oldCodeBlock->activationRegister()).jsValue()) {
             oldCodeBlock->createActivation(callFrame);
-            scopeChain = callFrame->scopeChain();
+            scope = callFrame->scope();
         }
-        while (!scopeChain->object->inherits(&JSActivation::s_info))
-            scopeChain = scopeChain->pop();
+        while (!scope->inherits(&JSActivation::s_info))
+            scope = scope->next();
 
-        callFrame->setScopeChain(scopeChain);
-        JSActivation* activation = asActivation(scopeChain->object.get());
-        activation->tearOff(*scopeChain->globalData);
+        callFrame->setScope(scope);
+        JSActivation* activation = asActivation(scope);
+        activation->tearOff(*scope->globalData());
         if (JSValue arguments = callFrame->uncheckedR(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue())
             asArguments(arguments)->didTearOffActivation(callFrame->globalData(), activation);
     } else if (oldCodeBlock->usesArguments() && !oldCodeBlock->isStrictMode()) {
@@ -773,7 +501,7 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
         bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
     else
         bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnVPC()) - 1;
-#elif ENABLE(JIT)
+#elif ENABLE(JIT) || ENABLE(LLINT)
     bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
 #else
     bytecodeOffset = codeBlock->bytecodeOffset(callFrame->returnVPC()) - 1;
@@ -808,10 +536,10 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
     if (!jsMessage || !jsMessage.isString())
         return;
 
-    UString message = asString(jsMessage)->value(callFrame);
+    String message = asString(jsMessage)->value(callFrame);
 
     if (expressionStart < expressionStop)
-        message =  makeUString(message, " (evaluating '", codeBlock->source()->getRange(expressionStart, expressionStop), "')");
+        message =  makeString(message, " (evaluating '", codeBlock->source()->getRange(expressionStart, expressionStop), "')");
     else {
         // No range information, so give a few characters of context
         const StringImpl* data = codeBlock->source()->data();
@@ -828,7 +556,7 @@ static void appendSourceToError(CallFrame* callFrame, ErrorInstance* exception,
             stop++;
         while (stop > expressionStart && isStrWhiteSpace((*data)[stop - 1]))
             stop--;
-        message = makeUString(message, " (near '...", codeBlock->source()->getRange(start, stop), "...')");
+        message = makeString(message, " (near '...", codeBlock->source()->getRange(start, stop), "...')");
     }
 
     exception->putDirect(*globalData, globalData->propertyNames->message, jsString(globalData, message));
@@ -845,7 +573,7 @@ static int getLineNumberForCallFrame(JSGlobalData* globalData, CallFrame* callFr
     if (!globalData->canUseJIT())
         return codeBlock->lineNumberForBytecodeOffset(callFrame->bytecodeOffsetForNonDFGCode() - 1);
 #endif
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
 #if ENABLE(DFG_JIT)
     if (codeBlock->getJITType() == JITCode::DFGJIT)
         return codeBlock->lineNumberForBytecodeOffset(codeBlock->codeOrigin(callFrame->codeOriginIndexForDFG()).bytecodeIndex);
@@ -871,7 +599,7 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
     
     CodeBlock* callerCodeBlock = callerFrame->codeBlock();
     
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
     if (!callFrame->hasReturnPC())
         callframeIsHost = true;
 #endif
@@ -890,7 +618,7 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
             return callerFrame;
         }
 #endif
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
 #if ENABLE(DFG_JIT)
         if (callerCodeBlock && callerCodeBlock->getJITType() == JITCode::DFGJIT) {
             unsigned codeOriginIndex = callerFrame->codeOriginIndexForDFG();
@@ -907,7 +635,7 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
             return callerFrame;
         }
 #endif
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
     #if ENABLE(DFG_JIT)
         if (callFrame->isInlineCallFrame()) {
             InlineCallFrame* icf = callFrame->inlineCallFrame();
@@ -941,7 +669,7 @@ static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame,
     return callerFrame;
 }
 
-static ALWAYS_INLINE const UString getSourceURLFromCallFrame(CallFrame* callFrame) 
+static ALWAYS_INLINE const String getSourceURLFromCallFrame(CallFrame* callFrame)
 {
     ASSERT(!callFrame->hasHostCallFrameFlag());
 #if ENABLE(CLASSIC_INTERPRETER)
@@ -982,13 +710,13 @@ void Interpreter::getStackTrace(JSGlobalData* globalData, Vector<StackFrame>& re
     callFrame = callFrame->trueCallFrameFromVMCode();
 
     while (callFrame && callFrame != CallFrame::noCaller()) {
-        UString sourceURL;
+        String sourceURL;
         if (callFrame->codeBlock()) {
             sourceURL = getSourceURLFromCallFrame(callFrame);
             StackFrame s = { Strong<JSObject>(*globalData, callFrame->callee()), getStackFrameCodeType(callFrame), Strong<ExecutableBase>(*globalData, callFrame->codeBlock()->ownerExecutable()), line, sourceURL};
             results.append(s);
         } else {
-            StackFrame s = { Strong<JSObject>(*globalData, callFrame->callee()), StackFrameNativeCode, Strong<ExecutableBase>(), -1, UString()};
+            StackFrame s = { Strong<JSObject>(*globalData, callFrame->callee()), StackFrameNativeCode, Strong<ExecutableBase>(), -1, String()};
             results.append(s);
         }
         unsigned unusedBytecodeOffset = 0;
@@ -1014,6 +742,8 @@ void Interpreter::addStackTraceIfNecessary(CallFrame* callFrame, JSObject* error
         globalObject = globalData->dynamicGlobalObject;
     else
         globalObject = error->globalObject();
+
+    // FIXME: JSStringJoiner could be more efficient than StringBuilder here.
     StringBuilder builder;
     for (unsigned i = 0; i < stackTrace.size(); i++) {
         builder.append(String(stackTrace[i].toString(globalObject->globalExec()).impl()));
@@ -1021,7 +751,7 @@ void Interpreter::addStackTraceIfNecessary(CallFrame* callFrame, JSObject* error
             builder.append('\n');
     }
     
-    error->putDirect(*globalData, globalData->propertyNames->stack, jsString(globalData, UString(builder.toString().impl())), ReadOnly | DontDelete);
+    error->putDirect(*globalData, globalData->propertyNames->stack, jsString(globalData, builder.toString()), ReadOnly | DontDelete);
 }
 
 NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValue& exceptionValue, unsigned bytecodeOffset)
@@ -1085,15 +815,15 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     m_registerFile.shrink(highWaterMark);
 
     // Unwind the scope chain within the exception handler's call frame.
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
+    JSScope* scope = callFrame->scope();
     int scopeDelta = 0;
     if (!codeBlock->needsFullScopeChain() || codeBlock->codeType() != FunctionCode 
         || callFrame->uncheckedR(codeBlock->activationRegister()).jsValue())
-        scopeDelta = depth(codeBlock, scopeChain) - handler->scopeDepth;
+        scopeDelta = depth(codeBlock, scope) - handler->scopeDepth;
     ASSERT(scopeDelta >= 0);
     while (scopeDelta--)
-        scopeChain = scopeChain->pop();
-    callFrame->setScopeChain(scopeChain);
+        scope = scope->next();
+    callFrame->setScope(scope);
 
     return handler;
 }
@@ -1110,10 +840,11 @@ static inline JSObject* checkedReturn(JSObject* returnValue)
     return returnValue;
 }
 
-JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj)
+JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, JSObject* thisObj)
 {
+    JSScope* scope = callFrame->scope();
     ASSERT(isValidThisObject(thisObj, callFrame));
-    ASSERT(!scopeChain->globalData->exception);
+    ASSERT(!scope->globalData()->exception);
     ASSERT(!callFrame->globalData().isCollectorBusy());
     if (callFrame->globalData().isCollectorBusy())
         CRASH();
@@ -1121,22 +852,25 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
     if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
         return checkedReturn(throwStackOverflowError(callFrame));
 
-    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+    // First check if the "program" is actually just a JSON object. If so,
+    // we'll handle the JSON object here. Else, we'll handle real JS code
+    // below at failedJSONP.
+    DynamicGlobalObjectScope globalObjectScope(*scope->globalData(), scope->globalObject());
     Vector<JSONPData> JSONPData;
     bool parseResult;
-    const UString programSource = program->source().toString();
+    const String programSource = program->source().toString();
     if (programSource.isNull())
         return jsUndefined();
     if (programSource.is8Bit()) {
         LiteralParser<LChar> literalParser(callFrame, programSource.characters8(), programSource.length(), JSONP);
-        parseResult = literalParser.tryJSONPParse(JSONPData, scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()));
+        parseResult = literalParser.tryJSONPParse(JSONPData, scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()));
     } else {
         LiteralParser<UChar> literalParser(callFrame, programSource.characters16(), programSource.length(), JSONP);
-        parseResult = literalParser.tryJSONPParse(JSONPData, scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()));
+        parseResult = literalParser.tryJSONPParse(JSONPData, scope->globalObject()->globalObjectMethodTable()->supportsRichSourceInfo(scope->globalObject()));
     }
 
     if (parseResult) {
-        JSGlobalObject* globalObject = scopeChain->globalObject.get();
+        JSGlobalObject* globalObject = scope->globalObject();
         JSValue result;
         for (unsigned entry = 0; entry < JSONPData.size(); entry++) {
             Vector<JSONPPathEntry> JSONPPath;
@@ -1221,36 +955,47 @@ JSValue Interpreter::execute(ProgramExecutable* program, CallFrame* callFrame, S
         return result;
     }
 failedJSONP:
-    JSObject* error = program->compile(callFrame, scopeChain);
+    // If we get here, then we have already proven that the script is not a JSON
+    // object.
+
+    // Compile source to bytecode if necessary:
+    JSObject* error = program->compile(callFrame, scope);
     if (error)
         return checkedReturn(throwError(callFrame, error));
     CodeBlock* codeBlock = &program->generatedBytecode();
 
+    // Reserve stack space for this invocation:
     Register* oldEnd = m_registerFile.end();
     Register* newEnd = oldEnd + codeBlock->numParameters() + RegisterFile::CallFrameHeaderSize + codeBlock->m_numCalleeRegisters;
     if (!m_registerFile.grow(newEnd))
         return checkedReturn(throwStackOverflowError(callFrame));
 
+    // Push the call frame for this invocation:
     CallFrame* newCallFrame = CallFrame::create(oldEnd + codeBlock->numParameters() + RegisterFile::CallFrameHeaderSize);
     ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
-    newCallFrame->init(codeBlock, 0, scopeChain, CallFrame::noCaller(), codeBlock->numParameters(), 0);
+    newCallFrame->init(codeBlock, 0, scope, CallFrame::noCaller(), codeBlock->numParameters(), 0);
     newCallFrame->setThisValue(thisObj);
     TopCallFrameSetter topCallFrame(callFrame->globalData(), newCallFrame);
 
     if (Profiler* profiler = callFrame->globalData().enabledProfiler())
         profiler->willExecute(callFrame, program->sourceURL(), program->lineNo());
 
+    // Execute the code:
     JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler.get());
 
         m_reentryDepth++;  
+#if ENABLE(LLINT_C_LOOP)
+        result = LLInt::CLoop::execute(newCallFrame, llint_program_prologue);
+#else // !ENABLE(LLINT_C_LOOP)
 #if ENABLE(JIT)
         if (!classicEnabled())
-            result = program->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData);
+            result = program->generatedJITCode().execute(&m_registerFile, newCallFrame, scope->globalData());
         else
-#endif
+#endif // ENABLE(JIT)
             result = privateExecute(Normal, &m_registerFile, newCallFrame);
+#endif // !ENABLE(LLINT_C_LOOP)
 
         m_reentryDepth--;
     }
@@ -1275,7 +1020,7 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
         return checkedReturn(throwStackOverflowError(callFrame));
 
     Register* oldEnd = m_registerFile.end();
-    ASSERT(callFrame->frameExtent() <= oldEnd || callFrame == callFrame->scopeChain()->globalObject->globalExec());
+    ASSERT(callFrame->frameExtent() <= oldEnd || callFrame == callFrame->scope()->globalObject()->globalExec());
     int argCount = 1 + args.size(); // implicit "this" parameter
     size_t registerOffset = argCount + RegisterFile::CallFrameHeaderSize;
 
@@ -1288,11 +1033,11 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
         newCallFrame->setArgument(i, args.at(i));
 
     if (callType == CallTypeJS) {
-        ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
+        JSScope* callDataScope = callData.js.scope;
 
-        DynamicGlobalObjectScope globalObjectScope(*callDataScopeChain->globalData, callDataScopeChain->globalObject.get());
+        DynamicGlobalObjectScope globalObjectScope(*callDataScope->globalData(), callDataScope->globalObject());
 
-        JSObject* compileError = callData.js.functionExecutable->compileForCall(callFrame, callDataScopeChain);
+        JSObject* compileError = callData.js.functionExecutable->compileForCall(callFrame, callDataScope);
         if (UNLIKELY(!!compileError)) {
             m_registerFile.shrink(oldEnd);
             return checkedReturn(throwError(callFrame, compileError));
@@ -1305,7 +1050,7 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
             return checkedReturn(throwStackOverflowError(callFrame));
         }
 
-        newCallFrame->init(newCodeBlock, 0, callDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
+        newCallFrame->init(newCodeBlock, 0, callDataScope, callFrame->addHostCallFrameFlag(), argCount, function);
 
         TopCallFrameSetter topCallFrame(callFrame->globalData(), newCallFrame);
 
@@ -1317,12 +1062,17 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
             SamplingTool::CallRecord callRecord(m_sampler.get());
 
             m_reentryDepth++;  
+#if ENABLE(LLINT_C_LOOP)
+            result = LLInt::CLoop::execute(newCallFrame, llint_function_for_call_prologue);
+#else // ENABLE(LLINT_C_LOOP)
 #if ENABLE(JIT)
             if (!classicEnabled())
-                result = callData.js.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, newCallFrame, callDataScopeChain->globalData);
+                result = callData.js.functionExecutable->generatedJITCodeForCall().execute(&m_registerFile, newCallFrame, callDataScope->globalData());
             else
-#endif
+#endif // ENABLE(JIT)
                 result = privateExecute(Normal, &m_registerFile, newCallFrame);
+#endif // !ENABLE(LLINT_C_LOOP)
+
             m_reentryDepth--;
         }
 
@@ -1334,12 +1084,12 @@ JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallT
     }
 
     ASSERT(callType == CallTypeHost);
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    newCallFrame->init(0, 0, scopeChain, callFrame->addHostCallFrameFlag(), argCount, function);
+    JSScope* scope = callFrame->scope();
+    newCallFrame->init(0, 0, scope, callFrame->addHostCallFrameFlag(), argCount, function);
 
     TopCallFrameSetter topCallFrame(callFrame->globalData(), newCallFrame);
 
-    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+    DynamicGlobalObjectScope globalObjectScope(*scope->globalData(), scope->globalObject());
 
     if (Profiler* profiler = callFrame->globalData().enabledProfiler())
         profiler->willExecute(callFrame, function);
@@ -1382,11 +1132,11 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
         newCallFrame->setArgument(i, args.at(i));
 
     if (constructType == ConstructTypeJS) {
-        ScopeChainNode* constructDataScopeChain = constructData.js.scopeChain;
+        JSScope* constructDataScope = constructData.js.scope;
 
-        DynamicGlobalObjectScope globalObjectScope(*constructDataScopeChain->globalData, constructDataScopeChain->globalObject.get());
+        DynamicGlobalObjectScope globalObjectScope(*constructDataScope->globalData(), constructDataScope->globalObject());
 
-        JSObject* compileError = constructData.js.functionExecutable->compileForConstruct(callFrame, constructDataScopeChain);
+        JSObject* compileError = constructData.js.functionExecutable->compileForConstruct(callFrame, constructDataScope);
         if (UNLIKELY(!!compileError)) {
             m_registerFile.shrink(oldEnd);
             return checkedReturn(throwError(callFrame, compileError));
@@ -1399,7 +1149,7 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
             return checkedReturn(throwStackOverflowError(callFrame));
         }
 
-        newCallFrame->init(newCodeBlock, 0, constructDataScopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
+        newCallFrame->init(newCodeBlock, 0, constructDataScope, callFrame->addHostCallFrameFlag(), argCount, constructor);
 
         TopCallFrameSetter topCallFrame(callFrame->globalData(), newCallFrame);
 
@@ -1411,12 +1161,16 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
             SamplingTool::CallRecord callRecord(m_sampler.get());
 
             m_reentryDepth++;  
+#if ENABLE(LLINT_C_LOOP)
+            result = LLInt::CLoop::execute(newCallFrame, llint_function_for_construct_prologue);
+#else // !ENABLE(LLINT_C_LOOP)
 #if ENABLE(JIT)
             if (!classicEnabled())
-                result = constructData.js.functionExecutable->generatedJITCodeForConstruct().execute(&m_registerFile, newCallFrame, constructDataScopeChain->globalData);
+                result = constructData.js.functionExecutable->generatedJITCodeForConstruct().execute(&m_registerFile, newCallFrame, constructDataScope->globalData());
             else
-#endif
+#endif // ENABLE(JIT)
                 result = privateExecute(Normal, &m_registerFile, newCallFrame);
+#endif // !ENABLE(LLINT_C_LOOP)
             m_reentryDepth--;
         }
 
@@ -1431,12 +1185,12 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     }
 
     ASSERT(constructType == ConstructTypeHost);
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    newCallFrame->init(0, 0, scopeChain, callFrame->addHostCallFrameFlag(), argCount, constructor);
+    JSScope* scope = callFrame->scope();
+    newCallFrame->init(0, 0, scope, callFrame->addHostCallFrameFlag(), argCount, constructor);
 
     TopCallFrameSetter topCallFrame(callFrame->globalData(), newCallFrame);
 
-    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+    DynamicGlobalObjectScope globalObjectScope(*scope->globalData(), scope->globalObject());
 
     if (Profiler* profiler = callFrame->globalData().enabledProfiler())
         profiler->willExecute(callFrame, constructor);
@@ -1457,9 +1211,9 @@ JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* construc
     return checkedReturn(asObject(result));
 }
 
-CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, JSFunction* function, int argumentCountIncludingThis, ScopeChainNode* scopeChain)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope)
 {
-    ASSERT(!scopeChain->globalData->exception);
+    ASSERT(!scope->globalData()->exception);
     
     if (callFrame->globalData().isCollectorBusy())
         return CallFrameClosure();
@@ -1478,7 +1232,7 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionE
         return CallFrameClosure();
     }
 
-    JSObject* error = functionExecutable->compileForCall(callFrame, scopeChain);
+    JSObject* error = functionExecutable->compileForCall(callFrame, scope);
     if (error) {
         throwError(callFrame, error);
         m_registerFile.shrink(oldEnd);
@@ -1492,9 +1246,9 @@ CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionE
         m_registerFile.shrink(oldEnd);
         return CallFrameClosure();
     }
-    newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), argumentCountIncludingThis, function);  
-    scopeChain->globalData->topCallFrame = newCallFrame;
-    CallFrameClosure result = { callFrame, newCallFrame, function, functionExecutable, scopeChain->globalData, oldEnd, scopeChain, codeBlock->numParameters(), argumentCountIncludingThis };
+    newCallFrame->init(codeBlock, 0, scope, callFrame->addHostCallFrameFlag(), argumentCountIncludingThis, function);  
+    scope->globalData()->topCallFrame = newCallFrame;
+    CallFrameClosure result = { callFrame, newCallFrame, function, functionExecutable, scope->globalData(), oldEnd, scope, codeBlock->numParameters(), argumentCountIncludingThis };
     return result;
 }
 
@@ -1514,6 +1268,9 @@ JSValue Interpreter::execute(CallFrameClosure& closure)
         SamplingTool::CallRecord callRecord(m_sampler.get());
         
         m_reentryDepth++;  
+#if ENABLE(LLINT_C_LOOP)
+        result = LLInt::CLoop::execute(closure.newCallFrame, llint_function_for_call_prologue);
+#else // !ENABLE(LLINT_C_LOOP)
 #if ENABLE(JIT)
 #if ENABLE(CLASSIC_INTERPRETER)
         if (closure.newCallFrame->globalData().canUseJIT())
@@ -1522,10 +1279,12 @@ JSValue Interpreter::execute(CallFrameClosure& closure)
 #if ENABLE(CLASSIC_INTERPRETER)
         else
 #endif
-#endif
+#endif // ENABLE(JIT)
 #if ENABLE(CLASSIC_INTERPRETER)
             result = privateExecute(Normal, &m_registerFile, closure.newCallFrame);
 #endif
+#endif // !ENABLE(LLINT_C_LOOP)
+
         m_reentryDepth--;
     }
 
@@ -1540,41 +1299,39 @@ void Interpreter::endRepeatCall(CallFrameClosure& closure)
     m_registerFile.shrink(closure.oldEnd);
 }
 
-JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue thisValue, ScopeChainNode* scopeChain, int globalRegisterOffset)
+JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue thisValue, JSScope* scope, int globalRegisterOffset)
 {
     ASSERT(isValidThisObject(thisValue, callFrame));
-    ASSERT(!scopeChain->globalData->exception);
+    ASSERT(!scope->globalData()->exception);
     ASSERT(!callFrame->globalData().isCollectorBusy());
     if (callFrame->globalData().isCollectorBusy())
         return jsNull();
 
-    DynamicGlobalObjectScope globalObjectScope(*scopeChain->globalData, scopeChain->globalObject.get());
+    DynamicGlobalObjectScope globalObjectScope(*scope->globalData(), scope->globalObject());
 
     if (m_reentryDepth >= MaxSmallThreadReentryDepth && m_reentryDepth >= callFrame->globalData().maxReentryDepth)
         return checkedReturn(throwStackOverflowError(callFrame));
 
-    JSObject* compileError = eval->compile(callFrame, scopeChain);
+    JSObject* compileError = eval->compile(callFrame, scope);
     if (UNLIKELY(!!compileError))
         return checkedReturn(throwError(callFrame, compileError));
     EvalCodeBlock* codeBlock = &eval->generatedBytecode();
 
     JSObject* variableObject;
-    for (ScopeChainNode* node = scopeChain; ; node = node->next.get()) {
+    for (JSScope* node = scope; ; node = node->next()) {
         ASSERT(node);
-        if (node->object->isVariableObject() && !node->object->isStaticScopeObject()) {
-            variableObject = jsCast<JSSymbolTableObject*>(node->object.get());
+        if (node->isVariableObject() && !node->isNameScopeObject()) {
+            variableObject = node;
             break;
         }
     }
 
     unsigned numVariables = codeBlock->numVariables();
     int numFunctions = codeBlock->numberOfFunctionDecls();
-    bool pushedScope = false;
     if (numVariables || numFunctions) {
         if (codeBlock->isStrictMode()) {
-            variableObject = StrictEvalActivation::create(callFrame);
-            scopeChain = scopeChain->push(variableObject);
-            pushedScope = true;
+            scope = StrictEvalActivation::create(callFrame);
+            variableObject = scope;
         }
         // Scope for BatchedTransitionOptimizer
         BatchedTransitionOptimizer optimizer(callFrame->globalData(), variableObject);
@@ -1590,22 +1347,19 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue
         for (int i = 0; i < numFunctions; ++i) {
             FunctionExecutable* function = codeBlock->functionDecl(i);
             PutPropertySlot slot;
-            variableObject->methodTable()->put(variableObject, callFrame, function->name(), function->make(callFrame, scopeChain), slot);
+            variableObject->methodTable()->put(variableObject, callFrame, function->name(), JSFunction::create(callFrame, function, scope), slot);
         }
     }
 
     Register* oldEnd = m_registerFile.end();
     Register* newEnd = m_registerFile.begin() + globalRegisterOffset + codeBlock->m_numCalleeRegisters;
-    if (!m_registerFile.grow(newEnd)) {
-        if (pushedScope)
-            scopeChain->pop();
+    if (!m_registerFile.grow(newEnd))
         return checkedReturn(throwStackOverflowError(callFrame));
-    }
 
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.begin() + globalRegisterOffset);
 
     ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
-    newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), codeBlock->numParameters(), 0);
+    newCallFrame->init(codeBlock, 0, scope, callFrame->addHostCallFrameFlag(), codeBlock->numParameters(), 0);
     newCallFrame->setThisValue(thisValue);
 
     TopCallFrameSetter topCallFrame(callFrame->globalData(), newCallFrame);
@@ -1619,18 +1373,22 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue
 
         m_reentryDepth++;
         
+#if ENABLE(LLINT_C_LOOP)
+        result = LLInt::CLoop::execute(newCallFrame, llint_eval_prologue);
+#else // !ENABLE(LLINT_C_LOOP)
 #if ENABLE(JIT)
 #if ENABLE(CLASSIC_INTERPRETER)
         if (callFrame->globalData().canUseJIT())
 #endif
-            result = eval->generatedJITCode().execute(&m_registerFile, newCallFrame, scopeChain->globalData);
+            result = eval->generatedJITCode().execute(&m_registerFile, newCallFrame, scope->globalData());
 #if ENABLE(CLASSIC_INTERPRETER)
         else
 #endif
-#endif
+#endif // ENABLE(JIT)
 #if ENABLE(CLASSIC_INTERPRETER)
             result = privateExecute(Normal, &m_registerFile, newCallFrame);
 #endif
+#endif // !ENABLE(LLINT_C_LOOP)
         m_reentryDepth--;
     }
 
@@ -1638,8 +1396,6 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue
         profiler->didExecute(callFrame, eval->sourceURL(), eval->lineNo());
 
     m_registerFile.shrink(oldEnd);
-    if (pushedScope)
-        scopeChain->pop();
     return checkedReturn(result);
 }
 
@@ -1672,16 +1428,14 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 }
     
 #if ENABLE(CLASSIC_INTERPRETER)
-NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
+NEVER_INLINE JSScope* Interpreter::createNameScope(CallFrame* callFrame, const Instruction* vPC)
 {
-    int dst = vPC[1].u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& property = codeBlock->identifier(vPC[2].u.operand);
-    JSValue value = callFrame->r(vPC[3].u.operand).jsValue();
-    JSObject* scope = JSStaticScopeObject::create(callFrame, property, value, DontDelete);
-    callFrame->uncheckedR(dst) = JSValue(scope);
-
-    return callFrame->scopeChain()->push(scope);
+    Identifier& property = codeBlock->identifier(vPC[1].u.operand);
+    JSValue value = callFrame->r(vPC[2].u.operand).jsValue();
+    unsigned attributes = vPC[3].u.operand;
+    JSNameScope* scope = JSNameScope::create(callFrame, property, value, attributes);
+    return scope;
 }
 
 NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const PutPropertySlot& slot)
@@ -1906,6 +1660,8 @@ NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock*, Instruction* vPC)
 
 #endif // ENABLE(CLASSIC_INTERPRETER)
 
+#if !ENABLE(LLINT_C_LOOP)
+
 JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame)
 {
     // One-time initialization of our address tables. We have to put this code
@@ -1991,9 +1747,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             UPDATE_BYTECODE_OFFSET();
 #else
     #define DEFINE_OPCODE(opcode) opcode: UPDATE_BYTECODE_OFFSET();
-#endif
+#endif // !ENABLE(OPCODE_STATS)
     NEXT_INSTRUCTION();
-#else
+#else // !ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     #define NEXT_INSTRUCTION() SAMPLE(codeBlock, vPC); goto interpreterLoopStart
 #if ENABLE(OPCODE_STATS)
     #define DEFINE_OPCODE(opcode) \
@@ -2006,7 +1762,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
     while (1) { // iterator loop begins
     interpreterLoopStart:;
     switch (vPC->u.opcode)
-#endif
+#endif // !ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
     {
     DEFINE_OPCODE(op_new_object) {
         /* new_object dst(r)
@@ -2064,7 +1820,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             exceptionValue = createSyntaxError(callFrame, "Invalid flags supplied to RegExp constructor.");
             goto vm_throw;
         }
-        callFrame->uncheckedR(dst) = JSValue(RegExpObject::create(*globalData, callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), regExp));
+        callFrame->uncheckedR(dst) = JSValue(RegExpObject::create(*globalData, callFrame->lexicalGlobalObject(), callFrame->scope()->globalObject()->regExpStructure(), regExp));
 
         vPC += OPCODE_LENGTH(op_new_regexp);
         NEXT_INSTRUCTION();
@@ -2825,8 +2581,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            scope chain, and writes the resulting value to register
            dst. If the property is not found, raises an exception.
         */
-        if (UNLIKELY(!resolve(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+        JSValue result = JSScope::resolve(callFrame, ident);
+        CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(dst) = result;
 
         vPC += OPCODE_LENGTH(op_resolve);
         NEXT_INSTRUCTION();
@@ -2838,11 +2599,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          scope chain skipping the top 'skip' levels, and writes the resulting
          value to register dst. If the property is not found, raises an exception.
          */
-        if (UNLIKELY(!resolveSkip(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int skip = vPC[3].u.operand;
+        Identifier& ident = callFrame->codeBlock()->identifier(property);
 
-        vPC += OPCODE_LENGTH(op_resolve_skip);
+        JSValue result = JSScope::resolveSkip(callFrame, ident, skip);
+        CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(dst) = result;
 
+        vPC += OPCODE_LENGTH(op_resolve_skip);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_global) {
@@ -2853,11 +2619,21 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            a fast lookup using the case offset, otherwise fall back to a full resolve and
            cache the new structure and offset
          */
-        if (UNLIKELY(!resolveGlobal(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
-        
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+        JSValue result = JSScope::resolveGlobal(
+            callFrame,
+            ident,
+            callFrame->lexicalGlobalObject(),
+            &vPC[3].u.structure,
+            &vPC[4].u.operand
+        );
+        CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(dst) = result;
+
         vPC += OPCODE_LENGTH(op_resolve_global);
-        
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_global_dynamic) {
@@ -2871,11 +2647,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          This walks through n levels of the scope chain to verify that none of those levels
          in the scope chain include dynamically added properties.
          */
-        if (UNLIKELY(!resolveGlobalDynamic(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
-        
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int skip = vPC[5].u.operand;
+        Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+        JSValue result = JSScope::resolveGlobalDynamic(callFrame, ident, skip, &vPC[3].u.structure, &vPC[4].u.operand);
+        CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(dst) = result;
+
         vPC += OPCODE_LENGTH(op_resolve_global_dynamic);
-        
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_global_var) {
@@ -2942,9 +2723,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int index = vPC[2].u.operand;
         int skip = vPC[3].u.operand;
 
-        ScopeChainNode* scopeChain = callFrame->scopeChain();
-        ScopeChainIterator iter = scopeChain->begin();
-        ScopeChainIterator end = scopeChain->end();
+        JSScope* scope = callFrame->scope();
+        ScopeChainIterator iter = scope->begin();
+        ScopeChainIterator end = scope->end();
         ASSERT_UNUSED(end, iter != end);
         ASSERT(codeBlock == callFrame->codeBlock());
         bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
@@ -2957,9 +2738,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ++iter;
             ASSERT_UNUSED(end, iter != end);
         }
-        ASSERT((*iter)->isVariableObject());
-        JSVariableObject* scope = jsCast<JSVariableObject*>(iter->get());
-        callFrame->uncheckedR(dst) = scope->registerAt(index).get();
+        ASSERT(iter->isVariableObject());
+        JSVariableObject* variableObject = jsCast<JSVariableObject*>(iter.get());
+        callFrame->uncheckedR(dst) = variableObject->registerAt(index).get();
         ASSERT(callFrame->r(dst).jsValue());
         vPC += OPCODE_LENGTH(op_get_scoped_var);
         NEXT_INSTRUCTION();
@@ -2972,9 +2753,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         int skip = vPC[2].u.operand;
         int value = vPC[3].u.operand;
 
-        ScopeChainNode* scopeChain = callFrame->scopeChain();
-        ScopeChainIterator iter = scopeChain->begin();
-        ScopeChainIterator end = scopeChain->end();
+        JSScope* scope = callFrame->scope();
+        ScopeChainIterator iter = scope->begin();
+        ScopeChainIterator end = scope->end();
         ASSERT(codeBlock == callFrame->codeBlock());
         ASSERT_UNUSED(end, iter != end);
         bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
@@ -2988,10 +2769,10 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ASSERT_UNUSED(end, iter != end);
         }
 
-        ASSERT((*iter)->isVariableObject());
-        JSVariableObject* scope = jsCast<JSVariableObject*>(iter->get());
+        ASSERT(iter->isVariableObject());
+        JSVariableObject* variableObject = jsCast<JSVariableObject*>(iter.get());
         ASSERT(callFrame->r(value).jsValue());
-        scope->registerAt(index).set(*globalData, scope, callFrame->r(value).jsValue());
+        variableObject->registerAt(index).set(*globalData, variableObject, callFrame->r(value).jsValue());
         vPC += OPCODE_LENGTH(op_put_scoped_var);
         NEXT_INSTRUCTION();
     }
@@ -3004,8 +2785,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            outermost scope (which will be the global object) is
            stored in register dst.
         */
-        resolveBase(callFrame, vPC);
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        bool isStrict = vPC[3].u.operand;
+        Identifier& ident = callFrame->codeBlock()->identifier(property);
+
+        JSValue result = JSScope::resolveBase(callFrame, ident, isStrict);
         CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(dst) = result;
 
         vPC += OPCODE_LENGTH(op_resolve_base);
         NEXT_INSTRUCTION();
@@ -3023,7 +2810,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSObject* baseObject = asObject(baseVal);
         PropertySlot slot(baseVal);
         if (!baseObject->getPropertySlot(callFrame, ident, slot)) {
-            exceptionValue = createErrorForInvalidGlobalAssignment(callFrame, ident.ustring());
+            exceptionValue = createErrorForInvalidGlobalAssignment(callFrame, ident.string());
             goto vm_throw;
         }
 
@@ -3042,8 +2829,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            resolve, or resolve_base followed by get_by_id, as it
            avoids duplicate hash lookups.
         */
-        if (UNLIKELY(!resolveBaseAndProperty(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
+        int baseDst = vPC[1].u.operand;
+        int propDst = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
+        Identifier& ident = codeBlock->identifier(property);
+
+        JSValue prop = JSScope::resolveWithBase(callFrame, ident, &callFrame->uncheckedR(baseDst));
+        CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(propDst) = prop;
 
         vPC += OPCODE_LENGTH(op_resolve_with_base);
         NEXT_INSTRUCTION();
@@ -3058,8 +2851,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            If the property is not found, raises an exception.
         */
-        if (UNLIKELY(!resolveThisAndProperty(callFrame, vPC, exceptionValue)))
-            goto vm_throw;
+        int thisDst = vPC[1].u.operand;
+        int propDst = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
+        Identifier& ident = codeBlock->identifier(property);
+
+        JSValue prop = JSScope::resolveWithThis(callFrame, ident, &callFrame->uncheckedR(thisDst));
+        CHECK_FOR_EXCEPTION();
+        callFrame->uncheckedR(propDst) = prop;
 
         vPC += OPCODE_LENGTH(op_resolve_with_this);
         NEXT_INSTRUCTION();
@@ -3928,7 +3727,7 @@ skip_id_custom_self:
 
         JSValue arrayValue = callFrame->r(base).jsValue();
         ASSERT(isJSArray(arrayValue));
-        asArray(arrayValue)->putDirectIndex(callFrame, property, callFrame->r(value).jsValue(), false);
+        asArray(arrayValue)->putDirectIndex(callFrame, property, callFrame->r(value).jsValue());
 
         vPC += OPCODE_LENGTH(op_put_by_index);
         NEXT_INSTRUCTION();
@@ -4460,7 +4259,7 @@ skip_id_custom_self:
         int shouldCheck = vPC[3].u.operand;
         ASSERT(codeBlock->codeType() != FunctionCode || !codeBlock->needsFullScopeChain() || callFrame->r(codeBlock->activationRegister()).jsValue());
         if (!shouldCheck || !callFrame->r(dst).jsValue())
-            callFrame->uncheckedR(dst) = JSValue(codeBlock->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
+            callFrame->uncheckedR(dst) = JSValue(JSFunction::create(callFrame, codeBlock->functionDecl(func), callFrame->scope()));
 
         vPC += OPCODE_LENGTH(op_new_func);
         NEXT_INSTRUCTION();
@@ -4478,19 +4277,7 @@ skip_id_custom_self:
         
         ASSERT(codeBlock->codeType() != FunctionCode || !codeBlock->needsFullScopeChain() || callFrame->r(codeBlock->activationRegister()).jsValue());
         FunctionExecutable* function = codeBlock->functionExpr(funcIndex);
-        JSFunction* func = function->make(callFrame, callFrame->scopeChain());
-
-        /* 
-            The Identifier in a FunctionExpression can be referenced from inside
-            the FunctionExpression's FunctionBody to allow the function to call
-            itself recursively. However, unlike in a FunctionDeclaration, the
-            Identifier in a FunctionExpression cannot be referenced from and
-            does not affect the scope enclosing the FunctionExpression.
-         */
-        if (!function->name().isNull()) {
-            JSStaticScopeObject* functionScopeObject = JSStaticScopeObject::create(callFrame, function->name(), func, ReadOnly | DontDelete);
-            func->setScope(*globalData, func->scope()->push(functionScopeObject));
-        }
+        JSFunction* func = JSFunction::create(callFrame, function, callFrame->scope());
 
         callFrame->uncheckedR(dst) = JSValue(func);
 
@@ -4518,7 +4305,7 @@ skip_id_custom_self:
 
         if (isHostFunction(funcVal, globalFuncEval)) {
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
-            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_call_eval), callFrame->scopeChain(), callFrame, argCount, jsCast<JSFunction*>(funcVal));
+            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_call_eval), callFrame->scope(), callFrame, argCount, jsCast<JSFunction*>(funcVal));
 
             JSValue result = eval(newCallFrame);
             if ((exceptionValue = globalData->exception))
@@ -4554,9 +4341,9 @@ skip_id_custom_self:
         CallType callType = getCallData(v, callData);
 
         if (callType == CallTypeJS) {
-            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
+            JSScope* callDataScope = callData.js.scope;
 
-            JSObject* error = callData.js.functionExecutable->compileForCall(callFrame, callDataScopeChain);
+            JSObject* error = callData.js.functionExecutable->compileForCall(callFrame, callDataScope);
             if (UNLIKELY(!!error)) {
                 exceptionValue = error;
                 goto vm_throw;
@@ -4571,7 +4358,7 @@ skip_id_custom_self:
                 goto vm_throw;
             }
 
-            callFrame->init(newCodeBlock, vPC + OPCODE_LENGTH(op_call), callDataScopeChain, previousCallFrame, argCount, jsCast<JSFunction*>(v));
+            callFrame->init(newCodeBlock, vPC + OPCODE_LENGTH(op_call), callDataScope, previousCallFrame, argCount, jsCast<JSFunction*>(v));
             codeBlock = newCodeBlock;
             ASSERT(codeBlock == callFrame->codeBlock());
             *topCallFrameSlot = callFrame;
@@ -4585,9 +4372,9 @@ skip_id_custom_self:
         }
 
         if (callType == CallTypeHost) {
-            ScopeChainNode* scopeChain = callFrame->scopeChain();
+            JSScope* scope = callFrame->scope();
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
-            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_call), scopeChain, callFrame, argCount, asObject(v));
+            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_call), scope, callFrame, argCount, asObject(v));
             JSValue returnValue;
             {
                 *topCallFrameSlot = newCallFrame;
@@ -4634,9 +4421,9 @@ skip_id_custom_self:
         CallType callType = getCallData(v, callData);
         
         if (callType == CallTypeJS) {
-            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
+            JSScope* callDataScope = callData.js.scope;
 
-            JSObject* error = callData.js.functionExecutable->compileForCall(callFrame, callDataScopeChain);
+            JSObject* error = callData.js.functionExecutable->compileForCall(callFrame, callDataScope);
             if (UNLIKELY(!!error)) {
                 exceptionValue = error;
                 goto vm_throw;
@@ -4649,7 +4436,7 @@ skip_id_custom_self:
                 goto vm_throw;
             }
 
-            newCallFrame->init(newCodeBlock, vPC + OPCODE_LENGTH(op_call_varargs), callDataScopeChain, callFrame, argCount, jsCast<JSFunction*>(v));
+            newCallFrame->init(newCodeBlock, vPC + OPCODE_LENGTH(op_call_varargs), callDataScope, callFrame, argCount, jsCast<JSFunction*>(v));
             codeBlock = newCodeBlock;
             callFrame = newCallFrame;
             ASSERT(codeBlock == callFrame->codeBlock());
@@ -4664,8 +4451,8 @@ skip_id_custom_self:
         }
         
         if (callType == CallTypeHost) {
-            ScopeChainNode* scopeChain = callFrame->scopeChain();
-            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_call_varargs), scopeChain, callFrame, argCount, asObject(v));
+            JSScope* scope = callFrame->scope();
+            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_call_varargs), scope, callFrame, argCount, asObject(v));
             
             JSValue returnValue;
             {
@@ -4832,7 +4619,7 @@ skip_id_custom_self:
         if (!callFrame->r(activationReg).jsValue()) {
             JSActivation* activation = JSActivation::create(*globalData, callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
             callFrame->r(activationReg) = JSValue(activation);
-            callFrame->setScopeChain(callFrame->scopeChain()->push(activation));
+            callFrame->setScope(activation);
         }
         vPC += OPCODE_LENGTH(op_create_activation);
         NEXT_INSTRUCTION();
@@ -4936,9 +4723,9 @@ skip_id_custom_self:
         ConstructType constructType = getConstructData(v, constructData);
 
         if (constructType == ConstructTypeJS) {
-            ScopeChainNode* callDataScopeChain = constructData.js.scopeChain;
+            JSScope* callDataScope = constructData.js.scope;
 
-            JSObject* error = constructData.js.functionExecutable->compileForConstruct(callFrame, callDataScopeChain);
+            JSObject* error = constructData.js.functionExecutable->compileForConstruct(callFrame, callDataScope);
             if (UNLIKELY(!!error)) {
                 exceptionValue = error;
                 goto vm_throw;
@@ -4953,7 +4740,7 @@ skip_id_custom_self:
                 goto vm_throw;
             }
 
-            callFrame->init(newCodeBlock, vPC + OPCODE_LENGTH(op_construct), callDataScopeChain, previousCallFrame, argCount, jsCast<JSFunction*>(v));
+            callFrame->init(newCodeBlock, vPC + OPCODE_LENGTH(op_construct), callDataScope, previousCallFrame, argCount, jsCast<JSFunction*>(v));
             codeBlock = newCodeBlock;
             *topCallFrameSlot = callFrame;
             vPC = newCodeBlock->instructions().begin();
@@ -4965,9 +4752,9 @@ skip_id_custom_self:
         }
 
         if (constructType == ConstructTypeHost) {
-            ScopeChainNode* scopeChain = callFrame->scopeChain();
+            JSScope* scope = callFrame->scope();
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
-            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_construct), scopeChain, callFrame, argCount, asObject(v));
+            newCallFrame->init(0, vPC + OPCODE_LENGTH(op_construct), scope, callFrame, argCount, asObject(v));
 
             JSValue returnValue;
             {
@@ -5016,22 +4803,20 @@ skip_id_custom_self:
 
         NEXT_INSTRUCTION();
     }
-    DEFINE_OPCODE(op_push_scope) {
-        /* push_scope scope(r)
+    DEFINE_OPCODE(op_push_with_scope) {
+        /* push_with_scope scope(r)
 
            Converts register scope to object, and pushes it onto the top
-           of the current scope chain.  The contents of the register scope
-           are replaced by the result of toObject conversion of the scope.
+           of the scope chain.
         */
         int scope = vPC[1].u.operand;
         JSValue v = callFrame->r(scope).jsValue();
         JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
 
-        callFrame->uncheckedR(scope) = JSValue(o);
-        callFrame->setScopeChain(callFrame->scopeChain()->push(o));
+        callFrame->setScope(JSWithScope::create(callFrame, o));
 
-        vPC += OPCODE_LENGTH(op_push_scope);
+        vPC += OPCODE_LENGTH(op_push_with_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pop_scope) {
@@ -5039,7 +4824,7 @@ skip_id_custom_self:
 
            Removes the top item from the current scope chain.
         */
-        callFrame->setScopeChain(callFrame->scopeChain()->pop());
+        callFrame->setScope(callFrame->scope()->next());
 
         vPC += OPCODE_LENGTH(op_pop_scope);
         NEXT_INSTRUCTION();
@@ -5117,10 +4902,10 @@ skip_id_custom_self:
         int count = vPC[1].u.operand;
         int target = vPC[2].u.operand;
 
-        ScopeChainNode* tmp = callFrame->scopeChain();
+        JSScope* tmp = callFrame->scope();
         while (count--)
-            tmp = tmp->pop();
-        callFrame->setScopeChain(tmp);
+            tmp = tmp->next();
+        callFrame->setScope(tmp);
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -5129,16 +4914,15 @@ skip_id_custom_self:
     // Appease GCC
     goto *(&&skip_new_scope);
 #endif
-    DEFINE_OPCODE(op_push_new_scope) {
-        /* new_scope dst(r) property(id) value(r)
+    DEFINE_OPCODE(op_push_name_scope) {
+        /* new_scope property(id) value(r) attributes(unsigned)
          
-           Constructs a new StaticScopeObject with property set to value.  That scope
-           object is then pushed onto the ScopeChain.  The scope object is then stored
-           in dst for GC.
+           Constructs a name scope of the form { property<attributes>: value },
+           and pushes it onto the scope chain.
          */
-        callFrame->setScopeChain(createExceptionScope(callFrame, vPC));
+        callFrame->setScope(createNameScope(callFrame, vPC));
 
-        vPC += OPCODE_LENGTH(op_push_new_scope);
+        vPC += OPCODE_LENGTH(op_push_name_scope);
         NEXT_INSTRUCTION();
     }
 #if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
@@ -5189,7 +4973,7 @@ skip_id_custom_self:
            original constructor, using constant message as the
            message string. The result is thrown.
         */
-        UString message = callFrame->r(vPC[1].u.operand).jsValue().toString(callFrame)->value(callFrame);
+        String message = callFrame->r(vPC[1].u.operand).jsValue().toString(callFrame)->value(callFrame);
         exceptionValue = JSValue(createReferenceError(callFrame, message));
         goto vm_throw;
     }
@@ -5319,6 +5103,9 @@ skip_id_custom_self:
 #endif // ENABLE(CLASSIC_INTERPRETER)
 }
 
+#endif // !ENABLE(LLINT_C_LOOP)
+
+
 JSValue Interpreter::retrieveArgumentsFromVMCode(CallFrame* callFrame, JSFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrameFromVMCode(callFrame, function);
@@ -5373,11 +5160,11 @@ JSValue Interpreter::retrieveCallerFromVMCode(CallFrame* callFrame, JSFunction*
     return caller;
 }
 
-void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const
+void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, String& sourceURL, JSValue& function) const
 {
     function = JSValue();
     lineNumber = -1;
-    sourceURL = UString();
+    sourceURL = String();
 
     CallFrame* callerFrame = callFrame->callerFrame();
     if (callerFrame->hasHostCallFrameFlag())
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index f4ccd995c..464056bc1 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -52,7 +52,7 @@ namespace JSC {
     class LLIntOffsetsExtractor;
     class ProgramExecutable;
     class Register;
-    class ScopeChainNode;
+    class JSScope;
     class SamplingTool;
     struct CallFrameClosure;
     struct HandlerInfo;
@@ -79,8 +79,8 @@ namespace JSC {
         StackFrameCodeType codeType;
         Strong<ExecutableBase> executable;
         int line;
-        UString sourceURL;
-        UString toString(CallFrame* callFrame) const
+        String sourceURL;
+        String toString(CallFrame* callFrame) const
         {
             StringBuilder traceBuild;
             String functionName = friendlyFunctionName(callFrame);
@@ -92,7 +92,7 @@ namespace JSC {
                 traceBuild.append(sourceURL);
                 if (line > -1) {
                     traceBuild.append(':');
-                    traceBuild.append(String::number(line));
+                    traceBuild.appendNumber(line);
                 }
             }
             return traceBuild.toString().impl();
@@ -187,14 +187,14 @@ namespace JSC {
         Interpreter();
         ~Interpreter();
         
-        void initialize(LLInt::Data*, bool canUseJIT);
+        void initialize(bool canUseJIT);
 
         RegisterFile& registerFile() { return m_registerFile; }
         
         Opcode getOpcode(OpcodeID id)
         {
             ASSERT(m_initialized);
-#if ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER) || ENABLE(LLINT)
+#if ENABLE(COMPUTED_GOTO_OPCODES)
             return m_opcodeTable[id];
 #else
             return id;
@@ -204,6 +204,7 @@ namespace JSC {
         OpcodeID getOpcodeID(Opcode opcode)
         {
             ASSERT(m_initialized);
+#if ENABLE(COMPUTED_GOTO_OPCODES)
 #if ENABLE(LLINT)
             ASSERT(isOpcode(opcode));
             return m_opcodeIDTable.get(opcode);
@@ -213,9 +214,10 @@ namespace JSC {
                 return static_cast<OpcodeID>(bitwise_cast<uintptr_t>(opcode));
 
             return m_opcodeIDTable.get(opcode);
-#else
+#endif // ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER)
+#else // !ENABLE(COMPUTED_GOTO_OPCODES)
             return opcode;
-#endif
+#endif // !ENABLE(COMPUTED_GOTO_OPCODES)
         }
         
         bool classicEnabled()
@@ -225,15 +227,15 @@ namespace JSC {
 
         bool isOpcode(Opcode);
 
-        JSValue execute(ProgramExecutable*, CallFrame*, ScopeChainNode*, JSObject* thisObj);
+        JSValue execute(ProgramExecutable*, CallFrame*, JSObject* thisObj);
         JSValue executeCall(CallFrame*, JSObject* function, CallType, const CallData&, JSValue thisValue, const ArgList&);
         JSObject* executeConstruct(CallFrame*, JSObject* function, ConstructType, const ConstructData&, const ArgList&);
-        JSValue execute(EvalExecutable*, CallFrame*, JSValue thisValue, ScopeChainNode*);
-        JSValue execute(EvalExecutable*, CallFrame*, JSValue thisValue, ScopeChainNode*, int globalRegisterOffset);
+        JSValue execute(EvalExecutable*, CallFrame*, JSValue thisValue, JSScope*);
+        JSValue execute(EvalExecutable*, CallFrame*, JSValue thisValue, JSScope*, int globalRegisterOffset);
 
         JSValue retrieveArgumentsFromVMCode(CallFrame*, JSFunction*) const;
         JSValue retrieveCallerFromVMCode(CallFrame*, JSFunction*) const;
-        JS_EXPORT_PRIVATE void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const;
+        JS_EXPORT_PRIVATE void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, String& sourceURL, JSValue& function) const;
         
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         
@@ -241,7 +243,7 @@ namespace JSC {
 
         NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset);
         NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine, int column);
-        static const UString getTraceLine(CallFrame*, StackFrameCodeType, const UString&, int);
+        static const String getTraceLine(CallFrame*, StackFrameCodeType, const String&, int);
         JS_EXPORT_PRIVATE static void getStackTrace(JSGlobalData*, Vector<StackFrame>& results);
         static void addStackTraceIfNecessary(CallFrame*, JSObject* error);
 
@@ -254,19 +256,12 @@ namespace JSC {
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, JSFunction*, int argumentCountIncludingThis, ScopeChainNode*);
+        CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, JSFunction*, int argumentCountIncludingThis, JSScope*);
         void endRepeatCall(CallFrameClosure&);
         JSValue execute(CallFrameClosure&);
 
 #if ENABLE(CLASSIC_INTERPRETER)
-        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveGlobalDynamic(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
-        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveThisAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
+        NEVER_INLINE JSScope* createNameScope(CallFrame*, const Instruction* vPC);
 
         void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
         void uncacheGetByID(CodeBlock*, Instruction* vPC);
@@ -280,7 +275,9 @@ namespace JSC {
 
         static CallFrame* findFunctionCallFrameFromVMCode(CallFrame*, JSFunction*);
 
+#if !ENABLE(LLINT_C_LOOP)
         JSValue privateExecute(ExecutionFlag, RegisterFile*, CallFrame*);
+#endif
 
         void dumpRegisters(CallFrame*);
         
@@ -294,6 +291,7 @@ namespace JSC {
 
         RegisterFile m_registerFile;
         
+#if ENABLE(COMPUTED_GOTO_OPCODES)
 #if ENABLE(LLINT)
         Opcode* m_opcodeTable; // Maps OpcodeID => Opcode for compiling
         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
@@ -301,6 +299,7 @@ namespace JSC {
         Opcode m_opcodeTable[numOpcodeIDs]; // Maps OpcodeID => Opcode for compiling
         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
 #endif
+#endif // ENABLE(COMPUTED_GOTO_OPCODES)
 
 #if !ASSERT_DISABLED
         bool m_initialized;
@@ -314,9 +313,9 @@ namespace JSC {
         return !thisValue.isObject() || thisValue.toThisObject(exec) == thisValue;
     }
 
-    inline JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue thisValue, ScopeChainNode* scopeChain)
+    inline JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue thisValue, JSScope* scope)
     {
-        return execute(eval, callFrame, thisValue, scopeChain, m_registerFile.size() + 1 + RegisterFile::CallFrameHeaderSize);
+        return execute(eval, callFrame, thisValue, scope, m_registerFile.size() + 1 + RegisterFile::CallFrameHeaderSize);
     }
 
     JSValue eval(CallFrame*);
diff --git a/Source/JavaScriptCore/interpreter/Register.h b/Source/JavaScriptCore/interpreter/Register.h
index a4a76b865..f056a1c8f 100644
--- a/Source/JavaScriptCore/interpreter/Register.h
+++ b/Source/JavaScriptCore/interpreter/Register.h
@@ -40,7 +40,7 @@ namespace JSC {
     class JSActivation;
     class JSObject;
     class JSPropertyNameIterator;
-    class ScopeChainNode;
+    class JSScope;
 
     struct InlineCallFrame;
     struct Instruction;
@@ -59,7 +59,7 @@ namespace JSC {
         
         Register& operator=(CallFrame*);
         Register& operator=(CodeBlock*);
-        Register& operator=(ScopeChainNode*);
+        Register& operator=(JSScope*);
         Register& operator=(Instruction*);
         Register& operator=(InlineCallFrame*);
 
@@ -69,7 +69,7 @@ namespace JSC {
         CodeBlock* codeBlock() const;
         JSObject* function() const;
         JSPropertyNameIterator* propertyNameIterator() const;
-        ScopeChainNode* scopeChain() const;
+        JSScope* scope() const;
         Instruction* vPC() const;
         InlineCallFrame* asInlineCallFrame() const;
         int32_t unboxedInt32() const;
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index ad3343d11..7a53b8e2e 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -48,6 +48,7 @@ namespace JSC {
 uintptr_t startOfFixedExecutableMemoryPool;
 
 class FixedVMPoolExecutableAllocator : public MetaAllocator {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     FixedVMPoolExecutableAllocator()
         : MetaAllocator(jitAllocationGranule) // round up all allocations to 32 bytes
diff --git a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
index 7ea61178c..0f0eb14b7 100644
--- a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
+++ b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
@@ -30,7 +30,7 @@
 
 #include "Heap.h"
 #include "JSGlobalData.h"
-#include "ScopeChain.h"
+
 #include "SlotVisitor.h"
 #include "Structure.h"
 
diff --git a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
index 9d449c374..c4d2e6ad9 100644
--- a/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
+++ b/Source/JavaScriptCore/jit/HostCallReturnValue.cpp
@@ -30,7 +30,7 @@
 #include <wtf/InlineASM.h>
 #include "JSObject.h"
 #include "JSValueInlineMethods.h"
-#include "ScopeChain.h"
+
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/jit/HostCallReturnValue.h b/Source/JavaScriptCore/jit/HostCallReturnValue.h
index b134c73da..0e17ca035 100644
--- a/Source/JavaScriptCore/jit/HostCallReturnValue.h
+++ b/Source/JavaScriptCore/jit/HostCallReturnValue.h
@@ -33,7 +33,7 @@
 // Unfortunately this only works on GCC-like compilers. And it's currently only used
 // by LLInt and DFG, which also are restricted to GCC-like compilers. We should
 // probably fix that at some point.
-#if COMPILER(GCC)
+#if COMPILER(GCC) && ENABLE(JIT)
 
 #if CALLING_CONVENTION_IS_STDCALL
 #define HOST_CALL_RETURN_VALUE_OPTION CDECL
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index 52a7158e6..6083a66e4 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -318,8 +318,8 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_pre_inc)
         DEFINE_OP(op_profile_did_call)
         DEFINE_OP(op_profile_will_call)
-        DEFINE_OP(op_push_new_scope)
-        DEFINE_OP(op_push_scope)
+        DEFINE_OP(op_push_name_scope)
+        DEFINE_OP(op_push_with_scope)
         case op_put_by_id_out_of_line:
         case op_put_by_id_transition_direct:
         case op_put_by_id_transition_normal:
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index 5529551d6..beb4cc060 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -60,7 +60,7 @@ namespace JSC {
     class Interpreter;
     class Register;
     class RegisterFile;
-    class ScopeChainNode;
+    class JSScope;
     class StructureChain;
 
     struct CallLinkInfo;
@@ -671,8 +671,8 @@ namespace JSC {
         void emit_op_pre_inc(Instruction*);
         void emit_op_profile_did_call(Instruction*);
         void emit_op_profile_will_call(Instruction*);
-        void emit_op_push_new_scope(Instruction*);
-        void emit_op_push_scope(Instruction*);
+        void emit_op_push_name_scope(Instruction*);
+        void emit_op_push_with_scope(Instruction*);
         void emit_op_put_by_id(Instruction*);
         void emit_op_put_by_index(Instruction*);
         void emit_op_put_by_val(Instruction*);
diff --git a/Source/JavaScriptCore/jit/JITCall.cpp b/Source/JavaScriptCore/jit/JITCall.cpp
index 7664eb746..f6ea71e17 100644
--- a/Source/JavaScriptCore/jit/JITCall.cpp
+++ b/Source/JavaScriptCore/jit/JITCall.cpp
@@ -160,6 +160,14 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         int argCount = instruction[2].u.operand;
         int registerOffset = instruction[3].u.operand;
 
+        if (opcodeID == op_call && canBeOptimized()) {
+            emitGetVirtualRegister(registerOffset + CallFrame::argumentOffsetIncludingThis(0), regT0);
+            Jump done = emitJumpIfNotJSCell(regT0);
+            loadPtr(Address(regT0, JSCell::structureOffset()), regT0);
+            storePtr(regT0, instruction[5].u.arrayProfile->addressOfLastSeenStructure());
+            done.link(this);
+        }
+    
         addPtr(TrustedImm32(registerOffset * sizeof(Register)), callFrameRegister, regT1);
         store32(TrustedImm32(argCount), Address(regT1, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register)) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
     } // regT1 holds newCallFrame with ArgumentCount initialized.
@@ -188,7 +196,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     m_callStructureStubCompilationInfo[callLinkInfoIndex].callType = CallLinkInfo::callTypeFor(opcodeID);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].bytecodeIndex = m_bytecodeOffset;
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
 
diff --git a/Source/JavaScriptCore/jit/JITCall32_64.cpp b/Source/JavaScriptCore/jit/JITCall32_64.cpp
index 7d86e615f..6195d0bb9 100644
--- a/Source/JavaScriptCore/jit/JITCall32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITCall32_64.cpp
@@ -236,7 +236,15 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     else {
         int argCount = instruction[2].u.operand;
         int registerOffset = instruction[3].u.operand;
-
+        
+        if (opcodeID == op_call && canBeOptimized()) {
+            emitLoad(registerOffset + CallFrame::argumentOffsetIncludingThis(0), regT0, regT1);
+            Jump done = branch32(NotEqual, regT0, TrustedImm32(JSValue::CellTag));
+            loadPtr(Address(regT1, JSCell::structureOffset()), regT1);
+            storePtr(regT1, instruction[5].u.arrayProfile->addressOfLastSeenStructure());
+            done.link(this);
+        }
+    
         addPtr(TrustedImm32(registerOffset * sizeof(Register)), callFrameRegister, regT3);
 
         store32(TrustedImm32(argCount), payloadFor(RegisterFile::ArgumentCount, regT3));
@@ -268,7 +276,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     m_callStructureStubCompilationInfo[callLinkInfoIndex].callType = CallLinkInfo::callTypeFor(opcodeID);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].bytecodeIndex = m_bytecodeOffset;
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
 
diff --git a/Source/JavaScriptCore/jit/JITCode.h b/Source/JavaScriptCore/jit/JITCode.h
index 478fcc7bf..e39b4f98d 100644
--- a/Source/JavaScriptCore/jit/JITCode.h
+++ b/Source/JavaScriptCore/jit/JITCode.h
@@ -26,7 +26,7 @@
 #ifndef JITCode_h
 #define JITCode_h
 
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
 #include "CallFrame.h"
 #include "JSValue.h"
 #include "Disassembler.h"
@@ -42,7 +42,7 @@ namespace JSC {
 #endif
     
     class JITCode {
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
         typedef MacroAssemblerCodeRef CodeRef;
         typedef MacroAssemblerCodePtr CodePtr;
 #else
@@ -77,7 +77,7 @@ namespace JSC {
             return jitType == InterpreterThunk || jitType == BaselineJIT;
         }
         
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
         JITCode()
             : m_jitType(None)
         {
@@ -127,12 +127,14 @@ namespace JSC {
             return static_cast<unsigned>(result);
         }
 
+#if ENABLE(JIT)
         // Execute the code!
         inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData)
         {
             JSValue result = JSValue::decode(ctiTrampoline(m_ref.code().executableAddress(), registerFile, callFrame, 0, 0, globalData));
             return globalData->exception ? jsNull() : result;
         }
+#endif
 
         void* start() const
         {
@@ -182,7 +184,7 @@ namespace JSC {
 
         CodeRef m_ref;
         JITType m_jitType;
-#endif // ENABLE(JIT)
+#endif // ENABLE(JIT) || ENABLE(LLINT)
     };
 
 };
diff --git a/Source/JavaScriptCore/jit/JITDriver.h b/Source/JavaScriptCore/jit/JITDriver.h
index 7b5cc28eb..318b4e7aa 100644
--- a/Source/JavaScriptCore/jit/JITDriver.h
+++ b/Source/JavaScriptCore/jit/JITDriver.h
@@ -75,7 +75,7 @@ inline bool jitCompileIfAppropriate(ExecState* exec, OwnPtr<CodeBlockType>& code
     return true;
 }
 
-inline bool jitCompileFunctionIfAppropriate(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType, unsigned bytecodeIndex, JITCompilationEffort effort)
+inline bool jitCompileFunctionIfAppropriate(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, WriteBarrier<SharedSymbolTable>& symbolTable, JITCode::JITType jitType, unsigned bytecodeIndex, JITCompilationEffort effort)
 {
     JSGlobalData& globalData = exec->globalData();
     
@@ -99,7 +99,7 @@ inline bool jitCompileFunctionIfAppropriate(ExecState* exec, OwnPtr<FunctionCode
     } else {
         if (codeBlock->alternative()) {
             codeBlock = static_pointer_cast<FunctionCodeBlock>(codeBlock->releaseAlternative());
-            symbolTable = codeBlock->sharedSymbolTable();
+            symbolTable.set(exec->globalData(), codeBlock->ownerExecutable(), codeBlock->symbolTable());
             jitCode = oldJITCode;
             jitCodeWithArityCheck = oldJITCodeWithArityCheck;
             return false;
diff --git a/Source/JavaScriptCore/jit/JITExceptions.cpp b/Source/JavaScriptCore/jit/JITExceptions.cpp
index 2955fac8d..f6cec24bd 100644
--- a/Source/JavaScriptCore/jit/JITExceptions.cpp
+++ b/Source/JavaScriptCore/jit/JITExceptions.cpp
@@ -32,7 +32,7 @@
 #include "JSGlobalData.h"
 #include "JSValue.h"
 
-#if ENABLE(JIT)
+#if ENABLE(JIT) || ENABLE(LLINT)
 
 namespace JSC {
 
@@ -47,10 +47,10 @@ ExceptionHandler genericThrow(JSGlobalData* globalData, ExecState* callFrame, JS
     void* catchRoutine;
     Instruction* catchPCForInterpreter = 0;
     if (handler) {
-        catchRoutine = handler->nativeCode.executableAddress();
         catchPCForInterpreter = &callFrame->codeBlock()->instructions()[handler->target];
+        catchRoutine = ExecutableBase::catchRoutineFor(handler, catchPCForInterpreter);
     } else
-        catchRoutine = FunctionPtr(ctiOpThrowNotCaught).value();
+        catchRoutine = FunctionPtr(LLInt::getCodePtr(ctiOpThrowNotCaught)).value();
     
     globalData->callFrameForThrow = callFrame;
     globalData->targetMachinePCForThrow = catchRoutine;
diff --git a/Source/JavaScriptCore/jit/JITExceptions.h b/Source/JavaScriptCore/jit/JITExceptions.h
index 59ded187d..1555f95dc 100644
--- a/Source/JavaScriptCore/jit/JITExceptions.h
+++ b/Source/JavaScriptCore/jit/JITExceptions.h
@@ -29,7 +29,7 @@
 #include "JSValue.h"
 #include "MacroAssemblerCodeRef.h"
 
-#if ENABLE(ASSEMBLER)
+#if ENABLE(JIT) || ENABLE(LLINT)
 
 namespace JSC {
 
@@ -50,7 +50,7 @@ ExceptionHandler jitThrow(JSGlobalData*, ExecState*, JSValue exceptionValue, Ret
 
 } // namespace JSC
 
-#endif
+#endif // ENABLE(JIT) || ENABLE(LLINT)
 
 #endif // JITExceptions_h
 
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 8ebad61ff..9b7dc634f 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -75,7 +75,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     callSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     // Also initialize ReturnPC for use by lazy linking and exceptions.
@@ -95,7 +95,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     constructSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     // Also initialize ReturnPC for use by lazy linking and exeptions.
@@ -115,7 +115,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     callSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
@@ -138,7 +138,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     constructSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
@@ -1003,11 +1003,11 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     end.link(this);
 }
 
-void JIT::emit_op_push_scope(Instruction* currentInstruction)
+void JIT::emit_op_push_with_scope(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_push_scope);
+    JITStubCall stubCall(this, cti_op_push_with_scope);
     stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.call();
 }
 
 void JIT::emit_op_pop_scope(Instruction*)
@@ -1072,12 +1072,13 @@ void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
-void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
+void JIT::emit_op_push_name_scope(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_push_new_scope);
-    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
-    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-    stubCall.call(currentInstruction[1].u.operand);
+    JITStubCall stubCall(this, cti_op_push_name_scope);
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[1].u.operand)));
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
+    stubCall.call();
 }
 
 void JIT::emit_op_catch(Instruction* currentInstruction)
@@ -1331,7 +1332,7 @@ void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
 
 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    void* globalThis = m_codeBlock->globalObject()->globalScopeChain()->globalThis.get();
+    void* globalThis = m_codeBlock->globalObject()->globalThis();
 
     linkSlowCase(iter);
     if (shouldEmitProfiling())
@@ -1591,15 +1592,13 @@ void JIT::emit_op_resolve_global_dynamic(Instruction* currentInstruction)
         Jump activationNotCreated;
         if (checkTopLevel)
             activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
-        addSlowCase(checkStructure(regT1, m_globalData->activationStructure.get()));
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+        addSlowCase(checkStructure(regT0, m_codeBlock->globalObject()->activationStructure()));
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
         activationNotCreated.link(this);
     }
     while (skip--) {
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
-        addSlowCase(checkStructure(regT1, m_globalData->activationStructure.get()));
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+        addSlowCase(checkStructure(regT0, m_codeBlock->globalObject()->activationStructure()));
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
     }
     emit_op_resolve_global(currentInstruction, true);
 }
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 00c886eb7..c94f5d910 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -69,7 +69,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     callSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     // Also initialize ReturnPC for use by lazy linking and exceptions.
@@ -89,7 +89,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     constructSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     // Also initialize ReturnPC for use by lazy linking and exeptions.
@@ -109,7 +109,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     callSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
@@ -133,7 +133,7 @@ PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGl
     constructSlowCase.append(emitJumpIfNotType(regT0, regT1, JSFunctionType));
 
     // Finish canonical initialization before JS function call.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), regT1);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_scope)), regT1);
     emitPutCellToCallFrameHeader(regT1, RegisterFile::ScopeChain);
 
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
@@ -1358,11 +1358,11 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     end.link(this);
 }
 
-void JIT::emit_op_push_scope(Instruction* currentInstruction)
+void JIT::emit_op_push_with_scope(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_push_scope);
+    JITStubCall stubCall(this, cti_op_push_with_scope);
     stubCall.addArgument(currentInstruction[1].u.operand);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.call();
 }
 
 void JIT::emit_op_pop_scope(Instruction*)
@@ -1397,12 +1397,13 @@ void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCa
     stubCall.call(dst);
 }
 
-void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
+void JIT::emit_op_push_name_scope(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_push_new_scope);
-    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
-    stubCall.addArgument(currentInstruction[3].u.operand);
-    stubCall.call(currentInstruction[1].u.operand);
+    JITStubCall stubCall(this, cti_op_push_name_scope);
+    stubCall.addArgument(TrustedImmPtr(&m_codeBlock->identifier(currentInstruction[1].u.operand)));
+    stubCall.addArgument(currentInstruction[2].u.operand);
+    stubCall.addArgument(TrustedImm32(currentInstruction[3].u.operand));
+    stubCall.call();
 }
 
 void JIT::emit_op_catch(Instruction* currentInstruction)
@@ -1586,7 +1587,7 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
 
 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    void* globalThis = m_codeBlock->globalObject()->globalScopeChain()->globalThis.get();
+    void* globalThis = m_codeBlock->globalObject()->globalThis();
     unsigned thisRegister = currentInstruction[1].u.operand;
 
     linkSlowCase(iter);
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 16af9125b..ada862a53 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -493,6 +493,7 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
     stubCall.addArgument(regT0);
     stubCall.addArgument(TrustedImmPtr(ident));
     stubCall.addArgument(regT1);
+    move(regT0, nonArgGPR1);
     Call call = stubCall.call();
 
     // Track the location of the call; this will be used to recover patch information.
@@ -537,6 +538,8 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, PropertyOffs
 
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, PropertyOffset cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
 {
+    move(nonArgGPR1, regT0);
+
     JumpList failureCases;
     // Check eax is an object of the right Structure.
     failureCases.append(emitJumpIfNotJSCell(regT0));
@@ -1067,13 +1070,12 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         Jump activationNotCreated;
         if (checkTopLevel)
             activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
         activationNotCreated.link(this);
     }
     while (skip--)
-        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+        loadPtr(Address(regT0, JSScope::offsetOfNext()), regT0);
 
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT0);
     loadPtr(Address(regT0, JSVariableObject::offsetOfRegisters()), regT0);
     loadPtr(Address(regT0, currentInstruction[2].u.operand * sizeof(Register)), regT0);
     emitValueProfilingSite();
@@ -1093,12 +1095,11 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         Jump activationNotCreated;
         if (checkTopLevel)
             activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
-        loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
+        loadPtr(Address(regT1, JSScope::offsetOfNext()), regT1);
         activationNotCreated.link(this);
     }
     while (skip--)
-        loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
+        loadPtr(Address(regT1, JSScope::offsetOfNext()), regT1);
 
     emitWriteBarrier(regT1, regT0, regT2, regT3, ShouldFilterImmediates, WriteBarrierForVariableAccess);
 
@@ -1162,7 +1163,7 @@ void JIT::resetPatchPutById(RepatchBuffer& repatchBuffer, StructureStubInfo* stu
     else
         repatchBuffer.relink(stubInfo->callReturnLocation, cti_op_put_by_id);
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(stubInfo->patch.baseline.u.put.structureToCompare), reinterpret_cast<void*>(-1));
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.put.displacementLabel), 0);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel), 0);
 }
 
 #endif // USE(JSVALUE64)
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index 6ef25046f..f3c79a985 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -213,7 +213,7 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 #if ENABLE(VALUE_PROFILER)
     storePtr(regT1, currentInstruction[4].u.arrayProfile->addressOfLastSeenStructure());
 #endif
-    addSlowCase(branchPtr(NotEqual, Address(regT1, JSCell::classInfoOffset()), TrustedImmPtr(&JSArray::s_info)));
+    addSlowCase(branchPtr(NotEqual, Address(regT1, Structure::classInfoOffset()), TrustedImmPtr(&JSArray::s_info)));
     
     loadPtr(Address(regT0, JSArray::storageOffset()), regT3);
     addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, JSArray::vectorLengthOffset())));
@@ -1108,13 +1108,12 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
         Jump activationNotCreated;
         if (checkTopLevel)
             activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
         activationNotCreated.link(this);
     }
     while (skip--)
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
 
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
     loadPtr(Address(regT2, JSVariableObject::offsetOfRegisters()), regT2);
 
     emitLoad(index, regT1, regT0, regT2);
@@ -1138,12 +1137,11 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
         Jump activationNotCreated;
         if (checkTopLevel)
             activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), TrustedImm32(JSValue::EmptyValueTag));
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
         activationNotCreated.link(this);
     }
     while (skip--)
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, object)), regT2);
+        loadPtr(Address(regT2, JSScope::offsetOfNext()), regT2);
 
     loadPtr(Address(regT2, JSVariableObject::offsetOfRegisters()), regT3);
     emitStore(index, regT1, regT0, regT3);
diff --git a/Source/JavaScriptCore/jit/JITStubRoutine.cpp b/Source/JavaScriptCore/jit/JITStubRoutine.cpp
index 951665318..121836ce9 100644
--- a/Source/JavaScriptCore/jit/JITStubRoutine.cpp
+++ b/Source/JavaScriptCore/jit/JITStubRoutine.cpp
@@ -29,7 +29,7 @@
 #if ENABLE(JIT)
 
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 #include "SlotVisitor.h"
 
 namespace JSC {
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index cc899587f..8fc395a63 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -50,10 +50,11 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSGlobalObjectFunctions.h"
+#include "JSNameScope.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
-#include "JSStaticScopeObject.h"
 #include "JSString.h"
+#include "JSWithScope.h"
 #include "NameInstance.h"
 #include "ObjectPrototype.h"
 #include "Operations.h"
@@ -203,8 +204,6 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 #define PRESERVED_R10_OFFSET             0x58
 #define PRESERVED_R11_OFFSET             0x5C
 #define REGISTER_FILE_OFFSET             0x60
-#define CALLFRAME_OFFSET                 0x64
-#define EXCEPTION_OFFSET                 0x64
 #define FIRST_STACK_ARGUMENT             0x68
 
 #elif (COMPILER(GCC) || COMPILER(MSVC) || COMPILER(RVCT)) && CPU(ARM_TRADITIONAL)
@@ -282,8 +281,6 @@ extern "C" {
 #define PRESERVED_RETURN_ADDRESS_OFFSET 76
 #define THUNK_RETURN_ADDRESS_OFFSET 80
 #define REGISTER_FILE_OFFSET        84
-#define CALLFRAME_OFFSET            88
-#define EXCEPTION_OFFSET            92
 #define GLOBAL_DATA_OFFSET         100
 #define STACK_LENGTH               104
 #elif CPU(SH4)
@@ -462,8 +459,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "li    $17,512      # set timeoutCheckRegister" "\n"
     "move  $25,$4       # move executableAddress to t9" "\n"
     "sw    $5," STRINGIZE_VALUE_OF(REGISTER_FILE_OFFSET) "($29) # store registerFile to current stack" "\n"
-    "sw    $6," STRINGIZE_VALUE_OF(CALLFRAME_OFFSET) "($29)     # store callFrame to curent stack" "\n"
-    "sw    $7," STRINGIZE_VALUE_OF(EXCEPTION_OFFSET) "($29)     # store exception to current stack" "\n"
     "lw    $9," STRINGIZE_VALUE_OF(STACK_LENGTH + 20) "($29)    # load globalData from previous stack" "\n"
     "jalr  $25" "\n"
     "sw    $9," STRINGIZE_VALUE_OF(GLOBAL_DATA_OFFSET) "($29)   # store globalData to current stack" "\n"
@@ -551,8 +546,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "str r10, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R10_OFFSET) "]" "\n"
     "str r11, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R11_OFFSET) "]" "\n"
     "str r1, [sp, #" STRINGIZE_VALUE_OF(REGISTER_FILE_OFFSET) "]" "\n"
-    "str r2, [sp, #" STRINGIZE_VALUE_OF(CALLFRAME_OFFSET) "]" "\n"
-    "str r3, [sp, #" STRINGIZE_VALUE_OF(EXCEPTION_OFFSET) "]" "\n"
     "mov r5, r2" "\n"
     "mov r6, #512" "\n"
     "blx r0" "\n"
@@ -680,8 +673,6 @@ __asm EncodedJSValue ctiTrampoline(void*, RegisterFile*, CallFrame*, void* /*unu
     str r10, [sp, # PRESERVED_R10_OFFSET ]
     str r11, [sp, # PRESERVED_R11_OFFSET ]
     str r1, [sp, # REGISTER_FILE_OFFSET ]
-    str r2, [sp, # CALLFRAME_OFFSET ]
-    str r3, [sp, # EXCEPTION_OFFSET ]
     mov r5, r2
     mov r6, #512
     blx r0
@@ -806,7 +797,6 @@ JITThunks::JITThunks(JSGlobalData* globalData)
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR11) == PRESERVED_R11_OFFSET);
 
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == REGISTER_FILE_OFFSET);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == CALLFRAME_OFFSET);
     // The fifth argument is the first item already on the stack.
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, unused1) == FIRST_STACK_ARGUMENT);
 
@@ -826,8 +816,6 @@ JITThunks::JITThunks(JSGlobalData* globalData)
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == PRESERVED_RETURN_ADDRESS_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == THUNK_RETURN_ADDRESS_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == REGISTER_FILE_OFFSET);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == CALLFRAME_OFFSET);
-    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, unused1) == EXCEPTION_OFFSET);
     ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, globalData) == GLOBAL_DATA_OFFSET);
 
 #endif
@@ -879,7 +867,7 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
         StructureChain* prototypeChain = structure->prototypeChain(callFrame);
         ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
         stubInfo->initPutByIdTransition(callFrame->globalData(), codeBlock->ownerExecutable(), structure->previousID(), structure, prototypeChain, direct);
-        JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress, direct);
+        JIT::compilePutByIdTransition(callFrame->scope()->globalData(), codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress, direct);
         return;
     }
     
@@ -902,7 +890,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
     JSGlobalData* globalData = &callFrame->globalData();
 
     if (isJSArray(baseValue) && propertyName == callFrame->propertyNames().length) {
-        JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
+        JIT::compilePatchGetArrayLength(callFrame->scope()->globalData(), codeBlock, returnAddress);
         return;
     }
     
@@ -962,7 +950,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
         ASSERT(!structure->isDictionary());
         ASSERT(!slotBaseObject->structure()->isDictionary());
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), propertyName, slot, offset, returnAddress);
+        JIT::compileGetByIdProto(callFrame->scope()->globalData(), callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), propertyName, slot, offset, returnAddress);
         return;
     }
 
@@ -975,7 +963,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
     stubInfo->initGetByIdChain(callFrame->globalData(), codeBlock->ownerExecutable(), structure, prototypeChain, count, slot.cachedPropertyType() == PropertySlot::Value);
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
+    JIT::compileGetByIdChain(callFrame->scope()->globalData(), callFrame, codeBlock, stubInfo, structure, prototypeChain, count, propertyName, slot, offset, returnAddress);
 }
 
 #if !defined(NDEBUG)
@@ -1590,7 +1578,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
         // for now.  For now it performs a check on a special object on the global object only used for this
         // purpose.  The object is in no way exposed, and as such the check will always pass.
         if (slot.slotBase() == baseValue) {
-            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
+            JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, callFrame->scope()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
             return JSValue::encode(result);
         }
     }
@@ -1690,7 +1678,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_update)
     // useful. We could try to nop it out altogether, but that's a little messy, so lets do something simpler
     // for now. For now it performs a check on a special object on the global object only used for this
     // purpose. The object is in no way exposed, and as such the check will always pass.
-    JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, callFrame->scopeChain()->globalObject->methodCallDummy(), STUB_RETURN_ADDRESS);
+    JIT::patchMethodCallProto(callFrame->globalData(), codeBlock, methodCallLinkInfo, stubInfo, callee, structure, callFrame->scope()->globalObject()->methodCallDummy(), STUB_RETURN_ADDRESS);
     return JSValue::encode(result);
 }
 
@@ -1760,7 +1748,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
         }
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             stubInfo->u.getByIdSelfList.listSize++;
-            JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, baseValue.asCell()->structure(), ident, slot, slot.cachedOffset());
+            JIT::compileGetByIdSelfList(callFrame->scope()->globalData(), codeBlock, stubInfo, polymorphicStructureList, listIndex, baseValue.asCell()->structure(), ident, slot, slot.cachedOffset());
 
             if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
@@ -1878,7 +1866,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(callFrame->globalData(), codeBlock->ownerExecutable(), stubInfo, listIndex);
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
-            JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
+            JIT::compileGetByIdProtoList(callFrame->scope()->globalData(), callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
             if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
@@ -1890,7 +1878,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
         
         if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
             StructureChain* protoChain = structure->prototypeChain(callFrame);
-            JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
+            JIT::compileGetByIdChainList(callFrame->scope()->globalData(), callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
 
             if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
                 ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
@@ -2021,8 +2009,8 @@ DEFINE_STUB_FUNCTION(void, optimize)
             return;
         }
         
-        ScopeChainNode* scopeChain = callFrame->scopeChain();
-        JSObject* error = codeBlock->compileOptimized(callFrame, scopeChain, bytecodeIndex);
+        JSScope* scope = callFrame->scope();
+        JSObject* error = codeBlock->compileOptimized(callFrame, scope, bytecodeIndex);
 #if ENABLE(JIT_VERBOSE_OSR)
         if (error)
             dataLog("WARNING: optimized compilation failed.\n");
@@ -2140,7 +2128,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
     STUB_INIT_STACK_FRAME(stackFrame);
     
     ASSERT(stackFrame.callFrame->codeBlock()->codeType() != FunctionCode || !stackFrame.callFrame->codeBlock()->needsFullScopeChain() || stackFrame.callFrame->uncheckedR(stackFrame.callFrame->codeBlock()->activationRegister()).jsValue());
-    return stackFrame.args[0].function()->make(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+    return JSFunction::create(stackFrame.callFrame, stackFrame.args[0].function(), stackFrame.callFrame->scope());
 }
 
 inline void* jitCompileFor(CallFrame* callFrame, CodeSpecializationKind kind)
@@ -2148,7 +2136,7 @@ inline void* jitCompileFor(CallFrame* callFrame, CodeSpecializationKind kind)
     JSFunction* function = jsCast<JSFunction*>(callFrame->callee());
     ASSERT(!function->isHostFunction());
     FunctionExecutable* executable = function->jsExecutable();
-    ScopeChainNode* callDataScopeChain = function->scope();
+    JSScope* callDataScopeChain = function->scope();
     JSObject* error = executable->compileFor(callFrame, callDataScopeChain, kind);
     if (!error)
         return function;
@@ -2278,7 +2266,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     JSActivation* activation = JSActivation::create(stackFrame.callFrame->globalData(), stackFrame.callFrame, static_cast<FunctionExecutable*>(stackFrame.callFrame->codeBlock()->ownerExecutable()));
-    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->push(activation));
+    stackFrame.callFrame->setScope(activation);
     return activation;
 }
 
@@ -2393,7 +2381,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve)
 
     CallFrame* callFrame = stackFrame.callFrame;
 
-    JSValue result = CommonSlowPaths::opResolve(callFrame, stackFrame.args[0].identifier());
+    JSValue result = JSScope::resolve(callFrame, stackFrame.args[0].identifier());
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2624,18 +2612,16 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValue::encode(JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain(), false));
+    return JSValue::encode(JSScope::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), false));
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base_strict_put)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-    JSValue base = JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain(), true);
-    if (!base) {
-        stackFrame.globalData->exception = createErrorForInvalidGlobalAssignment(stackFrame.callFrame, stackFrame.args[0].identifier().ustring());
-        VM_THROW_EXCEPTION();
-    }
-    return JSValue::encode(base);
+
+    if (JSValue result = JSScope::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), true))
+        return JSValue::encode(result);
+    VM_THROW_EXCEPTION();
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_ensure_property_exists)
@@ -2646,7 +2632,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_ensure_property_exists)
     PropertySlot slot(object);
     ASSERT(stackFrame.callFrame->codeBlock()->isStrictMode());
     if (!object->getPropertySlot(stackFrame.callFrame, stackFrame.args[1].identifier(), slot)) {
-        stackFrame.globalData->exception = createErrorForInvalidGlobalAssignment(stackFrame.callFrame, stackFrame.args[1].identifier().ustring());
+        stackFrame.globalData->exception = createErrorForInvalidGlobalAssignment(stackFrame.callFrame, stackFrame.args[1].identifier().string());
         VM_THROW_EXCEPTION();
     }
 
@@ -2657,7 +2643,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSValue result = CommonSlowPaths::opResolveSkip(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].int32());
+    JSValue result = JSScope::resolveSkip(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].int32());
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2667,28 +2653,20 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalObject* globalObject = codeBlock->globalObject();
     Identifier& ident = stackFrame.args[0].identifier();
+    CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned globalResolveInfoIndex = stackFrame.args[1].int32();
-    ASSERT(globalObject->isGlobalObject());
-
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
-            GlobalResolveInfo& globalResolveInfo = codeBlock->globalResolveInfo(globalResolveInfoIndex);
-            globalResolveInfo.structure.set(callFrame->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
-            globalResolveInfo.offset = slot.cachedOffset();
-            return JSValue::encode(result);
-        }
-
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValue::encode(result);
-    }
-
-    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident);
-    VM_THROW_EXCEPTION();
+    GlobalResolveInfo& globalResolveInfo = codeBlock->globalResolveInfo(globalResolveInfoIndex);
+
+    JSValue result = JSScope::resolveGlobal(
+        callFrame,
+        ident,
+        callFrame->lexicalGlobalObject(),
+        &globalResolveInfo.structure,
+        &globalResolveInfo.offset
+    );
+    CHECK_FOR_EXCEPTION();
+    return JSValue::encode(result);
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_div)
@@ -2970,7 +2948,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = CommonSlowPaths::opResolveWithBase(callFrame, stackFrame.args[0].identifier(), callFrame->registers()[stackFrame.args[1].int32()]);
+    JSValue result = JSScope::resolveWithBase(callFrame, stackFrame.args[0].identifier(), &callFrame->registers()[stackFrame.args[1].int32()]);
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2980,7 +2958,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_this)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    JSValue result = CommonSlowPaths::opResolveWithThis(callFrame, stackFrame.args[0].identifier(), callFrame->registers()[stackFrame.args[1].int32()]);
+    JSValue result = JSScope::resolveWithThis(callFrame, stackFrame.args[0].identifier(), &callFrame->registers()[stackFrame.args[1].int32()]);
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -2991,21 +2969,9 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
     CallFrame* callFrame = stackFrame.callFrame;
 
     FunctionExecutable* function = stackFrame.args[0].function();
-    JSFunction* func = function->make(callFrame, callFrame->scopeChain());
+    JSFunction* func = JSFunction::create(callFrame, function, callFrame->scope());
     ASSERT(callFrame->codeBlock()->codeType() != FunctionCode || !callFrame->codeBlock()->needsFullScopeChain() || callFrame->uncheckedR(callFrame->codeBlock()->activationRegister()).jsValue());
 
-    /* 
-        The Identifier in a FunctionExpression can be referenced from inside
-        the FunctionExpression's FunctionBody to allow the function to call
-        itself recursively. However, unlike in a FunctionDeclaration, the
-        Identifier in a FunctionExpression cannot be referenced from and
-        does not affect the scope enclosing the FunctionExpression.
-     */
-    if (!function->name().isNull()) {
-        JSStaticScopeObject* functionScopeObject = JSStaticScopeObject::create(callFrame, function->name(), func, ReadOnly | DontDelete);
-        func->setScope(callFrame->globalData(), func->scope()->push(functionScopeObject));
-    }
-
     return func;
 }
 
@@ -3104,7 +3070,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
         || !callFrame->callerFrame()->codeBlock()->needsFullScopeChain()
         || callFrame->callerFrame()->uncheckedR(callFrame->callerFrame()->codeBlock()->activationRegister()).jsValue());
 
-    callFrame->setScopeChain(callerFrame->scopeChain());
+    callFrame->setScope(callerFrame->scope());
     callFrame->setReturnPC(static_cast<Instruction*>((STUB_RETURN_ADDRESS).value()));
     callFrame->setCodeBlock(0);
 
@@ -3150,21 +3116,20 @@ DEFINE_STUB_FUNCTION(int, has_property)
     return result;
 }
 
-DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
+DEFINE_STUB_FUNCTION(void, op_push_with_scope)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
     JSObject* o = stackFrame.args[0].jsValue().toObject(stackFrame.callFrame);
-    CHECK_FOR_EXCEPTION();
-    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->push(o));
-    return o;
+    CHECK_FOR_EXCEPTION_VOID();
+    stackFrame.callFrame->setScope(JSWithScope::create(stackFrame.callFrame, o));
 }
 
 DEFINE_STUB_FUNCTION(void, op_pop_scope)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->pop());
+    stackFrame.callFrame->setScope(stackFrame.callFrame->scope()->next());
 }
 
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_typeof)
@@ -3267,15 +3232,14 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_in)
     return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
 }
 
-DEFINE_STUB_FUNCTION(JSObject*, op_push_new_scope)
+DEFINE_STUB_FUNCTION(void, op_push_name_scope)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSObject* scope = JSStaticScopeObject::create(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].jsValue(), DontDelete);
+    JSNameScope* scope = JSNameScope::create(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].jsValue(), stackFrame.args[2].int32());
 
     CallFrame* callFrame = stackFrame.callFrame;
-    callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
-    return scope;
+    callFrame->setScope(scope);
 }
 
 DEFINE_STUB_FUNCTION(void, op_jmp_scopes)
@@ -3285,10 +3249,10 @@ DEFINE_STUB_FUNCTION(void, op_jmp_scopes)
     unsigned count = stackFrame.args[0].int32();
     CallFrame* callFrame = stackFrame.callFrame;
 
-    ScopeChainNode* tmp = callFrame->scopeChain();
+    JSScope* tmp = callFrame->scope();
     while (count--)
-        tmp = tmp->pop();
-    callFrame->setScopeChain(tmp);
+        tmp = tmp->next();
+    callFrame->setScope(tmp);
 }
 
 DEFINE_STUB_FUNCTION(void, op_put_by_index)
@@ -3300,7 +3264,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_index)
 
     JSValue arrayValue = stackFrame.args[0].jsValue();
     ASSERT(isJSArray(arrayValue));
-    asArray(arrayValue)->putDirectIndex(callFrame, property, stackFrame.args[2].jsValue(), false);
+    asArray(arrayValue)->putDirectIndex(callFrame, property, stackFrame.args[2].jsValue());
 }
 
 DEFINE_STUB_FUNCTION(void*, op_switch_imm)
@@ -3419,7 +3383,7 @@ DEFINE_STUB_FUNCTION(void, op_throw_reference_error)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     CallFrame* callFrame = stackFrame.callFrame;
-    UString message = stackFrame.args[0].jsValue().toString(callFrame)->value(callFrame);
+    String message = stackFrame.args[0].jsValue().toString(callFrame)->value(callFrame);
     stackFrame.globalData->exception = createReferenceError(callFrame, message);
     VM_THROW_EXCEPTION_AT_END();
 }
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index 22a1dd773..e3ef4416e 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -417,8 +417,8 @@ extern "C" {
     JSObject* JIT_STUB cti_op_new_object(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-    JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-    JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
+    void JIT_STUB cti_op_push_name_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
+    void JIT_STUB cti_op_push_with_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     JSObject* JIT_STUB cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION) WTF_INTERNAL;
     int JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION) WTF_INTERNAL;
@@ -468,7 +468,13 @@ extern "C" {
     void* JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION) REFERENCED_FROM_ASM WTF_INTERNAL;
 } // extern "C"
 
-#endif // ENABLE(JIT)
+#elif ENABLE(LLINT_C_LOOP)
+
+struct JITStackFrame {
+    JSGlobalData* globalData;
+};
+
+#endif // ENABLE(LLINT_C_LOOP)
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/jit/JSInterfaceJIT.h b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
index 6b7dd2184..52f1dd0b0 100644
--- a/Source/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -36,6 +36,8 @@
 #include <wtf/AlwaysInline.h>
 #include <wtf/Vector.h>
 
+#if ENABLE(JIT)
+
 namespace JSC {
     class JSInterfaceJIT : public MacroAssembler {
     public:
@@ -75,6 +77,8 @@ namespace JSC {
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
         static const FPRegisterID fpRegT3 = X86Registers::xmm3;
+
+        static const RegisterID nonArgGPR1 = X86Registers::eax; // regT0
 #elif CPU(X86)
         static const RegisterID returnValueRegister = X86Registers::eax;
         static const RegisterID cachedResultRegister = X86Registers::eax;
@@ -331,6 +335,8 @@ namespace JSC {
         return Address(base, (static_cast<unsigned>(virtualRegisterIndex) * sizeof(Register)));
     }
 
-}
+} // namespace JSC
+
+#endif // ENABLE(JIT)
 
 #endif // JSInterfaceJIT_h
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 17ab51588..b044d5706 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -24,7 +24,6 @@
 
 #include "BytecodeGenerator.h"
 #include "Completion.h"
-#include <wtf/CurrentTime.h>
 #include "ExceptionHelpers.h"
 #include "InitializeThreading.h"
 #include "Interpreter.h"
@@ -33,12 +32,14 @@
 #include "JSFunction.h"
 #include "JSLock.h"
 #include "JSString.h"
-#include <wtf/MainThread.h>
 #include "SamplingTool.h"
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/MainThread.h>
+#include <wtf/text/StringBuilder.h>
 
 #if !OS(WINDOWS)
 #include <unistd.h>
@@ -80,7 +81,7 @@
 using namespace JSC;
 using namespace WTF;
 
-static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>& buffer);
+static bool fillBufferWithContentsOfFile(const String& fileName, Vector<char>& buffer);
 
 static EncodedJSValue JSC_HOST_CALL functionPrint(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionDebug(ExecState*);
@@ -129,7 +130,7 @@ public:
     bool m_dump;
     bool m_exitCode;
     Vector<Script> m_scripts;
-    Vector<UString> m_arguments;
+    Vector<String> m_arguments;
 
     void parseArguments(int, char**);
 };
@@ -169,7 +170,7 @@ private:
 public:
     typedef JSGlobalObject Base;
 
-    static GlobalObject* create(JSGlobalData& globalData, Structure* structure, const Vector<UString>& arguments)
+    static GlobalObject* create(JSGlobalData& globalData, Structure* structure, const Vector<String>& arguments)
     {
         GlobalObject* object = new (NotNull, allocateCell<GlobalObject>(globalData.heap)) GlobalObject(globalData, structure);
         object->finishCreation(globalData, arguments);
@@ -187,7 +188,7 @@ public:
     static bool javaScriptExperimentsEnabled(const JSGlobalObject*) { return true; }
 
 protected:
-    void finishCreation(JSGlobalData& globalData, const Vector<UString>& arguments)
+    void finishCreation(JSGlobalData& globalData, const Vector<String>& arguments)
     {
         Base::finishCreation(globalData);
         
@@ -224,20 +225,20 @@ protected:
 
         JSArray* array = constructEmptyArray(globalExec());
         for (size_t i = 0; i < arguments.size(); ++i)
-            array->putDirectIndex(globalExec(), i, jsString(globalExec(), arguments[i]), false);
+            array->putDirectIndex(globalExec(), i, jsString(globalExec(), arguments[i]));
         putDirect(globalData, Identifier(globalExec(), "arguments"), array);
     }
 
     void addFunction(JSGlobalData& globalData, const char* name, NativeFunction function, unsigned arguments)
     {
         Identifier identifier(globalExec(), name);
-        putDirect(globalData, identifier, JSFunction::create(globalExec(), this, arguments, identifier.ustring(), function));
+        putDirect(globalData, identifier, JSFunction::create(globalExec(), this, arguments, identifier.string(), function));
     }
     
     void addConstructableFunction(JSGlobalData& globalData, const char* name, NativeFunction function, unsigned arguments)
     {
         Identifier identifier(globalExec(), name);
-        putDirect(globalData, identifier, JSFunction::create(globalExec(), this, arguments, identifier.ustring(), function, NoIntrinsic, function));
+        putDirect(globalData, identifier, JSFunction::create(globalExec(), this, arguments, identifier.string(), function, NoIntrinsic, function));
     }
 };
 COMPILE_ASSERT(!IsInteger<GlobalObject>::value, WTF_IsInteger_GlobalObject_false);
@@ -252,7 +253,7 @@ GlobalObject::GlobalObject(JSGlobalData& globalData, Structure* structure)
 {
 }
 
-static inline SourceCode jscSource(const char* utf8, const UString& filename)
+static inline SourceCode jscSource(const char* utf8, const String& filename)
 {
     // Find the the first non-ascii character, or nul.
     const char* pos = utf8;
@@ -262,7 +263,7 @@ static inline SourceCode jscSource(const char* utf8, const UString& filename)
 
     // Fast case - string is all ascii.
     if (!*pos)
-        return makeSource(UString(utf8, asciiLength), filename);
+        return makeSource(String(utf8, asciiLength), filename);
 
     // Slow case - contains non-ascii characters, use fromUTF8WithLatin1Fallback.
     ASSERT(*pos < 0);
@@ -308,17 +309,19 @@ EncodedJSValue JSC_HOST_CALL functionDescribe(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState* exec)
 {
-    String trace = "--> Stack trace:\n";
+    StringBuilder trace;
+    trace.appendLiteral("--> Stack trace:\n");
+
     Vector<StackFrame> stackTrace;
     Interpreter::getStackTrace(&exec->globalData(), stackTrace);
     int i = 0;
 
     for (Vector<StackFrame>::iterator iter = stackTrace.begin(); iter < stackTrace.end(); iter++) {
         StackFrame level = *iter;
-        trace += String::format("    %i   %s\n", i, level.toString(exec).utf8().data());
+        trace.append(String::format("    %i   %s\n", i, level.toString(exec).utf8().data()));
         i++;
     }
-    fprintf(stderr, "%s", trace.utf8().data());
+    fprintf(stderr, "%s", trace.toString().utf8().data());
     return JSValue::encode(jsUndefined());
 }
 
@@ -347,17 +350,17 @@ EncodedJSValue JSC_HOST_CALL functionVersion(ExecState*)
 
 EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
 {
-    UString fileName = exec->argument(0).toString(exec)->value(exec);
+    String fileName = exec->argument(0).toString(exec)->value(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return JSValue::encode(throwError(exec, createError(exec, "Could not open file.")));
 
-    GlobalObject* globalObject = GlobalObject::create(exec->globalData(), GlobalObject::createStructure(exec->globalData(), jsNull()), Vector<UString>());
+    GlobalObject* globalObject = GlobalObject::create(exec->globalData(), GlobalObject::createStructure(exec->globalData(), jsNull()), Vector<String>());
 
     JSValue exception;
     StopWatch stopWatch;
     stopWatch.start();
-    evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), jscSource(script.data(), fileName), JSValue(), &exception);
+    evaluate(globalObject->globalExec(), jscSource(script.data(), fileName), JSValue(), &exception);
     stopWatch.stop();
 
     if (!!exception) {
@@ -370,7 +373,7 @@ EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL functionLoad(ExecState* exec)
 {
-    UString fileName = exec->argument(0).toString(exec)->value(exec);
+    String fileName = exec->argument(0).toString(exec)->value(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return JSValue::encode(throwError(exec, createError(exec, "Could not open file.")));
@@ -378,7 +381,7 @@ EncodedJSValue JSC_HOST_CALL functionLoad(ExecState* exec)
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     
     JSValue evaluationException;
-    JSValue result = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), jscSource(script.data(), fileName), JSValue(), &evaluationException);
+    JSValue result = evaluate(globalObject->globalExec(), jscSource(script.data(), fileName), JSValue(), &evaluationException);
     if (evaluationException)
         throwError(exec, evaluationException);
     return JSValue::encode(result);
@@ -386,7 +389,7 @@ EncodedJSValue JSC_HOST_CALL functionLoad(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL functionCheckSyntax(ExecState* exec)
 {
-    UString fileName = exec->argument(0).toString(exec)->value(exec);
+    String fileName = exec->argument(0).toString(exec)->value(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return JSValue::encode(throwError(exec, createError(exec, "Could not open file.")));
@@ -523,7 +526,7 @@ int main(int argc, char** argv)
 static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scripts, bool dump)
 {
     const char* script;
-    UString fileName;
+    String fileName;
     Vector<char> scriptBuffer;
 
     if (dump)
@@ -550,7 +553,7 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
         globalData.startSampling();
 
         JSValue evaluationException;
-        JSValue returnValue = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), jscSource(script, fileName), JSValue(), &evaluationException);
+        JSValue returnValue = evaluate(globalObject->globalExec(), jscSource(script, fileName), JSValue(), &evaluationException);
         success = success && !evaluationException;
         if (dump && !evaluationException)
             printf("End: %s\n", returnValue.toString(globalObject->globalExec())->value(globalObject->globalExec()).utf8().data());
@@ -586,7 +589,7 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scr
 
 static void runInteractive(GlobalObject* globalObject)
 {
-    UString interpreterName("Interpreter");
+    String interpreterName("Interpreter");
 
     while (true) {
 #if HAVE(READLINE) && !RUNNING_FROM_XCODE
@@ -596,7 +599,7 @@ static void runInteractive(GlobalObject* globalObject)
         if (line[0])
             add_history(line);
         JSValue evaluationException;
-        JSValue returnValue = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), jscSource(line, interpreterName), JSValue(), &evaluationException);
+        JSValue returnValue = evaluate(globalObject->globalExec(), jscSource(line, interpreterName), JSValue(), &evaluationException);
         free(line);
 #else
         printf("%s", interactivePrompt);
@@ -613,7 +616,7 @@ static void runInteractive(GlobalObject* globalObject)
         line.append('\0');
 
         JSValue evaluationException;
-        JSValue returnValue = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), jscSource(line.data(), interpreterName), JSValue(), &evaluationException);
+        JSValue returnValue = evaluate(globalObject->globalExec(), jscSource(line.data(), interpreterName), JSValue(), &evaluationException);
 #endif
         if (evaluationException)
             printf("Exception: %s\n", evaluationException.toString(globalObject->globalExec())->value(globalObject->globalExec()).utf8().data());
@@ -750,7 +753,7 @@ int jscmain(int argc, char** argv)
     return result;
 }
 
-static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>& buffer)
+static bool fillBufferWithContentsOfFile(const String& fileName, Vector<char>& buffer)
 {
     FILE* f = fopen(fileName.utf8().data(), "r");
     if (!f) {
diff --git a/Source/JavaScriptCore/llint/LLIntCLoop.cpp b/Source/JavaScriptCore/llint/LLIntCLoop.cpp
new file mode 100644
index 000000000..14fc04930
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntCLoop.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LLIntCLoop.h"
+
+#include "Instruction.h"
+
+namespace JSC {
+
+namespace LLInt {
+
+#if ENABLE(LLINT_C_LOOP)
+
+void CLoop::initialize()
+{
+    execute(0, llint_unused, true);
+}
+
+void* CLoop::catchRoutineFor(Instruction* catchPCForInterpreter)
+{
+    return reinterpret_cast<Instruction*>(catchPCForInterpreter->u.opcode);
+}
+
+MacroAssemblerCodePtr CLoop::hostCodeEntryFor(CodeSpecializationKind kind)
+{
+    MacroAssemblerCodePtr codePtr;
+    codePtr = (kind == CodeForCall) ?
+        MacroAssemblerCodePtr::createLLIntCodePtr(llint_native_call_trampoline) :
+        MacroAssemblerCodePtr::createLLIntCodePtr(llint_native_construct_trampoline);
+    return codePtr;
+}
+
+MacroAssemblerCodePtr CLoop::jsCodeEntryWithArityCheckFor(CodeSpecializationKind kind)
+{
+    MacroAssemblerCodePtr codePtr;
+    codePtr = (kind == CodeForCall) ?
+        MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_arity_check) :
+        MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_arity_check);
+    return codePtr;
+}
+
+MacroAssemblerCodePtr CLoop::jsCodeEntryFor(CodeSpecializationKind kind)
+{
+    MacroAssemblerCodePtr codePtr;
+    codePtr = (kind == CodeForCall) ?
+        MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_call_prologue) :
+        MacroAssemblerCodePtr::createLLIntCodePtr(llint_function_for_construct_prologue);
+    return codePtr;
+}
+
+#endif // ENABLE(LLINT_C_LOOP)
+
+} } // namespace JSC::LLInt
diff --git a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h b/Source/JavaScriptCore/llint/LLIntCLoop.h
index fd6634a88..3a9c77b6d 100644
--- a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.h
+++ b/Source/JavaScriptCore/llint/LLIntCLoop.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,27 +23,37 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef DFGRedundantPhiEliminationPhase_h
-#define DFGRedundantPhiEliminationPhase_h
+#ifndef LLIntCLoop_h
+#define LLIntCLoop_h
 
-#include <wtf/Platform.h>
+#if ENABLE(LLINT_C_LOOP)
 
-#if ENABLE(DFG_JIT)
+#include "CodeSpecializationKind.h"
+#include "JSValue.h"
+#include "MacroAssemblerCodeRef.h"
+#include "Opcode.h"
+#include "Register.h"
 
-#include "DFGPhase.h"
+namespace JSC {
 
-namespace JSC { namespace DFG {
+namespace LLInt {
 
-class Graph;
+const OpcodeID llint_unused = llint_end;
 
-// We inserted many can-be-redundant Phi nodes when building the graph.
-// This phase will just remove them.
+class CLoop {
+public:
+    static void initialize();
+    static JSValue execute(CallFrame*, OpcodeID bootstrapOpcodeId, bool isInitializationPass = false);
 
-bool performRedundantPhiElimination(Graph&);
+    static void* catchRoutineFor(Instruction* catchPCForInterpreter);
 
-} } // namespace JSC::DFG
+    static MacroAssemblerCodePtr hostCodeEntryFor(CodeSpecializationKind);
+    static MacroAssemblerCodePtr jsCodeEntryWithArityCheckFor(CodeSpecializationKind);
+    static MacroAssemblerCodePtr jsCodeEntryFor(CodeSpecializationKind);
+};
 
-#endif // ENABLE(DFG_JIT)
+} } // namespace JSC::LLInt
 
-#endif // DFGRedundantPhiEliminationPhase_h
+#endif // ENABLE(LLINT_C_LOOP)
 
+#endif // LLIntCLoop_h
diff --git a/Source/JavaScriptCore/llint/LLIntData.cpp b/Source/JavaScriptCore/llint/LLIntData.cpp
index 983a7d706..c7fd741d6 100644
--- a/Source/JavaScriptCore/llint/LLIntData.cpp
+++ b/Source/JavaScriptCore/llint/LLIntData.cpp
@@ -31,20 +31,31 @@
 #include "BytecodeConventions.h"
 #include "CodeType.h"
 #include "Instruction.h"
-#include "LowLevelInterpreter.h"
+#include "LLIntCLoop.h"
 #include "Opcode.h"
 
 namespace JSC { namespace LLInt {
 
-Data::Data()
-    : m_exceptionInstructions(new Instruction[maxOpcodeLength + 1])
-    , m_opcodeMap(new Opcode[numOpcodeIDs])
+Instruction* Data::s_exceptionInstructions = 0;
+Opcode* Data::s_opcodeMap = 0;
+
+void initialize()
 {
+    Data::s_exceptionInstructions = new Instruction[maxOpcodeLength + 1];
+    Data::s_opcodeMap = new Opcode[numOpcodeIDs];
+
+    #if ENABLE(LLINT_C_LOOP)
+    CLoop::initialize();
+
+    #else // !ENABLE(LLINT_C_LOOP)
     for (int i = 0; i < maxOpcodeLength + 1; ++i)
-        m_exceptionInstructions[i].u.pointer = bitwise_cast<void*>(&llint_throw_from_slow_path_trampoline);
-#define OPCODE_ENTRY(opcode, length) m_opcodeMap[opcode] = bitwise_cast<void*>(&llint_##opcode);
+        Data::s_exceptionInstructions[i].u.pointer =
+            LLInt::getCodePtr(llint_throw_from_slow_path_trampoline);
+    #define OPCODE_ENTRY(opcode, length) \
+        Data::s_opcodeMap[opcode] = LLInt::getCodePtr(llint_##opcode);
     FOR_EACH_OPCODE_ID(OPCODE_ENTRY);
-#undef OPCODE_ENTRY
+    #undef OPCODE_ENTRY
+    #endif // !ENABLE(LLINT_C_LOOP)
 }
 
 #if COMPILER(CLANG)
@@ -120,12 +131,6 @@ void Data::performAssertions(JSGlobalData& globalData)
 #pragma clang diagnostic pop
 #endif
 
-Data::~Data()
-{
-    delete[] m_exceptionInstructions;
-    delete[] m_opcodeMap;
-}
-
 } } // namespace JSC::LLInt
 
 #endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LLIntData.h b/Source/JavaScriptCore/llint/LLIntData.h
index ba8daedf1..3b3b6027f 100644
--- a/Source/JavaScriptCore/llint/LLIntData.h
+++ b/Source/JavaScriptCore/llint/LLIntData.h
@@ -26,6 +26,7 @@
 #ifndef LLIntData_h
 #define LLIntData_h
 
+#include "JSValue.h"
 #include "Opcode.h"
 #include <wtf/Platform.h>
 
@@ -34,30 +35,59 @@ namespace JSC {
 class JSGlobalData;
 struct Instruction;
 
+#if ENABLE(LLINT_C_LOOP)
+typedef OpcodeID LLIntCode;
+#else
+typedef void (*LLIntCode)();
+#endif
+
 namespace LLInt {
 
 #if ENABLE(LLINT)
+
 class Data {
 public:
-    Data();
-    ~Data();
-    
-    void performAssertions(JSGlobalData&);
-    
-    Instruction* exceptionInstructions()
-    {
-        return m_exceptionInstructions;
-    }
-    
-    Opcode* opcodeMap()
-    {
-        return m_opcodeMap;
-    }
+    static void performAssertions(JSGlobalData&);
+
 private:
-    Instruction* m_exceptionInstructions;
-    Opcode* m_opcodeMap;
+    static Instruction* s_exceptionInstructions;
+    static Opcode* s_opcodeMap;
+
+    friend void initialize();
+
+    friend Instruction* exceptionInstructions();
+    friend Opcode* opcodeMap();
+    friend Opcode getOpcode(OpcodeID);
+    friend void* getCodePtr(OpcodeID);
 };
-#else // ENABLE(LLINT)
+
+void initialize();
+
+inline Instruction* exceptionInstructions()
+{
+    return Data::s_exceptionInstructions;
+}
+    
+inline Opcode* opcodeMap()
+{
+    return Data::s_opcodeMap;
+}
+
+inline Opcode getOpcode(OpcodeID id)
+{
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+    return Data::s_opcodeMap[id];
+#else
+    return static_cast<Opcode>(id);
+#endif
+}
+
+ALWAYS_INLINE void* getCodePtr(OpcodeID id)
+{
+    return reinterpret_cast<void*>(getOpcode(id));
+}
+
+#else // !ENABLE(LLINT)
 
 #if COMPILER(CLANG)
 #pragma clang diagnostic push
@@ -66,26 +96,30 @@ private:
 
 class Data {
 public:
-    void performAssertions(JSGlobalData&) { }
-
-    Instruction* exceptionInstructions()
-    {
-        ASSERT_NOT_REACHED();
-        return 0;
-    }
-    
-    Opcode* opcodeMap()
-    {
-        ASSERT_NOT_REACHED();
-        return 0;
-    }
+    static void performAssertions(JSGlobalData&) { }
 };
 
 #if COMPILER(CLANG)
 #pragma clang diagnostic pop
 #endif
 
-#endif // ENABLE(LLINT)
+#endif // !ENABLE(LLINT)
+
+ALWAYS_INLINE void* getOpcode(void llintOpcode())
+{
+    return bitwise_cast<void*>(llintOpcode);
+}
+
+ALWAYS_INLINE void* getCodePtr(void glueHelper())
+{
+    return bitwise_cast<void*>(glueHelper);
+}
+
+ALWAYS_INLINE void* getCodePtr(JSC::EncodedJSValue glueHelper())
+{
+    return bitwise_cast<void*>(glueHelper);
+}
+
 
 } } // namespace JSC::LLInt
 
diff --git a/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp b/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
index dd7d9433d..be79134b7 100644
--- a/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
+++ b/Source/JavaScriptCore/llint/LLIntEntrypoints.cpp
@@ -33,7 +33,7 @@
 #include "JSObject.h"
 #include "LLIntThunks.h"
 #include "LowLevelInterpreter.h"
-#include "ScopeChain.h"
+
 
 namespace JSC { namespace LLInt {
 
@@ -52,6 +52,7 @@ void getFunctionEntrypoint(JSGlobalData& globalData, CodeSpecializationKind kind
         return;
     }
     
+#if ENABLE(JIT)
     if (kind == CodeForCall) {
         jitCode = JITCode(globalData.getCTIStub(functionForCallEntryThunkGenerator), JITCode::InterpreterThunk);
         arityCheck = globalData.getCTIStub(functionForCallArityCheckThunkGenerator).code();
@@ -61,6 +62,7 @@ void getFunctionEntrypoint(JSGlobalData& globalData, CodeSpecializationKind kind
     ASSERT(kind == CodeForConstruct);
     jitCode = JITCode(globalData.getCTIStub(functionForConstructEntryThunkGenerator), JITCode::InterpreterThunk);
     arityCheck = globalData.getCTIStub(functionForConstructArityCheckThunkGenerator).code();
+#endif // ENABLE(JIT)
 }
 
 void getEvalEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
@@ -69,8 +71,9 @@ void getEvalEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
         jitCode = JITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_eval_prologue), JITCode::InterpreterThunk);
         return;
     }
-    
+#if ENABLE(JIT)    
     jitCode = JITCode(globalData.getCTIStub(evalEntryThunkGenerator), JITCode::InterpreterThunk);
+#endif
 }
 
 void getProgramEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
@@ -79,8 +82,9 @@ void getProgramEntrypoint(JSGlobalData& globalData, JITCode& jitCode)
         jitCode = JITCode(MacroAssemblerCodeRef::createLLIntCodeRef(llint_program_prologue), JITCode::InterpreterThunk);
         return;
     }
-    
+#if ENABLE(JIT)
     jitCode = JITCode(globalData.getCTIStub(programEntryThunkGenerator), JITCode::InterpreterThunk);
+#endif
 }
 
 } } // namespace JSC::LLInt
diff --git a/Source/JavaScriptCore/llint/LLIntExceptions.cpp b/Source/JavaScriptCore/llint/LLIntExceptions.cpp
index a915c42e3..80ca732ad 100644
--- a/Source/JavaScriptCore/llint/LLIntExceptions.cpp
+++ b/Source/JavaScriptCore/llint/LLIntExceptions.cpp
@@ -60,7 +60,8 @@ void interpreterThrowInCaller(ExecState* exec, ReturnAddressPtr pc)
 
 Instruction* returnToThrowForThrownException(ExecState* exec)
 {
-    return exec->globalData().llintData.exceptionInstructions();
+    UNUSED_PARAM(exec);
+    return LLInt::exceptionInstructions();
 }
 
 Instruction* returnToThrow(ExecState* exec, Instruction* pc)
@@ -73,7 +74,7 @@ Instruction* returnToThrow(ExecState* exec, Instruction* pc)
     fixupPCforExceptionIfNeeded(exec);
     genericThrow(globalData, exec, globalData->exception, pc - exec->codeBlock()->instructions().begin());
     
-    return globalData->llintData.exceptionInstructions();
+    return LLInt::exceptionInstructions();
 }
 
 void* callToThrow(ExecState* exec, Instruction* pc)
@@ -85,8 +86,8 @@ void* callToThrow(ExecState* exec, Instruction* pc)
 #endif
     fixupPCforExceptionIfNeeded(exec);
     genericThrow(globalData, exec, globalData->exception, pc - exec->codeBlock()->instructions().begin());
-    
-    return bitwise_cast<void*>(&llint_throw_during_call_trampoline);
+
+    return LLInt::getCodePtr(llint_throw_during_call_trampoline);
 }
 
 } } // namespace JSC::LLInt
diff --git a/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h b/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
index 9a1539576..63488aa0b 100644
--- a/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
+++ b/Source/JavaScriptCore/llint/LLIntOfflineAsmConfig.h
@@ -31,6 +31,17 @@
 #include <wtf/InlineASM.h>
 #include <wtf/Platform.h>
 
+
+#if ENABLE(LLINT_C_LOOP)
+#define OFFLINE_ASM_C_LOOP 1
+#define OFFLINE_ASM_X86 0
+#define OFFLINE_ASM_ARMv7 0
+#define OFFLINE_ASM_X86_64 0
+
+#else // !ENABLE(LLINT_C_LOOP)
+
+#define OFFLINE_ASM_C_LOOP 0
+
 #if CPU(X86)
 #define OFFLINE_ASM_X86 1
 #else
@@ -49,6 +60,8 @@
 #define OFFLINE_ASM_X86_64 0
 #endif
 
+#endif // !ENABLE(LLINT_C_LOOP)
+
 #if USE(JSVALUE64)
 #define OFFLINE_ASM_JSVALUE64 1
 #else
@@ -91,24 +104,4 @@
 #define OFFLINE_ASM_VALUE_PROFILER 0
 #endif
 
-// These are for building an interpreter from generated assembly code:
-#define OFFLINE_ASM_BEGIN   asm (
-#define OFFLINE_ASM_END     );
-
-#if CPU(ARM_THUMB2)
-#define OFFLINE_ASM_GLOBAL_LABEL(label)          \
-    ".globl " SYMBOL_STRING(label) "\n"          \
-    HIDE_SYMBOL(label) "\n"                      \
-    ".thumb\n"                                   \
-    ".thumb_func " THUMB_FUNC_PARAM(label) "\n"  \
-    SYMBOL_STRING(label) ":\n"
-#else
-#define OFFLINE_ASM_GLOBAL_LABEL(label)         \
-    ".globl " SYMBOL_STRING(label) "\n"         \
-    HIDE_SYMBOL(label) "\n"                     \
-    SYMBOL_STRING(label) ":\n"
-#endif
-
-#define OFFLINE_ASM_LOCAL_LABEL(label)   LOCAL_LABEL_STRING(label) ":\n"
-
 #endif // LLIntOfflineAsmConfig_h
diff --git a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
index cbb4258d0..3ed6d6d2f 100644
--- a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
+++ b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
@@ -45,7 +45,7 @@
 #include "LLIntOfflineAsmConfig.h"
 #include "MarkedSpace.h"
 #include "RegisterFile.h"
-#include "ScopeChain.h"
+
 #include "Structure.h"
 #include "StructureChain.h"
 #include "ValueProfile.h"
@@ -62,7 +62,7 @@ public:
 
 const unsigned* LLIntOffsetsExtractor::dummy()
 {
-#if ENABLE(JIT)
+#if ENABLE(LLINT)
 // This is a file generated by offlineasm/generate_offsets_extractor.rb, and contains code
 // to create a table of offsets, sizes, and a header identifying what combination of
 // Platform.h macros we have set. We include it inside of a method on LLIntOffsetsExtractor
diff --git a/Source/JavaScriptCore/llint/LLIntOpcode.h b/Source/JavaScriptCore/llint/LLIntOpcode.h
new file mode 100644
index 000000000..3588f4ff3
--- /dev/null
+++ b/Source/JavaScriptCore/llint/LLIntOpcode.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LLIntOpcode_h
+#define LLIntOpcode_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(LLINT)
+
+#if ENABLE(LLINT_C_LOOP)
+
+#define FOR_EACH_LLINT_NOJIT_NATIVE_HELPER(macro) \
+    macro(getHostCallReturnValue, 1) \
+    macro(ctiOpThrowNotCaught, 1)
+
+#else // !ENABLE(LLINT_C_LOOP)
+
+#define FOR_EACH_LLINT_NOJIT_NATIVE_HELPER(macro) \
+    // Nothing to do here. Use the JIT impl instead.
+
+#endif // !ENABLE(LLINT_C_LOOP)
+
+
+#define FOR_EACH_LLINT_NATIVE_HELPER(macro) \
+    FOR_EACH_LLINT_NOJIT_NATIVE_HELPER(macro) \
+    \
+    macro(llint_begin, 1) \
+    \
+    macro(llint_program_prologue, 1) \
+    macro(llint_eval_prologue, 1) \
+    macro(llint_function_for_call_prologue, 1) \
+    macro(llint_function_for_construct_prologue, 1) \
+    macro(llint_function_for_call_arity_check, 1) \
+    macro(llint_function_for_construct_arity_check, 1) \
+    macro(llint_generic_return_point, 1) \
+    macro(llint_throw_from_slow_path_trampoline, 1) \
+    macro(llint_throw_during_call_trampoline, 1) \
+    \
+    /* Native call trampolines */ \
+    macro(llint_native_call_trampoline, 1) \
+    macro(llint_native_construct_trampoline, 1) \
+    \
+    macro(llint_end, 1)
+
+
+#if ENABLE(LLINT_C_LOOP)
+#define FOR_EACH_LLINT_OPCODE_EXTENSION(macro) FOR_EACH_LLINT_NATIVE_HELPER(macro)
+#else
+#define FOR_EACH_LLINT_OPCODE_EXTENSION(macro) // Nothing to add.
+#endif
+
+#else // !ENABLE(LLINT)
+
+#define FOR_EACH_LLINT_OPCODE_EXTENSION(macro) // Nothing to add.
+
+#endif // !ENABLE(LLINT)
+
+#endif // LLIntOpcode_h
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index eef54ac7b..1a34a09d4 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -38,10 +38,11 @@
 #include "JITDriver.h"
 #include "JSActivation.h"
 #include "JSGlobalObjectFunctions.h"
+#include "JSNameScope.h"
 #include "JSPropertyNameIterator.h"
-#include "JSStaticScopeObject.h"
 #include "JSString.h"
 #include "JSValue.h"
+#include "JSWithScope.h"
 #include "LLIntCommon.h"
 #include "LLIntExceptions.h"
 #include "LowLevelInterpreter.h"
@@ -236,7 +237,7 @@ LLINT_SLOW_PATH_DECL(trace)
             exec,
             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
             opcodeNames[exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode)],
-            exec->scopeChain());
+            exec->scope());
     if (exec->globalData().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
         dataLog("Will be returning to %p\n", exec->returnPC().value());
         dataLog("The new cfr will be %p\n", exec->callerFrame());
@@ -255,6 +256,7 @@ LLINT_SLOW_PATH_DECL(special_trace)
     LLINT_END_IMPL();
 }
 
+#if ENABLE(JIT)
 inline bool shouldJIT(ExecState* exec)
 {
     // You can modify this to turn off JITting without rebuilding the world.
@@ -390,6 +392,7 @@ LLINT_SLOW_PATH_DECL(replace)
         codeBlock->dontJITAnytimeSoon();
     LLINT_END_IMPL();
 }
+#endif // ENABLE(JIT)
 
 LLINT_SLOW_PATH_DECL(register_file_check)
 {
@@ -447,7 +450,7 @@ LLINT_SLOW_PATH_DECL(slow_path_create_activation)
     dataLog("Creating an activation, exec = %p!\n", exec);
 #endif
     JSActivation* activation = JSActivation::create(globalData, exec, static_cast<FunctionExecutable*>(exec->codeBlock()->ownerExecutable()));
-    exec->setScopeChain(exec->scopeChain()->push(activation));
+    exec->setScope(activation);
     LLINT_RETURN(JSValue(activation));
 }
 
@@ -757,7 +760,7 @@ LLINT_SLOW_PATH_DECL(slow_path_in)
 LLINT_SLOW_PATH_DECL(slow_path_resolve)
 {
     LLINT_BEGIN();
-    LLINT_RETURN_PROFILED(op_resolve, CommonSlowPaths::opResolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
+    LLINT_RETURN_PROFILED(op_resolve, JSScope::resolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_resolve_skip)
@@ -765,57 +768,31 @@ LLINT_SLOW_PATH_DECL(slow_path_resolve_skip)
     LLINT_BEGIN();
     LLINT_RETURN_PROFILED(
         op_resolve_skip,
-        CommonSlowPaths::opResolveSkip(
+        JSScope::resolveSkip(
             exec,
             exec->codeBlock()->identifier(pc[2].u.operand),
             pc[3].u.operand));
 }
 
-static JSValue resolveGlobal(ExecState* exec, Instruction* pc)
-{
-    CodeBlock* codeBlock = exec->codeBlock();
-    JSGlobalObject* globalObject = codeBlock->globalObject();
-    ASSERT(globalObject->isGlobalObject());
-    int property = pc[2].u.operand;
-    Structure* structure = pc[3].u.structure.get();
-    
-    ASSERT_UNUSED(structure, structure != globalObject->structure());
-    
-    Identifier& ident = codeBlock->identifier(property);
-    PropertySlot slot(globalObject);
-    
-    if (globalObject->getPropertySlot(exec, ident, slot)) {
-        JSValue result = slot.getValue(exec, ident);
-        if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary()
-            && slot.slotBase() == globalObject) {
-            pc[3].u.structure.set(
-                exec->globalData(), codeBlock->ownerExecutable(), globalObject->structure());
-            pc[4] = slot.cachedOffset();
-        }
-        
-        return result;
-    }
-    
-    exec->globalData().exception = createUndefinedVariableError(exec, ident);
-    return JSValue();
-}
-
 LLINT_SLOW_PATH_DECL(slow_path_resolve_global)
 {
     LLINT_BEGIN();
-    LLINT_RETURN_PROFILED(op_resolve_global, resolveGlobal(exec, pc));
+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
+    LLINT_RETURN_PROFILED(op_resolve_global, JSScope::resolveGlobal(exec, ident, exec->lexicalGlobalObject(), &pc[3].u.structure, &pc[4].u.operand));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_resolve_global_dynamic)
 {
+    // FIXME: <rdar://problem/12185487> LLInt resolve_global_dynamic doesn't check intervening scopes for modification
     LLINT_BEGIN();
-    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, resolveGlobal(exec, pc));
+    Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
+    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, JSScope::resolveGlobal(exec, ident, exec->lexicalGlobalObject(), &pc[3].u.structure, &pc[4].u.operand));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_resolve_for_resolve_global_dynamic)
 {
     LLINT_BEGIN();
-    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, CommonSlowPaths::opResolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
+    LLINT_RETURN_PROFILED(op_resolve_global_dynamic, JSScope::resolve(exec, exec->codeBlock()->identifier(pc[2].u.operand)));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_resolve_base)
@@ -823,13 +800,12 @@ LLINT_SLOW_PATH_DECL(slow_path_resolve_base)
     LLINT_BEGIN();
     Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
     if (pc[3].u.operand) {
-        JSValue base = JSC::resolveBase(exec, ident, exec->scopeChain(), true);
-        if (!base)
-            LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.ustring()));
-        LLINT_RETURN(base);
+        if (JSValue result = JSScope::resolveBase(exec, ident, true))
+            LLINT_RETURN(result);
+        LLINT_THROW(globalData.exception);
     }
-    
-    LLINT_RETURN_PROFILED(op_resolve_base, JSC::resolveBase(exec, ident, exec->scopeChain(), false));
+
+    LLINT_RETURN_PROFILED(op_resolve_base, JSScope::resolveBase(exec, ident, false));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_ensure_property_exists)
@@ -839,14 +815,14 @@ LLINT_SLOW_PATH_DECL(slow_path_ensure_property_exists)
     PropertySlot slot(object);
     Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
     if (!object->getPropertySlot(exec, ident, slot))
-        LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.ustring()));
+        LLINT_THROW(createErrorForInvalidGlobalAssignment(exec, ident.string()));
     LLINT_END();
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_resolve_with_base)
 {
     LLINT_BEGIN();
-    JSValue result = CommonSlowPaths::opResolveWithBase(exec, exec->codeBlock()->identifier(pc[3].u.operand), LLINT_OP(1));
+    JSValue result = JSScope::resolveWithBase(exec, exec->codeBlock()->identifier(pc[3].u.operand), &LLINT_OP(1));
     LLINT_CHECK_EXCEPTION();
     LLINT_OP(2) = result;
     // FIXME: technically should have profiling, but we don't do it because the DFG won't use it.
@@ -856,7 +832,7 @@ LLINT_SLOW_PATH_DECL(slow_path_resolve_with_base)
 LLINT_SLOW_PATH_DECL(slow_path_resolve_with_this)
 {
     LLINT_BEGIN();
-    JSValue result = CommonSlowPaths::opResolveWithThis(exec, exec->codeBlock()->identifier(pc[3].u.operand), LLINT_OP(1));
+    JSValue result = JSScope::resolveWithThis(exec, exec->codeBlock()->identifier(pc[3].u.operand), &LLINT_OP(1));
     LLINT_CHECK_EXCEPTION();
     LLINT_OP(2) = result;
     // FIXME: technically should have profiling, but we don't do it because the DFG won't use it.
@@ -897,10 +873,10 @@ LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
             pc[4].u.structure.set(
                 globalData, codeBlock->ownerExecutable(), structure);
             if (isInlineOffset(slot.cachedOffset())) {
-                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_get_by_id);
+                pc[0].u.opcode = LLInt::getOpcode(llint_op_get_by_id);
                 pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
             } else {
-                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_get_by_id_out_of_line);
+                pc[0].u.opcode = LLInt::getOpcode(llint_op_get_by_id_out_of_line);
                 pc[5].u.operand = offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue);
             }
         }
@@ -953,7 +929,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
                     
                     // This is needed because some of the methods we call
                     // below may GC.
-                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
+                    pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id);
 
                     normalizePrototypeChain(exec, baseCell);
                     
@@ -973,24 +949,24 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
                     
                     if (pc[8].u.operand) {
                         if (isInlineOffset(slot.cachedOffset()))
-                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct);
+                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct);
                         else
-                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct_out_of_line);
+                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct_out_of_line);
                     } else {
                         if (isInlineOffset(slot.cachedOffset()))
-                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal);
+                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal);
                         else
-                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal_out_of_line);
+                            pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal_out_of_line);
                     }
                 }
             } else {
                 pc[4].u.structure.set(
                     globalData, codeBlock->ownerExecutable(), structure);
                 if (isInlineOffset(slot.cachedOffset())) {
-                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
+                    pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id);
                     pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
                 } else {
-                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_out_of_line);
+                    pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_out_of_line);
                     pc[5].u.operand = offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue);
                 }
             }
@@ -1128,7 +1104,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
     LLINT_BEGIN();
     JSValue arrayValue = LLINT_OP_C(1).jsValue();
     ASSERT(isJSArray(arrayValue));
-    asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue(), false);
+    asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
     LLINT_END();
 }
 
@@ -1162,10 +1138,10 @@ LLINT_SLOW_PATH_DECL(slow_path_jmp_scopes)
 {
     LLINT_BEGIN();
     unsigned count = pc[1].u.operand;
-    ScopeChainNode* tmp = exec->scopeChain();
+    JSScope* tmp = exec->scope();
     while (count--)
-        tmp = tmp->pop();
-    exec->setScopeChain(tmp);
+        tmp = tmp->next();
+    exec->setScope(tmp);
     pc += pc[2].u.operand;
     LLINT_END();
 }
@@ -1284,7 +1260,7 @@ LLINT_SLOW_PATH_DECL(slow_path_new_func)
 #if LLINT_SLOW_PATH_TRACING
     dataLog("Creating function!\n");
 #endif
-    LLINT_RETURN(codeBlock->functionDecl(pc[2].u.operand)->make(exec, exec->scopeChain()));
+    LLINT_RETURN(JSFunction::create(exec, codeBlock->functionDecl(pc[2].u.operand), exec->scope()));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
@@ -1292,12 +1268,7 @@ LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
     LLINT_BEGIN();
     CodeBlock* codeBlock = exec->codeBlock();
     FunctionExecutable* function = codeBlock->functionExpr(pc[2].u.operand);
-    JSFunction* func = function->make(exec, exec->scopeChain());
-    
-    if (!function->name().isNull()) {
-        JSStaticScopeObject* functionScopeObject = JSStaticScopeObject::create(exec, function->name(), func, ReadOnly | DontDelete);
-        func->setScope(globalData, func->scope()->push(functionScopeObject));
-    }
+    JSFunction* func = JSFunction::create(exec, function, exec->scope());
     
     LLINT_RETURN(func);
 }
@@ -1307,7 +1278,7 @@ static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc,
     ExecState* exec = execCallee->callerFrame();
     JSGlobalData& globalData = exec->globalData();
 
-    execCallee->setScopeChain(exec->scopeChain());
+    execCallee->setScope(exec->scope());
     execCallee->setCodeBlock(0);
     execCallee->clearReturnPC();
 
@@ -1322,7 +1293,7 @@ static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc,
             execCallee->setCallee(asObject(callee));
             globalData.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
             
-            LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
+            LLINT_CALL_RETURN(execCallee, pc, LLInt::getCodePtr(getHostCallReturnValue));
         }
         
 #if LLINT_SLOW_PATH_TRACING
@@ -1345,7 +1316,7 @@ static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc,
         execCallee->setCallee(asObject(callee));
         globalData.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
 
-        LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
+        LLINT_CALL_RETURN(execCallee, pc, LLInt::getCodePtr(getHostCallReturnValue));
     }
     
 #if LLINT_SLOW_PATH_TRACING
@@ -1367,15 +1338,15 @@ inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, Code
         return handleHostCall(execCallee, pc, calleeAsValue, kind);
     
     JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
-    ScopeChainNode* scope = callee->scopeUnchecked();
-    JSGlobalData& globalData = *scope->globalData;
-    execCallee->setScopeChain(scope);
+    JSScope* scope = callee->scopeUnchecked();
+    JSGlobalData& globalData = *scope->globalData();
+    execCallee->setScope(scope);
     ExecutableBase* executable = callee->executable();
     
     MacroAssemblerCodePtr codePtr;
     CodeBlock* codeBlock = 0;
     if (executable->isHostFunction())
-        codePtr = executable->generatedJITCodeFor(kind).addressForCall();
+        codePtr = executable->hostCodeEntryFor(kind);
     else {
         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
         JSObject* error = functionExecutable->compileFor(execCallee, callee->scope(), kind);
@@ -1384,9 +1355,9 @@ inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, Code
         codeBlock = &functionExecutable->generatedBytecodeFor(kind);
         ASSERT(codeBlock);
         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
-            codePtr = functionExecutable->generatedJITCodeWithArityCheckFor(kind);
+            codePtr = functionExecutable->jsCodeWithArityCheckEntryFor(kind);
         else
-            codePtr = functionExecutable->generatedJITCodeFor(kind).addressForCall();
+            codePtr = functionExecutable->jsCodeEntryFor(kind);
     }
     
     if (callLinkInfo) {
@@ -1399,7 +1370,7 @@ inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, Code
         if (codeBlock)
             codeBlock->linkIncomingCall(callLinkInfo);
     }
-    
+
     LLINT_CALL_RETURN(execCallee, pc, codePtr.executableAddress());
 }
 
@@ -1467,8 +1438,8 @@ LLINT_SLOW_PATH_DECL(slow_path_call_eval)
     execCallee->setArgumentCountIncludingThis(pc[2].u.operand);
     execCallee->setCallerFrame(exec);
     execCallee->uncheckedR(RegisterFile::Callee) = calleeAsValue;
-    execCallee->setScopeChain(exec->scopeChain());
-    execCallee->setReturnPC(bitwise_cast<Instruction*>(&llint_generic_return_point));
+    execCallee->setScope(exec->scope());
+    execCallee->setReturnPC(LLInt::getCodePtr(llint_generic_return_point));
     execCallee->setCodeBlock(0);
     exec->setCurrentVPC(pc + OPCODE_LENGTH(op_call_eval));
     
@@ -1476,7 +1447,7 @@ LLINT_SLOW_PATH_DECL(slow_path_call_eval)
         return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
     
     globalData.hostCallReturnValue = eval(execCallee);
-    LLINT_CALL_RETURN(execCallee, pc, reinterpret_cast<void*>(getHostCallReturnValue));
+    LLINT_CALL_RETURN(execCallee, pc, LLInt::getCodePtr(getHostCallReturnValue));
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_tear_off_activation)
@@ -1554,15 +1525,14 @@ LLINT_SLOW_PATH_DECL(slow_path_next_pname)
     LLINT_END();
 }
 
-LLINT_SLOW_PATH_DECL(slow_path_push_scope)
+LLINT_SLOW_PATH_DECL(slow_path_push_with_scope)
 {
     LLINT_BEGIN();
-    JSValue v = LLINT_OP(1).jsValue();
+    JSValue v = LLINT_OP_C(1).jsValue();
     JSObject* o = v.toObject(exec);
     LLINT_CHECK_EXCEPTION();
     
-    LLINT_OP(1) = o;
-    exec->setScopeChain(exec->scopeChain()->push(o));
+    exec->setScope(JSWithScope::create(exec, o));
     
     LLINT_END();
 }
@@ -1570,17 +1540,17 @@ LLINT_SLOW_PATH_DECL(slow_path_push_scope)
 LLINT_SLOW_PATH_DECL(slow_path_pop_scope)
 {
     LLINT_BEGIN();
-    exec->setScopeChain(exec->scopeChain()->pop());
+    exec->setScope(exec->scope()->next());
     LLINT_END();
 }
 
-LLINT_SLOW_PATH_DECL(slow_path_push_new_scope)
+LLINT_SLOW_PATH_DECL(slow_path_push_name_scope)
 {
     LLINT_BEGIN();
     CodeBlock* codeBlock = exec->codeBlock();
-    JSObject* scope = JSStaticScopeObject::create(exec, codeBlock->identifier(pc[2].u.operand), LLINT_OP(3).jsValue(), DontDelete);
-    exec->setScopeChain(exec->scopeChain()->push(scope));
-    LLINT_RETURN(scope);
+    JSNameScope* scope = JSNameScope::create(exec, codeBlock->identifier(pc[1].u.operand), LLINT_OP(2).jsValue(), pc[3].u.operand);
+    exec->setScope(scope);
+    LLINT_END();
 }
 
 LLINT_SLOW_PATH_DECL(slow_path_throw)
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.h b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
index 2e069d073..fe897d4a4 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.h
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.h
@@ -44,33 +44,50 @@ namespace LLInt {
 // warnings, or worse, a change in the ABI used to return these types.
 struct SlowPathReturnType {
     void* a;
-    void* b;
+    ExecState* b;
 };
 
-inline SlowPathReturnType encodeResult(void* a, void* b)
+inline SlowPathReturnType encodeResult(void* a, ExecState* b)
 {
     SlowPathReturnType result;
     result.a = a;
     result.b = b;
     return result;
 }
-#else
+
+inline void decodeResult(SlowPathReturnType result, void*& a, ExecState*& b)
+{
+    a = result.a;
+    b = result.b;
+}
+
+#else // USE(JSVALUE32_64)
 typedef int64_t SlowPathReturnType;
 
-inline SlowPathReturnType encodeResult(void* a, void* b)
+typedef union {
+    struct {
+        void* a;
+        ExecState* b;
+    } pair;
+    int64_t i;
+} SlowPathReturnTypeEncoding;
+
+inline SlowPathReturnType encodeResult(void* a, ExecState* b)
 {
-    union {
-        struct {
-            void* a;
-            void* b;
-        } pair;
-        int64_t i;
-    } u;
+    SlowPathReturnTypeEncoding u;
     u.pair.a = a;
     u.pair.b = b;
     return u.i;
 }
-#endif
+
+inline void decodeResult(SlowPathReturnType result, void*& a, ExecState*& b)
+{
+    SlowPathReturnTypeEncoding u;
+    u.i = result;
+    a = u.pair.a;
+    b = u.pair.b;
+}
+#endif // USE(JSVALUE32_64)
 
 extern "C" SlowPathReturnType llint_trace_operand(ExecState*, Instruction*, int fromWhere, int operand);
 extern "C" SlowPathReturnType llint_trace_value(ExecState*, Instruction*, int fromWhere, int operand);
@@ -185,9 +202,9 @@ LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_strcat);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_to_primitive);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_pnames);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_next_pname);
-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_scope);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_with_scope);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_pop_scope);
-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_new_scope);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_push_name_scope);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_throw_reference_error);
 LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_debug);
diff --git a/Source/JavaScriptCore/llint/LLIntThunks.cpp b/Source/JavaScriptCore/llint/LLIntThunks.cpp
index 6a6a579a3..ef19c766d 100644
--- a/Source/JavaScriptCore/llint/LLIntThunks.cpp
+++ b/Source/JavaScriptCore/llint/LLIntThunks.cpp
@@ -32,10 +32,12 @@
 #include "JSObject.h"
 #include "LinkBuffer.h"
 #include "LowLevelInterpreter.h"
-#include "ScopeChain.h"
+
 
 namespace JSC { namespace LLInt {
 
+#if !ENABLE(LLINT_C_LOOP)
+
 static MacroAssemblerCodeRef generateThunkWithJumpTo(JSGlobalData* globalData, void (*target)(), const char *thunkKind)
 {
     JSInterfaceJIT jit;
@@ -78,6 +80,8 @@ MacroAssemblerCodeRef programEntryThunkGenerator(JSGlobalData* globalData)
     return generateThunkWithJumpTo(globalData, llint_program_prologue, "program");
 }
 
+#endif // !ENABLE(LLINT_C_LOOP)
+
 } } // namespace JSC::LLInt
 
 #endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index 10a5aaeab..db4b71dfd 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -110,9 +110,13 @@ end
 
 # Some common utilities.
 macro crash()
-    storei t0, 0xbbadbeef[]
-    move 0, t0
-    call t0
+    if C_LOOP
+        cloopCrash
+    else
+        storei t0, 0xbbadbeef[]
+        move 0, t0
+        call t0
+    end
 end
 
 macro assert(assertion)
@@ -124,7 +128,10 @@ macro assert(assertion)
 end
 
 macro preserveReturnAddressAfterCall(destinationRegister)
-    if ARMv7
+    if C_LOOP
+        # In our case, we're only preserving the bytecode vPC. 
+        move lr, destinationRegister
+    elsif ARMv7
         move lr, destinationRegister
     elsif X86 or X86_64
         pop destinationRegister
@@ -134,7 +141,10 @@ macro preserveReturnAddressAfterCall(destinationRegister)
 end
 
 macro restoreReturnAddressBeforeReturn(sourceRegister)
-    if ARMv7
+    if C_LOOP
+        # In our case, we're only restoring the bytecode vPC. 
+        move sourceRegister, lr
+    elsif ARMv7
         move sourceRegister, lr
     elsif X86 or X86_64
         push sourceRegister
@@ -149,13 +159,26 @@ macro traceExecution()
     end
 end
 
+macro callTargetFunction(callLinkInfo)
+    if C_LOOP
+        cloopCallJSFunction LLIntCallLinkInfo::machineCodeTarget[callLinkInfo]
+    else
+        call LLIntCallLinkInfo::machineCodeTarget[callLinkInfo]
+        dispatchAfterCall()
+    end
+end
+
 macro slowPathForCall(advance, slowPath)
     callCallSlowPath(
         advance,
         slowPath,
         macro (callee)
-            call callee
-            dispatchAfterCall()
+            if C_LOOP
+                cloopCallJSFunction callee
+            else
+                call callee
+                dispatchAfterCall()
+            end
         end)
 end
 
@@ -532,7 +555,12 @@ _llint_op_jmp_scopes:
 
 
 _llint_op_loop_if_true:
-    nop
+    traceExecution()
+    jumpTrueOrFalse(
+        macro (value, target) btinz value, target end,
+        _llint_slow_path_jtrue)
+
+
 _llint_op_jtrue:
     traceExecution()
     jumpTrueOrFalse(
@@ -541,7 +569,12 @@ _llint_op_jtrue:
 
 
 _llint_op_loop_if_false:
-    nop
+    traceExecution()
+    jumpTrueOrFalse(
+        macro (value, target) btiz value, target end,
+        _llint_slow_path_jfalse)
+
+
 _llint_op_jfalse:
     traceExecution()
     jumpTrueOrFalse(
@@ -550,7 +583,13 @@ _llint_op_jfalse:
 
 
 _llint_op_loop_if_less:
-    nop
+    traceExecution()
+    compare(
+        macro (left, right, target) bilt left, right, target end,
+        macro (left, right, target) bdlt left, right, target end,
+        _llint_slow_path_jless)
+
+
 _llint_op_jless:
     traceExecution()
     compare(
@@ -568,7 +607,13 @@ _llint_op_jnless:
 
 
 _llint_op_loop_if_greater:
-    nop
+    traceExecution()
+    compare(
+        macro (left, right, target) bigt left, right, target end,
+        macro (left, right, target) bdgt left, right, target end,
+        _llint_slow_path_jgreater)
+
+
 _llint_op_jgreater:
     traceExecution()
     compare(
@@ -586,7 +631,13 @@ _llint_op_jngreater:
 
 
 _llint_op_loop_if_lesseq:
-    nop
+    traceExecution()
+    compare(
+        macro (left, right, target) bilteq left, right, target end,
+        macro (left, right, target) bdlteq left, right, target end,
+        _llint_slow_path_jlesseq)
+
+
 _llint_op_jlesseq:
     traceExecution()
     compare(
@@ -604,7 +655,13 @@ _llint_op_jnlesseq:
 
 
 _llint_op_loop_if_greatereq:
-    nop
+    traceExecution()
+    compare(
+        macro (left, right, target) bigteq left, right, target end,
+        macro (left, right, target) bdgteq left, right, target end,
+        _llint_slow_path_jgreatereq)
+
+
 _llint_op_jgreatereq:
     traceExecution()
     compare(
@@ -641,6 +698,7 @@ _llint_op_new_func_exp:
 
 _llint_op_call:
     traceExecution()
+    arrayProfileForCall()
     doCall(_llint_slow_path_call)
 
 
@@ -715,9 +773,9 @@ _llint_op_get_pnames:
     dispatch(0) # The slow_path either advances the PC or jumps us to somewhere else.
 
 
-_llint_op_push_scope:
+_llint_op_push_with_scope:
     traceExecution()
-    callSlowPath(_llint_slow_path_push_scope)
+    callSlowPath(_llint_slow_path_push_with_scope)
     dispatch(2)
 
 
@@ -727,9 +785,9 @@ _llint_op_pop_scope:
     dispatch(1)
 
 
-_llint_op_push_new_scope:
+_llint_op_push_name_scope:
     traceExecution()
-    callSlowPath(_llint_slow_path_push_new_scope)
+    callSlowPath(_llint_slow_path_push_name_scope)
     dispatch(4)
 
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
index b95a50082..ebfdadfdb 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.cpp
@@ -31,8 +31,439 @@
 #include "LLIntOfflineAsmConfig.h"
 #include <wtf/InlineASM.h>
 
+#if ENABLE(LLINT_C_LOOP)
+#include "CodeBlock.h"
+#include "LLIntCLoop.h"
+#include "LLIntSlowPaths.h"
+#include "VMInspector.h"
+#include <wtf/Assertions.h>
+#include <wtf/MathExtras.h>
+
+using namespace JSC::LLInt;
+
+// LLInt C Loop opcodes
+// ====================
+// In the implementation of the C loop, the LLint trampoline glue functions
+// (e.g. llint_program_prologue, llint_eval_prologue, etc) are addressed as
+// if they are bytecode handlers. That means the names of the trampoline
+// functions will be added to the OpcodeID list via the
+// FOR_EACH_LLINT_OPCODE_EXTENSION() macro that FOR_EACH_OPCODE_ID()
+// includes.
+//
+// In addition, some JIT trampoline functions which are needed by LLInt
+// (e.g. getHostCallReturnValue, ctiOpThrowNotCaught) are also added as
+// bytecodes, and the CLoop will provide bytecode handlers for them.
+//
+// In the CLoop, we can only dispatch indirectly to these bytecodes
+// (including the LLInt and JIT extensions). All other dispatches
+// (i.e. goto's) must be to a known label (i.e. local / global labels).
+
+
+// How are the opcodes named?
+// ==========================
+// Here is a table to show examples of how each of the manifestation of the
+// opcodes are named:
+//
+//   Type:                        Opcode            Trampoline Glue
+//                                ======            ===============
+//   [In the llint .asm files]
+//   llint labels:                llint_op_enter    llint_program_prologue
+//
+//   OpcodeID:                    op_enter          llint_program
+//                                [in Opcode.h]     [in LLIntOpcode.h]
+//
+//   When using a switch statement dispatch in the CLoop, each "opcode" is
+//   a case statement:
+//   Opcode:                      case op_enter:    case llint_program_prologue:
+//
+//   When using a computed goto dispatch in the CLoop, each opcode is a label:
+//   Opcode:                      op_enter:         llint_program_prologue:
+
+
+//============================================================================
+// Define the opcode dispatch mechanism when using the C loop:
+//
+
+// These are for building a C Loop interpreter:
+#define OFFLINE_ASM_BEGIN
+#define OFFLINE_ASM_END
+
+
+#define OFFLINE_ASM_OPCODE_LABEL(opcode) DEFINE_OPCODE(opcode)
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+    #define OFFLINE_ASM_GLUE_LABEL(label)  label:
+#else
+    #define OFFLINE_ASM_GLUE_LABEL(label)  case label: label:
+#endif
+
+#define OFFLINE_ASM_LOCAL_LABEL(label)   label:
+
+
+//============================================================================
+// Some utilities:
+//
+
+namespace JSC {
+namespace LLInt {
+
+#if USE(JSVALUE32_64)
+static double Ints2Double(uint32_t lo, uint32_t hi)
+{
+    union {
+        double dval;
+        uint64_t ival64;
+    } u;
+    u.ival64 = (static_cast<uint64_t>(hi) << 32) | lo;
+    return u.dval;
+}
+#endif // USE(JSVALUE32_64)
+
+} // namespace LLint
+
+
+//============================================================================
+// The llint C++ interpreter loop:
+//
+
+JSValue CLoop::execute(CallFrame* callFrame, OpcodeID bootstrapOpcodeId,
+                       bool isInitializationPass)
+{
+    #define CAST reinterpret_cast
+    #define SIGN_BIT32(x) ((x) & 0x80000000)
+
+    // One-time initialization of our address tables. We have to put this code
+    // here because our labels are only in scope inside this function. The
+    // caller (or one of its ancestors) is responsible for ensuring that this
+    // is only called once during the initialization of the VM before threads
+    // are at play.
+    if (UNLIKELY(isInitializationPass)) {
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+        Opcode* opcodeMap = LLInt::opcodeMap();
+        #define OPCODE_ENTRY(__opcode, length) \
+            opcodeMap[__opcode] = bitwise_cast<void*>(&&__opcode);
+        FOR_EACH_OPCODE_ID(OPCODE_ENTRY)
+        #undef OPCODE_ENTRY
+
+        #define LLINT_OPCODE_ENTRY(__opcode, length) \
+            opcodeMap[__opcode] = bitwise_cast<void*>(&&__opcode);
+
+        FOR_EACH_LLINT_NATIVE_HELPER(LLINT_OPCODE_ENTRY)
+        #undef LLINT_OPCODE_ENTRY
+#endif
+        // Note: we can only set the exceptionInstructions after we have
+        // initialized the opcodeMap above. This is because getCodePtr()
+        // can depend on the opcodeMap.
+        Instruction* exceptionInstructions = LLInt::exceptionInstructions();
+        for (int i = 0; i < maxOpcodeLength + 1; ++i)
+            exceptionInstructions[i].u.pointer =
+                LLInt::getCodePtr(llint_throw_from_slow_path_trampoline);
+
+        return JSValue();
+    }
+
+    ASSERT(callFrame->globalData().topCallFrame == callFrame);
+
+    // Define the pseudo registers used by the LLINT C Loop backend:
+    union CLoopRegister {
+        intptr_t i;
+        uintptr_t u;
+        int32_t i32;
+        uint32_t u32;
+        int8_t i8;
+        uint8_t u8;
+        int8_t* i8p;
+        void* vp;
+        ExecState* execState;
+        void* instruction;
+        NativeFunction nativeFunc;
+#if USE(JSVALUE64)
+        int64_t i64;
+        EncodedJSValue encodedJSValue;
+        double castToDouble;
+#endif
+        Opcode opcode;
+    };
+    union CLoopDoubleRegister {
+        double d;
+#if USE(JSVALUE64)
+        void* castToVoidPtr;
+#endif
+    };
+
+    // The CLoop llint backend is initially based on the ARMv7 backend, and
+    // then further enhanced with a few instructions from the x86 backend to
+    // support building for X64 targets. Hence, the shape of the generated
+    // code and the usage convention of registers will look a lot like the
+    // ARMv7 backend's.
+    //
+    // For example, on a 32-bit build:
+    // 1. Outgoing args will be set up as follows:
+    //    arg1 in t0 (r0 on ARM)
+    //    arg2 in t1 (r1 on ARM)
+    // 2. 32 bit return values will be in t0 (r0 on ARM).
+    // 3. 64 bit return values (e.g. doubles) will be in t0,t1 (r0,r1 on ARM).
+    //
+    // But instead of naming these simulator registers based on their ARM
+    // counterparts, we'll name them based on their original llint asm names.
+    // This will make it easier to correlate the generated code with the
+    // original llint asm code.
+    //
+    // On a 64-bit build, it more like x64 in that the registers are 64 bit.
+    // Hence:
+    // 1. Outgoing args are still the same: arg1 in t0, arg2 in t1, etc.
+    // 2. 32 bit result values will be in the low 32-bit of t0.
+    // 3. 64 bit result values will be in t0.
+
+    CLoopRegister t0, t1, t2, t3;
+#if USE(JSVALUE64)
+    CLoopRegister rBasePC, tagTypeNumber, tagMask;
+#endif
+    CLoopRegister rRetVPC;
+    CLoopDoubleRegister d0, d1;
+
+#if COMPILER(MSVC)
+    // Keep the compiler happy. We don't really need this, but the compiler
+    // will complain. This makes the warning go away.
+    t0.i = 0;
+    t1.i = 0;
+#endif
+
+    // Instantiate the pseudo JIT stack frame used by the LLINT C Loop backend:
+    JITStackFrame jitStackFrame;
+
+    // The llint expects the native stack pointer, sp, to be pointing to the
+    // jitStackFrame (which is the simulation of the native stack frame):
+    JITStackFrame* const sp = &jitStackFrame;
+    sp->globalData = &callFrame->globalData();
+
+    // Set up an alias for the globalData ptr in the JITStackFrame:
+    JSGlobalData* &globalData = sp->globalData;
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    Instruction* vPC;
+
+    // rPC is an alias for vPC. Set up the alias:
+    CLoopRegister& rPC = *CAST<CLoopRegister*>(&vPC);
+
+#if USE(JSVALUE32_64)
+    vPC = codeBlock->instructions().begin();
+#else // USE(JSVALUE64)
+    vPC = 0;
+    rBasePC.vp = codeBlock->instructions().begin();
+
+    // For the ASM llint, JITStubs takes care of this initialization. We do
+    // it explicitly here for the C loop:
+    tagTypeNumber.i = 0xFFFF000000000000;
+    tagMask.i = 0xFFFF000000000002;
+#endif // USE(JSVALUE64)
+
+    // cfr is an alias for callFrame. Set up this alias:
+    CLoopRegister& cfr = *CAST<CLoopRegister*>(&callFrame);
+
+    // Simulate a native return PC which should never be used:
+    rRetVPC.i = 0xbbadbeef;
+
+    // Interpreter variables for value passing between opcodes and/or helpers:
+    NativeFunction nativeFunc = 0;
+    JSValue functionReturnValue;
+    Opcode opcode;
+
+    opcode = LLInt::getOpcode(bootstrapOpcodeId);
+
+    #if ENABLE(OPCODE_STATS)
+        #define RECORD_OPCODE_STATS(__opcode) \
+            OpcodeStats::recordInstruction(__opcode)
+    #else
+        #define RECORD_OPCODE_STATS(__opcode)
+    #endif
+
+    #if USE(JSVALUE32_64)
+        #define FETCH_OPCODE() vPC->u.opcode
+    #else // USE(JSVALUE64)
+        #define FETCH_OPCODE() *bitwise_cast<Opcode*>(rBasePC.i8p + rPC.i * 8)
+    #endif // USE(JSVALUE64)
+
+    #define NEXT_INSTRUCTION() \
+        do {                         \
+            opcode = FETCH_OPCODE(); \
+            DISPATCH_OPCODE();       \
+        } while (false)
+
+#if ENABLE(COMPUTED_GOTO_OPCODES)
+
+    //========================================================================
+    // Loop dispatch mechanism using computed goto statements:
+
+    #define DISPATCH_OPCODE() goto *opcode
+
+    #define DEFINE_OPCODE(__opcode) \
+        __opcode: \
+            RECORD_OPCODE_STATS(__opcode);
+
+    // Dispatch to the current PC's bytecode:
+    DISPATCH_OPCODE();
+
+#else // !ENABLE(COMPUTED_GOTO_OPCODES)
+    //========================================================================
+    // Loop dispatch mechanism using a C switch statement:
+
+    #define DISPATCH_OPCODE() goto dispatchOpcode
+
+    #define DEFINE_OPCODE(__opcode) \
+        case __opcode: \
+            RECORD_OPCODE_STATS(__opcode);
+
+    // Dispatch to the current PC's bytecode:
+    dispatchOpcode:
+    switch (opcode)
+
+#endif // !ENABLE(COMPUTED_GOTO_OPCODES)
+
+    //========================================================================
+    // Bytecode handlers:
+    {
+        // This is the file generated by offlineasm, which contains all of the
+        // bytecode handlers for the interpreter, as compiled from
+        // LowLevelInterpreter.asm and its peers.
+
+        #include "LLIntAssembly.h"
+
+        // In the ASM llint, getHostCallReturnValue() is a piece of glue
+        // function provided by the JIT (see dfg/DFGOperations.cpp).
+        // We simulate it here with a pseduo-opcode handler.
+        OFFLINE_ASM_GLUE_LABEL(getHostCallReturnValue)
+        {
+            // The ASM part pops the frame:
+            callFrame = callFrame->callerFrame();
+
+            // The part in getHostCallReturnValueWithExecState():
+            JSValue result = globalData->hostCallReturnValue;
+#if USE(JSVALUE32_64)
+            t1.i = result.tag();
+            t0.i = result.payload();
+#else
+            t0.encodedJSValue = JSValue::encode(result);
+#endif
+            goto doReturnHelper;
+        }
+
+        OFFLINE_ASM_GLUE_LABEL(ctiOpThrowNotCaught)
+        {
+            return globalData->exception;
+        }
+
+#if !ENABLE(COMPUTED_GOTO_OPCODES)
+    default:
+        ASSERT(false);
+#endif
+
+    } // END bytecode handler cases.
+
+    //========================================================================
+    // Bytecode helpers:
+
+    doReturnHelper: {
+        ASSERT(!!callFrame);
+        if (callFrame->hasHostCallFrameFlag()) {
+#if USE(JSVALUE32_64)
+            return JSValue(t1.i, t0.i); // returning JSValue(tag, payload);
+#else
+            return JSValue::decode(t0.encodedJSValue);
+#endif
+        }
+
+        // The normal ASM llint call implementation returns to the caller as
+        // recorded in rRetVPC, and the caller would fetch the return address
+        // from ArgumentCount.tag() (see the dispatchAfterCall() macro used in
+        // the callTargetFunction() macro in the llint asm files).
+        //
+        // For the C loop, we don't have the JIT stub to this work for us.
+        // So, we need to implement the equivalent of dispatchAfterCall() here
+        // before dispatching to the PC.
+
+        vPC = callFrame->currentVPC();
+
+#if USE(JSVALUE64)
+        // Based on LowLevelInterpreter64.asm's dispatchAfterCall():
+
+        // When returning from a native trampoline call, unlike the assembly
+        // LLInt, we can't simply return to the caller. In our case, we grab
+        // the caller's VPC and resume execution there. However, the caller's
+        // VPC returned by callFrame->currentVPC() is in the form of the real
+        // address of the target bytecode, but the 64-bit llint expects the
+        // VPC to be a bytecode offset. Hence, we need to map it back to a
+        // bytecode offset before we dispatch via the usual dispatch mechanism
+        // i.e. NEXT_INSTRUCTION():
+
+        codeBlock = callFrame->codeBlock();
+        ASSERT(codeBlock);
+        rPC.vp = callFrame->currentVPC();
+        rPC.i = rPC.i8p - reinterpret_cast<int8_t*>(codeBlock->instructions().begin());
+        rPC.i >>= 3;
+
+        rBasePC.vp = codeBlock->instructions().begin();
+#endif // USE(JSVALUE64)
+
+        NEXT_INSTRUCTION();
+
+    } // END doReturnHelper.
+
+
+    // Keep the compiler happy so that it doesn't complain about unused
+    // labels for the LLInt trampoline glue. The labels are automatically
+    // emitted by label macros above, and some of them are referenced by
+    // the llint generated code. Since we can't tell ahead of time which
+    // will be referenced and which will be not, we'll just passify the
+    // compiler on all such labels:
+    #define LLINT_OPCODE_ENTRY(__opcode, length) \
+        UNUSED_LABEL(__opcode);
+        FOR_EACH_LLINT_NATIVE_HELPER(LLINT_OPCODE_ENTRY)
+    #undef LLINT_OPCODE_ENTRY
+
+
+    #undef NEXT_INSTRUCTION
+    #undef DEFINE_OPCODE
+    #undef CHECK_FOR_TIMEOUT
+    #undef CAST
+    #undef SIGN_BIT32
+
+} // Interpreter::llintCLoopExecute()
+
+} // namespace JSC
+
+#else // !ENABLE(LLINT_C_LOOP)
+
+//============================================================================
+// Define the opcode dispatch mechanism when using an ASM loop:
+//
+
+// These are for building an interpreter from generated assembly code:
+#define OFFLINE_ASM_BEGIN   asm (
+#define OFFLINE_ASM_END     );
+
+#define OFFLINE_ASM_OPCODE_LABEL(__opcode) OFFLINE_ASM_GLOBAL_LABEL(llint_##__opcode)
+#define OFFLINE_ASM_GLUE_LABEL(__opcode)   OFFLINE_ASM_GLOBAL_LABEL(__opcode)
+
+#if CPU(ARM_THUMB2)
+#define OFFLINE_ASM_GLOBAL_LABEL(label)          \
+    ".globl " SYMBOL_STRING(label) "\n"          \
+    HIDE_SYMBOL(label) "\n"                      \
+    ".thumb\n"                                   \
+    ".thumb_func " THUMB_FUNC_PARAM(label) "\n"  \
+    SYMBOL_STRING(label) ":\n"
+#else
+#define OFFLINE_ASM_GLOBAL_LABEL(label)         \
+    ".globl " SYMBOL_STRING(label) "\n"         \
+    HIDE_SYMBOL(label) "\n"                     \
+    SYMBOL_STRING(label) ":\n"
+#endif
+
+#define OFFLINE_ASM_LOCAL_LABEL(label)   LOCAL_LABEL_STRING(label) ":\n"
+
 // This is a file generated by offlineasm, which contains all of the assembly code
 // for the interpreter, as compiled from LowLevelInterpreter.asm.
 #include "LLIntAssembly.h"
 
+#endif // !ENABLE(LLINT_C_LOOP)
+
 #endif // ENABLE(LLINT)
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.h b/Source/JavaScriptCore/llint/LowLevelInterpreter.h
index 6383757cf..76c950a8c 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.h
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.h
@@ -32,25 +32,57 @@
 
 #include "Opcode.h"
 
+#if ENABLE(LLINT_C_LOOP)
+
+namespace JSC {
+
+// The following is a minimal set of alias for the opcode names. This is needed
+// because there is code (e.g. in GetByIdStatus.cpp and PutByIdStatus.cpp)
+// which refers to the opcodes expecting them to be prefixed with "llint_".
+// In the CLoop implementation, the 2 are equivalent. Hence, we set up this
+// alias here.
+//
+// Note: we don't just do this for all opcodes because we only need a few,
+// and currently, FOR_EACH_OPCODE_ID() includes the llint and JIT opcode
+// extensions which we definitely don't want to add an alias for. With some
+// minor refactoring, we can use FOR_EACH_OPCODE_ID() to automatically
+// generate a llint_ alias for all opcodes, but that is not needed at this
+// time.
+
+const OpcodeID llint_op_call = op_call;
+const OpcodeID llint_op_call_eval = op_call_eval;
+const OpcodeID llint_op_call_varargs = op_call_varargs;
+const OpcodeID llint_op_construct = op_construct;
+const OpcodeID llint_op_catch = op_catch;
+const OpcodeID llint_op_get_by_id = op_get_by_id;
+const OpcodeID llint_op_get_by_id_out_of_line = op_get_by_id_out_of_line;
+const OpcodeID llint_op_put_by_id = op_put_by_id;
+const OpcodeID llint_op_put_by_id_out_of_line = op_put_by_id_out_of_line;
+
+const OpcodeID llint_op_put_by_id_transition_direct =
+    op_put_by_id_transition_direct;
+const OpcodeID llint_op_put_by_id_transition_direct_out_of_line =
+    op_put_by_id_transition_direct_out_of_line;
+const OpcodeID llint_op_put_by_id_transition_normal =
+    op_put_by_id_transition_normal;
+const OpcodeID llint_op_put_by_id_transition_normal_out_of_line =
+    op_put_by_id_transition_normal_out_of_line;
+
+const OpcodeID llint_op_method_check = op_method_check;
+
+} // namespace JSC
+
+#else // !ENABLE(LLINT_C_LOOP)
+
 #define LLINT_INSTRUCTION_DECL(opcode, length) extern "C" void llint_##opcode();
     FOR_EACH_OPCODE_ID(LLINT_INSTRUCTION_DECL);
 #undef LLINT_INSTRUCTION_DECL
 
-extern "C" void llint_begin();
-extern "C" void llint_end();
-extern "C" void llint_program_prologue();
-extern "C" void llint_eval_prologue();
-extern "C" void llint_function_for_call_prologue();
-extern "C" void llint_function_for_construct_prologue();
-extern "C" void llint_function_for_call_arity_check();
-extern "C" void llint_function_for_construct_arity_check();
-extern "C" void llint_generic_return_point();
-extern "C" void llint_throw_from_slow_path_trampoline();
-extern "C" void llint_throw_during_call_trampoline();
-
-// Native call trampolines
-extern "C" void llint_native_call_trampoline();
-extern "C" void llint_native_construct_trampoline();
+#define DECLARE_LLINT_NATIVE_HELPER(name, length) extern "C" void name();
+    FOR_EACH_LLINT_NATIVE_HELPER(DECLARE_LLINT_NATIVE_HELPER)
+#undef DECLARE_LLINT_NATIVE_HELPER
+
+#endif // !ENABLE(LLINT_C_LOOP)
 
 #endif // ENABLE(LLINT)
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index c0f136889..b011c5425 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -108,13 +108,16 @@ macro cCall2(function, arg1, arg2)
     if ARMv7
         move arg1, t0
         move arg2, t1
+        call function
     elsif X86
         poke arg1, 0
         poke arg2, 1
+        call function
+    elsif C_LOOP
+        cloopCallSlowPath function, arg1, arg2
     else
         error
     end
-    call function
 end
 
 # This barely works. arg3 and arg4 should probably be immediates.
@@ -124,15 +127,18 @@ macro cCall4(function, arg1, arg2, arg3, arg4)
         move arg2, t1
         move arg3, t2
         move arg4, t3
+        call function
     elsif X86
         poke arg1, 0
         poke arg2, 1
         poke arg3, 2
         poke arg4, 3
+        call function
+    elsif C_LOOP
+        error
     else
         error
     end
-    call function
 end
 
 macro callSlowPath(slowPath)
@@ -1006,14 +1012,14 @@ macro getScope(deBruijinIndexOperand, scopeCheck)
     # Need to conditionally skip over one scope.
     bieq TagOffset[cfr, t1, 8], EmptyValueTag, .noActivation
     scopeCheck(t0, t1)
-    loadp ScopeChainNode::next[t0], t0
+    loadp JSScope::m_next[t0], t0
 .noActivation:
     subi 1, t2
     
     btiz t2, .done
 .loop:
     scopeCheck(t0, t1)
-    loadp ScopeChainNode::next[t0], t0
+    loadp JSScope::m_next[t0], t0
     subi 1, t2
     btinz t2, .loop
 
@@ -1022,13 +1028,13 @@ end
 
 _llint_op_resolve_global_dynamic:
     traceExecution()
-    loadp JITStackFrame::globalData[sp], t3
-    loadp JSGlobalData::activationStructure[t3], t3
+    loadp CodeBlock[cfr], t3
+    loadp CodeBlock::m_globalObject[t3], t3
+    loadp JSGlobalObject::m_activationStructure[t3], t3
     getScope(
         20[PC],
         macro (scope, scratch)
-            loadp ScopeChainNode::object[scope], scratch
-            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
+            bpneq JSCell::m_structure[scope], t3, .opResolveGlobalDynamicSuperSlow
         end)
     resolveGlobal(7, .opResolveGlobalDynamicSlow)
     dispatch(7)
@@ -1051,7 +1057,6 @@ _llint_op_get_scoped_var:
     getScope(12[PC], macro (scope, scratch) end)
     loadi 4[PC], t1
     loadi 8[PC], t2
-    loadp ScopeChainNode::object[t0], t0
     loadp JSVariableObject::m_registers[t0], t0
     loadi TagOffset[t0, t2, 8], t3
     loadi PayloadOffset[t0, t2, 8], t0
@@ -1069,7 +1074,6 @@ _llint_op_put_scoped_var:
     loadConstantOrVariable(t1, t3, t2)
     loadi 4[PC], t1
     writeBarrier(t3, t2)
-    loadp ScopeChainNode::object[t0], t0
     loadp JSVariableObject::m_registers[t0], t0
     storei t3, TagOffset[t0, t1, 8]
     storei t2, PayloadOffset[t0, t1, 8]
@@ -1397,7 +1401,10 @@ _llint_op_put_by_val:
 
 
 _llint_op_loop:
-    nop
+    traceExecution()
+    dispatchBranch(4[PC])
+
+
 _llint_op_jmp:
     traceExecution()
     dispatchBranch(4[PC])
@@ -1590,6 +1597,18 @@ _llint_op_new_func:
     dispatch(4)
 
 
+macro arrayProfileForCall()
+    if VALUE_PROFILER
+        loadi 12[PC], t3
+        bineq ThisArgumentOffset + TagOffset[cfr, t3, 8], CellTag, .done
+        loadi ThisArgumentOffset + PayloadOffset[cfr, t3, 8], t0
+        loadp JSCell::m_structure[t0], t0
+        loadp 20[PC], t1
+        storep t0, ArrayProfile::m_lastSeenStructure[t1]
+    .done:
+    end
+end
+
 macro doCall(slowPath)
     loadi 4[PC], t0
     loadi 16[PC], t1
@@ -1600,7 +1619,7 @@ macro doCall(slowPath)
     addp 24, PC
     lshifti 3, t3
     addp cfr, t3  # t3 contains the new value of cfr
-    loadp JSFunction::m_scopeChain[t2], t0
+    loadp JSFunction::m_scope[t2], t0
     storei t2, Callee + PayloadOffset[t3]
     storei t0, ScopeChain + PayloadOffset[t3]
     loadi 8 - 24[PC], t2
@@ -1610,8 +1629,7 @@ macro doCall(slowPath)
     storei CellTag, Callee + TagOffset[t3]
     storei CellTag, ScopeChain + TagOffset[t3]
     move t3, cfr
-    call LLIntCallLinkInfo::machineCodeTarget[t1]
-    dispatchAfterCall()
+    callTargetFunction(t1)
 
 .opCallSlow:
     slowPathForCall(6, slowPath)
@@ -1811,6 +1829,19 @@ macro nativeCallTrampoline(executableOffsetToFunction)
         call executableOffsetToFunction[t1]
         restoreReturnAddressBeforeReturn(t3)
         loadp JITStackFrame::globalData[sp], t3
+    elsif C_LOOP
+        loadp JITStackFrame::globalData[sp], t3
+        storep cfr, JSGlobalData::topCallFrame[t3]
+        move t0, t2
+        preserveReturnAddressAfterCall(t3)
+        storep t3, ReturnPC[cfr]
+        move cfr, t0
+        loadi Callee + PayloadOffset[cfr], t1
+        loadp JSFunction::m_executable[t1], t1
+        move t2, cfr
+        cloopCallNative executableOffsetToFunction[t1]
+        restoreReturnAddressBeforeReturn(t3)
+        loadp JITStackFrame::globalData[sp], t3
     else  
         error
     end
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index 73e8613de..d429542e7 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -51,18 +51,30 @@ macro dispatchAfterCall()
 end
 
 macro cCall2(function, arg1, arg2)
-    move arg1, t5
-    move arg2, t4
-    call function
+    if X86_64
+        move arg1, t5
+        move arg2, t4
+        call function
+    elsif C_LOOP
+        cloopCallSlowPath function, arg1, arg2
+    else
+        error
+    end
 end
 
 # This barely works. arg3 and arg4 should probably be immediates.
 macro cCall4(function, arg1, arg2, arg3, arg4)
-    move arg1, t5
-    move arg2, t4
-    move arg3, t1
-    move arg4, t2
-    call function
+    if X86_64
+        move arg1, t5
+        move arg2, t4
+        move arg3, t1
+        move arg4, t2
+        call function
+    elsif C_LOOP
+        error
+    else
+        error
+    end
 end
 
 macro prepareStateForCCall()
@@ -857,14 +869,14 @@ macro getScope(deBruijinIndexOperand, scopeCheck)
     # Need to conditionally skip over one scope.
     btpz [cfr, t1, 8], .noActivation
     scopeCheck(t0, t1)
-    loadp ScopeChainNode::next[t0], t0
+    loadp JSScope::m_next[t0], t0
 .noActivation:
     subi 1, t2
     
     btiz t2, .done
 .loop:
     scopeCheck(t0, t1)
-    loadp ScopeChainNode::next[t0], t0
+    loadp JSScope::m_next[t0], t0
     subi 1, t2
     btinz t2, .loop
 
@@ -873,13 +885,13 @@ end
 
 _llint_op_resolve_global_dynamic:
     traceExecution()
-    loadp JITStackFrame::globalData[sp], t3
-    loadp JSGlobalData::activationStructure[t3], t3
+    loadp CodeBlock[cfr], t3
+    loadp CodeBlock::m_globalObject[t3], t3
+    loadp JSGlobalObject::m_activationStructure[t3], t3
     getScope(
         40[PB, PC, 8],
         macro (scope, scratch)
-            loadp ScopeChainNode::object[scope], scratch
-            bpneq JSCell::m_structure[scratch], t3, .opResolveGlobalDynamicSuperSlow
+            bpneq JSCell::m_structure[scope], t3, .opResolveGlobalDynamicSuperSlow
         end)
     resolveGlobal(7, .opResolveGlobalDynamicSlow)
     dispatch(7)
@@ -902,7 +914,6 @@ _llint_op_get_scoped_var:
     getScope(24[PB, PC, 8], macro (scope, scratch) end)
     loadis 8[PB, PC, 8], t1
     loadis 16[PB, PC, 8], t2
-    loadp ScopeChainNode::object[t0], t0
     loadp JSVariableObject::m_registers[t0], t0
     loadp [t0, t2, 8], t3
     storep t3, [cfr, t1, 8]
@@ -918,7 +929,6 @@ _llint_op_put_scoped_var:
     loadConstantOrVariable(t1, t3)
     loadis 8[PB, PC, 8], t1
     writeBarrier(t3)
-    loadp ScopeChainNode::object[t0], t0
     loadp JSVariableObject::m_registers[t0], t0
     storep t3, [t0, t1, 8]
     dispatch(4)
@@ -1234,7 +1244,10 @@ _llint_op_put_by_val:
 
 
 _llint_op_loop:
-    nop
+    traceExecution()
+    dispatchInt(8[PB, PC, 8])
+
+
 _llint_op_jmp:
     traceExecution()
     dispatchInt(8[PB, PC, 8])
@@ -1430,6 +1443,18 @@ _llint_op_new_func:
     dispatch(4)
 
 
+macro arrayProfileForCall()
+    if VALUE_PROFILER
+        loadis 24[PB, PC, 8], t3
+        loadp ThisArgumentOffset[cfr, t3, 8], t0
+        btpnz t0, tagMask, .done
+        loadp JSCell::m_structure[t0], t0
+        loadp 40[PB, PC, 8], t1
+        storep t0, ArrayProfile::m_lastSeenStructure[t1]
+    .done:
+    end
+end
+
 macro doCall(slowPath)
     loadis 8[PB, PC, 8], t0
     loadp 32[PB, PC, 8], t1
@@ -1440,7 +1465,7 @@ macro doCall(slowPath)
     addi 6, PC
     lshifti 3, t3
     addp cfr, t3
-    loadp JSFunction::m_scopeChain[t2], t0
+    loadp JSFunction::m_scope[t2], t0
     storep t2, Callee[t3]
     storep t0, ScopeChain[t3]
     loadis 16 - 48[PB, PC, 8], t2
@@ -1448,8 +1473,7 @@ macro doCall(slowPath)
     storep cfr, CallerFrame[t3]
     storei t2, ArgumentCount + PayloadOffset[t3]
     move t3, cfr
-    call LLIntCallLinkInfo::machineCodeTarget[t1]
-    dispatchAfterCall()
+    callTargetFunction(t1)
 
 .opCallSlow:
     slowPathForCall(6, slowPath)
@@ -1620,21 +1644,46 @@ _llint_throw_during_call_trampoline:
 
 macro nativeCallTrampoline(executableOffsetToFunction)
     storep 0, CodeBlock[cfr]
-    loadp JITStackFrame::globalData + 8[sp], t0
-    storep cfr, JSGlobalData::topCallFrame[t0]
-    loadp CallerFrame[cfr], t0
-    loadp ScopeChain[t0], t1
-    storep t1, ScopeChain[cfr]
-    peek 0, t1
-    storep t1, ReturnPC[cfr]
-    move cfr, t5  # t5 = rdi
-    subp 16 - 8, sp
-    loadp Callee[cfr], t4 # t4 = rsi
-    loadp JSFunction::m_executable[t4], t1
-    move t0, cfr # Restore cfr to avoid loading from stack
-    call executableOffsetToFunction[t1]
-    addp 16 - 8, sp
-    loadp JITStackFrame::globalData + 8[sp], t3
+    if X86_64
+        loadp JITStackFrame::globalData + 8[sp], t0
+        storep cfr, JSGlobalData::topCallFrame[t0]
+        loadp CallerFrame[cfr], t0
+        loadp ScopeChain[t0], t1
+        storep t1, ScopeChain[cfr]
+        peek 0, t1
+        storep t1, ReturnPC[cfr]
+        move cfr, t5  # t5 = rdi
+        subp 16 - 8, sp
+        loadp Callee[cfr], t4 # t4 = rsi
+        loadp JSFunction::m_executable[t4], t1
+        move t0, cfr # Restore cfr to avoid loading from stack
+        call executableOffsetToFunction[t1]
+        addp 16 - 8, sp
+        loadp JITStackFrame::globalData + 8[sp], t3
+
+    elsif C_LOOP
+        loadp CallerFrame[cfr], t0
+        loadp ScopeChain[t0], t1
+        storep t1, ScopeChain[cfr]
+
+        loadp JITStackFrame::globalData[sp], t3
+        storep cfr, JSGlobalData::topCallFrame[t3]
+
+        move t0, t2
+        preserveReturnAddressAfterCall(t3)
+        storep t3, ReturnPC[cfr]
+        move cfr, t0
+        loadp Callee[cfr], t1
+        loadp JSFunction::m_executable[t1], t1
+        move t2, cfr
+        cloopCallNative executableOffsetToFunction[t1]
+
+        restoreReturnAddressBeforeReturn(t3)
+        loadp JITStackFrame::globalData[sp], t3
+    else
+        error
+    end
+
     btpnz JSGlobalData::exception[t3], .exception
     ret
 .exception:
diff --git a/Source/JavaScriptCore/offlineasm/asm.rb b/Source/JavaScriptCore/offlineasm/asm.rb
index 1603f4af4..14d616442 100644
--- a/Source/JavaScriptCore/offlineasm/asm.rb
+++ b/Source/JavaScriptCore/offlineasm/asm.rb
@@ -96,6 +96,12 @@ class Assembler
         result
     end
     
+    # Puts a C Statement in the output stream.
+    def putc(*line)
+        raise unless @state == :asm
+        @outp.puts(formatDump("    " + line.join(''), lastComment))
+    end
+    
     def formatDump(dumpStr, comment, commentColumns=$preferredCommentStartColumn)
         if comment.length > 0
             "%-#{commentColumns}s %s" % [dumpStr, comment]
@@ -151,7 +157,11 @@ class Assembler
         @numGlobalLabels += 1
         putsNewlineSpacerIfAppropriate(:global)
         @internalComment = $enableLabelCountComments ? "Global Label #{@numGlobalLabels}" : nil
-        @outp.puts(formatDump("OFFLINE_ASM_GLOBAL_LABEL(#{labelName})", lastComment))
+        if /\Allint_op_/.match(labelName)
+            @outp.puts(formatDump("OFFLINE_ASM_OPCODE_LABEL(op_#{$~.post_match})", lastComment))
+        else
+            @outp.puts(formatDump("OFFLINE_ASM_GLUE_LABEL(#{labelName})", lastComment))
+        end
         @newlineSpacerState = :none # After a global label, we can use another spacer.
     end
     
@@ -171,6 +181,14 @@ class Assembler
         "\" LOCAL_LABEL_STRING(#{labelName}) \""
     end
     
+    def self.cLabelReference(labelName)
+        "#{labelName}"
+    end
+    
+    def self.cLocalLabelReference(labelName)
+        "#{labelName}"
+    end
+    
     def codeOrigin(text)
         case @commentState
         when :none
diff --git a/Source/JavaScriptCore/offlineasm/backends.rb b/Source/JavaScriptCore/offlineasm/backends.rb
index e33a2a083..0633f07f8 100644
--- a/Source/JavaScriptCore/offlineasm/backends.rb
+++ b/Source/JavaScriptCore/offlineasm/backends.rb
@@ -25,12 +25,14 @@ require "config"
 require "armv7"
 require "ast"
 require "x86"
+require "cloop"
 
 BACKENDS =
     [
      "X86",
      "X86_64",
-     "ARMv7"
+     "ARMv7",
+     "C_LOOP"
     ]
 
 # Keep the set of working backends separate from the set of backends that might be
@@ -42,7 +44,8 @@ WORKING_BACKENDS =
     [
      "X86",
      "X86_64",
-     "ARMv7"
+     "ARMv7",
+     "C_LOOP"
     ]
 
 BACKEND_PATTERN = Regexp.new('\\A(' + BACKENDS.join(')|(') + ')\\Z')
@@ -76,12 +79,18 @@ class LabelReference
     def asmLabel
         Assembler.labelReference(name[1..-1])
     end
+    def cLabel
+        Assembler.cLabelReference(name[1..-1])
+    end
 end
 
 class LocalLabelReference
     def asmLabel
         Assembler.localLabelReference("_offlineasm_"+name[1..-1])
     end
+    def cLabel
+        Assembler.cLocalLabelReference("_offlineasm_"+name[1..-1])
+    end
 end
 
 class Skip
diff --git a/Source/JavaScriptCore/offlineasm/cloop.rb b/Source/JavaScriptCore/offlineasm/cloop.rb
new file mode 100644
index 000000000..8469ed441
--- /dev/null
+++ b/Source/JavaScriptCore/offlineasm/cloop.rb
@@ -0,0 +1,988 @@
+# Copyright (C) 2012 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+require "config"
+require "ast"
+require "opt"
+
+# The CLoop llint backend is initially based on the ARMv7 backend, and
+# then further enhanced with a few instructions from the x86 backend to
+# support building for X64 targets.  Hence, the shape of the generated
+# code and the usage convention of registers will look a lot like the
+# ARMv7 backend's.
+
+def cloopMapType(type)
+    case type
+    when :int;            ".i"
+    when :uint;           ".u"
+    when :int32;          ".i32"
+    when :uint32;         ".u32"
+    when :int8;           ".i8"
+    when :uint8;          ".u8"
+    when :int8Ptr;        ".i8p"
+    when :voidPtr;        ".vp"
+    when :nativeFunc;     ".nativeFunc"
+    when :double;         ".d"
+    when :castToDouble;   ".castToDouble"
+    when :castToVoidPtr;  ".castToVoidPtr"
+    when :opcode;         ".opcode"
+    else;
+        raise "Unsupported type"
+    end
+end
+
+
+class SpecialRegister < NoChildren
+    def dump
+        @name
+    end
+    def clValue(type=:int)
+        @name + cloopMapType(type)
+    end
+end
+
+C_LOOP_SCRATCH_FPR = SpecialRegister.new("d8")
+
+class RegisterID
+    def dump
+        case name
+        when "t0"
+            "t0"
+        when "t1"
+            "t1"
+        when "t2"
+            "t2"
+        when "t3"
+            "t3"
+        when "t4"
+            "rPC"
+        when "t6"
+            "rBasePC"
+        when "csr1"
+            "tagTypeNumber"
+        when "csr2"
+            "tagMask"
+        when "cfr"
+            "cfr"
+        when "lr"
+            "rRetVPC"
+        when "sp"
+            "sp"
+        else
+            raise "Bad register #{name} for C_LOOP at #{codeOriginString}"
+        end
+    end
+    def clValue(type=:int)
+        dump + cloopMapType(type)
+    end
+end
+
+class FPRegisterID
+    def dump
+        case name
+        when "ft0", "fr"
+            "d0"
+        when "ft1"
+            "d1"
+        when "ft2"
+            "d2"
+        when "ft3"
+            "d3"
+        when "ft4"
+            "d4"
+        when "ft5"
+            "d5"
+        else
+            raise "Bad register #{name} for C_LOOP at #{codeOriginString}"
+        end
+    end
+    def clValue(type=:int)
+        dump + cloopMapType(type)
+    end
+end
+
+class Immediate
+    def dump
+        "#{value}"
+    end
+    def clValue(type=:int)
+        # There is a case of a very large unsigned number (0x8000000000000000)
+        # which we wish to encode.  Unfortunately, the C/C++ compiler
+        # complains if we express that number as a positive decimal integer.
+        # Hence, for positive values, we just convert the number into hex form
+        # to keep the compiler happy.
+        #
+        # However, for negative values, the to_s(16) hex conversion method does
+        # not strip the "-" sign resulting in a meaningless "0x-..." valueStr.
+        # To workaround this, we simply don't encode negative numbers as hex.
+
+        valueStr = (value < 0) ? "#{value}" : "0x#{value.to_s(16)}"
+
+        case type
+        when :int8;    "int8_t(#{valueStr})"
+        when :int32;   "int32_t(#{valueStr})"
+        when :int;     "intptr_t(#{valueStr})"
+        when :uint8;   "uint8_t(#{valueStr})"
+        when :uint32;  "uint32_t(#{valueStr})"
+        when :uint;    "uintptr_t(#{valueStr})"
+        else
+            raise "Not implemented immediate of type: #{type}" 
+        end
+    end
+end
+
+class Address
+    def dump
+        "[#{base.dump}, #{offset.value}]"
+    end
+    def clValue(type=:int)
+        case type
+        when :int8;         int8MemRef
+        when :int32;        int32MemRef
+        when :int;          intMemRef
+        when :uint8;        uint8MemRef
+        when :uint32;       uint32MemRef
+        when :uint;         uintMemRef
+        when :opcode;       opcodeMemRef
+        when :nativeFunc;   nativeFuncMemRef
+        else
+            raise "Unexpected Address type: #{type}"
+        end
+    end
+    def pointerExpr
+        if base.is_a? RegisterID and base.name == "sp" 
+            offsetValue = "#{offset.value}"
+            "(ASSERT(#{offsetValue} == offsetof(JITStackFrame, globalData)), &sp->globalData)"
+        elsif offset.value == 0
+            "#{base.clValue(:int8Ptr)}"
+        elsif offset.value > 0
+            "#{base.clValue(:int8Ptr)} + #{offset.value}"
+        else
+            "#{base.clValue(:int8Ptr)} - #{-offset.value}"
+        end
+    end
+    def int8MemRef
+        "*CAST<int8_t*>(#{pointerExpr})"
+    end
+    def int16MemRef
+        "*CAST<int16_t*>(#{pointerExpr})"
+    end
+    def int32MemRef
+        "*CAST<int32_t*>(#{pointerExpr})"
+    end
+    def intMemRef
+        "*CAST<intptr_t*>(#{pointerExpr})"
+    end
+    def uint8MemRef
+        "*CAST<uint8_t*>(#{pointerExpr})"
+    end
+    def uint16MemRef
+        "*CAST<uint16_t*>(#{pointerExpr})"
+    end
+    def uint32MemRef
+        "*CAST<uint32_t*>(#{pointerExpr})"
+    end
+    def uintMemRef
+        "*CAST<uintptr_t*>(#{pointerExpr})"
+    end
+    def nativeFuncMemRef
+        "*CAST<NativeFunction*>(#{pointerExpr})"
+    end
+    def opcodeMemRef
+        "*CAST<Opcode*>(#{pointerExpr})"
+    end
+    def dblMemRef
+        "*CAST<double*>(#{pointerExpr})"
+    end
+end
+
+class BaseIndex
+    def dump
+        "[#{base.dump}, #{offset.dump}, #{index.dump} << #{scaleShift}]"
+    end
+    def clValue(type=:int)
+        case type
+        when :int8;       int8MemRef
+        when :int32;      int32MemRef
+        when :int;        intMemRef
+        when :uint8;      uint8MemRef
+        when :uint32;     uint32MemRef
+        when :uint;       uintMemRef
+        when :opcode;     opcodeMemRef
+        else
+            raise "Unexpected BaseIndex type: #{type}"
+        end
+    end
+    def pointerExpr
+        if base.is_a? RegisterID and base.name == "sp"
+            offsetValue = "(#{index.clValue(:int32)} << #{scaleShift}) + #{offset.clValue})"
+            "(ASSERT(#{offsetValue} == offsetof(JITStackFrame, globalData)), &sp->globalData)"
+        else
+            "#{base.clValue(:int8Ptr)} + (#{index.clValue(:int32)} << #{scaleShift}) + #{offset.clValue}"
+        end
+    end
+    def int8MemRef
+        "*CAST<int8_t*>(#{pointerExpr})"
+    end
+    def int16MemRef
+        "*CAST<int16_t*>(#{pointerExpr})"
+    end
+    def int32MemRef
+        "*CAST<int32_t*>(#{pointerExpr})"
+    end
+    def intMemRef
+        "*CAST<intptr_t*>(#{pointerExpr})"
+    end
+    def uint8MemRef
+        "*CAST<uint8_t*>(#{pointerExpr})"
+    end
+    def uint16MemRef
+        "*CAST<uint16_t*>(#{pointerExpr})"
+    end
+    def uint32MemRef
+        "*CAST<uint32_t*>(#{pointerExpr})"
+    end
+    def uintMemRef
+        "*CAST<uintptr_t*>(#{pointerExpr})"
+    end
+    def opcodeMemRef
+        "*CAST<Opcode*>(#{pointerExpr})"
+    end
+    def dblMemRef
+        "*CAST<double*>(#{pointerExpr})"
+    end
+end
+
+class AbsoluteAddress
+    def dump
+        "#{codeOriginString}"
+    end
+    def clValue
+        dump
+    end
+end
+
+
+#
+# Lea support.
+#
+
+class Address
+    def cloopEmitLea(destination, type)
+        if destination == base
+            $asm.putc "#{destination.clValue(:int8Ptr)} += #{offset.clValue(type)};"
+        else
+            $asm.putc "#{destination.clValue(:int8Ptr)} = #{base.clValue(:int8Ptr)} + #{offset.clValue(type)};"
+        end
+    end
+end
+
+class BaseIndex
+    def cloopEmitLea(destination, type)
+        raise "Malformed BaseIndex, offset should be zero at #{codeOriginString}" unless offset.value == 0
+        $asm.putc "#{destination.clValue(:int8Ptr)} = #{base.clValue(:int8Ptr)} + (#{index.clValue} << #{scaleShift});"
+    end
+end
+
+#
+# Actual lowering code follows.
+#
+
+class Sequence
+    def getModifiedListC_LOOP
+        myList = @list
+        
+        # Verify that we will only see instructions and labels.
+        myList.each {
+            | node |
+            unless node.is_a? Instruction or
+                    node.is_a? Label or
+                    node.is_a? LocalLabel or
+                    node.is_a? Skip
+                raise "Unexpected #{node.inspect} at #{node.codeOrigin}" 
+            end
+        }
+        
+        return myList
+    end
+end
+
+def clOperands(operands)
+    operands.map{|v| v.dump}.join(", ")
+end
+
+
+def cloopEmitOperation(operands, type, operator)
+    if operands.size == 3
+        $asm.putc "#{operands[2].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+    else
+        raise unless operands.size == 2
+        raise unless not operands[1].is_a? Immediate
+        $asm.putc "#{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+    end
+end
+
+def cloopEmitShiftOperation(operands, type, operator)
+    if operands.size == 3
+        $asm.putc "#{operands[2].clValue(type)} = #{operands[1].clValue(type)} #{operator} (#{operands[0].clValue(:int)} & 0x1f);"
+    else
+        raise unless operands.size == 2
+        raise unless not operands[1].is_a? Immediate
+        $asm.putc "#{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} (#{operands[0].clValue(:int)} & 0x1f);"
+    end
+end
+
+def cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, condition)
+    $asm.putc "if (isnan(#{operands[0].clValue(:double)}) || isnan(#{operands[1].clValue(:double)})"
+    $asm.putc "    || (#{operands[0].clValue(:double)} #{condition} #{operands[1].clValue(:double)}))"
+    $asm.putc "    goto #{operands[2].cLabel};"
+end
+
+
+def cloopEmitCompareAndSet(operands, type, comparator)
+    # The result is a boolean.  Hence, it doesn't need to be based on the type
+    # of the arguments being compared.
+    $asm.putc "#{operands[2].clValue} = (#{operands[0].clValue(type)} #{comparator} #{op2 = operands[1].clValue(type)});"
+end
+
+
+def cloopEmitCompareAndBranch(operands, type, comparator)
+    $asm.putc "if (#{operands[0].clValue(type)} #{comparator} #{operands[1].clValue(type)})"
+    $asm.putc "    goto #{operands[2].cLabel};"
+end
+
+
+# conditionTest should contain a string that provides a comparator and a RHS
+# value e.g. "< 0".
+def cloopGenerateConditionExpression(operands, type, conditionTest)
+    op1 = operands[0].clValue(type)
+
+    # The operands must consist of 2 or 3 values.
+    case operands.size
+    when 2 # Just test op1 against the conditionTest.
+        lhs = op1
+    when 3 # Mask op1 with op2 before testing against the conditionTest.
+        lhs = "(#{op1} & #{operands[1].clValue(type)})"
+    else
+        raise "Expected 2 or 3 operands but got #{operands.size} at #{codeOriginString}"
+    end
+    
+    "#{lhs} #{conditionTest}"
+end
+
+# conditionTest should contain a string that provides a comparator and a RHS
+# value e.g. "< 0".
+def cloopEmitTestAndBranchIf(operands, type, conditionTest, branchTarget)
+    conditionExpr = cloopGenerateConditionExpression(operands, type, conditionTest)
+    $asm.putc "if (#{conditionExpr})"
+    $asm.putc "    goto #{branchTarget};"
+end
+
+def cloopEmitTestSet(operands, type, conditionTest)
+    # The result is a boolean condition.  Hence, the result type is always an
+    # int.  The passed in type is only used for the values being tested in
+    # the condition test.
+    conditionExpr = cloopGenerateConditionExpression(operands, type, conditionTest)
+    $asm.putc "#{operands[-1].clValue} = (#{conditionExpr});"
+end
+
+def cloopEmitOpAndBranch(operands, operator, type, conditionTest)
+    case type
+    when :int;   tempType = "intptr_t"
+    when :int32; tempType = "int32_t"
+    else
+        raise "Unimplemented type"
+    end
+
+    op1 = operands[0].clValue(type)
+    op2 = operands[1].clValue(type)
+
+    $asm.putc "{"
+    $asm.putc "    #{tempType} temp = #{op2} #{operator} #{op1};"
+    $asm.putc "    if (temp #{conditionTest})"
+    $asm.putc "        goto  #{operands[2].cLabel};"
+    $asm.putc "    #{op2} = temp;"
+    $asm.putc "}"
+end
+
+def cloopAddOverflowTest(operands, type)
+    case type
+    when :int32
+        tempType = "int32_t"
+        signBit = "SIGN_BIT32"
+    else
+        raise "Unimplemented type"
+    end
+
+    $asm.putc "    #{tempType} a = #{operands[0].clValue(type)};"
+    $asm.putc "    #{tempType} b = #{operands[1].clValue(type)};"
+    $asm.putc "    // sign(b) sign(a) | Overflows if:"
+    $asm.putc "    // 0       0       | sign(b+a) = 1 (pos + pos != neg)"
+    $asm.putc "    // 0       1       | never"
+    $asm.putc "    // 1       0       | never"
+    $asm.putc "    // 1       1       | sign(b+a) = 0 (neg + neg != pos)"
+    "((#{signBit}(b) == #{signBit}(a)) && (#{signBit}(b+a) != #{signBit}(a)))"
+end
+
+def cloopSubOverflowTest(operands, type)
+    case type
+    when :int32
+        tempType = "int32_t"
+        signBit = "SIGN_BIT32"
+    else
+        raise "Unimplemented type"
+    end
+
+    $asm.putc "    #{tempType} a = #{operands[0].clValue(type)};"
+    $asm.putc "    #{tempType} b = #{operands[1].clValue(type)};"
+    $asm.putc "    // sign(b) sign(a) | Overflows if:"
+    $asm.putc "    // 0       0       | never"
+    $asm.putc "    // 0       1       | sign(b-a) = 1 (pos - neg != pos)"
+    $asm.putc "    // 1       0       | sign(b-a) = 0 (neg - pos != pos)"
+    $asm.putc "    // 1       1       | never"
+    "((#{signBit}(b) != #{signBit}(a)) && (#{signBit}(b-a) == #{signBit}(a)))"
+end
+
+def cloopMulOverflowTest(operands, type)
+    case type
+    when :int32
+        tempType = "uint32_t"
+    else
+        raise "Unimplemented type"
+    end
+    $asm.putc "    #{tempType} a = #{operands[0].clValue(type)};"
+    $asm.putc "    #{tempType} b = #{operands[1].clValue(type)};"
+    "((b | a) >> 15)"
+end
+
+def cloopEmitOpAndBranchIfOverflow(operands, operator, type)
+    $asm.putc "{"
+
+    # Emit the overflow test based on the operands and the type:
+    case operator
+    when "+"; overflowTest = cloopAddOverflowTest(operands, type)
+    when "-"; overflowTest = cloopSubOverflowTest(operands, type)
+    when "*"; overflowTest = cloopMulOverflowTest(operands, type)
+    else
+        raise "Unimplemented opeartor"
+    end
+
+    $asm.putc "    if #{overflowTest} {"
+    $asm.putc "        goto #{operands[2].cLabel};"
+    $asm.putc "    }"
+    $asm.putc "    #{operands[1].clValue(type)} = #{operands[1].clValue(type)} #{operator} #{operands[0].clValue(type)};"
+    $asm.putc "}"
+end
+
+# operands: callTarget, currentFrame, currentPC
+def cloopEmitCallSlowPath(operands)
+    $asm.putc "{"
+    $asm.putc "    ExecState* exec = CAST<ExecState*>(#{operands[1].clValue(:voidPtr)});"
+    $asm.putc "    Instruction* pc = CAST<Instruction*>(#{operands[2].clValue(:voidPtr)});"
+    $asm.putc "    SlowPathReturnType result = #{operands[0].cLabel}(exec, pc);"
+    $asm.putc "    LLInt::decodeResult(result, t0.instruction, t1.execState);"
+    $asm.putc "}"
+end
+
+class Instruction
+    def lowerC_LOOP
+        $asm.codeOrigin codeOriginString if $enableCodeOriginComments
+        $asm.annotation annotation if $enableInstrAnnotations
+
+        case opcode
+        when "addi"
+            cloopEmitOperation(operands, :int32, "+")
+        when "addp"
+            cloopEmitOperation(operands, :int, "+")
+
+        when "andi"
+            cloopEmitOperation(operands, :int32, "&")
+        when "andp"
+            cloopEmitOperation(operands, :int, "&")
+
+        when "ori"
+            cloopEmitOperation(operands, :int32, "|")
+        when "orp"
+            cloopEmitOperation(operands, :int, "|")
+
+        when "xori"
+            cloopEmitOperation(operands, :int32, "^")
+        when "xorp"
+            cloopEmitOperation(operands, :int, "^")
+
+        when "lshifti"
+            cloopEmitShiftOperation(operands, :int32, "<<")
+        when "lshiftp"
+            cloopEmitShiftOperation(operands, :int, "<<")
+
+        when "rshifti"
+            cloopEmitShiftOperation(operands, :int32, ">>")
+        when "rshiftp"
+            cloopEmitShiftOperation(operands, :int, ">>")
+
+        when "urshifti"
+            cloopEmitShiftOperation(operands, :uint32, ">>")
+        when "urshiftp"
+            cloopEmitShiftOperation(operands, :uint, ">>")
+
+        when "muli"
+            cloopEmitOperation(operands, :int32, "*")
+        when "mulp"
+            cloopEmitOperation(operands, :int, "*")
+
+        when "subi"
+            cloopEmitOperation(operands, :int32, "-")
+        when "subp"
+            cloopEmitOperation(operands, :int, "-")
+
+        when "negi"
+            $asm.putc "#{operands[0].clValue(:int32)} = -#{operands[0].clValue(:int32)};"
+        when "negp"
+            $asm.putc "#{operands[0].clValue(:int)} = -#{operands[0].clValue(:int)};"
+
+        when "noti"
+            $asm.putc "#{operands[0].clValue(:int32)} = !#{operands[0].clValue(:int32)};"
+
+        when "loadi"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].uint32MemRef};"
+        when "loadis"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int32MemRef};"
+        when "loadp"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].intMemRef};"
+        when "storei"
+            $asm.putc "#{operands[1].int32MemRef} = #{operands[0].clValue(:int32)};"
+        when "storep"
+            $asm.putc "#{operands[1].intMemRef} = #{operands[0].clValue(:int)};"
+        when "loadb"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].uint8MemRef};"
+        when "loadbs"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int8MemRef};"
+        when "storeb"
+            $asm.putc "#{operands[1].uint8MemRef} = #{operands[0].clValue(:int8)}"
+        when "loadh"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].uint16MemRef};"
+        when "loadhs"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].int16MemRef};"
+        when "storeh"
+            $asm.putc "*#{operands[1].uint16MemRef} = #{operands[0].clValue(:int16)};"
+        when "loadd"
+            $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].dblMemRef};"
+        when "stored"
+            $asm.putc "#{operands[1].dblMemRef} = #{operands[0].clValue(:double)};"
+
+        when "addd"
+            cloopEmitOperation(operands, :double, "+")
+        when "divd"
+            cloopEmitOperation(operands, :double, "/")
+        when "subd"
+            cloopEmitOperation(operands, :double, "-")
+        when "muld"
+            cloopEmitOperation(operands, :double, "*")
+
+        # Convert an int value to its double equivalent, and store it in a double register.
+        when "ci2d"
+            $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].clValue(:int32)};"
+            
+        when "bdeq"
+            cloopEmitCompareAndBranch(operands, :double, "==")
+        when "bdneq"
+            cloopEmitCompareAndBranch(operands, :double, "!=")
+        when "bdgt"
+            cloopEmitCompareAndBranch(operands, :double, ">");
+        when "bdgteq"
+            cloopEmitCompareAndBranch(operands, :double, ">=");
+        when "bdlt"
+            cloopEmitCompareAndBranch(operands, :double, "<");
+        when "bdlteq"
+            cloopEmitCompareAndBranch(operands, :double, "<=");
+
+        when "bdequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "==")
+        when "bdnequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "!=")
+        when "bdgtun"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, ">")
+        when "bdgtequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, ">=")
+        when "bdltun"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "<")
+        when "bdltequn"
+            cloopEmitCompareDoubleWithNaNCheckAndBranch(operands, "<=")
+
+        when "td2i"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:double)};"
+
+        when "bcd2i"  # operands: srcDbl dstInt slowPath
+            $asm.putc "{"
+            $asm.putc "    double d = #{operands[0].clValue(:double)};"
+            $asm.putc "    const int32_t asInt32 = int32_t(d);"
+            $asm.putc "    if (asInt32 != d || (!asInt32 && signbit(d))) // true for -0.0"
+            $asm.putc "        goto  #{operands[2].cLabel};"
+            $asm.putc "    #{operands[1].clValue} = asInt32;"            
+            $asm.putc "}"
+
+        when "move"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:int)};"
+        when "sxi2p"
+            $asm.putc "#{operands[1].clValue(:int)} = #{operands[0].clValue(:int32)};"
+        when "zxi2p"
+            $asm.putc "#{operands[1].clValue(:uint)} = #{operands[0].clValue(:uint32)};"
+        when "nop"
+            $asm.putc "// nop"
+        when "bbeq"
+            cloopEmitCompareAndBranch(operands, :int8, "==")
+        when "bieq"
+            cloopEmitCompareAndBranch(operands, :int32, "==")
+        when "bpeq"
+            cloopEmitCompareAndBranch(operands, :int, "==")
+
+        when "bbneq"
+            cloopEmitCompareAndBranch(operands, :int8, "!=")
+        when "bineq"
+            cloopEmitCompareAndBranch(operands, :int32, "!=")
+        when "bpneq"
+            cloopEmitCompareAndBranch(operands, :int, "!=")
+
+        when "bba"
+            cloopEmitCompareAndBranch(operands, :uint8, ">")
+        when "bia"
+            cloopEmitCompareAndBranch(operands, :uint32, ">")
+        when "bpa"
+            cloopEmitCompareAndBranch(operands, :uint, ">")
+
+        when "bbaeq"
+            cloopEmitCompareAndBranch(operands, :uint8, ">=")
+        when "biaeq"
+            cloopEmitCompareAndBranch(operands, :uint32, ">=")
+        when "bpaeq"
+            cloopEmitCompareAndBranch(operands, :uint, ">=")
+
+        when "bbb"
+            cloopEmitCompareAndBranch(operands, :uint8, "<")
+        when "bib"
+            cloopEmitCompareAndBranch(operands, :uint32, "<")
+        when "bpb"
+            cloopEmitCompareAndBranch(operands, :uint, "<")
+
+        when "bbbeq"
+            cloopEmitCompareAndBranch(operands, :uint8, "<=")
+        when "bibeq"
+            cloopEmitCompareAndBranch(operands, :uint32, "<=")
+        when "bpbeq"
+            cloopEmitCompareAndBranch(operands, :uint, "<=")
+
+        when "bbgt"
+            cloopEmitCompareAndBranch(operands, :int8, ">")
+        when "bigt"
+            cloopEmitCompareAndBranch(operands, :int32, ">")
+        when "bpgt"
+            cloopEmitCompareAndBranch(operands, :int, ">")
+
+        when "bbgteq"
+            cloopEmitCompareAndBranch(operands, :int8, ">=")
+        when "bigteq"
+            cloopEmitCompareAndBranch(operands, :int32, ">=")
+        when "bpgteq"
+            cloopEmitCompareAndBranch(operands, :int, ">=")
+
+        when "bblt"
+            cloopEmitCompareAndBranch(operands, :int8, "<")
+        when "bilt"
+            cloopEmitCompareAndBranch(operands, :int32, "<")
+        when "bplt"
+            cloopEmitCompareAndBranch(operands, :int, "<")
+
+        when "bblteq"
+            cloopEmitCompareAndBranch(operands, :int8, "<=")
+        when "bilteq"
+            cloopEmitCompareAndBranch(operands, :int32, "<=")
+        when "bplteq"
+            cloopEmitCompareAndBranch(operands, :int, "<=")
+
+        when "btbz"
+            cloopEmitTestAndBranchIf(operands, :int8, "== 0", operands[-1].cLabel)
+        when "btiz"
+            cloopEmitTestAndBranchIf(operands, :int32, "== 0", operands[-1].cLabel)
+        when "btpz"
+            cloopEmitTestAndBranchIf(operands, :int, "== 0", operands[-1].cLabel)
+
+        when "btbnz"
+            cloopEmitTestAndBranchIf(operands, :int8, "!= 0", operands[-1].cLabel)
+        when "btinz"
+            cloopEmitTestAndBranchIf(operands, :int32, "!= 0", operands[-1].cLabel)
+        when "btpnz"
+            cloopEmitTestAndBranchIf(operands, :int, "!= 0", operands[-1].cLabel)
+
+        when "btbs"
+            cloopEmitTestAndBranchIf(operands, :int8, "< 0", operands[-1].cLabel)
+        when "btis"
+            cloopEmitTestAndBranchIf(operands, :int32, "< 0", operands[-1].cLabel)
+        when "btps"
+            cloopEmitTestAndBranchIf(operands, :int, "< 0", operands[-1].cLabel)
+
+        # For jmp, we do not want to assume that we have COMPUTED_GOTO support.
+        # Fortunately, the only times we should ever encounter indirect jmps is
+        # when the jmp target is a CLoop opcode (by design).
+        #
+        # Hence, we check if the jmp target is a known label reference. If so,
+        # we can emit a goto directly. If it is not a known target, then we set
+        # the target in the opcode, and dispatch to it via whatever dispatch
+        # mechanism is in used.
+        when "jmp"
+            if operands[0].is_a? LocalLabelReference or operands[0].is_a? LabelReference
+                # Handles jumps local or global labels.
+                $asm.putc "goto #{operands[0].cLabel};"
+            else
+                # Handles jumps to some computed target.
+                # NOTE: must be an opcode handler or a llint glue helper.
+                $asm.putc "opcode = #{operands[0].clValue(:opcode)};"
+                $asm.putc "DISPATCH_OPCODE();"
+            end
+
+        when "call"
+            $asm.putc "CRASH(); // generic call instruction not supported by design!"
+        when "break"
+            $asm.putc "CRASH(); // break instruction not implemented."
+        when "ret"
+            $asm.putc "goto doReturnHelper;"
+
+        when "cbeq"
+            cloopEmitCompareAndSet(operands, :uint8, "==")
+        when "cieq"
+            cloopEmitCompareAndSet(operands, :uint32, "==")
+        when "cpeq"
+            cloopEmitCompareAndSet(operands, :uint, "==")
+
+        when "cbneq"
+            cloopEmitCompareAndSet(operands, :uint8, "!=")
+        when "cineq"
+            cloopEmitCompareAndSet(operands, :uint32, "!=")
+        when "cpneq"
+            cloopEmitCompareAndSet(operands, :uint, "!=")
+
+        when "cba"
+            cloopEmitCompareAndSet(operands, :uint8, ">")
+        when "cia"
+            cloopEmitCompareAndSet(operands, :uint32, ">")
+        when "cpa"
+            cloopEmitCompareAndSet(operands, :uint, ">")
+
+        when "cbaeq"
+            cloopEmitCompareAndSet(operands, :uint8, ">=")
+        when "ciaeq"
+            cloopEmitCompareAndSet(operands, :uint32, ">=")
+        when "cpaeq"
+            cloopEmitCompareAndSet(operands, :uint, ">=")
+
+        when "cbb"
+            cloopEmitCompareAndSet(operands, :uint8, "<")
+        when "cib"
+            cloopEmitCompareAndSet(operands, :uint32, "<")
+        when "cpb"
+            cloopEmitCompareAndSet(operands, :uint, "<")
+
+        when "cbbeq"
+            cloopEmitCompareAndSet(operands, :uint8, "<=")
+        when "cibeq"
+            cloopEmitCompareAndSet(operands, :uint32, "<=")
+        when "cpbeq"
+            cloopEmitCompareAndSet(operands, :uint, "<=")
+
+        when "cbgt"
+            cloopEmitCompareAndSet(operands, :int8, ">")
+        when "cigt"
+            cloopEmitCompareAndSet(operands, :int32, ">")
+        when "cpgt"
+            cloopEmitCompareAndSet(operands, :int, ">")
+
+        when "cbgteq"
+            cloopEmitCompareAndSet(operands, :int8, ">=")
+        when "cigteq"
+            cloopEmitCompareAndSet(operands, :int32, ">=")
+        when "cpgteq"
+            cloopEmitCompareAndSet(operands, :int, ">=")
+
+        when "cblt"
+            cloopEmitCompareAndSet(operands, :int8, "<")
+        when "cilt"
+            cloopEmitCompareAndSet(operands, :int32, "<")
+        when "cplt"
+            cloopEmitCompareAndSet(operands, :int, "<")
+
+        when "cblteq"
+            cloopEmitCompareAndSet(operands, :int8, "<=")
+        when "cilteq"
+            cloopEmitCompareAndSet(operands, :int32, "<=")
+        when "cplteq"
+            cloopEmitCompareAndSet(operands, :int, "<=")
+
+        when "tbs"
+            cloopEmitTestSet(operands, :int8, "< 0")
+        when "tis"
+            cloopEmitTestSet(operands, :int32, "< 0")
+        when "tps"
+            cloopEmitTestSet(operands, :int, "< 0")
+
+        when "tbz"
+            cloopEmitTestSet(operands, :int8, "== 0")
+        when "tiz"
+            cloopEmitTestSet(operands, :int32, "== 0")
+        when "tpz"
+            cloopEmitTestSet(operands, :int, "== 0")
+
+        when "tbnz"
+            cloopEmitTestSet(operands, :int8, "!= 0")
+        when "tinz"
+            cloopEmitTestSet(operands, :int32, "!= 0")
+        when "tpnz"
+            cloopEmitTestSet(operands, :int, "!= 0")
+
+        # 64-bit instruction: cdqi (based on X64)
+        # Sign extends the lower 32 bits of t0, but put the sign extension into
+        # the lower 32 bits of t1. Leave the upper 32 bits of t0 and t1 unchanged.
+        when "cdqi"
+            $asm.putc "{"
+            $asm.putc "    int64_t temp = t0.i32; // sign extend the low 32bit"
+            $asm.putc "    t0.i32 = temp; // low word"
+            $asm.putc "    t1.i32 = uint64_t(temp) >> 32; // high word"
+            $asm.putc "}"
+
+        # 64-bit instruction: idivi op1 (based on X64)
+        # Divide a 64-bit integer numerator by the specified denominator.
+        # The numerator is specified in t0 and t1 as follows:
+        #     1. low 32 bits of the numerator is in the low 32 bits of t0.
+        #     2. high 32 bits of the numerator is in the low 32 bits of t1.
+        #
+        # The resultant quotient is a signed 32-bit int, and is to be stored
+        # in the lower 32 bits of t0.
+        # The resultant remainder is a signed 32-bit int, and is to be stored
+        # in the lower 32 bits of t1.
+        when "idivi"
+            # Divide t1,t0 (EDX,EAX) by the specified arg, and store the remainder in t1,
+            # and quotient in t0:
+            $asm.putc "{"
+            $asm.putc "    int64_t dividend = (int64_t(t1.u32) << 32) | t0.u32;"
+            $asm.putc "    int64_t divisor = #{operands[0].clValue(:int)};"
+            $asm.putc "    t1.i32 = dividend % divisor; // remainder"
+            $asm.putc "    t0.i32 = dividend / divisor; // quotient"
+            $asm.putc "}"
+
+        # 32-bit instruction: fii2d int32LoOp int32HiOp dblOp (based on ARMv7)
+        # Decode 2 32-bit ints (low and high) into a 64-bit double.
+        when "fii2d"
+            $asm.putc "#{operands[2].clValue(:double)} = Ints2Double(#{operands[0].clValue(:uint32)}, #{operands[1].clValue(:uint32)});"
+
+        # 32-bit instruction: f2dii dblOp int32LoOp int32HiOp (based on ARMv7)
+        # Encode a 64-bit double into 2 32-bit ints (low and high).
+        when "fd2ii"
+            $asm.putc "Double2Ints(#{operands[0].clValue(:double)}, #{operands[1].clValue}, #{operands[2].clValue});"
+
+        # 64-bit instruction: fp2d int64Op dblOp (based on X64)
+        # Copy a bit-encoded double in a 64-bit int register to a double register.
+        when "fp2d"
+            $asm.putc "#{operands[1].clValue(:double)} = #{operands[0].clValue(:castToDouble)};"
+
+        # 64-bit instruction: fd2p dblOp int64Op (based on X64 instruction set)
+        # Copy a double as a bit-encoded double into a 64-bit int register.
+        when "fd2p"
+            $asm.putc "#{operands[1].clValue(:voidPtr)} = #{operands[0].clValue(:castToVoidPtr)};"
+
+        when "leai"
+            operands[0].cloopEmitLea(operands[1], :int32)
+        when "leap"
+            operands[0].cloopEmitLea(operands[1], :int)
+
+        when "baddio"
+            cloopEmitOpAndBranchIfOverflow(operands, "+", :int32)
+        when "bsubio"
+            cloopEmitOpAndBranchIfOverflow(operands, "-", :int32)
+        when "bmulio"
+            cloopEmitOpAndBranchIfOverflow(operands, "*", :int32)
+
+        when "baddis"
+            cloopEmitOpAndBranch(operands, "+", :int32, "< 0")
+        when "baddiz"
+            cloopEmitOpAndBranch(operands, "+", :int32, "== 0")
+        when "baddinz"
+            cloopEmitOpAndBranch(operands, "+", :int32, "!= 0")
+
+        when "baddps"
+            cloopEmitOpAndBranch(operands, "+", :int, "< 0")
+        when "baddpz"
+            cloopEmitOpAndBranch(operands, "+", :int, "== 0")
+        when "baddpnz"
+            cloopEmitOpAndBranch(operands, "+", :int, "!= 0")
+
+        when "bsubis"
+            cloopEmitOpAndBranch(operands, "-", :int32, "< 0")
+        when "bsubiz"
+            cloopEmitOpAndBranch(operands, "-", :int32, "== 0")
+        when "bsubinz"
+            cloopEmitOpAndBranch(operands, "-", :int32, "!= 0")
+
+        when "borris"
+            cloopEmitOpAndBranch(operands, "|", :int32, "< 0")
+        when "borriz"
+            cloopEmitOpAndBranch(operands, "|", :int32, "== 0")
+        when "borrinz"
+            cloopEmitOpAndBranch(operands, "|", :int32, "!= 0")
+
+        # A convenience and compact call to crash because we don't want to use
+        # the generic llint crash mechanism which relies on the availability
+        # of the call instruction (which cannot be implemented in a generic
+        # way, and can be abused if we made it just work for this special case).
+        # Using a special cloopCrash instruction is cleaner.
+        when "cloopCrash"
+            $asm.putc "CRASH();"
+
+        # We can't rely on the llint JS call mechanism which actually makes
+        # use of the call instruction. Instead, we just implement JS calls
+        # as an opcode dispatch.
+        when "cloopCallJSFunction"
+            $asm.putc "opcode = #{operands[0].clValue(:opcode)};"
+            $asm.putc "DISPATCH_OPCODE();"
+
+        # We can't do generic function calls with an arbitrary set of args, but
+        # fortunately we don't have to here. All native function calls always
+        # have a fixed prototype of 1 args: the passed ExecState.
+        when "cloopCallNative"
+            $asm.putc "nativeFunc = #{operands[0].clValue(:nativeFunc)};"
+            $asm.putc "functionReturnValue = JSValue::decode(nativeFunc(t0.execState));"
+            $asm.putc "#if USE(JSVALUE32_64)"
+            $asm.putc "    t1.i = functionReturnValue.tag();"
+            $asm.putc "    t0.i = functionReturnValue.payload();"
+            $asm.putc "#else // USE_JSVALUE64)"
+            $asm.putc "    t0.encodedJSValue = JSValue::encode(functionReturnValue);"
+            $asm.putc "#endif // USE_JSVALUE64)"            
+
+        # We can't do generic function calls with an arbitrary set of args, but
+        # fortunately we don't have to here. All slow path function calls always
+        # have a fixed prototype too. See cloopEmitCallSlowPath() for details.
+        when "cloopCallSlowPath"
+            cloopEmitCallSlowPath(operands)
+
+        else
+            lowerDefault
+        end
+    end
+end
diff --git a/Source/JavaScriptCore/offlineasm/config.rb b/Source/JavaScriptCore/offlineasm/config.rb
index e6287f367..4c86eeceb 100644
--- a/Source/JavaScriptCore/offlineasm/config.rb
+++ b/Source/JavaScriptCore/offlineasm/config.rb
@@ -21,7 +21,7 @@
 # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 # THE POSSIBILITY OF SUCH DAMAGE.
 
-$preferredCommentStartColumn = 70
+$preferredCommentStartColumn = 60
 
 
 # Turns on dumping of the count of labels.
diff --git a/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb b/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
index fefbb1290..81c28632c 100644
--- a/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
+++ b/Source/JavaScriptCore/offlineasm/generate_offset_extractor.rb
@@ -42,7 +42,7 @@ $stderr.puts "offlineasm: Parsing #{inputFlnm} and creating offset extractor #{o
 def emitMagicNumber
     OFFSET_MAGIC_NUMBERS.each {
         | number |
-        $output.puts "#{number},"
+        $output.puts "unsigned(#{number}),"
     }
 end
 
@@ -120,7 +120,7 @@ File.open(outputFlnm, "w") {
         | settings, ast, backend, index |
         OFFSET_HEADER_MAGIC_NUMBERS.each {
             | number |
-            $output.puts "#{number},"
+            $output.puts "unsigned(#{number}),"
         }
 
         offsetsList = ast.filter(StructOffset).uniq.sort
diff --git a/Source/JavaScriptCore/offlineasm/instructions.rb b/Source/JavaScriptCore/offlineasm/instructions.rb
index aa1a32393..211c10933 100644
--- a/Source/JavaScriptCore/offlineasm/instructions.rb
+++ b/Source/JavaScriptCore/offlineasm/instructions.rb
@@ -227,7 +227,15 @@ ARMv7_INSTRUCTIONS =
      "oris"
     ]
 
-INSTRUCTIONS = MACRO_INSTRUCTIONS + X86_INSTRUCTIONS + ARMv7_INSTRUCTIONS
+CXX_INSTRUCTIONS =
+    [
+     "cloopCrash",           # no operands
+     "cloopCallJSFunction",  # operands: callee
+     "cloopCallNative",      # operands: callee
+     "cloopCallSlowPath",    # operands: callTarget, currentFrame, currentPC
+    ]
+
+INSTRUCTIONS = MACRO_INSTRUCTIONS + X86_INSTRUCTIONS + ARMv7_INSTRUCTIONS + CXX_INSTRUCTIONS
 
 INSTRUCTION_PATTERN = Regexp.new('\\A((' + INSTRUCTIONS.join(')|(') + '))\\Z')
 
diff --git a/Source/JavaScriptCore/offlineasm/offsets.rb b/Source/JavaScriptCore/offlineasm/offsets.rb
index 8a064a216..627183dc8 100644
--- a/Source/JavaScriptCore/offlineasm/offsets.rb
+++ b/Source/JavaScriptCore/offlineasm/offsets.rb
@@ -61,7 +61,7 @@ end
 
 #
 # offsetsAndConfigurationIndex(ast, file) ->
-#     [[offsets, index], ...]
+#     {[offsets, index], ...}
 #
 # Parses the offsets from a file and returns a list of offsets and the
 # index of the configuration that is valid in this build target.
@@ -69,7 +69,7 @@ end
 
 def offsetsAndConfigurationIndex(file)
     endiannessMarkerBytes = nil
-    result = []
+    result = {}
     
     def readInt(endianness, bytes)
         if endianness == :little
@@ -155,13 +155,14 @@ def offsetsAndConfigurationIndex(file)
                     | data |
                     offsets << readInt(endianness, data)
                 }
-                result << [offsets, index]
+                if not result.has_key?(offsets)
+                    result[offsets] = index
+                end
             }
         end
     }
     
     raise MissingMagicValuesException unless result.length >= 1
-    raise if result.map{|v| v[1]}.uniq.size < result.map{|v| v[1]}.size
     
     result
 end
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index 0a71f1294..6e7334f97 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -220,7 +220,7 @@ public:
 
     ExpressionNode* createRegExp(const JSTokenLocation& location, const Identifier& pattern, const Identifier& flags, int start)
     {
-        if (Yarr::checkSyntax(pattern.ustring()))
+        if (Yarr::checkSyntax(pattern.string()))
             return 0;
         RegExpNode* node = new (m_globalData) RegExpNode(location, pattern, flags);
         int size = pattern.length() + 2; // + 2 for the two /'s
@@ -943,47 +943,12 @@ ExpressionNode* ASTBuilder::makeAssignNode(const JSTokenLocation& location, Expr
 
 ExpressionNode* ASTBuilder::makePrefixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
-    if (!expr->isLocation())
-        return new (m_globalData) PrefixErrorNode(location, op, divot, divot - start, end - divot);
-
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (m_globalData) PrefixResolveNode(location, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (m_globalData) PrefixBracketNode(location, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
-        return node;
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (m_globalData) PrefixDotNode(location, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->startOffset());
-    return node;
+    return new (m_globalData) PrefixNode(location, expr, op, divot, divot - start, end - divot);
 }
 
 ExpressionNode* ASTBuilder::makePostfixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
-    if (!expr->isLocation())
-        return new (m_globalData) PostfixErrorNode(location, op, divot, divot - start, end - divot);
-
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (m_globalData) PostfixResolveNode(location, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (m_globalData) PostfixBracketNode(location, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return node;
-
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (m_globalData) PostfixDotNode(location, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
+    return new (m_globalData) PostfixNode(location, expr, op, divot, divot - start, end - divot);
 }
 
 }
diff --git a/Source/JavaScriptCore/parser/Lexer.cpp b/Source/JavaScriptCore/parser/Lexer.cpp
index 2a8a8dc9e..063168be1 100644
--- a/Source/JavaScriptCore/parser/Lexer.cpp
+++ b/Source/JavaScriptCore/parser/Lexer.cpp
@@ -368,7 +368,7 @@ Lexer<T>::~Lexer()
 }
 
 template <typename T>
-UString Lexer<T>::invalidCharacterMessage() const
+String Lexer<T>::invalidCharacterMessage() const
 {
     switch (m_current) {
     case 0:
@@ -418,7 +418,7 @@ void Lexer<T>::setCode(const SourceCode& source, ParserArena* arena)
     m_error = false;
     m_atLineStart = true;
     m_columnNumber = 0;
-    m_lexErrorMessage = UString();
+    m_lexErrorMessage = String();
     
     m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer16.reserveInitialCapacity((m_codeEnd - m_code) / 2);
diff --git a/Source/JavaScriptCore/parser/Lexer.h b/Source/JavaScriptCore/parser/Lexer.h
index 1ac832a2c..d75f2020d 100644
--- a/Source/JavaScriptCore/parser/Lexer.h
+++ b/Source/JavaScriptCore/parser/Lexer.h
@@ -100,12 +100,12 @@ public:
 
     // Functions for use after parsing.
     bool sawError() const { return m_error; }
-    UString getErrorMessage() const { return m_lexErrorMessage; }
+    String getErrorMessage() const { return m_lexErrorMessage; }
     void clear();
     void setOffset(int offset)
     {
         m_error = 0;
-        m_lexErrorMessage = UString();
+        m_lexErrorMessage = String();
         m_code = m_codeStart + offset;
         m_buffer8.resize(0);
         m_buffer16.resize(0);
@@ -137,7 +137,7 @@ private:
     int parseFourDigitUnicodeHex();
     void shiftLineTerminator();
 
-    UString invalidCharacterMessage() const;
+    String invalidCharacterMessage() const;
     ALWAYS_INLINE const T* currentCharacter() const;
     ALWAYS_INLINE int currentOffset() const { return m_code - m_codeStart; }
     ALWAYS_INLINE void setOffsetFromCharOffset(const T* charOffset) { setOffset(charOffset - m_codeStart); }
@@ -181,7 +181,7 @@ private:
     bool m_isReparsing;
     bool m_atLineStart;
     bool m_error;
-    UString m_lexErrorMessage;
+    String m_lexErrorMessage;
 
     T m_current;
 
diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
index 43d1e17c6..1678bf7ea 100644
--- a/Source/JavaScriptCore/parser/NodeConstructors.h
+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
@@ -287,40 +287,10 @@ namespace JSC {
     {
     }
 
-    inline PrePostResolveNode::PrePostResolveNode(const JSTokenLocation& location, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(location, ResultType::numberType()) // could be reusable for pre?
-        , ThrowableExpressionData(divot, startOffset, endOffset)
-        , m_ident(ident)
-    {
-    }
-
-    inline PostfixResolveNode::PostfixResolveNode(const JSTokenLocation& location, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : PrePostResolveNode(location, ident, divot, startOffset, endOffset)
-        , m_operator(oper)
-    {
-    }
-
-    inline PostfixBracketNode::PostfixBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(location)
-        , ThrowableSubExpressionData(divot, startOffset, endOffset)
-        , m_base(base)
-        , m_subscript(subscript)
-        , m_operator(oper)
-    {
-    }
-
-    inline PostfixDotNode::PostfixDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(location)
-        , ThrowableSubExpressionData(divot, startOffset, endOffset)
-        , m_base(base)
-        , m_ident(ident)
-        , m_operator(oper)
-    {
-    }
-
-    inline PostfixErrorNode::PostfixErrorNode(const JSTokenLocation& location, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+    inline PostfixNode::PostfixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
         : ExpressionNode(location)
-        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
         , m_operator(oper)
     {
     }
@@ -372,33 +342,10 @@ namespace JSC {
     {
     }
 
-    inline PrefixResolveNode::PrefixResolveNode(const JSTokenLocation& location, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : PrePostResolveNode(location, ident, divot, startOffset, endOffset)
-        , m_operator(oper)
-    {
-    }
-
-    inline PrefixBracketNode::PrefixBracketNode(const JSTokenLocation& location, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(location)
-        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-        , m_base(base)
-        , m_subscript(subscript)
-        , m_operator(oper)
-    {
-    }
-
-    inline PrefixDotNode::PrefixDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+    inline PrefixNode::PrefixNode(const JSTokenLocation& location, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
         : ExpressionNode(location)
         , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-        , m_base(base)
-        , m_ident(ident)
-        , m_operator(oper)
-    {
-    }
-
-    inline PrefixErrorNode::PrefixErrorNode(const JSTokenLocation& location, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
-        : ExpressionNode(location)
-        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
         , m_operator(oper)
     {
     }
@@ -802,14 +749,14 @@ namespace JSC {
         : ExpressionNode(location)
         , m_body(body)
     {
-        m_body->finishParsing(source, parameter, ident);
+        m_body->finishParsing(source, parameter, ident, FunctionNameIsInScope);
     }
 
     inline FuncDeclNode::FuncDeclNode(const JSTokenLocation& location, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
         : StatementNode(location)
         , m_body(body)
     {
-        m_body->finishParsing(source, parameter, ident);
+        m_body->finishParsing(source, parameter, ident, FunctionNameIsNotInScope);
     }
 
     inline CaseClauseNode::CaseClauseNode(ExpressionNode* expr, SourceElements* statements)
diff --git a/Source/JavaScriptCore/parser/Nodes.cpp b/Source/JavaScriptCore/parser/Nodes.cpp
index 0172359c7..14ee83805 100644
--- a/Source/JavaScriptCore/parser/Nodes.cpp
+++ b/Source/JavaScriptCore/parser/Nodes.cpp
@@ -33,7 +33,7 @@
 #include "JIT.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
-#include "JSStaticScopeObject.h"
+#include "JSNameScope.h"
 #include "LabelScope.h"
 #include "Lexer.h"
 #include "Operations.h"
@@ -167,17 +167,18 @@ inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, const JSToke
 {
 }
 
-void FunctionBodyNode::finishParsing(const SourceCode& source, ParameterNode* firstParameter, const Identifier& ident)
+void FunctionBodyNode::finishParsing(const SourceCode& source, ParameterNode* firstParameter, const Identifier& ident, FunctionNameIsInScopeToggle functionNameIsInScopeToggle)
 {
     setSource(source);
-    finishParsing(FunctionParameters::create(firstParameter), ident);
+    finishParsing(FunctionParameters::create(firstParameter), ident, functionNameIsInScopeToggle);
 }
 
-void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters, const Identifier& ident)
+void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters, const Identifier& ident, FunctionNameIsInScopeToggle functionNameIsInScopeToggle)
 {
     ASSERT(!source().isNull());
     m_parameters = parameters;
     m_ident = ident;
+    m_functionNameIsInScopeToggle = functionNameIsInScopeToggle;
 }
 
 FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, const JSTokenLocation& location, bool inStrictContext)
diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
index ed1a85aaf..475689ce9 100644
--- a/Source/JavaScriptCore/parser/Nodes.h
+++ b/Source/JavaScriptCore/parser/Nodes.h
@@ -44,7 +44,7 @@ namespace JSC {
     class PropertyListNode;
     class ReadModifyResolveNode;
     class RegisterID;
-    class ScopeChainNode;
+    class JSScope;
     class ScopeNode;
 
     typedef unsigned CodeFeatures;
@@ -279,7 +279,7 @@ namespace JSC {
         uint16_t endOffset() const { return m_endOffset; }
 
     protected:
-        RegisterID* emitThrowReferenceError(BytecodeGenerator&, const UString& message);
+        RegisterID* emitThrowReferenceError(BytecodeGenerator&, const String& message);
 
     private:
         uint32_t m_divot;
@@ -461,6 +461,8 @@ namespace JSC {
         ExpressionNode* base() const { return m_base; }
         ExpressionNode* subscript() const { return m_subscript; }
 
+        bool subscriptHasAssignments() const { return m_subscriptHasAssignments; }
+
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
@@ -594,55 +596,17 @@ namespace JSC {
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
-    class PrePostResolveNode : public ExpressionNode, public ThrowableExpressionData {
-    public:
-        PrePostResolveNode(const JSTokenLocation&, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    protected:
-        const Identifier& m_ident;
-    };
-
-    class PostfixResolveNode : public PrePostResolveNode {
-    public:
-        PostfixResolveNode(const JSTokenLocation&, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        Operator m_operator;
-    };
-
-    class PostfixBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
-    public:
-        PostfixBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        ExpressionNode* m_base;
-        ExpressionNode* m_subscript;
-        Operator m_operator;
-    };
-
-    class PostfixDotNode : public ExpressionNode, public ThrowableSubExpressionData {
-    public:
-        PostfixDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        ExpressionNode* m_base;
-        const Identifier& m_ident;
-        Operator m_operator;
-    };
-
-    class PostfixErrorNode : public ExpressionNode, public ThrowableSubExpressionData {
+    class PostfixNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PostfixErrorNode(const JSTokenLocation&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PostfixNode(const JSTokenLocation&, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitResolve(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitBracket(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitDot(BytecodeGenerator&, RegisterID* = 0);
 
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
@@ -720,47 +684,17 @@ namespace JSC {
         ExpressionNode* m_expr;
     };
 
-    class PrefixResolveNode : public PrePostResolveNode {
+    class PrefixNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixResolveNode(const JSTokenLocation&, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        Operator m_operator;
-    };
-
-    class PrefixBracketNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
-    public:
-        PrefixBracketNode(const JSTokenLocation&, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        ExpressionNode* m_base;
-        ExpressionNode* m_subscript;
-        Operator m_operator;
-    };
-
-    class PrefixDotNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
-    public:
-        PrefixDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
-
-    private:
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        ExpressionNode* m_base;
-        const Identifier& m_ident;
-        Operator m_operator;
-    };
-
-    class PrefixErrorNode : public ExpressionNode, public ThrowableExpressionData {
-    public:
-        PrefixErrorNode(const JSTokenLocation&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrefixNode(const JSTokenLocation&, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitResolve(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitBracket(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitDot(BytecodeGenerator&, RegisterID* = 0);
 
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
@@ -1389,7 +1323,7 @@ namespace JSC {
         }
 
         const SourceCode& source() const { return m_source; }
-        const UString& sourceURL() const { return m_source.provider()->url(); }
+        const String& sourceURL() const { return m_source.provider()->url(); }
         intptr_t sourceID() const { return m_source.providerID(); }
 
         void setFeatures(CodeFeatures features) { m_features = features; }
@@ -1469,6 +1403,7 @@ namespace JSC {
         FunctionParameters(ParameterNode*);
     };
 
+    enum FunctionNameIsInScopeToggle { FunctionNameIsNotInScope, FunctionNameIsInScope };
     class FunctionBodyNode : public ScopeNode {
     public:
         static const bool isFunctionNode = true;
@@ -1480,13 +1415,16 @@ namespace JSC {
 
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        void finishParsing(const SourceCode&, ParameterNode*, const Identifier&);
-        void finishParsing(PassRefPtr<FunctionParameters>, const Identifier&);
+        void finishParsing(const SourceCode&, ParameterNode*, const Identifier&, FunctionNameIsInScopeToggle);
+        void finishParsing(PassRefPtr<FunctionParameters>, const Identifier&, FunctionNameIsInScopeToggle);
         
         const Identifier& ident() { return m_ident; }
         void setInferredName(const Identifier& inferredName) { ASSERT(!inferredName.isNull()); m_inferredName = inferredName; }
         const Identifier& inferredName() { return m_inferredName.isEmpty() ? m_ident : m_inferredName; }
 
+        bool functionNameIsInScope() { return m_functionNameIsInScopeToggle == FunctionNameIsInScope; }
+        FunctionNameIsInScopeToggle functionNameIsInScopeToggle() { return m_functionNameIsInScopeToggle; }
+
         static const bool scopeIsFunction = true;
 
     private:
@@ -1495,6 +1433,7 @@ namespace JSC {
 
         Identifier m_ident;
         Identifier m_inferredName;
+        FunctionNameIsInScopeToggle m_functionNameIsInScopeToggle;
         RefPtr<FunctionParameters> m_parameters;
     };
 
diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
index 4fd671fb7..3555f07cd 100644
--- a/Source/JavaScriptCore/parser/Parser.cpp
+++ b/Source/JavaScriptCore/parser/Parser.cpp
@@ -40,7 +40,7 @@ using namespace std;
 namespace JSC {
 
 template <typename LexerType>
-Parser<LexerType>::Parser(JSGlobalData* globalData, const SourceCode& source, FunctionParameters* parameters, JSParserStrictness strictness, JSParserMode parserMode)
+Parser<LexerType>::Parser(JSGlobalData* globalData, const SourceCode& source, FunctionParameters* parameters, const Identifier& name, JSParserStrictness strictness, JSParserMode parserMode)
     : m_globalData(globalData)
     , m_source(&source)
     , m_stack(wtfThreadData().stack())
@@ -71,6 +71,8 @@ Parser<LexerType>::Parser(JSGlobalData* globalData, const SourceCode& source, Fu
         for (unsigned i = 0; i < parameters->size(); i++)
             scope->declareParameter(&parameters->at(i));
     }
+    if (!name.isNull())
+        scope->declareCallee(&name);
     next();
     m_lexer->setLastLineNumber(tokenLine());
 }
@@ -81,9 +83,9 @@ Parser<LexerType>::~Parser()
 }
 
 template <typename LexerType>
-UString Parser<LexerType>::parseInner()
+String Parser<LexerType>::parseInner()
 {
-    UString parseError = UString();
+    String parseError = String();
     
     unsigned oldFunctionCacheSize = m_functionCache ? m_functionCache->byteSize() : 0;
     ASTBuilder context(const_cast<JSGlobalData*>(m_globalData), const_cast<SourceCode*>(m_source));
@@ -1507,7 +1509,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parsePrimaryExpre
         next();
         TreeExpression re = context.createRegExp(location, *pattern, *flags, start);
         if (!re) {
-            const char* yarrErrorMsg = Yarr::checkSyntax(pattern->ustring());
+            const char* yarrErrorMsg = Yarr::checkSyntax(pattern->string());
             ASSERT(!m_errorMessage.isNull());
             failWithMessage(yarrErrorMsg);
         }
diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
index 79a95b696..3a61da1a8 100644
--- a/Source/JavaScriptCore/parser/Parser.h
+++ b/Source/JavaScriptCore/parser/Parser.h
@@ -56,7 +56,6 @@ class Identifier;
 class JSGlobalData;
 class ProgramNode;
 class SourceCode;
-class UString;
 
 #define fail() do { if (!m_error) updateErrorMessage(); return 0; } while (0)
 #define failWithToken(tok) do { if (!m_error) updateErrorMessage(tok); return 0; } while (0)
@@ -209,11 +208,16 @@ struct Scope {
     bool isFunction() { return m_isFunction; }
     bool isFunctionBoundary() { return m_isFunctionBoundary; }
 
+    void declareCallee(const Identifier* ident)
+    {
+        m_declaredVariables.add(ident->string().impl());
+    }
+
     bool declareVariable(const Identifier* ident)
     {
         bool isValidStrictMode = m_globalData->propertyNames->eval != *ident && m_globalData->propertyNames->arguments != *ident;
         m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
-        m_declaredVariables.add(ident->ustring().impl());
+        m_declaredVariables.add(ident->string().impl());
         return isValidStrictMode;
     }
 
@@ -229,7 +233,7 @@ struct Scope {
     bool declareParameter(const Identifier* ident)
     {
         bool isArguments = m_globalData->propertyNames->arguments == *ident;
-        bool isValidStrictMode = m_declaredVariables.add(ident->ustring().impl()).isNewEntry && m_globalData->propertyNames->eval != *ident && !isArguments;
+        bool isValidStrictMode = m_declaredVariables.add(ident->string().impl()).isNewEntry && m_globalData->propertyNames->eval != *ident && !isArguments;
         m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
         if (isArguments)
             m_shadowsArguments = true;
@@ -239,7 +243,7 @@ struct Scope {
     void useVariable(const Identifier* ident, bool isEval)
     {
         m_usesEval |= isEval;
-        m_usedVariables.add(ident->ustring().impl());
+        m_usedVariables.add(ident->string().impl());
     }
 
     void setNeedsFullActivation() { m_needsFullActivation = true; }
@@ -383,7 +387,7 @@ class Parser {
     WTF_MAKE_FAST_ALLOCATED;
 
 public:
-    Parser(JSGlobalData*, const SourceCode&, FunctionParameters*, JSParserStrictness, JSParserMode);
+    Parser(JSGlobalData*, const SourceCode&, FunctionParameters*, const Identifier&, JSParserStrictness, JSParserMode);
     ~Parser();
 
     template <class ParsedNode>
@@ -489,7 +493,7 @@ private:
     }
 
     Parser();
-    UString parseInner();
+    String parseInner();
 
     void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
                           ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures,
@@ -529,9 +533,9 @@ private:
         return result;
     }
     
-    ALWAYS_INLINE UString getToken() {
+    ALWAYS_INLINE String getToken() {
         SourceProvider* sourceProvider = m_source->provider();
-        return UString(sourceProvider->getRange(tokenStart(), tokenEnd()).impl());
+        return sourceProvider->getRange(tokenStart(), tokenEnd());
     }
     
     ALWAYS_INLINE bool match(JSTokenType expected)
@@ -736,52 +740,34 @@ private:
     
     ALWAYS_INLINE void updateErrorMessageSpecialCase(JSTokenType expectedToken) 
     {
-        String errorMessage;
         switch (expectedToken) {
         case RESERVED_IF_STRICT:
-            errorMessage = "Use of reserved word '";
-            errorMessage += getToken().impl();
-            errorMessage += "' in strict mode";
-            m_errorMessage = errorMessage.impl();
+            m_errorMessage = "Use of reserved word '" + getToken() + "' in strict mode";
             return;
         case RESERVED:
-            errorMessage = "Use of reserved word '";
-            errorMessage += getToken().impl();
-            errorMessage += "'";
-            m_errorMessage = errorMessage.impl();
+            m_errorMessage = "Use of reserved word '" + getToken() + '\'';
             return;
         case NUMBER: 
-            errorMessage = "Unexpected number '";
-            errorMessage += getToken().impl();
-            errorMessage += "'";
-            m_errorMessage = errorMessage.impl();
+            m_errorMessage = "Unexpected number '" + getToken() + '\'';
             return;
         case IDENT: 
-            errorMessage = "Expected an identifier but found '";
-            errorMessage += getToken().impl();
-            errorMessage += "' instead";
-            m_errorMessage = errorMessage.impl();
+            m_errorMessage = "Expected an identifier but found '" + getToken() + "' instead";
             return;
         case STRING: 
-            errorMessage = "Unexpected string ";
-            errorMessage += getToken().impl();
-            m_errorMessage = errorMessage.impl();
+            m_errorMessage = "Unexpected string " + getToken();
             return;
         case ERRORTOK: 
-            errorMessage = "Unrecognized token '";
-            errorMessage += getToken().impl();
-            errorMessage += "'";
-            m_errorMessage = errorMessage.impl();
+            m_errorMessage = "Unrecognized token '" + getToken() + '\'';
             return;
         case EOFTOK:  
-            m_errorMessage = "Unexpected EOF";
+            m_errorMessage = ASCIILiteral("Unexpected EOF");
             return;
         case RETURN:
-            m_errorMessage = "Return statements are only valid inside functions";
+            m_errorMessage = ASCIILiteral("Return statements are only valid inside functions");
             return;
         default:
             ASSERT_NOT_REACHED();
-            m_errorMessage = "internal error";
+            m_errorMessage = ASCIILiteral("internal error");
             return;
         }
     }
@@ -793,7 +779,7 @@ private:
         if (!name) 
             updateErrorMessageSpecialCase(m_token.m_type);
         else 
-            m_errorMessage = UString(String::format("Unexpected token '%s'", name).impl());
+            m_errorMessage = String::format("Unexpected token '%s'", name);
     }
     
     NEVER_INLINE void updateErrorMessage(JSTokenType expectedToken) 
@@ -801,31 +787,25 @@ private:
         m_error = true;
         const char* name = getTokenName(expectedToken);
         if (name)
-            m_errorMessage = UString(String::format("Expected token '%s'", name).impl());
+            m_errorMessage = String::format("Expected token '%s'", name);
         else {
             if (!getTokenName(m_token.m_type))
                 updateErrorMessageSpecialCase(m_token.m_type);
             else
                 updateErrorMessageSpecialCase(expectedToken);
-        } 
+        }
     }
     
-    NEVER_INLINE void updateErrorWithNameAndMessage(const char* beforeMsg, UString name, const char* afterMsg) 
+    NEVER_INLINE void updateErrorWithNameAndMessage(const char* beforeMsg, String name, const char* afterMsg)
     {
         m_error = true;
-        String prefix(beforeMsg);
-        String postfix(afterMsg);
-        prefix += " '";
-        prefix += name.impl();
-        prefix += "' ";
-        prefix += postfix;
-        m_errorMessage = prefix.impl();
+        m_errorMessage = makeString(beforeMsg, " '", name, "' ", afterMsg);
     }
     
-    NEVER_INLINE void updateErrorMessage(const char* msg) 
+    NEVER_INLINE void updateErrorMessage(const char* msg)
     {   
         m_error = true;
-        m_errorMessage = UString(msg);
+        m_errorMessage = String(msg);
     }
     
     void startLoop() { currentScope()->startLoop(); }
@@ -938,7 +918,7 @@ private:
     
     StackBounds m_stack;
     bool m_error;
-    UString m_errorMessage;
+    String m_errorMessage;
     JSToken m_token;
     bool m_allowsIn;
     int m_lastLine;
@@ -982,7 +962,7 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
     ASSERT(lexicalGlobalObject);
     ASSERT(exception && !*exception);
     int errLine;
-    UString errMsg;
+    String errMsg;
 
     if (ParsedNode::scopeIsFunction)
         m_lexer->setIsReparsing();
@@ -990,13 +970,13 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
     m_sourceElements = 0;
 
     errLine = -1;
-    errMsg = UString();
+    errMsg = String();
 
-    UString parseError = parseInner();
+    String parseError = parseInner();
 
     int lineNumber = m_lexer->lineNumber();
     bool lexError = m_lexer->sawError();
-    UString lexErrorMessage = lexError ? m_lexer->getErrorMessage() : UString();
+    String lexErrorMessage = lexError ? m_lexer->getErrorMessage() : String();
     ASSERT(lexErrorMessage.isNull() != lexError);
     m_lexer->clear();
 
@@ -1045,17 +1025,17 @@ PassRefPtr<ParsedNode> Parser<LexerType>::parse(JSGlobalObject* lexicalGlobalObj
 }
 
 template <class ParsedNode>
-PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, JSGlobalObject* lexicalGlobalObject, const SourceCode& source, FunctionParameters* parameters, JSParserStrictness strictness, JSParserMode parserMode, Debugger* debugger, ExecState* execState, JSObject** exception)
+PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, JSGlobalObject* lexicalGlobalObject, const SourceCode& source, FunctionParameters* parameters, const Identifier& name, JSParserStrictness strictness, JSParserMode parserMode, Debugger* debugger, ExecState* execState, JSObject** exception)
 {
     SamplingRegion samplingRegion("Parsing");
 
     ASSERT(source.provider()->data());
 
     if (source.provider()->data()->is8Bit()) {
-        Parser< Lexer<LChar> > parser(globalData, source, parameters, strictness, parserMode);
+        Parser< Lexer<LChar> > parser(globalData, source, parameters, name, strictness, parserMode);
         return parser.parse<ParsedNode>(lexicalGlobalObject, debugger, execState, exception);
     }
-    Parser< Lexer<UChar> > parser(globalData, source, parameters, strictness, parserMode);
+    Parser< Lexer<UChar> > parser(globalData, source, parameters, name, strictness, parserMode);
     return parser.parse<ParsedNode>(lexicalGlobalObject, debugger, execState, exception);
 }
 
diff --git a/Source/JavaScriptCore/parser/ParserArena.h b/Source/JavaScriptCore/parser/ParserArena.h
index 067b83a26..2f5b447b1 100644
--- a/Source/JavaScriptCore/parser/ParserArena.h
+++ b/Source/JavaScriptCore/parser/ParserArena.h
@@ -113,7 +113,7 @@ namespace JSC {
     
     inline const Identifier& IdentifierArena::makeNumericIdentifier(JSGlobalData* globalData, double number)
     {
-        m_identifiers.append(Identifier(globalData, UString::number(number)));
+        m_identifiers.append(Identifier(globalData, String::numberToStringECMAScript(number)));
         return m_identifiers.last();
     }
 
diff --git a/Source/JavaScriptCore/parser/SourceCode.h b/Source/JavaScriptCore/parser/SourceCode.h
index 11a00337d..bda91b3c8 100644
--- a/Source/JavaScriptCore/parser/SourceCode.h
+++ b/Source/JavaScriptCore/parser/SourceCode.h
@@ -60,10 +60,10 @@ namespace JSC {
         {
         }
 
-        UString toString() const
+        String toString() const
         {
             if (!m_provider)
-                return UString();
+                return String();
             return m_provider->getRange(m_startChar, m_endChar);
         }
         
@@ -90,9 +90,9 @@ namespace JSC {
         int m_firstLine;
     };
 
-    inline SourceCode makeSource(const UString& source, const UString& url = UString(), const TextPosition& startPosition = TextPosition::minimumPosition())
+    inline SourceCode makeSource(const String& source, const String& url = String(), const TextPosition& startPosition = TextPosition::minimumPosition())
     {
-        return SourceCode(UStringSourceProvider::create(source, url, startPosition), startPosition.m_line.oneBasedInt());
+        return SourceCode(StringSourceProvider::create(source, url, startPosition), startPosition.m_line.oneBasedInt());
     }
 
     inline SourceCode SourceCode::subExpression(unsigned openBrace, unsigned closeBrace, int firstLine)
diff --git a/Source/JavaScriptCore/parser/SourceProvider.h b/Source/JavaScriptCore/parser/SourceProvider.h
index 2e7f71785..7f2e8d995 100644
--- a/Source/JavaScriptCore/parser/SourceProvider.h
+++ b/Source/JavaScriptCore/parser/SourceProvider.h
@@ -30,7 +30,6 @@
 #define SourceProvider_h
 
 #include "SourceProviderCache.h"
-#include "UString.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/UnusedParam.h>
@@ -42,7 +41,7 @@ namespace JSC {
     public:
         static const intptr_t nullID = 1;
         
-        SourceProvider(const UString& url, const TextPosition& startPosition, SourceProviderCache* cache = 0)
+        SourceProvider(const String& url, const TextPosition& startPosition, SourceProviderCache* cache = 0)
             : m_url(url)
             , m_startPosition(startPosition)
             , m_validated(false)
@@ -57,11 +56,11 @@ namespace JSC {
                 delete m_cache;
         }
 
-        virtual UString getRange(int start, int end) const = 0;
+        virtual String getRange(int start, int end) const = 0;
         virtual const StringImpl* data() const = 0;
         virtual int length() const = 0;
         
-        const UString& url() { return m_url; }
+        const String& url() { return m_url; }
         TextPosition startPosition() const { return m_startPosition; }
         intptr_t asID()
         {
@@ -80,21 +79,21 @@ namespace JSC {
     private:
         virtual void cacheSizeChanged(int delta) { UNUSED_PARAM(delta); }
 
-        UString m_url;
+        String m_url;
         TextPosition m_startPosition;
         bool m_validated;
         SourceProviderCache* m_cache;
         bool m_cacheOwned;
     };
 
-    class UStringSourceProvider : public SourceProvider {
+    class StringSourceProvider : public SourceProvider {
     public:
-        static PassRefPtr<UStringSourceProvider> create(const UString& source, const UString& url, const TextPosition& startPosition = TextPosition::minimumPosition())
+        static PassRefPtr<StringSourceProvider> create(const String& source, const String& url, const TextPosition& startPosition = TextPosition::minimumPosition())
         {
-            return adoptRef(new UStringSourceProvider(source, url, startPosition));
+            return adoptRef(new StringSourceProvider(source, url, startPosition));
         }
 
-        virtual UString getRange(int start, int end) const OVERRIDE
+        virtual String getRange(int start, int end) const OVERRIDE
         {
             return m_source.substringSharingImpl(start, end - start);
         }
@@ -102,13 +101,13 @@ namespace JSC {
         int length() const { return m_source.length(); }
 
     private:
-        UStringSourceProvider(const UString& source, const UString& url, const TextPosition& startPosition)
+        StringSourceProvider(const String& source, const String& url, const TextPosition& startPosition)
             : SourceProvider(url, startPosition)
             , m_source(source)
         {
         }
 
-        UString m_source;
+        String m_source;
     };
     
 } // namespace JSC
diff --git a/Source/JavaScriptCore/parser/SourceProviderCache.h b/Source/JavaScriptCore/parser/SourceProviderCache.h
index e94230d10..c346fba0c 100644
--- a/Source/JavaScriptCore/parser/SourceProviderCache.h
+++ b/Source/JavaScriptCore/parser/SourceProviderCache.h
@@ -34,6 +34,7 @@
 namespace JSC {
 
 class SourceProviderCache {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     SourceProviderCache() : m_contentByteSize(0) {}
     JS_EXPORT_PRIVATE ~SourceProviderCache();
diff --git a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
index bfd35648e..9ca121e2a 100644
--- a/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
+++ b/Source/JavaScriptCore/parser/SourceProviderCacheItem.h
@@ -33,6 +33,7 @@
 namespace JSC {
 
 class SourceProviderCacheItem {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     SourceProviderCacheItem(int closeBraceLine, int closeBracePos)
         : closeBraceLine(closeBraceLine) 
diff --git a/Source/JavaScriptCore/parser/SyntaxChecker.h b/Source/JavaScriptCore/parser/SyntaxChecker.h
index 7d44ef3c6..0e6889752 100644
--- a/Source/JavaScriptCore/parser/SyntaxChecker.h
+++ b/Source/JavaScriptCore/parser/SyntaxChecker.h
@@ -144,7 +144,7 @@ public:
     ExpressionType createNull(const JSTokenLocation&) { return NullExpr; }
     ExpressionType createBracketAccess(const JSTokenLocation&, ExpressionType, ExpressionType, bool, int, int, int) { return BracketExpr; }
     ExpressionType createDotAccess(const JSTokenLocation&, ExpressionType, const Identifier*, int, int, int) { return DotExpr; }
-    ExpressionType createRegExp(const JSTokenLocation&, const Identifier& pattern, const Identifier&, int) { return Yarr::checkSyntax(pattern.ustring()) ? 0 : RegExpExpr; }
+    ExpressionType createRegExp(const JSTokenLocation&, const Identifier& pattern, const Identifier&, int) { return Yarr::checkSyntax(pattern.string()) ? 0 : RegExpExpr; }
     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
     ExpressionType createConditionalExpr(const JSTokenLocation&, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
diff --git a/Source/JavaScriptCore/profiler/CallIdentifier.h b/Source/JavaScriptCore/profiler/CallIdentifier.h
index 2da8a2ff1..bf9f904b0 100644
--- a/Source/JavaScriptCore/profiler/CallIdentifier.h
+++ b/Source/JavaScriptCore/profiler/CallIdentifier.h
@@ -27,17 +27,17 @@
 #ifndef CallIdentifier_h
 #define CallIdentifier_h
 
-#include <runtime/UString.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
     struct CallIdentifier {
         WTF_MAKE_FAST_ALLOCATED;
     public:
-        UString m_name;
-        UString m_url;
+        String m_name;
+        String m_url;
         unsigned m_lineNumber;
 
         CallIdentifier()
@@ -45,7 +45,7 @@ namespace JSC {
         {
         }
 
-        CallIdentifier(const UString& name, const UString& url, int lineNumber)
+        CallIdentifier(const String& name, const String& url, int lineNumber)
             : m_name(name)
             , m_url(!url.isNull() ? url : "")
             , m_lineNumber(lineNumber)
@@ -87,7 +87,7 @@ namespace WTF {
     template<> struct HashTraits<JSC::CallIdentifier> : GenericHashTraits<JSC::CallIdentifier> {
         static void constructDeletedValue(JSC::CallIdentifier& slot)
         {
-            new (NotNull, &slot) JSC::CallIdentifier(JSC::UString(), JSC::UString(), std::numeric_limits<unsigned>::max());
+            new (NotNull, &slot) JSC::CallIdentifier(String(), String(), std::numeric_limits<unsigned>::max());
         }
         static bool isDeletedValue(const JSC::CallIdentifier& value)
         {
diff --git a/Source/JavaScriptCore/profiler/Profile.cpp b/Source/JavaScriptCore/profiler/Profile.cpp
index 92e32c4ba..51f871898 100644
--- a/Source/JavaScriptCore/profiler/Profile.cpp
+++ b/Source/JavaScriptCore/profiler/Profile.cpp
@@ -32,18 +32,18 @@
 
 namespace JSC {
 
-PassRefPtr<Profile> Profile::create(const UString& title, unsigned uid)
+PassRefPtr<Profile> Profile::create(const String& title, unsigned uid)
 {
     return adoptRef(new Profile(title, uid));
 }
 
-Profile::Profile(const UString& title, unsigned uid)
+Profile::Profile(const String& title, unsigned uid)
     : m_title(title)
     , m_uid(uid)
 {
     // FIXME: When multi-threading is supported this will be a vector and calls
     // into the profiler will need to know which thread it is executing on.
-    m_head = ProfileNode::create(0, CallIdentifier("Thread_1", UString(), 0), 0, 0);
+    m_head = ProfileNode::create(0, CallIdentifier("Thread_1", String(), 0), 0, 0);
 }
 
 Profile::~Profile()
@@ -128,7 +128,7 @@ void Profile::debugPrintDataSampleStyle() const
 
     std::sort(sortedFunctions.begin(), sortedFunctions.end(), functionNameCountPairComparator);
     for (NameCountPairVector::iterator it = sortedFunctions.begin(); it != sortedFunctions.end(); ++it)
-        dataLog("        %-12d%s\n", (*it).second, UString((*it).first).utf8().data());
+        dataLog("        %-12d%s\n", (*it).second, String((*it).first).utf8().data());
 
     dataLog("\nSort by top of stack, same collapsed (when >= 5):\n");
 }
diff --git a/Source/JavaScriptCore/profiler/Profile.h b/Source/JavaScriptCore/profiler/Profile.h
index 9455e3595..c1c69193c 100644
--- a/Source/JavaScriptCore/profiler/Profile.h
+++ b/Source/JavaScriptCore/profiler/Profile.h
@@ -27,18 +27,18 @@
 #define Profile_h
 
 #include "ProfileNode.h"
-#include <runtime/UString.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
     class Profile : public RefCounted<Profile> {
     public:
-        static PassRefPtr<Profile> create(const UString& title, unsigned uid);
+        static PassRefPtr<Profile> create(const String& title, unsigned uid);
         virtual ~Profile();
 
-        const UString& title() const { return m_title; }
+        const String& title() const { return m_title; }
         ProfileNode* head() const { return m_head.get(); }
         void setHead(PassRefPtr<ProfileNode> head) { m_head = head; }
         double totalTime() const { return m_head->totalTime(); }
@@ -56,13 +56,13 @@ namespace JSC {
 #endif
 
     protected:
-        Profile(const UString& title, unsigned uid);
+        Profile(const String& title, unsigned uid);
 
     private:
         void removeProfileStart();
         void removeProfileEnd();
  
-        UString m_title;
+        String m_title;
         RefPtr<ProfileNode> m_head;
         unsigned int m_uid;
     };
diff --git a/Source/JavaScriptCore/profiler/ProfileGenerator.cpp b/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
index 5db38bca8..09877d3c8 100644
--- a/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/Source/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -40,12 +40,12 @@ namespace JSC {
 
 static const char* NonJSExecution = "(idle)";
 
-PassRefPtr<ProfileGenerator> ProfileGenerator::create(ExecState* exec, const UString& title, unsigned uid)
+PassRefPtr<ProfileGenerator> ProfileGenerator::create(ExecState* exec, const String& title, unsigned uid)
 {
     return adoptRef(new ProfileGenerator(exec, title, uid));
 }
 
-ProfileGenerator::ProfileGenerator(ExecState* exec, const UString& title, unsigned uid)
+ProfileGenerator::ProfileGenerator(ExecState* exec, const String& title, unsigned uid)
     : m_origin(exec ? exec->lexicalGlobalObject() : 0)
     , m_profileGroup(exec ? exec->lexicalGlobalObject()->profileGroup() : 0)
 {
@@ -59,7 +59,7 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
 {
     int lineNumber;
     intptr_t sourceID;
-    UString sourceURL;
+    String sourceURL;
     JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
@@ -67,7 +67,7 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     m_head->insertNode(m_currentNode.get());
 }
 
-const UString& ProfileGenerator::title() const
+const String& ProfileGenerator::title() const
 {
     return m_profile->title();
 }
@@ -135,7 +135,7 @@ void ProfileGenerator::stopProfiling()
     m_currentNode = m_currentNode->parent();
 
    if (double headSelfTime = m_head->selfTime()) {
-        RefPtr<ProfileNode> idleNode = ProfileNode::create(0, CallIdentifier(NonJSExecution, UString(), 0), m_head.get(), m_head.get());
+        RefPtr<ProfileNode> idleNode = ProfileNode::create(0, CallIdentifier(NonJSExecution, String(), 0), m_head.get(), m_head.get());
 
         idleNode->setTotalTime(headSelfTime);
         idleNode->setSelfTime(headSelfTime);
diff --git a/Source/JavaScriptCore/profiler/ProfileGenerator.h b/Source/JavaScriptCore/profiler/ProfileGenerator.h
index 8c8b81731..40cc8de01 100644
--- a/Source/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/Source/JavaScriptCore/profiler/ProfileGenerator.h
@@ -37,15 +37,14 @@ namespace JSC {
     class JSGlobalObject;
     class Profile;
     class ProfileNode;
-    class UString;
     struct CallIdentifier;    
 
     class ProfileGenerator : public RefCounted<ProfileGenerator>  {
     public:
-        static PassRefPtr<ProfileGenerator> create(ExecState*, const UString& title, unsigned uid);
+        static PassRefPtr<ProfileGenerator> create(ExecState*, const WTF::String& title, unsigned uid);
 
         // Members
-        const UString& title() const;
+        const WTF::String& title() const;
         PassRefPtr<Profile> profile() const { return m_profile; }
         JSGlobalObject* origin() const { return m_origin; }
         unsigned profileGroup() const { return m_profileGroup; }
@@ -62,7 +61,7 @@ namespace JSC {
         typedef void (ProfileGenerator::*ProfileFunction)(ExecState* callerOrHandlerCallFrame, const CallIdentifier& callIdentifier);
 
     private:
-        ProfileGenerator(ExecState*, const UString& title, unsigned uid);
+        ProfileGenerator(ExecState*, const WTF::String& title, unsigned uid);
         void addParentForConsoleStart(ExecState*);
 
         void removeProfileStart();
diff --git a/Source/JavaScriptCore/profiler/ProfileNode.h b/Source/JavaScriptCore/profiler/ProfileNode.h
index ffe7b6f9d..26000a827 100644
--- a/Source/JavaScriptCore/profiler/ProfileNode.h
+++ b/Source/JavaScriptCore/profiler/ProfileNode.h
@@ -64,8 +64,8 @@ namespace JSC {
         // CallIdentifier members
         ExecState* callerCallFrame() const { return m_callerCallFrame; }
         const CallIdentifier& callIdentifier() const { return m_callIdentifier; }
-        const UString& functionName() const { return m_callIdentifier.m_name; }
-        const UString& url() const { return m_callIdentifier.m_url; }
+        const String& functionName() const { return m_callIdentifier.m_name; }
+        const String& url() const { return m_callIdentifier.m_url; }
         unsigned lineNumber() const { return m_callIdentifier.m_lineNumber; }
 
         // Relationships
@@ -146,8 +146,8 @@ namespace JSC {
         static inline bool selfTimeAscendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return a->selfTime() < b->selfTime(); }
         static inline bool callsDescendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return a->numberOfCalls() > b->numberOfCalls(); }
         static inline bool callsAscendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return a->numberOfCalls() < b->numberOfCalls(); }
-        static inline bool functionNameDescendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return a->functionName() > b->functionName(); }
-        static inline bool functionNameAscendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return a->functionName() < b->functionName(); }
+        static inline bool functionNameDescendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return codePointCompareLessThan(b->functionName(), a->functionName()); }
+        static inline bool functionNameAscendingComparator(const RefPtr<ProfileNode>& a, const RefPtr<ProfileNode>& b) { return codePointCompareLessThan(a->functionName(), b->functionName()); }
 
         ExecState* m_callerCallFrame;
         CallIdentifier m_callIdentifier;
diff --git a/Source/JavaScriptCore/profiler/Profiler.cpp b/Source/JavaScriptCore/profiler/Profiler.cpp
index 723393b5c..9642a0684 100644
--- a/Source/JavaScriptCore/profiler/Profiler.cpp
+++ b/Source/JavaScriptCore/profiler/Profiler.cpp
@@ -39,7 +39,6 @@
 #include "Profile.h"
 #include "ProfileGenerator.h"
 #include "ProfileNode.h"
-#include "UStringConcatenate.h"
 #include <stdio.h>
 
 namespace JSC {
@@ -48,7 +47,7 @@ static const char* GlobalCodeExecution = "(program)";
 static const char* AnonymousFunction = "(anonymous function)";
 static unsigned ProfilesUID = 0;
 
-static CallIdentifier createCallIdentifierFromFunctionImp(ExecState*, JSObject*, const UString& defaultSourceURL, int defaultLineNumber);
+static CallIdentifier createCallIdentifierFromFunctionImp(ExecState*, JSObject*, const String& defaultSourceURL, int defaultLineNumber);
 
 Profiler* Profiler::s_sharedProfiler = 0;
 
@@ -59,7 +58,7 @@ Profiler* Profiler::profiler()
     return s_sharedProfiler;
 }   
 
-void Profiler::startProfiling(ExecState* exec, const UString& title)
+void Profiler::startProfiling(ExecState* exec, const String& title)
 {
     ASSERT_ARG(title, !title.isNull());
 
@@ -78,7 +77,7 @@ void Profiler::startProfiling(ExecState* exec, const UString& title)
     m_currentProfiles.append(profileGenerator);
 }
 
-PassRefPtr<Profile> Profiler::stopProfiling(ExecState* exec, const UString& title)
+PassRefPtr<Profile> Profiler::stopProfiling(ExecState* exec, const String& title)
 {
     JSGlobalObject* origin = exec ? exec->lexicalGlobalObject() : 0;
     for (ptrdiff_t i = m_currentProfiles.size() - 1; i >= 0; --i) {
@@ -126,7 +125,7 @@ void Profiler::willExecute(ExecState* callerCallFrame, JSValue function)
     dispatchFunctionToProfiles(callerCallFrame, m_currentProfiles, &ProfileGenerator::willExecute, createCallIdentifier(callerCallFrame, function, "", 0), callerCallFrame->lexicalGlobalObject()->profileGroup());
 }
 
-void Profiler::willExecute(ExecState* callerCallFrame, const UString& sourceURL, int startingLineNumber)
+void Profiler::willExecute(ExecState* callerCallFrame, const String& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -142,7 +141,7 @@ void Profiler::didExecute(ExecState* callerCallFrame, JSValue function)
     dispatchFunctionToProfiles(callerCallFrame, m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(callerCallFrame, function, "", 0), callerCallFrame->lexicalGlobalObject()->profileGroup());
 }
 
-void Profiler::didExecute(ExecState* callerCallFrame, const UString& sourceURL, int startingLineNumber)
+void Profiler::didExecute(ExecState* callerCallFrame, const String& sourceURL, int startingLineNumber)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -156,7 +155,7 @@ void Profiler::exceptionUnwind(ExecState* handlerCallFrame)
     dispatchFunctionToProfiles(handlerCallFrame, m_currentProfiles, &ProfileGenerator::exceptionUnwind, createCallIdentifier(handlerCallFrame, JSValue(), "", 0), handlerCallFrame->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionValue, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionValue, const String& defaultSourceURL, int defaultLineNumber)
 {
     if (!functionValue)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
@@ -164,12 +163,12 @@ CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionV
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
     if (asObject(functionValue)->inherits(&JSFunction::s_info) || asObject(functionValue)->inherits(&InternalFunction::s_info))
         return createCallIdentifierFromFunctionImp(exec, asObject(functionValue), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier(makeUString("(", asObject(functionValue)->methodTable()->className(asObject(functionValue)), " object)"), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier(makeString("(", asObject(functionValue)->methodTable()->className(asObject(functionValue)), " object)"), defaultSourceURL, defaultLineNumber);
 }
 
-CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSObject* function, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSObject* function, const String& defaultSourceURL, int defaultLineNumber)
 {
-    const UString& name = getCalculatedDisplayName(exec, function);
+    const String& name = getCalculatedDisplayName(exec, function);
     JSFunction* jsFunction = jsDynamicCast<JSFunction*>(function);
     if (jsFunction && !jsFunction->isHostFunction())
         return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, jsFunction->jsExecutable()->sourceURL(), jsFunction->jsExecutable()->lineNo());
diff --git a/Source/JavaScriptCore/profiler/Profiler.h b/Source/JavaScriptCore/profiler/Profiler.h
index 877065eca..6852457c7 100644
--- a/Source/JavaScriptCore/profiler/Profiler.h
+++ b/Source/JavaScriptCore/profiler/Profiler.h
@@ -42,23 +42,22 @@ namespace JSC {
     class JSObject;
     class JSValue;
     class ProfileGenerator;
-    class UString;
-    struct CallIdentifier;    
+    struct CallIdentifier;
 
     class Profiler {
         WTF_MAKE_FAST_ALLOCATED;
     public:
         JS_EXPORT_PRIVATE static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(ExecState* exec, JSValue, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(ExecState*, JSValue, const WTF::String& sourceURL, int lineNumber);
 
-        JS_EXPORT_PRIVATE void startProfiling(ExecState*, const UString& title);
-        JS_EXPORT_PRIVATE PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
+        JS_EXPORT_PRIVATE void startProfiling(ExecState*, const WTF::String& title);
+        JS_EXPORT_PRIVATE PassRefPtr<Profile> stopProfiling(ExecState*, const WTF::String& title);
         void stopProfiling(JSGlobalObject*);
 
         void willExecute(ExecState* callerCallFrame, JSValue function);
-        void willExecute(ExecState* callerCallFrame, const UString& sourceURL, int startingLineNumber);
+        void willExecute(ExecState* callerCallFrame, const WTF::String& sourceURL, int startingLineNumber);
         void didExecute(ExecState* callerCallFrame, JSValue function);
-        void didExecute(ExecState* callerCallFrame, const UString& sourceURL, int startingLineNumber);
+        void didExecute(ExecState* callerCallFrame, const WTF::String& sourceURL, int startingLineNumber);
 
         void exceptionUnwind(ExecState* handlerCallFrame);
 
diff --git a/Source/JavaScriptCore/runtime/ArgList.cpp b/Source/JavaScriptCore/runtime/ArgList.cpp
index 873ddc2da..301abd530 100644
--- a/Source/JavaScriptCore/runtime/ArgList.cpp
+++ b/Source/JavaScriptCore/runtime/ArgList.cpp
@@ -24,7 +24,7 @@
 #include "HeapRootVisitor.h"
 #include "JSValue.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 
 using std::min;
 
diff --git a/Source/JavaScriptCore/runtime/ArgList.h b/Source/JavaScriptCore/runtime/ArgList.h
index 1512a0fa1..29010b1ee 100644
--- a/Source/JavaScriptCore/runtime/ArgList.h
+++ b/Source/JavaScriptCore/runtime/ArgList.h
@@ -24,7 +24,6 @@
 
 #include "CallFrame.h"
 #include "Register.h"
-#include "WriteBarrier.h"
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 
diff --git a/Source/JavaScriptCore/runtime/Arguments.cpp b/Source/JavaScriptCore/runtime/Arguments.cpp
index 96791c326..fe79f740e 100644
--- a/Source/JavaScriptCore/runtime/Arguments.cpp
+++ b/Source/JavaScriptCore/runtime/Arguments.cpp
@@ -48,8 +48,7 @@ void Arguments::visitChildren(JSCell* cell, SlotVisitor& visitor)
     if (thisObject->d->registerArray)
         visitor.appendValues(thisObject->d->registerArray.get(), thisObject->d->numArguments);
     visitor.append(&thisObject->d->callee);
-    if (thisObject->d->activation)
-        visitor.append(&thisObject->d->activation);
+    visitor.append(&thisObject->d->activation);
 }
 
 void Arguments::destroy(JSCell* cell)
@@ -99,7 +98,7 @@ bool Arguments::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, unsigne
         return true;
     }
 
-    return JSObject::getOwnPropertySlot(thisObject, exec, Identifier(exec, UString::number(i)), slot);
+    return JSObject::getOwnPropertySlot(thisObject, exec, Identifier(exec, String::number(i)), slot);
 }
     
 void Arguments::createStrictModeCallerIfNecessary(ExecState* exec)
@@ -187,7 +186,7 @@ void Arguments::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyN
     Arguments* thisObject = jsCast<Arguments*>(object);
     for (unsigned i = 0; i < thisObject->d->numArguments; ++i) {
         if (!thisObject->d->deletedArguments || !thisObject->d->deletedArguments[i])
-            propertyNames.add(Identifier(exec, UString::number(i)));
+            propertyNames.add(Identifier(exec, String::number(i)));
     }
     if (mode == IncludeDontEnumProperties) {
         propertyNames.add(exec->propertyNames().callee);
@@ -205,7 +204,7 @@ void Arguments::putByIndex(JSCell* cell, ExecState* exec, unsigned i, JSValue va
     }
 
     PutPropertySlot slot(shouldThrow);
-    JSObject::put(thisObject, exec, Identifier(exec, UString::number(i)), value, slot);
+    JSObject::put(thisObject, exec, Identifier(exec, String::number(i)), value, slot);
 }
 
 void Arguments::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
@@ -256,7 +255,7 @@ bool Arguments::deletePropertyByIndex(JSCell* cell, ExecState* exec, unsigned i)
         }
     }
 
-    return JSObject::deleteProperty(thisObject, exec, Identifier(exec, UString::number(i)));
+    return JSObject::deleteProperty(thisObject, exec, Identifier(exec, String::number(i)));
 }
 
 bool Arguments::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName) 
diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
index 90eed25fa..1d0bffd6b 100644
--- a/Source/JavaScriptCore/runtime/Arguments.h
+++ b/Source/JavaScriptCore/runtime/Arguments.h
@@ -49,7 +49,7 @@ namespace JSC {
         bool overrodeCaller;
         bool isStrictMode;
 
-        WriteBarrier<Unknown>* registers;
+        WriteBarrierBase<Unknown>* registers;
         OwnArrayPtr<WriteBarrier<Unknown> > registerArray;
 
         OwnArrayPtr<bool> deletedArguments;
@@ -110,6 +110,7 @@ namespace JSC {
             d->activation.set(globalData, this, activation);
             d->registers = &activation->registerAt(0);
         }
+        void setRegisters(WriteBarrierBase<Unknown>* registers) { d->registers = registers; }
 
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype) 
         { 
@@ -138,7 +139,7 @@ namespace JSC {
         void createStrictModeCallerIfNecessary(ExecState*);
         void createStrictModeCalleeIfNecessary(ExecState*);
 
-        WriteBarrier<Unknown>& argument(size_t);
+        WriteBarrierBase<Unknown>& argument(size_t);
 
         void init(CallFrame*);
 
@@ -165,7 +166,7 @@ namespace JSC {
     {
     }
 
-    inline WriteBarrier<Unknown>& Arguments::argument(size_t i)
+    inline WriteBarrierBase<Unknown>& Arguments::argument(size_t i)
     {
         return d->registers[CallFrame::argumentOffset(i)];
     }
@@ -177,7 +178,7 @@ namespace JSC {
 
         JSFunction* callee = jsCast<JSFunction*>(callFrame->callee());
         d->numArguments = callFrame->argumentCount();
-        d->registers = reinterpret_cast<WriteBarrier<Unknown>*>(callFrame->registers());
+        d->registers = reinterpret_cast<WriteBarrierBase<Unknown>*>(callFrame->registers());
         d->callee.set(callFrame->globalData(), this, callee);
         d->overrodeLength = false;
         d->overrodeCallee = false;
@@ -197,7 +198,7 @@ namespace JSC {
 
         JSFunction* callee = inlineCallFrame->callee.get();
         d->numArguments = inlineCallFrame->arguments.size() - 1;
-        d->registers = reinterpret_cast<WriteBarrier<Unknown>*>(callFrame->registers()) + inlineCallFrame->stackOffset;
+        d->registers = reinterpret_cast<WriteBarrierBase<Unknown>*>(callFrame->registers()) + inlineCallFrame->stackOffset;
         d->callee.set(callFrame->globalData(), this, callee);
         d->overrodeLength = false;
         d->overrodeCallee = false;
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
index 83e48ca1b..c9a6dc600 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -85,7 +85,7 @@ static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgLi
     if (args.size() == 1 && args.at(0).isNumber()) {
         uint32_t n = args.at(0).toUInt32(exec);
         if (n != args.at(0).toNumber(exec))
-            return throwError(exec, createRangeError(exec, "Array size is not a small enough positive integer."));
+            return throwError(exec, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer.")));
         return constructEmptyArray(exec, globalObject, n);
     }
 
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index a97cf82de..4b13f993c 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -77,7 +77,7 @@ static inline bool isNumericCompareFunction(ExecState* exec, CallType callType,
 
     FunctionExecutable* executable = callData.js.functionExecutable;
 
-    JSObject* error = executable->compileForCall(exec, callData.js.scopeChain);
+    JSObject* error = executable->compileForCall(exec, callData.js.scope);
     if (error)
         return false;
 
@@ -205,13 +205,13 @@ static inline void shift(ExecState* exec, JSObject* thisObj, unsigned header, un
             if (exec->hadException())
                 return;
         } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, to)) {
-            throwTypeError(exec, "Unable to delete property.");
+            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
             return;
         }
     }
     for (unsigned k = length; k > length - count; --k) {
         if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k - 1)) {
-            throwTypeError(exec, "Unable to delete property.");
+            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
             return;
         }
     }
@@ -243,7 +243,7 @@ static inline void unshift(ExecState* exec, JSObject* thisObj, unsigned header,
                 return;
             thisObj->methodTable()->putByIndex(thisObj, exec, to, value, true);
         } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, to)) {
-            throwTypeError(exec, "Unable to delete property.");
+            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
             return;
         }
         if (exec->hadException())
@@ -300,7 +300,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
         if (element.isUndefinedOrNull())
             continue;
         
-        UString str = element.toUString(exec);
+        String str = element.toWTFString(exec);
         strBuffer[k] = str.impl();
         totalSize += str.length();
         allStrings8Bit = allStrings8Bit && str.is8Bit();
@@ -328,7 +328,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
                 buffer.append(rep->characters8(), rep->length());
         }
         ASSERT(buffer.size() == totalSize);
-        return JSValue::encode(jsString(exec, UString::adopt(buffer)));        
+        return JSValue::encode(jsString(exec, String::adopt(buffer)));
     }
 
     Vector<UChar> buffer;
@@ -343,7 +343,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
             buffer.append(rep->characters(), rep->length());
     }
     ASSERT(buffer.size() == totalSize);
-    return JSValue::encode(jsString(exec, UString::adopt(buffer)));
+    return JSValue::encode(jsString(exec, String::adopt(buffer)));
 }
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
@@ -362,7 +362,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
     if (JSValue earlyReturnValue = checker.earlyReturnValue())
         return JSValue::encode(earlyReturnValue);
 
-    UString separator(",");
+    String separator(",", String::ConstructFromLiteral);
     JSStringJoiner stringJoiner(separator, length);
     for (unsigned k = 0; k < length; k++) {
         JSValue element = thisObj->get(exec, k);
@@ -373,13 +373,13 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec)
             JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
             if (exec->hadException())
                 return JSValue::encode(jsUndefined());
-            UString str;
+            String str;
             CallData callData;
             CallType callType = getCallData(conversionFunction, callData);
             if (callType != CallTypeNone)
-                str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toUString(exec);
+                str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toWTFString(exec);
             else
-                str = element.toUString(exec);
+                str = element.toWTFString(exec);
             if (exec->hadException())
                 return JSValue::encode(jsUndefined());
             stringJoiner.append(str);
@@ -400,11 +400,11 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
     if (JSValue earlyReturnValue = checker.earlyReturnValue())
         return JSValue::encode(earlyReturnValue);
 
-    UString separator;
+    String separator;
     if (!exec->argument(0).isUndefined())
-        separator = exec->argument(0).toUString(exec);
+        separator = exec->argument(0).toWTFString(exec);
     if (separator.isNull())
-        separator = UString(",");
+        separator = String(",", String::ConstructFromLiteral);
 
     JSStringJoiner stringJoiner(separator, length);
 
@@ -418,18 +418,18 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 
             JSValue element = array->getIndex(k);
             if (!element.isUndefinedOrNull())
-                stringJoiner.append(element.toUStringInline(exec));
+                stringJoiner.append(element.toWTFStringInline(exec));
             else
-                stringJoiner.append(UString());
+                stringJoiner.append(String());
         }
     }
 
     for (; k < length; k++) {
         JSValue element = thisObj->get(exec, k);
         if (!element.isUndefinedOrNull())
-            stringJoiner.append(element.toUStringInline(exec));
+            stringJoiner.append(element.toWTFStringInline(exec));
         else
-            stringJoiner.append(UString());
+            stringJoiner.append(String());
     }
 
     return JSValue::encode(stringJoiner.build(exec));
@@ -491,7 +491,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
         if (exec->hadException())
             return JSValue::encode(jsUndefined());
         if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, length - 1)) {
-            throwTypeError(exec, "Unable to delete property.");
+            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
             return JSValue::encode(jsUndefined());
         }
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(length - 1));
@@ -520,7 +520,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec)
             thisObj->methodTable()->putByIndex(thisObj, exec, length + n, exec->argument(n), true);
         else {
             PutPropertySlot slot;
-            Identifier propertyName(exec, JSValue(static_cast<int64_t>(length) + static_cast<int64_t>(n)).toUString(exec));
+            Identifier propertyName(exec, JSValue(static_cast<int64_t>(length) + static_cast<int64_t>(n)).toWTFString(exec));
             thisObj->methodTable()->put(thisObj, exec, propertyName, exec->argument(n), slot);
         }
         if (exec->hadException())
@@ -553,7 +553,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
             if (exec->hadException())
                 return JSValue::encode(jsUndefined());
         } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, k)) {
-            throwTypeError(exec, "Unable to delete property.");
+            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
             return JSValue::encode(jsUndefined());
         }
 
@@ -562,7 +562,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
             if (exec->hadException())
                 return JSValue::encode(jsUndefined());
         } else if (!thisObj->methodTable()->deletePropertyByIndex(thisObj, exec, lk1)) {
-            throwTypeError(exec, "Unable to delete property.");
+            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
             return JSValue::encode(jsUndefined());
         }
     }
@@ -661,7 +661,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec)
                 l.append(minObj);
                 compareResult = call(exec, function, callType, callData, jsUndefined(), l).toNumber(exec);
             } else
-                compareResult = (jObj.toUStringInline(exec) < minObj.toUStringInline(exec)) ? -1 : 1;
+                compareResult = codePointCompareLessThan(jObj.toWTFStringInline(exec), minObj.toWTFStringInline(exec)) ? -1 : 1;
 
             if (compareResult < 0) {
                 themin = j;
diff --git a/Source/JavaScriptCore/runtime/BooleanObject.cpp b/Source/JavaScriptCore/runtime/BooleanObject.cpp
index 37c6eab0d..bf2655bbb 100644
--- a/Source/JavaScriptCore/runtime/BooleanObject.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanObject.cpp
@@ -21,6 +21,8 @@
 #include "config.h"
 #include "BooleanObject.h"
 
+#include "JSScope.h"
+
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(BooleanObject);
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
index 1551eabf2..c8c77220a 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -77,21 +77,22 @@ bool BooleanPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exe
 
 EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)
 {
+    JSGlobalData* globalData = &exec->globalData();
     JSValue thisValue = exec->hostThisValue();
     if (thisValue == jsBoolean(false))
-        return JSValue::encode(jsNontrivialString(exec, "false"));
+        return JSValue::encode(globalData->smallStrings.falseString(globalData));
 
     if (thisValue == jsBoolean(true))
-        return JSValue::encode(jsNontrivialString(exec, "true"));
+        return JSValue::encode(globalData->smallStrings.trueString(globalData));
 
     if (!thisValue.inherits(&BooleanObject::s_info))
         return throwVMTypeError(exec);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
-        return JSValue::encode(jsNontrivialString(exec, "false"));
+        return JSValue::encode(globalData->smallStrings.falseString(globalData));
 
     ASSERT(asBooleanObject(thisValue)->internalValue() == jsBoolean(true));
-    return JSValue::encode(jsNontrivialString(exec, "true"));
+    return JSValue::encode(globalData->smallStrings.trueString(globalData));
 }
 
 EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/CallData.h b/Source/JavaScriptCore/runtime/CallData.h
index 15a6a0a48..77478304c 100644
--- a/Source/JavaScriptCore/runtime/CallData.h
+++ b/Source/JavaScriptCore/runtime/CallData.h
@@ -37,7 +37,7 @@ namespace JSC {
     class ExecState;
     class FunctionExecutable;
     class JSObject;
-    class ScopeChainNode;
+    class JSScope;
 
     enum CallType {
         CallTypeNone,
@@ -53,7 +53,7 @@ namespace JSC {
         } native;
         struct {
             FunctionExecutable* functionExecutable;
-            ScopeChainNode* scopeChain;
+            JSScope* scope;
         } js;
     };
 
diff --git a/Source/JavaScriptCore/runtime/ClassInfo.h b/Source/JavaScriptCore/runtime/ClassInfo.h
index b0adab32c..4c72f3ed1 100644
--- a/Source/JavaScriptCore/runtime/ClassInfo.h
+++ b/Source/JavaScriptCore/runtime/ClassInfo.h
@@ -75,7 +75,7 @@ namespace JSC {
         typedef void (*GetPropertyNamesFunctionPtr)(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
         GetPropertyNamesFunctionPtr getPropertyNames;
 
-        typedef UString (*ClassNameFunctionPtr)(const JSObject*);
+        typedef String (*ClassNameFunctionPtr)(const JSObject*);
         ClassNameFunctionPtr className;
 
         typedef bool (*HasInstanceFunctionPtr)(JSObject*, ExecState*, JSValue, JSValue);
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.h b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
index 0d3480104..e4c76ad16 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
@@ -119,123 +119,6 @@ inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)
     return baseObj->hasProperty(exec, property);
 }
 
-ALWAYS_INLINE JSValue opResolve(ExecState* exec, Identifier& ident)
-{
-    ScopeChainNode* scopeChain = exec->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    
-    do {
-        JSObject* o = iter->get();
-        PropertySlot slot(o);
-        if (o->getPropertySlot(exec, ident, slot))
-            return slot.getValue(exec, ident);
-    } while (++iter != end);
-
-    exec->globalData().exception = createUndefinedVariableError(exec, ident);
-    return JSValue();
-}
-
-ALWAYS_INLINE JSValue opResolveSkip(ExecState* exec, Identifier& ident, int skip)
-{
-    ScopeChainNode* scopeChain = exec->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    CodeBlock* codeBlock = exec->codeBlock();
-    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
-    ASSERT(skip || !checkTopLevel);
-    if (checkTopLevel && skip--) {
-        if (exec->uncheckedR(codeBlock->activationRegister()).jsValue())
-            ++iter;
-    }
-    while (skip--) {
-        ++iter;
-        ASSERT(iter != end);
-    }
-    do {
-        JSObject* o = iter->get();
-        PropertySlot slot(o);
-        if (o->getPropertySlot(exec, ident, slot))
-            return slot.getValue(exec, ident);
-    } while (++iter != end);
-
-    exec->globalData().exception = createUndefinedVariableError(exec, ident);
-    return JSValue();
-}
-
-ALWAYS_INLINE JSValue opResolveWithBase(ExecState* exec, Identifier& ident, Register& baseSlot)
-{
-    ScopeChainNode* scopeChain = exec->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    JSObject* base;
-    do {
-        base = iter->get();
-        PropertySlot slot(base);
-        if (base->getPropertySlot(exec, ident, slot)) {
-            JSValue result = slot.getValue(exec, ident);
-            if (exec->globalData().exception)
-                return JSValue();
-
-            baseSlot = JSValue(base);
-            return result;
-        }
-        ++iter;
-    } while (iter != end);
-
-    exec->globalData().exception = createUndefinedVariableError(exec, ident);
-    return JSValue();
-}
-
-ALWAYS_INLINE JSValue opResolveWithThis(ExecState* exec, Identifier& ident, Register& baseSlot)
-{
-    ScopeChainNode* scopeChain = exec->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    JSObject* base;
-    do {
-        base = iter->get();
-        ++iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(exec, ident, slot)) {
-            JSValue result = slot.getValue(exec, ident);
-            if (exec->globalData().exception)
-                return JSValue();
-
-            // All entries on the scope chain should be EnvironmentRecords (activations etc),
-            // other then 'with' object, which are directly referenced from the scope chain,
-            // and the global object. If we hit either an EnvironmentRecord or a global
-            // object at the end of the scope chain, this is undefined. If we hit a non-
-            // EnvironmentRecord within the scope chain, pass the base as the this value.
-            if (iter == end || base->structure()->typeInfo().isEnvironmentRecord())
-                baseSlot = jsUndefined();
-            else
-                baseSlot = JSValue(base);
-            return result;
-        }
-    } while (iter != end);
-
-    exec->globalData().exception = createUndefinedVariableError(exec, ident);
-    return JSValue();
-}
-
 } } // namespace JSC::CommonSlowPaths
 
 #endif // CommonSlowPaths_h
-
diff --git a/Source/JavaScriptCore/runtime/Completion.cpp b/Source/JavaScriptCore/runtime/Completion.cpp
index 1c35b9626..3de8d4841 100644
--- a/Source/JavaScriptCore/runtime/Completion.cpp
+++ b/Source/JavaScriptCore/runtime/Completion.cpp
@@ -51,7 +51,7 @@ bool checkSyntax(ExecState* exec, const SourceCode& source, JSValue* returnedExc
     return true;
 }
 
-JSValue evaluate(ExecState* exec, ScopeChainNode* scopeChain, const SourceCode& source, JSValue thisValue, JSValue* returnedException)
+JSValue evaluate(ExecState* exec, const SourceCode& source, JSValue thisValue, JSValue* returnedException)
 {
     JSLockHolder lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
@@ -72,7 +72,7 @@ JSValue evaluate(ExecState* exec, ScopeChainNode* scopeChain, const SourceCode&
     if (!thisValue || thisValue.isUndefinedOrNull())
         thisValue = exec->dynamicGlobalObject();
     JSObject* thisObj = thisValue.toThisObject(exec);
-    JSValue result = exec->interpreter()->execute(program, exec, scopeChain, thisObj);
+    JSValue result = exec->interpreter()->execute(program, exec, thisObj);
 
     if (exec->hadException()) {
         if (returnedException)
diff --git a/Source/JavaScriptCore/runtime/Completion.h b/Source/JavaScriptCore/runtime/Completion.h
index 3d3b86fe4..d150fcea2 100644
--- a/Source/JavaScriptCore/runtime/Completion.h
+++ b/Source/JavaScriptCore/runtime/Completion.h
@@ -28,11 +28,11 @@
 namespace JSC {
 
     class ExecState;
-    class ScopeChainNode;
+    class JSScope;
     class SourceCode;
 
     JS_EXPORT_PRIVATE bool checkSyntax(ExecState*, const SourceCode&, JSValue* exception = 0);
-    JS_EXPORT_PRIVATE JSValue evaluate(ExecState*, ScopeChainNode*, const SourceCode&, JSValue thisValue = JSValue(), JSValue* exception = 0);
+    JS_EXPORT_PRIVATE JSValue evaluate(ExecState*, const SourceCode&, JSValue thisValue = JSValue(), JSValue* exception = 0);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/ConstructData.h b/Source/JavaScriptCore/runtime/ConstructData.h
index d7a3c73d3..6426b044e 100644
--- a/Source/JavaScriptCore/runtime/ConstructData.h
+++ b/Source/JavaScriptCore/runtime/ConstructData.h
@@ -38,7 +38,7 @@ namespace JSC {
     class ExecState;
     class FunctionExecutable;
     class JSObject;
-    class ScopeChainNode;
+    class JSScope;
 
     enum ConstructType {
         ConstructTypeNone,
@@ -52,7 +52,7 @@ namespace JSC {
         } native;
         struct {
             FunctionExecutable* functionExecutable;
-            ScopeChainNode* scopeChain;
+            JSScope* scope;
         } js;
     };
 
diff --git a/Source/JavaScriptCore/runtime/DateConversion.cpp b/Source/JavaScriptCore/runtime/DateConversion.cpp
index 47839817f..0b57f012d 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.cpp
+++ b/Source/JavaScriptCore/runtime/DateConversion.cpp
@@ -25,10 +25,10 @@
 #include "config.h"
 #include "DateConversion.h"
 
-#include "UString.h"
 #include <wtf/Assertions.h>
 #include <wtf/DateMath.h>
 #include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
 
 #if OS(WINDOWS)
 #include <windows.h>
@@ -62,7 +62,7 @@ void appendNumber<2>(StringBuilder& builder, int value)
     builder.append(static_cast<char>('0' + value % 10));
 }
 
-UString formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool asUTCVariant)
+String formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool asUTCVariant)
 {
     bool appendDate = format & DateTimeFormatDate;
     bool appendTime = format & DateTimeFormatTime;
@@ -73,7 +73,7 @@ UString formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool a
         builder.append(weekdayName[(t.weekDay() + 6) % 7]);
 
         if (asUTCVariant) {
-            builder.append(", ");
+            builder.appendLiteral(", ");
             appendNumber<2>(builder, t.monthDay());
             builder.append(' ');
             builder.append(monthName[t.month()]);
@@ -96,7 +96,7 @@ UString formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool a
         appendNumber<2>(builder, t.minute());
         builder.append(':');
         appendNumber<2>(builder, t.second());
-        builder.append(" GMT");
+        builder.appendLiteral(" GMT");
 
         if (!asUTCVariant) {
             int offset = abs(t.utcOffset()) / 60;
@@ -114,7 +114,7 @@ UString formatDateTime(const GregorianDateTime& t, DateTimeFormat format, bool a
             strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
 #endif
             if (timeZoneName[0]) {
-                builder.append(" (");
+                builder.appendLiteral(" (");
                 builder.append(timeZoneName);
                 builder.append(')');
             }
diff --git a/Source/JavaScriptCore/runtime/DateConversion.h b/Source/JavaScriptCore/runtime/DateConversion.h
index fd1a7eb35..8ea4c17ad 100644
--- a/Source/JavaScriptCore/runtime/DateConversion.h
+++ b/Source/JavaScriptCore/runtime/DateConversion.h
@@ -27,9 +27,11 @@
 
 #include <wtf/GregorianDateTime.h>
 
-namespace JSC {
+namespace WTF {
+class String;
+} // namespace WTF
 
-class UString;
+namespace JSC {
 
 enum DateTimeFormat {
     DateTimeFormatDate = 1,
@@ -37,7 +39,7 @@ enum DateTimeFormat {
     DateTimeFormatDateAndTime = DateTimeFormatDate | DateTimeFormatTime
 };
 
-UString formatDateTime(const GregorianDateTime&, DateTimeFormat, bool asUTCVariant);
+WTF::String formatDateTime(const GregorianDateTime&, DateTimeFormat, bool asUTCVariant);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 363eec03a..62211d302 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -131,7 +131,7 @@ enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
 // FIXME: Since this is superior to the strftime-based version, why limit this to PLATFORM(MAC)?
 // Instead we should consider using this whenever USE(CF) is true.
 
-static CFDateFormatterStyle styleFromArgString(const UString& string, CFDateFormatterStyle defaultStyle)
+static CFDateFormatterStyle styleFromArgString(const String& string, CFDateFormatterStyle defaultStyle)
 {
     if (string == "short")
         return kCFDateFormatterShortStyle;
@@ -150,9 +150,9 @@ static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMil
     CFDateFormatterStyle timeStyle = (format != LocaleDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
 
     bool useCustomFormat = false;
-    UString customFormatString;
+    String customFormatString;
 
-    UString arg0String = exec->argument(0).toString(exec)->value(exec);
+    String arg0String = exec->argument(0).toString(exec)->value(exec);
     if (arg0String == "custom" && !exec->argument(1).isUndefined()) {
         useCustomFormat = true;
         customFormatString = exec->argument(1).toString(exec)->value(exec);
@@ -190,7 +190,7 @@ static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMil
 
     CFRelease(string);
 
-    return jsNontrivialString(exec, UString(buffer, length));
+    return jsNontrivialString(exec, String(buffer, length));
 }
 
 #elif USE(ICU_UNICODE) && !UCONFIG_NO_FORMATTING
@@ -212,7 +212,7 @@ static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, doubl
     if (status != U_ZERO_ERROR)
         return jsEmptyString(exec);
 
-    return jsNontrivialString(exec, UString(buffer, length));
+    return jsNontrivialString(exec, String(buffer, length));
 }
 
 #else
@@ -253,7 +253,7 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
     if (length)
         length--;
 
-    return jsNontrivialString(exec, UString(buffer.data(), length));
+    return jsNontrivialString(exec, String(buffer.data(), length));
 
 #else // OS(WINDOWS)
 
@@ -322,7 +322,7 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
     if (length != static_cast<size_t>(-1)) {
         for (size_t i = 0; i < length; ++i)
             buffer[i] = static_cast<UChar>(tempbuffer[i]);
-        return jsNontrivialString(exec, UString(buffer, length));
+        return jsNontrivialString(exec, String(buffer, length));
     }
 #endif
 
@@ -334,7 +334,7 @@ static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, doubl
 {
     const GregorianDateTime* gregorianDateTime = dateObject->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return jsNontrivialString(exec, "Invalid Date");
+        return jsNontrivialString(exec, ASCIILiteral("Invalid Date"));
     return formatLocaleDate(exec, *gregorianDateTime, format);
 }
 
@@ -352,7 +352,7 @@ static EncodedJSValue formateDateInstance(ExecState* exec, DateTimeFormat format
         ? thisDateObj->gregorianDateTimeUTC(exec)
         : thisDateObj->gregorianDateTime(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
+        return JSValue::encode(jsNontrivialString(exec, String(ASCIILiteral("Invalid Date"))));
 
     return JSValue::encode(jsNontrivialString(exec, formatDateTime(*gregorianDateTime, format, asUTCVariant)));
 }
@@ -548,24 +548,30 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
     
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     if (!isfinite(thisDateObj->internalNumber()))
-        return throwVMError(exec, createRangeError(exec, "Invalid Date"));
+        return throwVMError(exec, createRangeError(exec, ASCIILiteral("Invalid Date")));
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
-        return JSValue::encode(jsNontrivialString(exec, "Invalid Date"));
+        return JSValue::encode(jsNontrivialString(exec, String(ASCIILiteral("Invalid Date"))));
     // Maximum amount of space we need in buffer: 7 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 28. We add one extra character to allow us to force null termination.
-    char buffer[29];
+    char buffer[28];
     // If the year is outside the bounds of 0 and 9999 inclusive we want to use the extended year format (ES 15.9.1.15.1).
     int ms = static_cast<int>(fmod(thisDateObj->internalNumber(), msPerSecond));
     if (ms < 0)
         ms += msPerSecond;
+
+    int charactersWritten;
     if (gregorianDateTime->year() > 9999 || gregorianDateTime->year() < 0)
-        snprintf(buffer, sizeof(buffer) - 1, "%+07d-%02d-%02dT%02d:%02d:%02d.%03dZ", gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
+        charactersWritten = snprintf(buffer, sizeof(buffer), "%+07d-%02d-%02dT%02d:%02d:%02d.%03dZ", gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
     else
-        snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
-    buffer[sizeof(buffer) - 1] = 0;
-    return JSValue::encode(jsNontrivialString(exec, buffer));
+        charactersWritten = snprintf(buffer, sizeof(buffer), "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", gregorianDateTime->year(), gregorianDateTime->month() + 1, gregorianDateTime->monthDay(), gregorianDateTime->hour(), gregorianDateTime->minute(), gregorianDateTime->second(), ms);
+
+    ASSERT(charactersWritten > 0 && static_cast<unsigned>(charactersWritten) < sizeof(buffer));
+    if (static_cast<unsigned>(charactersWritten) >= sizeof(buffer))
+        return JSValue::encode(jsEmptyString(exec));
+
+    return JSValue::encode(jsNontrivialString(exec, String(buffer, charactersWritten)));
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec)
@@ -1113,13 +1119,13 @@ EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec)
     CallData callData;
     CallType callType = getCallData(toISOValue, callData);
     if (callType == CallTypeNone)
-        return throwVMError(exec, createTypeError(exec, "toISOString is not a function"));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("toISOString is not a function")));
 
     JSValue result = call(exec, asObject(toISOValue), callType, callData, object, exec->emptyList());
     if (exec->hadException())
         return JSValue::encode(jsNull());
     if (result.isObject())
-        return throwVMError(exec, createTypeError(exec, "toISOString did not return a primitive value"));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("toISOString did not return a primitive value")));
     return JSValue::encode(result);
 }
 
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index a3a990d59..27a729d0a 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -43,37 +43,37 @@ namespace JSC {
 static const char* linePropertyName = "line";
 static const char* sourceURLPropertyName = "sourceURL";
 
-JSObject* createError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->errorStructure(), message);
 }
 
-JSObject* createEvalError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createEvalError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->evalErrorConstructor()->errorStructure(), message);
 }
 
-JSObject* createRangeError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createRangeError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->rangeErrorConstructor()->errorStructure(), message);
 }
 
-JSObject* createReferenceError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createReferenceError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->referenceErrorConstructor()->errorStructure(), message);
 }
 
-JSObject* createSyntaxError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createSyntaxError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->syntaxErrorConstructor()->errorStructure(), message);
 }
 
-JSObject* createTypeError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createTypeError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->typeErrorConstructor()->errorStructure(), message);
@@ -81,41 +81,41 @@ JSObject* createTypeError(JSGlobalObject* globalObject, const UString& message)
 
 JSObject* createNotEnoughArgumentsError(JSGlobalObject* globalObject)
 {
-    return createTypeError(globalObject, "Not enough arguments");
+    return createTypeError(globalObject, ASCIILiteral("Not enough arguments"));
 }
 
-JSObject* createURIError(JSGlobalObject* globalObject, const UString& message)
+JSObject* createURIError(JSGlobalObject* globalObject, const String& message)
 {
     ASSERT(!message.isEmpty());
     return ErrorInstance::create(globalObject->globalData(), globalObject->URIErrorConstructor()->errorStructure(), message);
 }
 
-JSObject* createError(ExecState* exec, const UString& message)
+JSObject* createError(ExecState* exec, const String& message)
 {
     return createError(exec->lexicalGlobalObject(), message);
 }
 
-JSObject* createEvalError(ExecState* exec, const UString& message)
+JSObject* createEvalError(ExecState* exec, const String& message)
 {
     return createEvalError(exec->lexicalGlobalObject(), message);
 }
 
-JSObject* createRangeError(ExecState* exec, const UString& message)
+JSObject* createRangeError(ExecState* exec, const String& message)
 {
     return createRangeError(exec->lexicalGlobalObject(), message);
 }
 
-JSObject* createReferenceError(ExecState* exec, const UString& message)
+JSObject* createReferenceError(ExecState* exec, const String& message)
 {
     return createReferenceError(exec->lexicalGlobalObject(), message);
 }
 
-JSObject* createSyntaxError(ExecState* exec, const UString& message)
+JSObject* createSyntaxError(ExecState* exec, const String& message)
 {
     return createSyntaxError(exec->lexicalGlobalObject(), message);
 }
 
-JSObject* createTypeError(ExecState* exec, const UString& message)
+JSObject* createTypeError(ExecState* exec, const String& message)
 {
     return createTypeError(exec->lexicalGlobalObject(), message);
 }
@@ -125,7 +125,7 @@ JSObject* createNotEnoughArgumentsError(ExecState* exec)
     return createNotEnoughArgumentsError(exec->lexicalGlobalObject());
 }
 
-JSObject* createURIError(ExecState* exec, const UString& message)
+JSObject* createURIError(ExecState* exec, const String& message)
 {
     return createURIError(exec->lexicalGlobalObject(), message);
 }
@@ -133,7 +133,7 @@ JSObject* createURIError(ExecState* exec, const UString& message)
 JSObject* addErrorInfo(CallFrame* callFrame, JSObject* error, int line, const SourceCode& source)
 {
     JSGlobalData* globalData = &callFrame->globalData();
-    const UString& sourceURL = source.provider()->url();
+    const String& sourceURL = source.provider()->url();
 
     if (line != -1)
         error->putDirect(*globalData, Identifier(globalData, linePropertyName), jsNumber(line), ReadOnly | DontDelete);
@@ -169,12 +169,12 @@ JSObject* throwError(ExecState* exec, JSObject* error)
 
 JSObject* throwTypeError(ExecState* exec)
 {
-    return throwError(exec, createTypeError(exec, "Type error"));
+    return throwError(exec, createTypeError(exec, ASCIILiteral("Type error")));
 }
 
 JSObject* throwSyntaxError(ExecState* exec)
 {
-    return throwError(exec, createSyntaxError(exec, "Syntax error"));
+    return throwError(exec, createSyntaxError(exec, ASCIILiteral("Syntax error")));
 }
 
 ASSERT_CLASS_FITS_IN_CELL(StrictModeTypeErrorFunction);
diff --git a/Source/JavaScriptCore/runtime/Error.h b/Source/JavaScriptCore/runtime/Error.h
index 65aea3edc..9c34a0574 100644
--- a/Source/JavaScriptCore/runtime/Error.h
+++ b/Source/JavaScriptCore/runtime/Error.h
@@ -36,26 +36,25 @@ namespace JSC {
     class JSObject;
     class SourceCode;
     class Structure;
-    class UString;
 
     // Methods to create a range of internal errors.
-    JSObject* createError(JSGlobalObject*, const UString&);
-    JSObject* createEvalError(JSGlobalObject*, const UString&);
-    JSObject* createRangeError(JSGlobalObject*, const UString&);
-    JSObject* createReferenceError(JSGlobalObject*, const UString&);
-    JSObject* createSyntaxError(JSGlobalObject*, const UString&);
-    JSObject* createTypeError(JSGlobalObject*, const UString&);
+    JSObject* createError(JSGlobalObject*, const String&);
+    JSObject* createEvalError(JSGlobalObject*, const String&);
+    JSObject* createRangeError(JSGlobalObject*, const String&);
+    JSObject* createReferenceError(JSGlobalObject*, const String&);
+    JSObject* createSyntaxError(JSGlobalObject*, const String&);
+    JSObject* createTypeError(JSGlobalObject*, const String&);
     JSObject* createNotEnoughArgumentsError(JSGlobalObject*);
-    JSObject* createURIError(JSGlobalObject*, const UString&);
+    JSObject* createURIError(JSGlobalObject*, const String&);
     // ExecState wrappers.
-    JS_EXPORT_PRIVATE JSObject* createError(ExecState*, const UString&);
-    JSObject* createEvalError(ExecState*, const UString&);
-    JS_EXPORT_PRIVATE JSObject* createRangeError(ExecState*, const UString&);
-    JS_EXPORT_PRIVATE JSObject* createReferenceError(ExecState*, const UString&);
-    JS_EXPORT_PRIVATE JSObject* createSyntaxError(ExecState*, const UString&);
-    JS_EXPORT_PRIVATE JSObject* createTypeError(ExecState*, const UString&);
+    JS_EXPORT_PRIVATE JSObject* createError(ExecState*, const String&);
+    JSObject* createEvalError(ExecState*, const String&);
+    JS_EXPORT_PRIVATE JSObject* createRangeError(ExecState*, const String&);
+    JS_EXPORT_PRIVATE JSObject* createReferenceError(ExecState*, const String&);
+    JS_EXPORT_PRIVATE JSObject* createSyntaxError(ExecState*, const String&);
+    JS_EXPORT_PRIVATE JSObject* createTypeError(ExecState*, const String&);
     JS_EXPORT_PRIVATE JSObject* createNotEnoughArgumentsError(ExecState*);
-    JSObject* createURIError(ExecState*, const UString&);
+    JSObject* createURIError(ExecState*, const String&);
 
     // Methods to add 
     bool hasErrorInfo(ExecState*, JSObject* error);
@@ -76,7 +75,7 @@ namespace JSC {
 
     class StrictModeTypeErrorFunction : public InternalFunction {
     private:
-        StrictModeTypeErrorFunction(JSGlobalObject* globalObject, Structure* structure, const UString& message)
+        StrictModeTypeErrorFunction(JSGlobalObject* globalObject, Structure* structure, const String& message)
             : InternalFunction(globalObject, structure)
             , m_message(message)
         {
@@ -87,10 +86,10 @@ namespace JSC {
     public:
         typedef InternalFunction Base;
 
-        static StrictModeTypeErrorFunction* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& message)
+        static StrictModeTypeErrorFunction* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const String& message)
         {
             StrictModeTypeErrorFunction* function = new (NotNull, allocateCell<StrictModeTypeErrorFunction>(*exec->heap())) StrictModeTypeErrorFunction(globalObject, structure, message);
-            function->finishCreation(exec->globalData(), "");
+            function->finishCreation(exec->globalData(), String());
             return function;
         }
     
@@ -126,7 +125,7 @@ namespace JSC {
         }
 
     private:
-        UString m_message;
+        String m_message;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
index 91a6fc40e..9c0fe3e8b 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -21,6 +21,8 @@
 #include "config.h"
 #include "ErrorInstance.h"
 
+#include "JSScope.h"
+
 namespace JSC {
 
 ASSERT_HAS_TRIVIAL_DESTRUCTOR(ErrorInstance);
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
index d6fa32f99..894676361 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
@@ -36,7 +36,7 @@ namespace JSC {
             return Structure::create(globalData, globalObject, prototype, TypeInfo(ErrorInstanceType, StructureFlags), &s_info);
         }
 
-        static ErrorInstance* create(JSGlobalData& globalData, Structure* structure, const UString& message)
+        static ErrorInstance* create(JSGlobalData& globalData, Structure* structure, const String& message)
         {
             ErrorInstance* instance = new (NotNull, allocateCell<ErrorInstance>(globalData.heap)) ErrorInstance(globalData, structure);
             instance->finishCreation(globalData, message);
@@ -45,7 +45,7 @@ namespace JSC {
 
         static ErrorInstance* create(ExecState* exec, Structure* structure, JSValue message)
         {
-            return create(exec->globalData(), structure, message.isUndefined() ? UString() : message.toString(exec)->value(exec));
+            return create(exec->globalData(), structure, message.isUndefined() ? String() : message.toString(exec)->value(exec));
         }
 
         bool appendSourceToMessage() { return m_appendSourceToMessage; }
@@ -55,7 +55,7 @@ namespace JSC {
     protected:
         explicit ErrorInstance(JSGlobalData&, Structure*);
 
-        void finishCreation(JSGlobalData& globalData, const UString& message)
+        void finishCreation(JSGlobalData& globalData, const String& message)
         {
             Base::finishCreation(globalData);
             ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index 5dd3e85e2..6c9d6df04 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -27,7 +27,6 @@
 #include "JSStringBuilder.h"
 #include "ObjectPrototype.h"
 #include "StringRecursionChecker.h"
-#include "UString.h"
 
 namespace JSC {
 
@@ -60,7 +59,7 @@ void ErrorPrototype::finishCreation(ExecState* exec, JSGlobalObject*)
 {
     Base::finishCreation(exec->globalData(), "");
     ASSERT(inherits(&s_info));
-    putDirect(exec->globalData(), exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
+    putDirect(exec->globalData(), exec->propertyNames().name, jsNontrivialString(exec, String(ASCIILiteral("Error"))), DontEnum);
 }
 
 bool ErrorPrototype::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
@@ -97,9 +96,9 @@ EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
         return JSValue::encode(jsUndefined());
 
     // 4. If name is undefined, then let name be "Error"; else let name be ToString(name).
-    UString nameString;
+    String nameString;
     if (name.isUndefined())
-        nameString = "Error";
+        nameString = ASCIILiteral("Error");
     else {
         nameString = name.toString(exec)->value(exec);
         if (exec->hadException())
@@ -114,9 +113,9 @@ EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
     // (sic)
     // 6. If msg is undefined, then let msg be the empty String; else let msg be ToString(msg).
     // 7. If msg is undefined, then let msg be the empty String; else let msg be ToString(msg).
-    UString messageString;
+    String messageString;
     if (message.isUndefined())
-        messageString = "";
+        messageString = String();
     else {
         messageString = message.toString(exec)->value(exec);
         if (exec->hadException())
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
index ce63ae9af..38c525268 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -37,7 +37,6 @@
 #include "JSNotAnObject.h"
 #include "Interpreter.h"
 #include "Nodes.h"
-#include "UStringConcatenate.h"
 
 namespace JSC {
 
@@ -48,7 +47,7 @@ const ClassInfo InterruptedExecutionError::s_info = { "InterruptedExecutionError
 JSValue InterruptedExecutionError::defaultValue(const JSObject*, ExecState* exec, PreferredPrimitiveType hint)
 {
     if (hint == PreferString)
-        return jsNontrivialString(exec, "JavaScript execution exceeded timeout.");
+        return jsNontrivialString(exec, String(ASCIILiteral("JavaScript execution exceeded timeout.")));
     return JSValue(std::numeric_limits<double>::quiet_NaN());
 }
 
@@ -75,7 +74,7 @@ const ClassInfo TerminatedExecutionError::s_info = { "TerminatedExecutionError",
 JSValue TerminatedExecutionError::defaultValue(const JSObject*, ExecState* exec, PreferredPrimitiveType hint)
 {
     if (hint == PreferString)
-        return jsNontrivialString(exec, "JavaScript execution terminated.");
+        return jsNontrivialString(exec, String(ASCIILiteral("JavaScript execution terminated.")));
     return JSValue(std::numeric_limits<double>::quiet_NaN());
 }
 
@@ -97,23 +96,23 @@ bool isTerminatedExecutionException(JSValue value)
 
 JSObject* createStackOverflowError(ExecState* exec)
 {
-    return createRangeError(exec, "Maximum call stack size exceeded.");
+    return createRangeError(exec, ASCIILiteral("Maximum call stack size exceeded."));
 }
 
 JSObject* createStackOverflowError(JSGlobalObject* globalObject)
 {
-    return createRangeError(globalObject, "Maximum call stack size exceeded.");
+    return createRangeError(globalObject, ASCIILiteral("Maximum call stack size exceeded."));
 }
 
 JSObject* createUndefinedVariableError(ExecState* exec, const Identifier& ident)
 {
-    UString message(makeUString("Can't find variable: ", ident.ustring()));
+    String message(makeString("Can't find variable: ", ident.string()));
     return createReferenceError(exec, message);
 }
     
 JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value)
 {
-    UString errorMessage = makeUString("'", value.toString(exec)->value(exec), "' is not a valid argument for '", op, "'");
+    String errorMessage = makeString("'", value.toString(exec)->value(exec), "' is not a valid argument for '", op, "'");
     JSObject* exception = createTypeError(exec, errorMessage);
     ASSERT(exception->isErrorInstance());
     static_cast<ErrorInstance*>(exception)->setAppendSourceToMessage();
@@ -122,7 +121,7 @@ JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value
 
 JSObject* createNotAConstructorError(ExecState* exec, JSValue value)
 {
-    UString errorMessage = makeUString("'", value.toString(exec)->value(exec), "' is not a constructor");
+    String errorMessage = makeString("'", value.toString(exec)->value(exec), "' is not a constructor");
     JSObject* exception = createTypeError(exec, errorMessage);
     ASSERT(exception->isErrorInstance());
     static_cast<ErrorInstance*>(exception)->setAppendSourceToMessage();
@@ -131,7 +130,7 @@ JSObject* createNotAConstructorError(ExecState* exec, JSValue value)
 
 JSObject* createNotAFunctionError(ExecState* exec, JSValue value)
 {
-    UString errorMessage = makeUString("'", value.toString(exec)->value(exec), "' is not a function");
+    String errorMessage = makeString("'", value.toString(exec)->value(exec), "' is not a function");
     JSObject* exception = createTypeError(exec, errorMessage);
     ASSERT(exception->isErrorInstance());
     static_cast<ErrorInstance*>(exception)->setAppendSourceToMessage();
@@ -140,21 +139,21 @@ JSObject* createNotAFunctionError(ExecState* exec, JSValue value)
 
 JSObject* createNotAnObjectError(ExecState* exec, JSValue value)
 {
-    UString errorMessage = makeUString("'", value.toString(exec)->value(exec), "' is not an object");
+    String errorMessage = makeString("'", value.toString(exec)->value(exec), "' is not an object");
     JSObject* exception = createTypeError(exec, errorMessage);
     ASSERT(exception->isErrorInstance());
     static_cast<ErrorInstance*>(exception)->setAppendSourceToMessage();
     return exception;
 }
 
-JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const UString& propertyName)
+JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const String& propertyName)
 {
-    return createReferenceError(exec, makeUString("Strict mode forbids implicit creation of global property '", propertyName, "'"));
+    return createReferenceError(exec, makeString("Strict mode forbids implicit creation of global property '", propertyName, "'"));
 }
 
 JSObject* createOutOfMemoryError(JSGlobalObject* globalObject)
 {
-    return createError(globalObject, "Out of memory");
+    return createError(globalObject, ASCIILiteral("Out of memory"));
 }
 
 JSObject* throwOutOfMemoryError(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.h b/Source/JavaScriptCore/runtime/ExceptionHelpers.h
index 7bffd294b..d2daaa044 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -49,7 +49,7 @@ JSObject* createNotAnObjectError(ExecState*, JSValue);
 JSObject* createInvalidParamError(ExecState*, const char* op, JSValue);
 JSObject* createNotAConstructorError(ExecState*, JSValue);
 JSObject* createNotAFunctionError(ExecState*, JSValue);
-JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const UString&);
+JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const String&);
 
 JSObject* throwOutOfMemoryError(ExecState*);
 JSObject* throwStackOverflowError(ExecState*);
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 50bb5ffae..b11220bea 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -33,8 +33,8 @@
 #include "JIT.h"
 #include "JITDriver.h"
 #include "Parser.h"
-#include "UStringBuilder.h"
 #include <wtf/Vector.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace JSC {
 
@@ -133,26 +133,17 @@ void ProgramExecutable::destroy(JSCell* cell)
 
 const ClassInfo FunctionExecutable::s_info = { "FunctionExecutable", &ScriptExecutable::s_info, 0, 0, CREATE_METHOD_TABLE(FunctionExecutable) };
 
-FunctionExecutable::FunctionExecutable(JSGlobalData& globalData, const Identifier& name, const Identifier& inferredName, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext)
-    : ScriptExecutable(globalData.functionExecutableStructure.get(), globalData, source, inStrictContext)
+FunctionExecutable::FunctionExecutable(JSGlobalData& globalData, FunctionBodyNode* node)
+    : ScriptExecutable(globalData.functionExecutableStructure.get(), globalData, node->source(), node->isStrictMode())
     , m_numCapturedVariables(0)
-    , m_forceUsesArguments(forceUsesArguments)
-    , m_parameters(parameters)
-    , m_name(name)
-    , m_inferredName(inferredName.isNull() ? globalData.propertyNames->emptyIdentifier : inferredName)
-    , m_symbolTable(0)
-{
-}
-
-FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name, const Identifier& inferredName, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext)
-    : ScriptExecutable(exec->globalData().functionExecutableStructure.get(), exec, source, inStrictContext)
-    , m_numCapturedVariables(0)
-    , m_forceUsesArguments(forceUsesArguments)
-    , m_parameters(parameters)
-    , m_name(name)
-    , m_inferredName(inferredName.isNull() ? exec->globalData().propertyNames->emptyIdentifier : inferredName)
-    , m_symbolTable(0)
+    , m_forceUsesArguments(node->usesArguments())
+    , m_parameters(node->parameters())
+    , m_name(node->ident())
+    , m_inferredName(node->inferredName().isNull() ? globalData.propertyNames->emptyIdentifier : node->inferredName())
+    , m_functionNameIsInScopeToggle(node->functionNameIsInScopeToggle())
 {
+    m_firstLine = node->lineNo();
+    m_lastLine = node->lastLine();
 }
 
 void FunctionExecutable::destroy(JSCell* cell)
@@ -160,13 +151,13 @@ void FunctionExecutable::destroy(JSCell* cell)
     static_cast<FunctionExecutable*>(cell)->FunctionExecutable::~FunctionExecutable();
 }
 
-JSObject* EvalExecutable::compileOptimized(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* EvalExecutable::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_evalCodeBlock);
     JSObject* error = 0;
     if (m_evalCodeBlock->getJITType() != JITCode::topTierJIT())
-        error = compileInternal(exec, scopeChainNode, JITCode::nextTierJIT(m_evalCodeBlock->getJITType()), bytecodeIndex);
+        error = compileInternal(exec, scope, JITCode::nextTierJIT(m_evalCodeBlock->getJITType()), bytecodeIndex);
     ASSERT(!!m_evalCodeBlock);
     return error;
 }
@@ -193,7 +184,7 @@ inline const char* samplingDescription(JITCode::JITType jitType)
     }
 }
 
-JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType, unsigned bytecodeIndex)
+JSObject* EvalExecutable::compileInternal(ExecState* exec, JSScope* scope, JITCode::JITType jitType, unsigned bytecodeIndex)
 {
     SamplingRegion samplingRegion(samplingDescription(jitType));
     
@@ -211,20 +202,20 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
         m_evalCodeBlock = newCodeBlock.release();
     } else {
         if (!lexicalGlobalObject->evalEnabled())
-            return throwError(exec, createEvalError(exec, "Eval is disabled"));
-        RefPtr<EvalNode> evalNode = parse<EvalNode>(globalData, lexicalGlobalObject, m_source, 0, isStrictMode() ? JSParseStrict : JSParseNormal, EvalNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
+            return throwError(exec, createEvalError(exec, ASCIILiteral("Eval is disabled")));
+        RefPtr<EvalNode> evalNode = parse<EvalNode>(globalData, lexicalGlobalObject, m_source, 0, Identifier(), isStrictMode() ? JSParseStrict : JSParseNormal, EvalNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
         if (!evalNode) {
             ASSERT(exception);
             return exception;
         }
         recordParse(evalNode->features(), evalNode->hasCapturedVariables(), evalNode->lineNo(), evalNode->lastLine());
         
-        JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
+        JSGlobalObject* globalObject = scope->globalObject();
         
         OwnPtr<CodeBlock> previousCodeBlock = m_evalCodeBlock.release();
         ASSERT((jitType == JITCode::bottomTierJIT()) == !previousCodeBlock);
-        m_evalCodeBlock = adoptPtr(new EvalCodeBlock(this, globalObject, source().provider(), scopeChainNode->localDepth(), previousCodeBlock.release()));
-        OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(evalNode.get(), scopeChainNode, m_evalCodeBlock->symbolTable(), m_evalCodeBlock.get(), !!m_evalCodeBlock->alternative() ? OptimizingCompilation : FirstCompilation)));
+        m_evalCodeBlock = adoptPtr(new EvalCodeBlock(this, globalObject, source().provider(), scope->localDepth(), previousCodeBlock.release()));
+        OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(evalNode.get(), scope, m_evalCodeBlock->symbolTable(), m_evalCodeBlock.get(), !!m_evalCodeBlock->alternative() ? OptimizingCompilation : FirstCompilation)));
         if ((exception = generator->generate())) {
             m_evalCodeBlock = static_pointer_cast<EvalCodeBlock>(m_evalCodeBlock->releaseAlternative());
             evalNode->destroyData();
@@ -295,20 +286,20 @@ JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
     JSObject* exception = 0;
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, lexicalGlobalObject, m_source, 0, JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
+    RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, lexicalGlobalObject, m_source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
     if (programNode)
         return 0;
     ASSERT(exception);
     return exception;
 }
 
-JSObject* ProgramExecutable::compileOptimized(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* ProgramExecutable::compileOptimized(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_programCodeBlock);
     JSObject* error = 0;
     if (m_programCodeBlock->getJITType() != JITCode::topTierJIT())
-        error = compileInternal(exec, scopeChainNode, JITCode::nextTierJIT(m_programCodeBlock->getJITType()), bytecodeIndex);
+        error = compileInternal(exec, scope, JITCode::nextTierJIT(m_programCodeBlock->getJITType()), bytecodeIndex);
     ASSERT(!!m_programCodeBlock);
     return error;
 }
@@ -320,7 +311,7 @@ bool ProgramExecutable::jitCompile(ExecState* exec)
 }
 #endif
 
-JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType, unsigned bytecodeIndex)
+JSObject* ProgramExecutable::compileInternal(ExecState* exec, JSScope* scope, JITCode::JITType jitType, unsigned bytecodeIndex)
 {
     SamplingRegion samplingRegion(samplingDescription(jitType));
     
@@ -337,19 +328,19 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
         newCodeBlock->setAlternative(static_pointer_cast<CodeBlock>(m_programCodeBlock.release()));
         m_programCodeBlock = newCodeBlock.release();
     } else {
-        RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, lexicalGlobalObject, m_source, 0, isStrictMode() ? JSParseStrict : JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
+        RefPtr<ProgramNode> programNode = parse<ProgramNode>(globalData, lexicalGlobalObject, m_source, 0, Identifier(), isStrictMode() ? JSParseStrict : JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, lexicalGlobalObject->debugger(), exec, &exception);
         if (!programNode) {
             ASSERT(exception);
             return exception;
         }
         recordParse(programNode->features(), programNode->hasCapturedVariables(), programNode->lineNo(), programNode->lastLine());
 
-        JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
+        JSGlobalObject* globalObject = scope->globalObject();
     
         OwnPtr<CodeBlock> previousCodeBlock = m_programCodeBlock.release();
         ASSERT((jitType == JITCode::bottomTierJIT()) == !previousCodeBlock);
         m_programCodeBlock = adoptPtr(new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider(), previousCodeBlock.release()));
-        OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(programNode.get(), scopeChainNode, &globalObject->symbolTable(), m_programCodeBlock.get(), !!m_programCodeBlock->alternative() ? OptimizingCompilation : FirstCompilation)));
+        OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(programNode.get(), scope, globalObject->symbolTable(), m_programCodeBlock.get(), !!m_programCodeBlock->alternative() ? OptimizingCompilation : FirstCompilation)));
         if ((exception = generator->generate())) {
             m_programCodeBlock = static_pointer_cast<ProgramCodeBlock>(m_programCodeBlock->releaseAlternative());
             programNode->destroyData();
@@ -433,24 +424,24 @@ FunctionCodeBlock* FunctionExecutable::baselineCodeBlockFor(CodeSpecializationKi
     return result;
 }
 
-JSObject* FunctionExecutable::compileOptimizedForCall(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* FunctionExecutable::compileOptimizedForCall(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_codeBlockForCall);
     JSObject* error = 0;
     if (m_codeBlockForCall->getJITType() != JITCode::topTierJIT())
-        error = compileForCallInternal(exec, scopeChainNode, JITCode::nextTierJIT(m_codeBlockForCall->getJITType()), bytecodeIndex);
+        error = compileForCallInternal(exec, scope, JITCode::nextTierJIT(m_codeBlockForCall->getJITType()), bytecodeIndex);
     ASSERT(!!m_codeBlockForCall);
     return error;
 }
 
-JSObject* FunctionExecutable::compileOptimizedForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex)
+JSObject* FunctionExecutable::compileOptimizedForConstruct(ExecState* exec, JSScope* scope, unsigned bytecodeIndex)
 {
     ASSERT(exec->globalData().dynamicGlobalObject);
     ASSERT(!!m_codeBlockForConstruct);
     JSObject* error = 0;
     if (m_codeBlockForConstruct->getJITType() != JITCode::topTierJIT())
-        error = compileForConstructInternal(exec, scopeChainNode, JITCode::nextTierJIT(m_codeBlockForConstruct->getJITType()), bytecodeIndex);
+        error = compileForConstructInternal(exec, scope, JITCode::nextTierJIT(m_codeBlockForConstruct->getJITType()), bytecodeIndex);
     ASSERT(!!m_codeBlockForConstruct);
     return error;
 }
@@ -472,15 +463,26 @@ FunctionCodeBlock* FunctionExecutable::codeBlockWithBytecodeFor(CodeSpecializati
     return baselineCodeBlockFor(kind);
 }
 
-PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(ScopeChainNode* scopeChainNode, CompilationKind compilationKind, CodeSpecializationKind specializationKind, JSObject*& exception)
+PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(JSScope* scope, CompilationKind compilationKind, CodeSpecializationKind specializationKind, JSObject*& exception)
 {
     if (!!codeBlockFor(specializationKind))
         return adoptPtr(new FunctionCodeBlock(CodeBlock::CopyParsedBlock, *codeBlockFor(specializationKind)));
     
     exception = 0;
-    JSGlobalData* globalData = scopeChainNode->globalData;
-    JSGlobalObject* globalObject = scopeChainNode->globalObject.get();
-    RefPtr<FunctionBodyNode> body = parse<FunctionBodyNode>(globalData, globalObject, m_source, m_parameters.get(), isStrictMode() ? JSParseStrict : JSParseNormal, FunctionBodyNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, 0, 0, &exception);
+    JSGlobalData* globalData = scope->globalData();
+    JSGlobalObject* globalObject = scope->globalObject();
+    RefPtr<FunctionBodyNode> body = parse<FunctionBodyNode>(
+        globalData,
+        globalObject,
+        m_source,
+        m_parameters.get(),
+        name(),
+        isStrictMode() ? JSParseStrict : JSParseNormal,
+        FunctionBodyNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode,
+        0,
+        0,
+        &exception
+    );
 
     if (!body) {
         ASSERT(exception);
@@ -488,13 +490,13 @@ PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(ScopeChain
     }
     if (m_forceUsesArguments)
         body->setUsesArguments();
-    body->finishParsing(m_parameters, m_name);
+    body->finishParsing(m_parameters, m_name, m_functionNameIsInScopeToggle);
     recordParse(body->features(), body->hasCapturedVariables(), body->lineNo(), body->lastLine());
 
     OwnPtr<FunctionCodeBlock> result;
     ASSERT((compilationKind == FirstCompilation) == !codeBlockFor(specializationKind));
     result = adoptPtr(new FunctionCodeBlock(this, FunctionCode, globalObject, source().provider(), source().startOffset(), specializationKind == CodeForConstruct));
-    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scopeChainNode, result->symbolTable(), result.get(), compilationKind)));
+    OwnPtr<BytecodeGenerator> generator(adoptPtr(new BytecodeGenerator(body.get(), scope, result->symbolTable(), result.get(), compilationKind)));
     exception = generator->generate();
     body->destroyData();
     if (exception)
@@ -504,7 +506,7 @@ PassOwnPtr<FunctionCodeBlock> FunctionExecutable::produceCodeBlockFor(ScopeChain
     return result.release();
 }
 
-JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType, unsigned bytecodeIndex)
+JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, JSScope* scope, JITCode::JITType jitType, unsigned bytecodeIndex)
 {
     SamplingRegion samplingRegion(samplingDescription(jitType));
     
@@ -516,7 +518,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
 #endif
     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForCall);
     JSObject* exception;
-    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scopeChainNode, !!m_codeBlockForCall ? OptimizingCompilation : FirstCompilation, CodeForCall, exception);
+    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, !!m_codeBlockForCall ? OptimizingCompilation : FirstCompilation, CodeForCall, exception);
     if (!newCodeBlock)
         return exception;
 
@@ -526,7 +528,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
     m_numParametersForCall = m_codeBlockForCall->numParameters();
     ASSERT(m_numParametersForCall);
     m_numCapturedVariables = m_codeBlockForCall->m_numCapturedVars;
-    m_symbolTable = m_codeBlockForCall->sharedSymbolTable();
+    m_symbolTable.set(exec->globalData(), this, m_codeBlockForCall->symbolTable());
 
 #if ENABLE(JIT)
     if (!prepareFunctionForExecution(exec, m_codeBlockForCall, m_jitCodeForCall, m_jitCodeForCallWithArityCheck, m_symbolTable, jitType, bytecodeIndex, CodeForCall))
@@ -547,7 +549,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
     return 0;
 }
 
-JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, ScopeChainNode* scopeChainNode, JITCode::JITType jitType, unsigned bytecodeIndex)
+JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, JSScope* scope, JITCode::JITType jitType, unsigned bytecodeIndex)
 {
     SamplingRegion samplingRegion(samplingDescription(jitType));
     
@@ -559,7 +561,7 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
     
     ASSERT((jitType == JITCode::bottomTierJIT()) == !m_codeBlockForConstruct);
     JSObject* exception;
-    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scopeChainNode, !!m_codeBlockForConstruct ? OptimizingCompilation : FirstCompilation, CodeForConstruct, exception);
+    OwnPtr<FunctionCodeBlock> newCodeBlock = produceCodeBlockFor(scope, !!m_codeBlockForConstruct ? OptimizingCompilation : FirstCompilation, CodeForConstruct, exception);
     if (!newCodeBlock)
         return exception;
 
@@ -569,7 +571,7 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
     m_numParametersForConstruct = m_codeBlockForConstruct->numParameters();
     ASSERT(m_numParametersForConstruct);
     m_numCapturedVariables = m_codeBlockForConstruct->m_numCapturedVars;
-    m_symbolTable = m_codeBlockForConstruct->sharedSymbolTable();
+    m_symbolTable.set(exec->globalData(), this, m_codeBlockForConstruct->symbolTable());
 
 #if ENABLE(JIT)
     if (!prepareFunctionForExecution(exec, m_codeBlockForConstruct, m_jitCodeForConstruct, m_jitCodeForConstructWithArityCheck, m_symbolTable, jitType, bytecodeIndex, CodeForConstruct))
@@ -613,8 +615,8 @@ void FunctionExecutable::visitChildren(JSCell* cell, SlotVisitor& visitor)
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     ScriptExecutable::visitChildren(thisObject, visitor);
-    if (thisObject->m_nameValue)
-        visitor.append(&thisObject->m_nameValue);
+    visitor.append(&thisObject->m_nameValue);
+    visitor.append(&thisObject->m_symbolTable);
     if (thisObject->m_codeBlockForCall)
         thisObject->m_codeBlockForCall->visitAggregate(visitor);
     if (thisObject->m_codeBlockForConstruct)
@@ -649,16 +651,16 @@ void FunctionExecutable::unlinkCalls()
 #endif
 }
 
-FunctionExecutable* FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
+FunctionExecutable* FunctionExecutable::fromGlobalCode(const Identifier& name, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
 {
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> program = parse<ProgramNode>(&exec->globalData(), lexicalGlobalObject, source, 0, JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, debugger, exec, exception);
+    RefPtr<ProgramNode> program = parse<ProgramNode>(&exec->globalData(), lexicalGlobalObject, source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, debugger, exec, exception);
     if (!program) {
         ASSERT(*exception);
         return 0;
     }
 
-    // Uses of this function that would not result in a single function expression are invalid.
+    // This function assumes an input string that would result in a single anonymous function expression.
     StatementNode* exprStatement = program->singleStatement();
     ASSERT(exprStatement);
     ASSERT(exprStatement->isExprStatement());
@@ -667,20 +669,23 @@ FunctionExecutable* FunctionExecutable::fromGlobalCode(const Identifier& functio
     ASSERT(funcExpr->isFuncExprNode());
     FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);
+    ASSERT(body->ident().isNull());
 
-    return FunctionExecutable::create(exec->globalData(), functionName, functionName, body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
+    FunctionExecutable* functionExecutable = FunctionExecutable::create(exec->globalData(), body);
+    functionExecutable->m_nameValue.set(exec->globalData(), functionExecutable, jsString(&exec->globalData(), name.string()));
+    return functionExecutable;
 }
 
-UString FunctionExecutable::paramString() const
+String FunctionExecutable::paramString() const
 {
     FunctionParameters& parameters = *m_parameters;
-    UStringBuilder builder;
+    StringBuilder builder;
     for (size_t pos = 0; pos < parameters.size(); ++pos) {
         if (!builder.isEmpty())
-            builder.append(", ");
-        builder.append(parameters[pos].ustring());
+            builder.appendLiteral(", ");
+        builder.append(parameters[pos].string());
     }
-    return builder.toUString();
+    return builder.toString();
 }
 
 }
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index 2e5ba28ca..f63cc7f99 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -28,8 +28,10 @@
 
 #include "CallData.h"
 #include "CodeSpecializationKind.h"
+#include "HandlerInfo.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
+#include "LLIntCLoop.h"
 #include "Nodes.h"
 #include "SamplingTool.h"
 #include <wtf/PassOwnPtr.h>
@@ -42,7 +44,7 @@ namespace JSC {
     class FunctionCodeBlock;
     class LLIntOffsetsExtractor;
     class ProgramCodeBlock;
-    class ScopeChainNode;
+    class JSScope;
     
     enum CompilationKind { FirstCompilation, OptimizingCompilation };
 
@@ -200,7 +202,47 @@ namespace JSC {
             ASSERT(kind == CodeForConstruct);
             return OBJECT_OFFSETOF(ExecutableBase, m_numParametersForConstruct);
         }
-#endif
+#endif // ENABLE(JIT)
+
+#if ENABLE(JIT) || ENABLE(LLINT_C_LOOP)
+        MacroAssemblerCodePtr hostCodeEntryFor(CodeSpecializationKind kind)
+        {
+            #if ENABLE(JIT)
+            return generatedJITCodeFor(kind).addressForCall();
+            #else
+            return LLInt::CLoop::hostCodeEntryFor(kind);
+            #endif
+        }
+
+        MacroAssemblerCodePtr jsCodeEntryFor(CodeSpecializationKind kind)
+        {
+            #if ENABLE(JIT)
+            return generatedJITCodeFor(kind).addressForCall();
+            #else
+            return LLInt::CLoop::jsCodeEntryFor(kind);
+            #endif
+        }
+
+        MacroAssemblerCodePtr jsCodeWithArityCheckEntryFor(CodeSpecializationKind kind)
+        {
+            #if ENABLE(JIT)
+            return generatedJITCodeWithArityCheckFor(kind);
+            #else
+            return LLInt::CLoop::jsCodeEntryWithArityCheckFor(kind);
+            #endif
+        }
+
+        static void* catchRoutineFor(HandlerInfo* handler, Instruction* catchPCForInterpreter)
+        {
+            #if ENABLE(JIT)
+            UNUSED_PARAM(catchPCForInterpreter);
+            return handler->nativeCode.executableAddress();
+            #else
+            UNUSED_PARAM(handler);
+            return LLInt::CLoop::catchRoutineFor(catchPCForInterpreter);
+            #endif
+        }
+#endif // ENABLE(JIT || ENABLE(LLINT_C_LOOP)
 
     protected:
         ExecutableBase* m_prev;
@@ -236,7 +278,7 @@ namespace JSC {
         }
 #endif
 
-#if ENABLE(CLASSIC_INTERPRETER)
+#if ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT_C_LOOP)
         static NativeExecutable* create(JSGlobalData& globalData, NativeFunction function, NativeFunction constructor)
         {
             ASSERT(!globalData.canUseJIT());
@@ -320,7 +362,7 @@ namespace JSC {
 
         const SourceCode& source() { return m_source; }
         intptr_t sourceID() const { return m_source.providerID(); }
-        const UString& sourceURL() const { return m_source.provider()->url(); }
+        const String& sourceURL() const { return m_source.provider()->url(); }
         int lineNo() const { return m_firstLine; }
         int lastLine() const { return m_lastLine; }
 
@@ -367,17 +409,17 @@ namespace JSC {
 
         static void destroy(JSCell*);
 
-        JSObject* compile(ExecState* exec, ScopeChainNode* scopeChainNode)
+        JSObject* compile(ExecState* exec, JSScope* scope)
         {
             ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_evalCodeBlock)
-                error = compileInternal(exec, scopeChainNode, JITCode::bottomTierJIT());
+                error = compileInternal(exec, scope, JITCode::bottomTierJIT());
             ASSERT(!error == !!m_evalCodeBlock);
             return error;
         }
         
-        JSObject* compileOptimized(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex);
         
 #if ENABLE(JIT)
         void jettisonOptimizedCode(JSGlobalData&);
@@ -418,7 +460,7 @@ namespace JSC {
         static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
         EvalExecutable(ExecState*, const SourceCode&, bool);
 
-        JSObject* compileInternal(ExecState*, ScopeChainNode*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
+        JSObject* compileInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
         static void visitChildren(JSCell*, SlotVisitor&);
 
         OwnPtr<EvalCodeBlock> m_evalCodeBlock;
@@ -438,17 +480,17 @@ namespace JSC {
 
         static void destroy(JSCell*);
 
-        JSObject* compile(ExecState* exec, ScopeChainNode* scopeChainNode)
+        JSObject* compile(ExecState* exec, JSScope* scope)
         {
             ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_programCodeBlock)
-                error = compileInternal(exec, scopeChainNode, JITCode::bottomTierJIT());
+                error = compileInternal(exec, scope, JITCode::bottomTierJIT());
             ASSERT(!error == !!m_programCodeBlock);
             return error;
         }
 
-        JSObject* compileOptimized(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        JSObject* compileOptimized(ExecState*, JSScope*, unsigned bytecodeIndex);
         
 #if ENABLE(JIT)
         void jettisonOptimizedCode(JSGlobalData&);
@@ -485,7 +527,7 @@ namespace JSC {
         static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
         ProgramExecutable(ExecState*, const SourceCode&);
 
-        JSObject* compileInternal(ExecState*, ScopeChainNode*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
+        JSObject* compileInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
         static void visitChildren(JSCell*, SlotVisitor&);
 
         OwnPtr<ProgramCodeBlock> m_programCodeBlock;
@@ -497,27 +539,16 @@ namespace JSC {
     public:
         typedef ScriptExecutable Base;
 
-        static FunctionExecutable* create(ExecState* exec, const Identifier& name, const Identifier& inferredName, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
-        {
-            FunctionExecutable* executable = new (NotNull, allocateCell<FunctionExecutable>(*exec->heap())) FunctionExecutable(exec, name, inferredName, source, forceUsesArguments, parameters, isInStrictContext);
-            executable->finishCreation(exec->globalData(), name, firstLine, lastLine);
-            return executable;
-        }
-
-        static FunctionExecutable* create(JSGlobalData& globalData, const Identifier& name, const Identifier& inferredName, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
+        static FunctionExecutable* create(JSGlobalData& globalData, FunctionBodyNode* node)
         {
-            FunctionExecutable* executable = new (NotNull, allocateCell<FunctionExecutable>(globalData.heap)) FunctionExecutable(globalData, name, inferredName, source, forceUsesArguments, parameters, isInStrictContext);
-            executable->finishCreation(globalData, name, firstLine, lastLine);
+            FunctionExecutable* executable = new (NotNull, allocateCell<FunctionExecutable>(globalData.heap)) FunctionExecutable(globalData, node);
+            executable->finishCreation(globalData);
             return executable;
         }
+        static FunctionExecutable* fromGlobalCode(const Identifier& name, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
 
         static void destroy(JSCell*);
 
-        JSFunction* make(ExecState* exec, ScopeChainNode* scopeChain)
-        {
-            return JSFunction::create(exec, this, scopeChain);
-        }
-        
         // Returns either call or construct bytecode. This can be appropriate
         // for answering questions that that don't vary between call and construct --
         // for example, argumentsRegister().
@@ -531,19 +562,19 @@ namespace JSC {
         
         FunctionCodeBlock* codeBlockWithBytecodeFor(CodeSpecializationKind);
         
-        PassOwnPtr<FunctionCodeBlock> produceCodeBlockFor(ScopeChainNode*, CompilationKind, CodeSpecializationKind, JSObject*& exception);
+        PassOwnPtr<FunctionCodeBlock> produceCodeBlockFor(JSScope*, CompilationKind, CodeSpecializationKind, JSObject*& exception);
 
-        JSObject* compileForCall(ExecState* exec, ScopeChainNode* scopeChainNode)
+        JSObject* compileForCall(ExecState* exec, JSScope* scope)
         {
             ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForCall)
-                error = compileForCallInternal(exec, scopeChainNode, JITCode::bottomTierJIT());
+                error = compileForCallInternal(exec, scope, JITCode::bottomTierJIT());
             ASSERT(!error == !!m_codeBlockForCall);
             return error;
         }
 
-        JSObject* compileOptimizedForCall(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        JSObject* compileOptimizedForCall(ExecState*, JSScope*, unsigned bytecodeIndex);
         
 #if ENABLE(JIT)
         void jettisonOptimizedCodeForCall(JSGlobalData&);
@@ -561,17 +592,17 @@ namespace JSC {
             return *m_codeBlockForCall;
         }
 
-        JSObject* compileForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode)
+        JSObject* compileForConstruct(ExecState* exec, JSScope* scope)
         {
             ASSERT(exec->globalData().dynamicGlobalObject);
             JSObject* error = 0;
             if (!m_codeBlockForConstruct)
-                error = compileForConstructInternal(exec, scopeChainNode, JITCode::bottomTierJIT());
+                error = compileForConstructInternal(exec, scope, JITCode::bottomTierJIT());
             ASSERT(!error == !!m_codeBlockForConstruct);
             return error;
         }
 
-        JSObject* compileOptimizedForConstruct(ExecState*, ScopeChainNode*, unsigned bytecodeIndex);
+        JSObject* compileOptimizedForConstruct(ExecState*, JSScope*, unsigned bytecodeIndex);
         
 #if ENABLE(JIT)
         void jettisonOptimizedCodeForConstruct(JSGlobalData&);
@@ -589,28 +620,28 @@ namespace JSC {
             return *m_codeBlockForConstruct;
         }
         
-        JSObject* compileFor(ExecState* exec, ScopeChainNode* scopeChainNode, CodeSpecializationKind kind)
+        JSObject* compileFor(ExecState* exec, JSScope* scope, CodeSpecializationKind kind)
         {
             ASSERT(exec->callee());
             ASSERT(exec->callee()->inherits(&JSFunction::s_info));
             ASSERT(jsCast<JSFunction*>(exec->callee())->jsExecutable() == this);
 
             if (kind == CodeForCall)
-                return compileForCall(exec, scopeChainNode);
+                return compileForCall(exec, scope);
             ASSERT(kind == CodeForConstruct);
-            return compileForConstruct(exec, scopeChainNode);
+            return compileForConstruct(exec, scope);
         }
         
-        JSObject* compileOptimizedFor(ExecState* exec, ScopeChainNode* scopeChainNode, unsigned bytecodeIndex, CodeSpecializationKind kind)
+        JSObject* compileOptimizedFor(ExecState* exec, JSScope* scope, unsigned bytecodeIndex, CodeSpecializationKind kind)
         {
             ASSERT(exec->callee());
             ASSERT(exec->callee()->inherits(&JSFunction::s_info));
             ASSERT(jsCast<JSFunction*>(exec->callee())->jsExecutable() == this);
             
             if (kind == CodeForCall)
-                return compileOptimizedForCall(exec, scopeChainNode, bytecodeIndex);
+                return compileOptimizedForCall(exec, scope, bytecodeIndex);
             ASSERT(kind == CodeForConstruct);
-            return compileOptimizedForConstruct(exec, scopeChainNode, bytecodeIndex);
+            return compileOptimizedForConstruct(exec, scope, bytecodeIndex);
         }
         
 #if ENABLE(JIT)
@@ -661,12 +692,11 @@ namespace JSC {
         JSString* nameValue() const { return m_nameValue.get(); }
         size_t parameterCount() const { return m_parameters->size(); } // Excluding 'this'!
         unsigned capturedVariableCount() const { return m_numCapturedVariables; }
-        UString paramString() const;
-        SharedSymbolTable* symbolTable() const { return m_symbolTable; }
+        String paramString() const;
+        SharedSymbolTable* symbolTable() const { return m_symbolTable.get(); }
 
         void clearCodeIfNotCompiling();
         static void visitChildren(JSCell*, SlotVisitor&);
-        static FunctionExecutable* fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
         {
             return Structure::create(globalData, globalObject, proto, TypeInfo(FunctionExecutableType, StructureFlags), &s_info);
@@ -679,20 +709,17 @@ namespace JSC {
         void clearCode();
 
     protected:
-        void finishCreation(JSGlobalData& globalData, const Identifier& name, int firstLine, int lastLine)
+        void finishCreation(JSGlobalData& globalData)
         {
             Base::finishCreation(globalData);
-            m_firstLine = firstLine;
-            m_lastLine = lastLine;
-            m_nameValue.set(globalData, this, jsString(&globalData, name.ustring()));
+            m_nameValue.set(globalData, this, jsString(&globalData, name().string()));
         }
 
     private:
-        FunctionExecutable(JSGlobalData&, const Identifier& name, const Identifier& inferredName, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool);
-        FunctionExecutable(ExecState*, const Identifier& name, const Identifier& inferredName, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool);
+        FunctionExecutable(JSGlobalData&, FunctionBodyNode*);
 
-        JSObject* compileForCallInternal(ExecState*, ScopeChainNode*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
-        JSObject* compileForConstructInternal(ExecState*, ScopeChainNode*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
+        JSObject* compileForCallInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
+        JSObject* compileForConstructInternal(ExecState*, JSScope*, JITCode::JITType, unsigned bytecodeIndex = UINT_MAX);
         
         OwnPtr<FunctionCodeBlock>& codeBlockFor(CodeSpecializationKind kind)
         {
@@ -722,8 +749,9 @@ namespace JSC {
         OwnPtr<FunctionCodeBlock> m_codeBlockForConstruct;
         Identifier m_name;
         Identifier m_inferredName;
+        FunctionNameIsInScopeToggle m_functionNameIsInScopeToggle;
         WriteBarrier<JSString> m_nameValue;
-        SharedSymbolTable* m_symbolTable;
+        WriteBarrier<SharedSymbolTable> m_symbolTable;
     };
 
     inline FunctionExecutable* JSFunction::jsExecutable() const
diff --git a/Source/JavaScriptCore/runtime/ExecutionHarness.h b/Source/JavaScriptCore/runtime/ExecutionHarness.h
index 3a876402e..065788aee 100644
--- a/Source/JavaScriptCore/runtime/ExecutionHarness.h
+++ b/Source/JavaScriptCore/runtime/ExecutionHarness.h
@@ -49,7 +49,7 @@ inline bool prepareForExecution(ExecState* exec, OwnPtr<CodeBlockType>& codeBloc
     return jitCompileIfAppropriate(exec, codeBlock, jitCode, jitType, bytecodeIndex, JITCode::isBaselineCode(jitType) ? JITCompilationMustSucceed : JITCompilationCanFail);
 }
 
-inline bool prepareFunctionForExecution(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, SharedSymbolTable*& symbolTable, JITCode::JITType jitType, unsigned bytecodeIndex, CodeSpecializationKind kind)
+inline bool prepareFunctionForExecution(ExecState* exec, OwnPtr<FunctionCodeBlock>& codeBlock, JITCode& jitCode, MacroAssemblerCodePtr& jitCodeWithArityCheck, WriteBarrier<SharedSymbolTable>& symbolTable, JITCode::JITType jitType, unsigned bytecodeIndex, CodeSpecializationKind kind)
 {
 #if ENABLE(LLINT)
     if (JITCode::isBaselineCode(jitType)) {
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index 7f82a74ce..40507dae1 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -30,8 +30,7 @@
 #include "Lexer.h"
 #include "Nodes.h"
 #include "Parser.h"
-#include "UStringBuilder.h"
-#include "UStringConcatenate.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace JSC {
 
@@ -80,38 +79,37 @@ CallType FunctionConstructor::getCallData(JSCell*, CallData& callData)
 }
 
 // ECMA 15.3.2 The Function Constructor
-JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const UString& sourceURL, const TextPosition& position)
+JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const String& sourceURL, const TextPosition& position)
 {
     if (!globalObject->evalEnabled())
-        return throwError(exec, createEvalError(exec, "Function constructor is disabled"));
+        return throwError(exec, createEvalError(exec, ASCIILiteral("Function constructor is disabled")));
     return constructFunctionSkippingEvalEnabledCheck(exec, globalObject, args, functionName, sourceURL, position);
 }
 
-JSObject* constructFunctionSkippingEvalEnabledCheck(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const UString& sourceURL, const TextPosition& position)
+JSObject* constructFunctionSkippingEvalEnabledCheck(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const String& sourceURL, const TextPosition& position)
 {
     // Functions need to have a space following the opening { due to for web compatibility
     // see https://bugs.webkit.org/show_bug.cgi?id=24350
     // We also need \n before the closing } to handle // comments at the end of the last line
-    UString program;
+    String program;
     if (args.isEmpty())
-        program = "(function() { \n})";
+        program = ASCIILiteral("(function() { \n})");
     else if (args.size() == 1)
-        program = makeUString("(function() { ", args.at(0).toString(exec)->value(exec), "\n})");
+        program = makeString("(function() { ", args.at(0).toString(exec)->value(exec), "\n})");
     else {
-        UStringBuilder builder;
-        builder.append("(function(");
+        StringBuilder builder;
+        builder.appendLiteral("(function(");
         builder.append(args.at(0).toString(exec)->value(exec));
         for (size_t i = 1; i < args.size() - 1; i++) {
-            builder.append(",");
+            builder.append(',');
             builder.append(args.at(i).toString(exec)->value(exec));
         }
-        builder.append(") { ");
+        builder.appendLiteral(") { ");
         builder.append(args.at(args.size() - 1).toString(exec)->value(exec));
-        builder.append("\n})");
-        program = builder.toUString();
+        builder.appendLiteral("\n})");
+        program = builder.toString();
     }
 
-    JSGlobalData& globalData = globalObject->globalData();
     SourceCode source = makeSource(program, sourceURL, position);
     JSObject* exception = 0;
     FunctionExecutable* function = FunctionExecutable::fromGlobalCode(functionName, exec, exec->dynamicGlobalObject()->debugger(), source, &exception);
@@ -120,14 +118,13 @@ JSObject* constructFunctionSkippingEvalEnabledCheck(ExecState* exec, JSGlobalObj
         return throwError(exec, exception);
     }
 
-    ScopeChainNode* scopeChain = ScopeChainNode::create(exec, 0, globalObject, &globalData, globalObject, exec->globalThisValue());
-    return JSFunction::create(exec, function, scopeChain);
+    return JSFunction::create(exec, function, globalObject);
 }
 
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
 {
-    return constructFunction(exec, globalObject, args, Identifier(exec, "anonymous"), UString(), TextPosition::minimumPosition());
+    return constructFunction(exec, globalObject, args, Identifier(exec, "anonymous"), String(), TextPosition::minimumPosition());
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.h b/Source/JavaScriptCore/runtime/FunctionConstructor.h
index 31986b70a..99eafee80 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.h
@@ -56,10 +56,10 @@ namespace JSC {
         static CallType getCallData(JSCell*, CallData&);
     };
 
-    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, const Identifier& functionName, const UString& sourceURL, const WTF::TextPosition&);
+    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, const Identifier& functionName, const String& sourceURL, const WTF::TextPosition&);
     JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&);
 
-    JS_EXPORT_PRIVATE JSObject* constructFunctionSkippingEvalEnabledCheck(ExecState*, JSGlobalObject*, const ArgList&, const Identifier&, const UString&, const WTF::TextPosition&);
+    JS_EXPORT_PRIVATE JSObject* constructFunctionSkippingEvalEnabledCheck(ExecState*, JSGlobalObject*, const ArgList&, const Identifier&, const String&, const WTF::TextPosition&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
index 4206cf2b0..455a21877 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -47,7 +47,7 @@ FunctionPrototype::FunctionPrototype(JSGlobalObject* globalObject, Structure* st
 {
 }
 
-void FunctionPrototype::finishCreation(ExecState* exec, const UString& name)
+void FunctionPrototype::finishCreation(ExecState* exec, const String& name)
 {
     Base::finishCreation(exec->globalData(), name);
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().length, jsNumber(0), DontDelete | ReadOnly | DontEnum);
@@ -55,16 +55,16 @@ void FunctionPrototype::finishCreation(ExecState* exec, const UString& name)
 
 void FunctionPrototype::addFunctionProperties(ExecState* exec, JSGlobalObject* globalObject, JSFunction** callFunction, JSFunction** applyFunction)
 {
-    JSFunction* toStringFunction = JSFunction::create(exec, globalObject, 0, exec->propertyNames().toString.ustring(), functionProtoFuncToString);
+    JSFunction* toStringFunction = JSFunction::create(exec, globalObject, 0, exec->propertyNames().toString.string(), functionProtoFuncToString);
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().toString, toStringFunction, DontEnum);
 
-    *applyFunction = JSFunction::create(exec, globalObject, 2, exec->propertyNames().apply.ustring(), functionProtoFuncApply);
+    *applyFunction = JSFunction::create(exec, globalObject, 2, exec->propertyNames().apply.string(), functionProtoFuncApply);
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().apply, *applyFunction, DontEnum);
 
-    *callFunction = JSFunction::create(exec, globalObject, 1, exec->propertyNames().call.ustring(), functionProtoFuncCall);
+    *callFunction = JSFunction::create(exec, globalObject, 1, exec->propertyNames().call.string(), functionProtoFuncCall);
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().call, *callFunction, DontEnum);
 
-    JSFunction* bindFunction = JSFunction::create(exec, globalObject, 1, exec->propertyNames().bind.ustring(), functionProtoFuncBind);
+    JSFunction* bindFunction = JSFunction::create(exec, globalObject, 1, exec->propertyNames().bind.string(), functionProtoFuncBind);
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().bind, bindFunction, DontEnum);
 }
 
@@ -83,7 +83,7 @@ CallType FunctionPrototype::getCallData(JSCell*, CallData& callData)
 // Functions
 
 // Compatibility hack for the Optimost JavaScript library. (See <rdar://problem/6595040>.)
-static inline void insertSemicolonIfNeeded(UString& functionBody)
+static inline void insertSemicolonIfNeeded(String& functionBody)
 {
     ASSERT(functionBody[0] == '{');
     ASSERT(functionBody[functionBody.length() - 1] == '}');
@@ -92,7 +92,7 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
         UChar ch = functionBody[i];
         if (!Lexer<UChar>::isWhiteSpace(ch) && !Lexer<UChar>::isLineTerminator(ch)) {
             if (ch != ';' && ch != '}')
-                functionBody = makeUString(functionBody.substringSharingImpl(0, i + 1), ";", functionBody.substringSharingImpl(i + 1, functionBody.length() - (i + 1)));
+                functionBody = makeString(functionBody.substringSharingImpl(0, i + 1), ";", functionBody.substringSharingImpl(i + 1, functionBody.length() - (i + 1)));
             return;
         }
     }
@@ -106,7 +106,7 @@ EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec)
         if (function->isHostFunction())
             return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}"));
         FunctionExecutable* executable = function->jsExecutable();
-        UString sourceString = executable->source().toString();
+        String sourceString = executable->source().toString();
         insertSemicolonIfNeeded(sourceString);
         return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(exec), "(", executable->paramString(), ") ", sourceString));
     }
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.h b/Source/JavaScriptCore/runtime/FunctionPrototype.h
index 59427912b..07f381306 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.h
@@ -32,7 +32,7 @@ namespace JSC {
         static FunctionPrototype* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
         {
             FunctionPrototype* prototype = new (NotNull, allocateCell<FunctionPrototype>(*exec->heap())) FunctionPrototype(globalObject, structure);
-            prototype->finishCreation(exec, "");
+            prototype->finishCreation(exec, String());
             return prototype;
         }
         
@@ -46,7 +46,7 @@ namespace JSC {
         static const ClassInfo s_info;
 
     protected:
-        void finishCreation(ExecState*, const UString& name);
+        void finishCreation(ExecState*, const String& name);
 
     private:
         FunctionPrototype(JSGlobalObject*, Structure*);
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallback.cpp b/Source/JavaScriptCore/runtime/GCActivityCallback.cpp
index c2fca8c01..74cbdbaef 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallback.cpp
+++ b/Source/JavaScriptCore/runtime/GCActivityCallback.cpp
@@ -34,7 +34,7 @@
 #include "JSGlobalData.h"
 #include "JSLock.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 #include <wtf/RetainPtr.h>
 #include <wtf/WTFThreadData.h>
 
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallback.h b/Source/JavaScriptCore/runtime/GCActivityCallback.h
index 67ee17420..c112a7120 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallback.h
+++ b/Source/JavaScriptCore/runtime/GCActivityCallback.h
@@ -42,6 +42,7 @@ namespace JSC {
 class Heap;
 
 class GCActivityCallback : public HeapTimer {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     virtual void didAllocate(size_t) { }
     virtual void willCollect() { }
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.cpp b/Source/JavaScriptCore/runtime/GetterSetter.cpp
index 920399dda..8ed582548 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/Source/JavaScriptCore/runtime/GetterSetter.cpp
@@ -39,10 +39,8 @@ void GetterSetter::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     JSCell::visitChildren(thisObject, visitor);
 
-    if (thisObject->m_getter)
-        visitor.append(&thisObject->m_getter);
-    if (thisObject->m_setter)
-        visitor.append(&thisObject->m_setter);
+    visitor.append(&thisObject->m_getter);
+    visitor.append(&thisObject->m_setter);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/Identifier.cpp b/Source/JavaScriptCore/runtime/Identifier.cpp
index 0fc54f3c6..a9a2a66bf 100644
--- a/Source/JavaScriptCore/runtime/Identifier.cpp
+++ b/Source/JavaScriptCore/runtime/Identifier.cpp
@@ -23,10 +23,10 @@
 
 #include "CallFrame.h"
 #include "JSObject.h"
+#include "JSScope.h"
 #include "NumericStrings.h"
-#include "ScopeChain.h"
-#include <new> // for placement new
-#include <string.h> // for strlen
+#include <new>
+#include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
 #include <wtf/HashSet.h>
diff --git a/Source/JavaScriptCore/runtime/Identifier.h b/Source/JavaScriptCore/runtime/Identifier.h
index 196fdca23..bdcfbd187 100644
--- a/Source/JavaScriptCore/runtime/Identifier.h
+++ b/Source/JavaScriptCore/runtime/Identifier.h
@@ -23,9 +23,9 @@
 
 #include "JSGlobalData.h"
 #include <wtf/ThreadSpecific.h>
-#include "UString.h"
 #include <wtf/WTFThreadData.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -45,14 +45,14 @@ namespace JSC {
         Identifier(JSGlobalData* globalData, const char (&characters)[charactersCount]) : m_string(add(globalData, characters)) { }
 
         Identifier(ExecState* exec, StringImpl* rep) : m_string(add(exec, rep)) { }
-        Identifier(ExecState* exec, const UString& s) : m_string(add(exec, s.impl())) { }
+        Identifier(ExecState* exec, const String& s) : m_string(add(exec, s.impl())) { }
 
         Identifier(JSGlobalData* globalData, const LChar* s, int length) : m_string(add(globalData, s, length)) { }
         Identifier(JSGlobalData* globalData, const UChar* s, int length) : m_string(add(globalData, s, length)) { }
         Identifier(JSGlobalData* globalData, StringImpl* rep) : m_string(add(globalData, rep)) { } 
-        Identifier(JSGlobalData* globalData, const UString& s) : m_string(add(globalData, s.impl())) { }
+        Identifier(JSGlobalData* globalData, const String& s) : m_string(add(globalData, s.impl())) { }
 
-        const UString& ustring() const { return m_string; }
+        const String& string() const { return m_string; }
         StringImpl* impl() const { return m_string.impl(); }
         
         const UChar* characters() const { return m_string.characters(); }
@@ -91,7 +91,7 @@ namespace JSC {
         JS_EXPORT_PRIVATE static PassRefPtr<StringImpl> add(ExecState*, const char*);
 
     private:
-        UString m_string;
+        String m_string;
 
         template <typename CharType>
         ALWAYS_INLINE static uint32_t toUInt32FromCharacters(const CharType* characters, unsigned length, bool& ok);
diff --git a/Source/JavaScriptCore/runtime/InitializeThreading.cpp b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
index c7fbd332e..6e7eddbf1 100644
--- a/Source/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -35,7 +35,7 @@
 #include "Identifier.h"
 #include "JSDateMath.h"
 #include "JSGlobalObject.h"
-#include "UString.h"
+#include "LLIntData.h"
 #include "WriteBarrier.h"
 #include <wtf/dtoa.h>
 #include <wtf/Threading.h>
@@ -61,6 +61,9 @@ static void initializeThreadingOnce()
     ExecutableAllocator::initializeAllocator();
 #endif
     RegisterFile::initializeThreading();
+#if ENABLE(LLINT)
+    LLInt::initialize();
+#endif
 }
 
 void initializeThreading()
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.cpp b/Source/JavaScriptCore/runtime/InternalFunction.cpp
index 985ab73b0..e2de03d92 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/InternalFunction.cpp
@@ -39,27 +39,27 @@ InternalFunction::InternalFunction(JSGlobalObject* globalObject, Structure* stru
 {
 }
 
-void InternalFunction::finishCreation(JSGlobalData& globalData, const UString& name)
+void InternalFunction::finishCreation(JSGlobalData& globalData, const String& name)
 {
     Base::finishCreation(globalData);
     ASSERT(inherits(&s_info));
     ASSERT(methodTable()->getCallData != InternalFunction::s_info.methodTable.getCallData);
-    putDirect(globalData, globalData.propertyNames->name, jsString(&globalData, name.isNull() ? "" : name), DontDelete | ReadOnly | DontEnum);
+    putDirect(globalData, globalData.propertyNames->name, jsString(&globalData, name), DontDelete | ReadOnly | DontEnum);
 }
 
-const UString& InternalFunction::name(ExecState* exec)
+const String& InternalFunction::name(ExecState* exec)
 {
     return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
 }
 
-const UString InternalFunction::displayName(ExecState* exec)
+const String InternalFunction::displayName(ExecState* exec)
 {
     JSValue displayName = getDirect(exec->globalData(), exec->globalData().propertyNames->displayName);
     
     if (displayName && isJSString(displayName))
         return asString(displayName)->tryGetValue();
     
-    return UString();
+    return String();
 }
 
 CallType InternalFunction::getCallData(JSCell*, CallData&)
@@ -68,9 +68,9 @@ CallType InternalFunction::getCallData(JSCell*, CallData&)
     return CallTypeNone;
 }
 
-const UString InternalFunction::calculatedDisplayName(ExecState* exec)
+const String InternalFunction::calculatedDisplayName(ExecState* exec)
 {
-    const UString explicitName = displayName(exec);
+    const String explicitName = displayName(exec);
     
     if (!explicitName.isEmpty())
         return explicitName;
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.h b/Source/JavaScriptCore/runtime/InternalFunction.h
index 150fb759e..e26b9f953 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.h
+++ b/Source/JavaScriptCore/runtime/InternalFunction.h
@@ -37,9 +37,9 @@ namespace JSC {
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
-        JS_EXPORT_PRIVATE const UString& name(ExecState*);
-        const UString displayName(ExecState*);
-        const UString calculatedDisplayName(ExecState*);
+        JS_EXPORT_PRIVATE const String& name(ExecState*);
+        const String displayName(ExecState*);
+        const String calculatedDisplayName(ExecState*);
 
         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) 
         { 
@@ -51,7 +51,7 @@ namespace JSC {
 
         JS_EXPORT_PRIVATE InternalFunction(JSGlobalObject*, Structure*);
 
-        JS_EXPORT_PRIVATE void finishCreation(JSGlobalData&, const UString& name);
+        JS_EXPORT_PRIVATE void finishCreation(JSGlobalData&, const String& name);
 
         static CallType getCallData(JSCell*, CallData&);
     };
diff --git a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
index 8517085df..cd1d830fe 100644
--- a/Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
+++ b/Source/JavaScriptCore/runtime/JSAPIValueWrapper.cpp
@@ -24,7 +24,6 @@
 #include "JSAPIValueWrapper.h"
 
 #include "NumberObject.h"
-#include "UString.h"
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index 5417b0023..ae403ce46 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -42,7 +42,13 @@ ASSERT_CLASS_FITS_IN_CELL(JSActivation);
 const ClassInfo JSActivation::s_info = { "JSActivation", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSActivation) };
 
 JSActivation::JSActivation(CallFrame* callFrame, FunctionExecutable* functionExecutable)
-    : Base(callFrame->globalData(), callFrame->globalData().activationStructure.get(), functionExecutable->symbolTable(), callFrame->registers())
+    : Base(
+        callFrame->globalData(),
+        callFrame->lexicalGlobalObject()->activationStructure(),
+        callFrame->registers(),
+        callFrame->scope()
+    )
+    , m_registerArray(callFrame->globalData(), this, 0)
     , m_numCapturedArgs(max(callFrame->argumentCount(), functionExecutable->parameterCount()))
     , m_numCapturedVars(functionExecutable->capturedVariableCount())
     , m_isTornOff(false)
@@ -51,20 +57,10 @@ JSActivation::JSActivation(CallFrame* callFrame, FunctionExecutable* functionExe
 {
 }
 
-void JSActivation::finishCreation(CallFrame* callFrame)
+void JSActivation::finishCreation(CallFrame* callFrame, FunctionExecutable* functionExecutable)
 {
-    Base::finishCreation(callFrame->globalData());
+    Base::finishCreation(callFrame->globalData(), functionExecutable->symbolTable());
     ASSERT(inherits(&s_info));
-
-    // We have to manually ref and deref the symbol table as JSVariableObject
-    // doesn't know about SharedSymbolTable
-    static_cast<SharedSymbolTable*>(m_symbolTable)->ref();
-    callFrame->globalData().heap.addFinalizer(this, &finalize);
-}
-
-void JSActivation::finalize(JSCell* cell)
-{
-    static_cast<SharedSymbolTable*>(jsCast<JSActivation*>(cell)->m_symbolTable)->deref();
 }
 
 void JSActivation::visitChildren(JSCell* cell, SlotVisitor& visitor)
@@ -76,25 +72,27 @@ void JSActivation::visitChildren(JSCell* cell, SlotVisitor& visitor)
     Base::visitChildren(thisObject, visitor);
 
     // No need to mark our registers if they're still in the RegisterFile.
-    WriteBarrier<Unknown>* registerArray = thisObject->m_registerArray.get();
+    PropertyStorage registerArray = thisObject->m_registerArray.get();
     if (!registerArray)
         return;
-    
-    visitor.appendValues(registerArray, thisObject->m_numCapturedArgs);
 
-    // Skip 'this' and call frame, except for callee and scope chain.
-    int offset = CallFrame::offsetFor(thisObject->m_numCapturedArgs + 1);
-    visitor.append(registerArray + offset + RegisterFile::ScopeChain);
-    visitor.append(registerArray + offset + RegisterFile::Callee);
-    
-    visitor.appendValues(registerArray + offset, thisObject->m_numCapturedVars);
+    visitor.copyAndAppend(bitwise_cast<void**>(&registerArray), thisObject->registerArraySizeInBytes(), reinterpret_cast<JSValue*>(registerArray), thisObject->registerArraySize());
+    thisObject->m_registerArray.set(registerArray, StorageBarrier::Unchecked);
+    thisObject->m_registers = registerArray + thisObject->registerOffset();
+
+    // Update the arguments object, since it points at our buffer.
+    CallFrame* callFrame = CallFrame::create(reinterpret_cast<Register*>(thisObject->m_registers));
+    if (JSValue v = callFrame->uncheckedR(unmodifiedArgumentsRegister(thisObject->m_argumentsRegister)).jsValue())
+        jsCast<Arguments*>(v)->setRegisters(thisObject->m_registers);
 }
 
 inline bool JSActivation::symbolTableGet(PropertyName propertyName, PropertySlot& slot)
 {
-    SymbolTableEntry entry = symbolTable().inlineGet(propertyName.publicName());
+    SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.publicName());
     if (entry.isNull())
         return false;
+
+    // Defend against the inspector asking for a var after it has been optimized out.
     if (m_isTornOff && entry.getIndex() >= m_numCapturedVars)
         return false;
 
@@ -102,12 +100,26 @@ inline bool JSActivation::symbolTableGet(PropertyName propertyName, PropertySlot
     return true;
 }
 
+inline bool JSActivation::symbolTableGet(PropertyName propertyName, PropertyDescriptor& descriptor)
+{
+    SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.publicName());
+    if (entry.isNull())
+        return false;
+
+    // Defend against the inspector asking for a var after it has been optimized out.
+    if (m_isTornOff && entry.getIndex() >= m_numCapturedVars)
+        return false;
+
+    descriptor.setDescriptor(registerAt(entry.getIndex()).get(), entry.getAttributes());
+    return true;
+}
+
 inline bool JSActivation::symbolTablePut(ExecState* exec, PropertyName propertyName, JSValue value, bool shouldThrow)
 {
     JSGlobalData& globalData = exec->globalData();
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
     
-    SymbolTableEntry entry = symbolTable().inlineGet(propertyName.publicName());
+    SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.publicName());
     if (entry.isNull())
         return false;
     if (entry.isReadOnly()) {
@@ -115,6 +127,8 @@ inline bool JSActivation::symbolTablePut(ExecState* exec, PropertyName propertyN
             throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
         return true;
     }
+
+    // Defend against the inspector asking for a var after it has been optimized out.
     if (m_isTornOff && entry.getIndex() >= m_numCapturedVars)
         return false;
 
@@ -125,8 +139,12 @@ inline bool JSActivation::symbolTablePut(ExecState* exec, PropertyName propertyN
 void JSActivation::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     JSActivation* thisObject = jsCast<JSActivation*>(object);
-    SymbolTable::const_iterator end = thisObject->symbolTable().end();
-    for (SymbolTable::const_iterator it = thisObject->symbolTable().begin(); it != end; ++it) {
+
+    if (mode == IncludeDontEnumProperties)
+        propertyNames.add(exec->propertyNames().arguments);
+
+    SymbolTable::const_iterator end = thisObject->symbolTable()->end();
+    for (SymbolTable::const_iterator it = thisObject->symbolTable()->begin(); it != end; ++it) {
         if (it->second.getAttributes() & DontEnum && mode != IncludeDontEnumProperties)
             continue;
         if (it->second.getIndex() >= thisObject->m_numCapturedVars)
@@ -141,8 +159,8 @@ inline bool JSActivation::symbolTablePutWithAttributes(JSGlobalData& globalData,
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
     
-    SymbolTable::iterator iter = symbolTable().find(propertyName.publicName());
-    if (iter == symbolTable().end())
+    SymbolTable::iterator iter = symbolTable()->find(propertyName.publicName());
+    if (iter == symbolTable()->end())
         return false;
     SymbolTableEntry& entry = iter->second;
     ASSERT(!entry.isNull());
@@ -157,9 +175,13 @@ inline bool JSActivation::symbolTablePutWithAttributes(JSGlobalData& globalData,
 bool JSActivation::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSActivation* thisObject = jsCast<JSActivation*>(cell);
+
     if (propertyName == exec->propertyNames().arguments) {
-        slot.setCustom(thisObject, thisObject->getArgumentsGetter());
-        return true;
+        // Defend against the inspector asking for the arguments object after it has been optimized out.
+        if (!thisObject->m_isTornOff) {
+            slot.setCustom(thisObject, thisObject->getArgumentsGetter());
+            return true;
+        }
     }
 
     if (thisObject->symbolTableGet(propertyName, slot))
@@ -177,6 +199,26 @@ bool JSActivation::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyNam
     return false;
 }
 
+bool JSActivation::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
+{
+    JSActivation* thisObject = jsCast<JSActivation*>(object);
+
+    if (propertyName == exec->propertyNames().arguments) {
+        // Defend against the inspector asking for the arguments object after it has been optimized out.
+        if (!thisObject->m_isTornOff) {
+            PropertySlot slot;
+            JSActivation::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontEnum);
+            return true;
+        }
+    }
+
+    if (thisObject->symbolTableGet(propertyName, descriptor))
+        return true;
+
+    return Base::getOwnPropertyDescriptor(object, exec, propertyName, descriptor);
+}
+
 void JSActivation::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSActivation* thisObject = jsCast<JSActivation*>(cell);
diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index 95639076d..3abe5f54b 100644
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -30,9 +30,10 @@
 #define JSActivation_h
 
 #include "CodeBlock.h"
+#include "CopiedSpaceInlineMethods.h"
 #include "JSVariableObject.h"
-#include "SymbolTable.h"
 #include "Nodes.h"
+#include "SymbolTable.h"
 
 namespace JSC {
 
@@ -49,18 +50,17 @@ namespace JSC {
         static JSActivation* create(JSGlobalData& globalData, CallFrame* callFrame, FunctionExecutable* funcExec)
         {
             JSActivation* activation = new (NotNull, allocateCell<JSActivation>(globalData.heap)) JSActivation(callFrame, funcExec);
-            activation->finishCreation(callFrame);
+            activation->finishCreation(callFrame, funcExec);
             return activation;
         }
 
-        static void finalize(JSCell*);
-
         static void visitChildren(JSCell*, SlotVisitor&);
 
         bool isDynamicScope(bool& requiresDynamicChecks) const;
 
         static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
         static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+        JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, PropertyName, PropertyDescriptor&);
 
         static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
 
@@ -78,8 +78,8 @@ namespace JSC {
         bool isValidScopedLookup(int index) { return index < m_numCapturedVars; }
 
     protected:
-        void finishCreation(CallFrame*);
-        static const unsigned StructureFlags = IsEnvironmentRecord | OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
+        void finishCreation(CallFrame*, FunctionExecutable*);
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | Base::StructureFlags;
 
     private:
         bool symbolTableGet(PropertyName, PropertySlot&);
@@ -91,6 +91,11 @@ namespace JSC {
         static JSValue argumentsGetter(ExecState*, JSValue, PropertyName);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
+        size_t registerOffset();
+        size_t registerArraySize();
+        size_t registerArraySizeInBytes();
+
+        StorageBarrier m_registerArray; // Independent copy of registers, used when a variable object copies its registers out of the register file.
         int m_numCapturedArgs;
         int m_numCapturedVars : 30;
         bool m_isTornOff : 1;
@@ -117,23 +122,50 @@ namespace JSC {
         return false;
     }
 
+    inline size_t JSActivation::registerOffset()
+    {
+        if (!m_numCapturedArgs)
+            return 0;
+
+        size_t capturedArgumentCountIncludingThis = m_numCapturedArgs + 1;
+        return CallFrame::offsetFor(capturedArgumentCountIncludingThis);
+    }
+
+    inline size_t JSActivation::registerArraySize()
+    {
+        return registerOffset() + m_numCapturedVars;
+    }
+
+    inline size_t JSActivation::registerArraySizeInBytes()
+    {
+        return registerArraySize() * sizeof(WriteBarrierBase<Unknown>);
+    }
+
     inline void JSActivation::tearOff(JSGlobalData& globalData)
     {
         ASSERT(!m_registerArray);
         ASSERT(m_numCapturedVars + m_numCapturedArgs);
 
-        int registerOffset = CallFrame::offsetFor(m_numCapturedArgs + 1);
-        size_t registerArraySize = registerOffset + m_numCapturedVars;
-
-        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[registerArraySize]);
-        WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
+        void* allocation = 0;
+        if (!globalData.heap.tryAllocateStorage(registerArraySizeInBytes(), &allocation))
+            CRASH();
+        PropertyStorage registerArray = static_cast<PropertyStorage>(allocation);
+        PropertyStorage registers = registerArray + registerOffset();
 
+        // arguments
         int from = CallFrame::argumentOffset(m_numCapturedArgs - 1);
-        int to = m_numCapturedVars;
+        int to = CallFrame::thisArgumentOffset(); // Skip 'this' because it's not lexically accessible.
+        for (int i = from; i < to; ++i)
+            registers[i].set(globalData, this, m_registers[i].get());
+
+        // vars
+        from = 0;
+        to = m_numCapturedVars;
         for (int i = from; i < to; ++i)
             registers[i].set(globalData, this, m_registers[i].get());
 
-        setRegisters(registers, registerArray.release());
+        m_registerArray.set(globalData, this, registerArray);
+        m_registers = registers;
         m_isTornOff = true;
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 7218604d1..8e1606fd8 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -113,7 +113,7 @@ static inline bool isDenseEnoughForVector(unsigned length, unsigned numValues)
 static bool reject(ExecState* exec, bool throwException, const char* message)
 {
     if (throwException)
-        throwTypeError(exec, message);
+        throwTypeError(exec, ASCIILiteral(message));
     return false;
 }
 
@@ -212,14 +212,14 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     if (result.isNewEntry && !array->isExtensible()) {
         remove(result.iterator);
         if (shouldThrow)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
         return;
     }
 
     if (!(entry.attributes & Accessor)) {
         if (entry.attributes & ReadOnly) {
             if (shouldThrow)
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
             return;
         }
 
@@ -233,7 +233,7 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     
     if (!setter) {
         if (shouldThrow)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
         return;
     }
 
@@ -244,7 +244,7 @@ inline void SparseArrayValueMap::put(ExecState* exec, JSArray* array, unsigned i
     call(exec, setter, callType, callData, array, args);
 }
 
-inline bool SparseArrayValueMap::putDirect(ExecState* exec, JSArray* array, unsigned i, JSValue value, bool shouldThrow)
+inline bool SparseArrayValueMap::putDirect(ExecState* exec, JSArray* array, unsigned i, JSValue value, PutDirectIndexMode mode)
 {
     AddResult result = add(array, i);
     SparseArrayEntry& entry = result.iterator->second;
@@ -252,9 +252,9 @@ inline bool SparseArrayValueMap::putDirect(ExecState* exec, JSArray* array, unsi
     // To save a separate find & add, we first always add to the sparse map.
     // In the uncommon case that this is a new property, and the array is not
     // extensible, this is not the right thing to have done - so remove again.
-    if (result.isNewEntry && !array->isExtensible()) {
+    if (mode != PutDirectIndexLikePutDirect && result.isNewEntry && !array->isExtensible()) {
         remove(result.iterator);
-        return reject(exec, shouldThrow, "Attempting to define property on object that is not extensible.");
+        return reject(exec, mode == PutDirectIndexShouldThrow, "Attempting to define property on object that is not extensible.");
     }
 
     entry.attributes = 0;
@@ -414,7 +414,7 @@ bool JSArray::defineOwnNumericProperty(ExecState* exec, unsigned index, Property
         // state (i.e. defineOwnProperty could be used to set a value without needing to entering 'SparseMode').
         if (!descriptor.attributes()) {
             ASSERT(!descriptor.isAccessorDescriptor());
-            return putDirectIndex(exec, index, descriptor.value(), throwException);
+            return putDirectIndex(exec, index, descriptor.value(), throwException ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
         }
 
         enterDictionaryMode(exec->globalData());
@@ -723,7 +723,7 @@ void JSArray::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSVa
     if (propertyName == exec->propertyNames().length) {
         unsigned newLength = value.toUInt32(exec);
         if (value.toNumber(exec) != static_cast<double>(newLength)) {
-            throwError(exec, createRangeError(exec, "Invalid array length"));
+            throwError(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return;
         }
         thisObject->setLength(exec, newLength, slot.isStrictMode());
@@ -811,7 +811,7 @@ void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue
         // Prohibit growing the array if length is not writable.
         if (map->lengthIsReadOnly() || !isExtensible()) {
             if (shouldThrow)
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
             return;
         }
         length = i + 1;
@@ -844,7 +844,7 @@ void JSArray::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue
     valueSlot.set(globalData, this, value);
 }
 
-bool JSArray::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
+bool JSArray::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, PutDirectIndexMode mode)
 {
     JSGlobalData& globalData = exec->globalData();
 
@@ -875,17 +875,19 @@ bool JSArray::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSVa
         // We don't want to, or can't use a vector to hold this property - allocate a sparse map & add the value.
         allocateSparseMap(exec->globalData());
         map = m_sparseValueMap;
-        return map->putDirect(exec, this, i, value, shouldThrow);
+        return map->putDirect(exec, this, i, value, mode);
     }
 
     // Update m_length if necessary.
     unsigned length = storage->m_length;
     if (i >= length) {
         // Prohibit growing the array if length is not writable.
-        if (map->lengthIsReadOnly())
-            return reject(exec, shouldThrow, StrictModeReadonlyPropertyWriteError);
-        if (!isExtensible())
-            return reject(exec, shouldThrow, "Attempting to define property on object that is not extensible.");
+        if (mode != PutDirectIndexLikePutDirect) {
+            if (map->lengthIsReadOnly())
+                return reject(exec, mode == PutDirectIndexShouldThrow, StrictModeReadonlyPropertyWriteError);
+            if (!isExtensible())
+                return reject(exec, mode == PutDirectIndexShouldThrow, "Attempting to define property on object that is not extensible.");
+        }
         length = i + 1;
         storage->m_length = length;
     }
@@ -894,7 +896,7 @@ bool JSArray::putDirectIndexBeyondVectorLength(ExecState* exec, unsigned i, JSVa
     // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
     unsigned numValuesInArray = storage->m_numValuesInVector + map->size();
     if (map->sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(exec->globalData(), length))
-        return map->putDirect(exec, this, i, value, shouldThrow);
+        return map->putDirect(exec, this, i, value, mode);
 
     // Reread m_storage afterincreaseVectorLength, update m_numValuesInVector.
     storage = m_storage;
@@ -1234,7 +1236,7 @@ JSValue JSArray::pop(ExecState* exec)
     unsigned length = storage->m_length;
     if (!length) {
         if (!isLengthWritable())
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
         return jsUndefined();
     }
 
@@ -1259,7 +1261,7 @@ JSValue JSArray::pop(ExecState* exec)
         return jsUndefined();
     // Call the [[Delete]] internal method of O with arguments indx and true.
     if (!deletePropertyByIndex(this, exec, index)) {
-        throwTypeError(exec, "Unable to delete property.");
+        throwTypeError(exec, ASCIILiteral("Unable to delete property."));
         return jsUndefined();
     }
     // Call the [[Put]] internal method of O with arguments "length", indx, and true.
@@ -1292,7 +1294,7 @@ void JSArray::push(ExecState* exec, JSValue value)
         methodTable()->putByIndex(this, exec, storage->m_length, value, true);
         // Per ES5.1 15.4.4.7 step 6 & 15.4.5.1 step 3.d.
         if (!exec->hadException())
-            throwError(exec, createRangeError(exec, "Invalid array length"));
+            throwError(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
         return;
     }
 
@@ -1479,7 +1481,7 @@ void JSArray::sort(ExecState* exec)
     // a toString call raises an exception.
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++)
-        values[i].second = values[i].first.toUStringInline(exec);
+        values[i].second = values[i].first.toWTFStringInline(exec);
 
     if (exec->hadException()) {
         Heap::heap(this)->popTempSortVector(&values);
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index c0b9916d1..2aab8c683 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -30,6 +30,8 @@ namespace JSC {
     class JSArray;
     class LLIntOffsetsExtractor;
 
+    enum PutDirectIndexMode { PutDirectIndexLikePutDirect, PutDirectIndexShouldNotThrow, PutDirectIndexShouldThrow };
+
     struct SparseArrayEntry : public WriteBarrier<Unknown> {
         typedef WriteBarrier<Unknown> Base;
 
@@ -87,7 +89,7 @@ namespace JSC {
 
         // These methods may mutate the contents of the map
         void put(ExecState*, JSArray*, unsigned, JSValue, bool shouldThrow);
-        bool putDirect(ExecState*, JSArray*, unsigned, JSValue, bool shouldThrow);
+        bool putDirect(ExecState*, JSArray*, unsigned, JSValue, PutDirectIndexMode);
         AddResult add(JSArray*, unsigned);
         iterator find(unsigned i) { return m_map.find(i); }
         // This should ASSERT the remove is valid (check the result of the find).
@@ -173,14 +175,15 @@ namespace JSC {
         // This is similar to the JSObject::putDirect* methods:
         //  - the prototype chain is not consulted
         //  - accessors are not called.
+        //  - it will ignore extensibility and read-only properties if PutDirectIndexLikePutDirect is passed as the mode (the default).
         // This method creates a property with attributes writable, enumerable and configurable all set to true.
-        bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow = true)
+        bool putDirectIndex(ExecState* exec, unsigned propertyName, JSValue value, PutDirectIndexMode mode = PutDirectIndexLikePutDirect)
         {
             if (canSetIndex(propertyName)) {
                 setIndex(exec->globalData(), propertyName, value);
                 return true;
             }
-            return putDirectIndexBeyondVectorLength(exec, propertyName, value, shouldThrow);
+            return putDirectIndexBeyondVectorLength(exec, propertyName, value, mode);
         }
 
         static JS_EXPORTDATA const ClassInfo s_info;
@@ -302,7 +305,7 @@ namespace JSC {
         void deallocateSparseMap();
 
         void putByIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
-        JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
+        JS_EXPORT_PRIVATE bool putDirectIndexBeyondVectorLength(ExecState*, unsigned propertyName, JSValue, PutDirectIndexMode);
 
         unsigned getNewVectorLength(unsigned desiredLength);
         bool increaseVectorLength(JSGlobalData&, unsigned newLength);
diff --git a/Source/JavaScriptCore/runtime/JSBoundFunction.cpp b/Source/JavaScriptCore/runtime/JSBoundFunction.cpp
index 3f6430871..7540d4394 100644
--- a/Source/JavaScriptCore/runtime/JSBoundFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSBoundFunction.cpp
@@ -76,7 +76,7 @@ EncodedJSValue JSC_HOST_CALL boundFunctionConstruct(ExecState* exec)
     return JSValue::encode(construct(exec, targetFunction, constructType, constructData, args));
 }
 
-JSBoundFunction* JSBoundFunction::create(ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const UString& name)
+JSBoundFunction* JSBoundFunction::create(ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const String& name)
 {
     ConstructData constructData;
     ConstructType constructType = JSC::getConstructData(targetFunction, constructData);
@@ -107,7 +107,7 @@ JSBoundFunction::JSBoundFunction(ExecState* exec, JSGlobalObject* globalObject,
 {
 }
 
-void JSBoundFunction::finishCreation(ExecState* exec, NativeExecutable* executable, int length, const UString& name)
+void JSBoundFunction::finishCreation(ExecState* exec, NativeExecutable* executable, int length, const String& name)
 {
     Base::finishCreation(exec, executable, length, name);
     ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/JSBoundFunction.h b/Source/JavaScriptCore/runtime/JSBoundFunction.h
index dd1229272..5067d194c 100644
--- a/Source/JavaScriptCore/runtime/JSBoundFunction.h
+++ b/Source/JavaScriptCore/runtime/JSBoundFunction.h
@@ -37,7 +37,7 @@ class JSBoundFunction : public JSFunction {
 public:
     typedef JSFunction Base;
 
-    static JSBoundFunction* create(ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const UString&);
+    static JSBoundFunction* create(ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const String&);
 
     static bool hasInstance(JSObject*, ExecState*, JSValue, JSValue proto);
 
@@ -61,7 +61,7 @@ protected:
 private:
     JSBoundFunction(ExecState*, JSGlobalObject*, Structure*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs);
     
-    void finishCreation(ExecState*, NativeExecutable*, int, const UString&);
+    void finishCreation(ExecState*, NativeExecutable*, int, const String&);
 
     WriteBarrier<JSObject> m_targetFunction;
     WriteBarrier<Unknown> m_boundThis;
diff --git a/Source/JavaScriptCore/runtime/JSCell.cpp b/Source/JavaScriptCore/runtime/JSCell.cpp
index 61e8549ee..ffb76ff95 100644
--- a/Source/JavaScriptCore/runtime/JSCell.cpp
+++ b/Source/JavaScriptCore/runtime/JSCell.cpp
@@ -38,7 +38,7 @@ void JSCell::destroy(JSCell* cell)
     cell->JSCell::~JSCell();
 }
 
-bool JSCell::getString(ExecState* exec, UString&stringValue) const
+bool JSCell::getString(ExecState* exec, String& stringValue) const
 {
     if (!isString())
         return false;
@@ -46,9 +46,9 @@ bool JSCell::getString(ExecState* exec, UString&stringValue) const
     return true;
 }
 
-UString JSCell::getString(ExecState* exec) const
+String JSCell::getString(ExecState* exec) const
 {
-    return isString() ? static_cast<const JSString*>(this)->value(exec) : UString();
+    return isString() ? static_cast<const JSString*>(this)->value(exec) : String();
 }
 
 JSObject* JSCell::getObject()
@@ -178,10 +178,10 @@ void JSCell::getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, Enum
     ASSERT_NOT_REACHED();
 }
 
-UString JSCell::className(const JSObject*)
+String JSCell::className(const JSObject*)
 {
     ASSERT_NOT_REACHED();
-    return UString();
+    return String();
 }
 
 const char* JSCell::className()
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 39f98356f..ef06b1ecf 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -65,6 +65,8 @@ namespace JSC {
         template<typename T> friend void* allocateCell(Heap&);
 
     public:
+        static const unsigned StructureFlags = 0;
+
         enum CreatingEarlyCellTag { CreatingEarlyCell };
         JSCell(CreatingEarlyCellTag);
 
@@ -87,8 +89,8 @@ namespace JSC {
         const char* className();
 
         // Extracting the value.
-        JS_EXPORT_PRIVATE bool getString(ExecState* exec, UString&) const;
-        JS_EXPORT_PRIVATE UString getString(ExecState* exec) const; // null string if not a string
+        JS_EXPORT_PRIVATE bool getString(ExecState*, String&) const;
+        JS_EXPORT_PRIVATE String getString(ExecState*) const; // null string if not a string
         JS_EXPORT_PRIVATE JSObject* getObject(); // NULL if not an object
         const JSObject* getObject() const; // NULL if not an object
         
@@ -124,7 +126,7 @@ namespace JSC {
         // call this function, not its slower virtual counterpart. (For integer
         // property names, we want a similar interface with appropriate optimizations.)
         bool fastGetOwnPropertySlot(ExecState*, PropertyName, PropertySlot&);
-        JSValue fastGetOwnProperty(ExecState*, const UString&);
+        JSValue fastGetOwnProperty(ExecState*, const String&);
 
         static ptrdiff_t structureOffset()
         {
@@ -159,7 +161,7 @@ namespace JSC {
         static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
         static NO_RETURN_DUE_TO_ASSERT void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
         static NO_RETURN_DUE_TO_ASSERT void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
-        static UString className(const JSObject*);
+        static String className(const JSObject*);
         static bool hasInstance(JSObject*, ExecState*, JSValue, JSValue prototypeProperty);
         static NO_RETURN_DUE_TO_ASSERT void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
         static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool shouldThrow);
@@ -221,17 +223,17 @@ namespace JSC {
         return isCell() && asCell()->isObject();
     }
 
-    inline bool JSValue::getString(ExecState* exec, UString& s) const
+    inline bool JSValue::getString(ExecState* exec, String& s) const
     {
         return isCell() && asCell()->getString(exec, s);
     }
 
-    inline UString JSValue::getString(ExecState* exec) const
+    inline String JSValue::getString(ExecState* exec) const
     {
-        return isCell() ? asCell()->getString(exec) : UString();
+        return isCell() ? asCell()->getString(exec) : String();
     }
 
-    template <typename Base> UString HandleConverter<Base, Unknown>::getString(ExecState* exec) const
+    template <typename Base> String HandleConverter<Base, Unknown>::getString(ExecState* exec) const
     {
         return jsValue().getString(exec);
     }
diff --git a/Source/JavaScriptCore/runtime/JSDateMath.cpp b/Source/JavaScriptCore/runtime/JSDateMath.cpp
index fcf1c4345..c54147ef2 100644
--- a/Source/JavaScriptCore/runtime/JSDateMath.cpp
+++ b/Source/JavaScriptCore/runtime/JSDateMath.cpp
@@ -73,7 +73,7 @@
 #include "JSDateMath.h"
 
 #include "JSObject.h"
-#include "ScopeChain.h"
+#include "JSScope.h"
 
 #include <algorithm>
 #include <limits.h>
@@ -258,7 +258,7 @@ double parseDateFromNullTerminatedCharacters(ExecState* exec, const char* dateSt
     return ms - (offset * WTF::msPerMinute);
 }
 
-double parseDate(ExecState* exec, const UString& date)
+double parseDate(ExecState* exec, const String& date)
 {
     if (date == exec->globalData().cachedDateString)
         return exec->globalData().cachedDateStringValue;
diff --git a/Source/JavaScriptCore/runtime/JSDateMath.h b/Source/JavaScriptCore/runtime/JSDateMath.h
index c7fb5a975..a6dd96f99 100644
--- a/Source/JavaScriptCore/runtime/JSDateMath.h
+++ b/Source/JavaScriptCore/runtime/JSDateMath.h
@@ -49,13 +49,12 @@
 namespace JSC {
 
 class ExecState;
-class UString;
 
 void msToGregorianDateTime(ExecState*, double, bool outputIsUTC, GregorianDateTime&);
 double gregorianDateTimeToMS(ExecState*, const GregorianDateTime&, double, bool inputIsUTC);
 double getUTCOffset(ExecState*);
 double parseDateFromNullTerminatedCharacters(ExecState*, const char* dateString);
-double parseDate(ExecState*, const UString&);
+double parseDate(ExecState*, const WTF::String&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index 0a65deee2..e5cb8cf38 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -38,7 +38,6 @@
 #include "ObjectPrototype.h"
 #include "Parser.h"
 #include "PropertyNameArray.h"
-#include "ScopeChainMark.h"
 
 using namespace WTF;
 using namespace Unicode;
@@ -59,7 +58,7 @@ bool JSFunction::isHostFunctionNonInline() const
     return isHostFunction();
 }
 
-JSFunction* JSFunction::create(ExecState* exec, JSGlobalObject* globalObject, int length, const UString& name, NativeFunction nativeFunction, Intrinsic intrinsic, NativeFunction nativeConstructor)
+JSFunction* JSFunction::create(ExecState* exec, JSGlobalObject* globalObject, int length, const String& name, NativeFunction nativeFunction, Intrinsic intrinsic, NativeFunction nativeConstructor)
 {
     NativeExecutable* executable;
 #if !ENABLE(JIT)
@@ -81,38 +80,38 @@ JSFunction* JSFunction::create(ExecState* exec, JSGlobalObject* globalObject, in
 JSFunction::JSFunction(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
     : Base(exec->globalData(), structure)
     , m_executable()
-    , m_scopeChain(exec->globalData(), this, globalObject->globalScopeChain())
+    , m_scope(exec->globalData(), this, globalObject)
 {
 }
 
-JSFunction::JSFunction(ExecState* exec, FunctionExecutable* executable, ScopeChainNode* scopeChainNode)
-    : Base(exec->globalData(), scopeChainNode->globalObject->functionStructure())
+JSFunction::JSFunction(ExecState* exec, FunctionExecutable* executable, JSScope* scope)
+    : Base(exec->globalData(), scope->globalObject()->functionStructure())
     , m_executable(exec->globalData(), this, executable)
-    , m_scopeChain(exec->globalData(), this, scopeChainNode)
+    , m_scope(exec->globalData(), this, scope)
 {
 }
 
-void JSFunction::finishCreation(ExecState* exec, NativeExecutable* executable, int length, const UString& name)
+void JSFunction::finishCreation(ExecState* exec, NativeExecutable* executable, int length, const String& name)
 {
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     m_executable.set(exec->globalData(), this, executable);
-    putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name), DontDelete | ReadOnly | DontEnum);
+    putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name), DontDelete | ReadOnly | DontEnum);
     putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
 }
 
-void JSFunction::finishCreation(ExecState* exec, FunctionExecutable* executable, ScopeChainNode* scopeChainNode)
+void JSFunction::finishCreation(ExecState* exec, FunctionExecutable* executable, JSScope* scope)
 {
     JSGlobalData& globalData = exec->globalData();
     Base::finishCreation(globalData);
     ASSERT(inherits(&s_info));
 
     // Switching the structure here is only safe if we currently have the function structure!
-    ASSERT(structure() == scopeChainNode->globalObject->functionStructure());
+    ASSERT(structure() == scope->globalObject()->functionStructure());
     setStructureAndReallocateStorageIfNecessary(
         globalData,
-        scopeChainNode->globalObject->namedFunctionStructure());
-    putDirectOffset(globalData, scopeChainNode->globalObject->functionNameOffset(), executable->nameValue());
+        scope->globalObject()->namedFunctionStructure());
+    putDirectOffset(globalData, scope->globalObject()->functionNameOffset(), executable->nameValue());
 }
 
 Structure* JSFunction::cacheInheritorID(ExecState* exec)
@@ -125,33 +124,33 @@ Structure* JSFunction::cacheInheritorID(ExecState* exec)
     return m_cachedInheritorID.get();
 }
 
-const UString& JSFunction::name(ExecState* exec)
+const String& JSFunction::name(ExecState* exec)
 {
     return asString(getDirect(exec->globalData(), exec->globalData().propertyNames->name))->tryGetValue();
 }
 
-const UString JSFunction::displayName(ExecState* exec)
+const String JSFunction::displayName(ExecState* exec)
 {
     JSValue displayName = getDirect(exec->globalData(), exec->globalData().propertyNames->displayName);
     
     if (displayName && isJSString(displayName))
         return asString(displayName)->tryGetValue();
     
-    return UString();
+    return String();
 }
 
-const UString JSFunction::calculatedDisplayName(ExecState* exec)
+const String JSFunction::calculatedDisplayName(ExecState* exec)
 {
-    const UString explicitName = displayName(exec);
+    const String explicitName = displayName(exec);
     
     if (!explicitName.isEmpty())
         return explicitName;
     
-    const UString actualName = name(exec);
+    const String actualName = name(exec);
     if (!actualName.isEmpty() || isHostFunction())
         return actualName;
     
-    return jsExecutable()->inferredName().ustring();
+    return jsExecutable()->inferredName().string();
 }
 
 const SourceCode* JSFunction::sourceCode() const
@@ -169,9 +168,8 @@ void JSFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     Base::visitChildren(thisObject, visitor);
 
-    visitor.append(&thisObject->m_scopeChain);
-    if (thisObject->m_executable)
-        visitor.append(&thisObject->m_executable);
+    visitor.append(&thisObject->m_scope);
+    visitor.append(&thisObject->m_executable);
 }
 
 CallType JSFunction::getCallData(JSCell* cell, CallData& callData)
@@ -182,7 +180,7 @@ CallType JSFunction::getCallData(JSCell* cell, CallData& callData)
         return CallTypeHost;
     }
     callData.js.functionExecutable = thisObject->jsExecutable();
-    callData.js.scopeChain = thisObject->scope();
+    callData.js.scope = thisObject->scope();
     return CallTypeJS;
 }
 
@@ -205,7 +203,7 @@ JSValue JSFunction::callerGetter(ExecState* exec, JSValue slotBase, PropertyName
     JSFunction* function = jsCast<JSFunction*>(caller);
     if (function->isHostFunction() || !function->jsExecutable()->isStrictMode())
         return caller;
-    return throwTypeError(exec, "Function.caller used to retrieve strict caller");
+    return throwTypeError(exec, ASCIILiteral("Function.caller used to retrieve strict caller"));
 }
 
 JSValue JSFunction::lengthGetter(ExecState*, JSValue slotBase, PropertyName)
@@ -416,27 +414,27 @@ bool JSFunction::defineOwnProperty(JSObject* object, ExecState* exec, PropertyNa
      
     if (descriptor.configurablePresent() && descriptor.configurable()) {
         if (throwException)
-            throwError(exec, createTypeError(exec, "Attempting to configurable attribute of unconfigurable property."));
+            throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to configurable attribute of unconfigurable property.")));
         return false;
     }
     if (descriptor.enumerablePresent() && descriptor.enumerable()) {
         if (throwException)
-            throwError(exec, createTypeError(exec, "Attempting to change enumerable attribute of unconfigurable property."));
+            throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property.")));
         return false;
     }
     if (descriptor.isAccessorDescriptor()) {
         if (throwException)
-            throwError(exec, createTypeError(exec, "Attempting to change access mechanism for an unconfigurable property."));
+            throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change access mechanism for an unconfigurable property.")));
         return false;
     }
     if (descriptor.writablePresent() && descriptor.writable()) {
         if (throwException)
-            throwError(exec, createTypeError(exec, "Attempting to change writable attribute of unconfigurable property."));
+            throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change writable attribute of unconfigurable property.")));
         return false;
     }
     if (!valueCheck) {
         if (throwException)
-            throwError(exec, createTypeError(exec, "Attempting to change value of a readonly property."));
+            throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change value of a readonly property.")));
         return false;
     }
     return true;
@@ -451,12 +449,12 @@ ConstructType JSFunction::getConstructData(JSCell* cell, ConstructData& construc
         return ConstructTypeHost;
     }
     constructData.js.functionExecutable = thisObject->jsExecutable();
-    constructData.js.scopeChain = thisObject->scope();
+    constructData.js.scope = thisObject->scope();
     return ConstructTypeJS;
 }
     
 
-UString getCalculatedDisplayName(CallFrame* callFrame, JSObject* object)
+String getCalculatedDisplayName(CallFrame* callFrame, JSObject* object)
 {
     if (JSFunction* function = jsDynamicCast<JSFunction*>(object))
         return function->calculatedDisplayName(callFrame);
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index 56faf00de..4bd5f46fa 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -25,7 +25,7 @@
 #define JSFunction_h
 
 #include "InternalFunction.h"
-#include "JSObject.h"
+#include "JSScope.h"
 
 namespace JSC {
 
@@ -44,7 +44,7 @@ namespace JSC {
 
     JS_EXPORT_PRIVATE EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState*);
 
-    JS_EXPORT_PRIVATE UString getCalculatedDisplayName(CallFrame*, JSObject*);
+    JS_EXPORT_PRIVATE String getCalculatedDisplayName(CallFrame*, JSObject*);
     
     class JSFunction : public JSNonFinalObject {
         friend class JIT;
@@ -55,38 +55,38 @@ namespace JSC {
     public:
         typedef JSNonFinalObject Base;
 
-        JS_EXPORT_PRIVATE static JSFunction* create(ExecState*, JSGlobalObject*, int length, const UString& name, NativeFunction, Intrinsic = NoIntrinsic, NativeFunction nativeConstructor = callHostFunctionAsConstructor);
+        JS_EXPORT_PRIVATE static JSFunction* create(ExecState*, JSGlobalObject*, int length, const String& name, NativeFunction, Intrinsic = NoIntrinsic, NativeFunction nativeConstructor = callHostFunctionAsConstructor);
 
-        static JSFunction* create(ExecState* exec, FunctionExecutable* executable, ScopeChainNode* scopeChain)
+        static JSFunction* create(ExecState* exec, FunctionExecutable* executable, JSScope* scope)
         {
-            JSFunction* function = new (NotNull, allocateCell<JSFunction>(*exec->heap())) JSFunction(exec, executable, scopeChain);
+            JSFunction* function = new (NotNull, allocateCell<JSFunction>(*exec->heap())) JSFunction(exec, executable, scope);
             ASSERT(function->structure()->globalObject());
-            function->finishCreation(exec, executable, scopeChain);
+            function->finishCreation(exec, executable, scope);
             return function;
         }
         
-        JS_EXPORT_PRIVATE const UString& name(ExecState*);
-        JS_EXPORT_PRIVATE const UString displayName(ExecState*);
-        const UString calculatedDisplayName(ExecState*);
+        JS_EXPORT_PRIVATE const String& name(ExecState*);
+        JS_EXPORT_PRIVATE const String displayName(ExecState*);
+        const String calculatedDisplayName(ExecState*);
 
-        ScopeChainNode* scope()
+        JSScope* scope()
         {
             ASSERT(!isHostFunctionNonInline());
-            return m_scopeChain.get();
+            return m_scope.get();
         }
         // This method may be called for host functins, in which case it
         // will return an arbitrary value. This should only be used for
         // optimized paths in which the return value does not matter for
         // host functions, and checking whether the function is a host
         // function is deemed too expensive.
-        ScopeChainNode* scopeUnchecked()
+        JSScope* scopeUnchecked()
         {
-            return m_scopeChain.get();
+            return m_scope.get();
         }
-        void setScope(JSGlobalData& globalData, ScopeChainNode* scopeChain)
+        void setScope(JSGlobalData& globalData, JSScope* scope)
         {
             ASSERT(!isHostFunctionNonInline());
-            m_scopeChain.set(globalData, this, scopeChain);
+            m_scope.set(globalData, this, scope);
         }
 
         ExecutableBase* executable() const { return m_executable.get(); }
@@ -113,7 +113,7 @@ namespace JSC {
 
         static inline size_t offsetOfScopeChain()
         {
-            return OBJECT_OFFSETOF(JSFunction, m_scopeChain);
+            return OBJECT_OFFSETOF(JSFunction, m_scope);
         }
 
         static inline size_t offsetOfExecutable()
@@ -137,10 +137,10 @@ namespace JSC {
         const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesVisitChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
 
         JS_EXPORT_PRIVATE JSFunction(ExecState*, JSGlobalObject*, Structure*);
-        JSFunction(ExecState*, FunctionExecutable*, ScopeChainNode*);
+        JSFunction(ExecState*, FunctionExecutable*, JSScope*);
         
-        void finishCreation(ExecState*, NativeExecutable*, int length, const UString& name);
-        void finishCreation(ExecState*, FunctionExecutable*, ScopeChainNode*);
+        void finishCreation(ExecState*, NativeExecutable*, int length, const String& name);
+        void finishCreation(ExecState*, FunctionExecutable*, JSScope*);
 
         Structure* cacheInheritorID(ExecState*);
 
@@ -165,7 +165,7 @@ namespace JSC {
         static JSValue lengthGetter(ExecState*, JSValue, PropertyName);
 
         WriteBarrier<ExecutableBase> m_executable;
-        WriteBarrier<ScopeChainNode> m_scopeChain;
+        WriteBarrier<JSScope> m_scope;
         WriteBarrier<Structure> m_cachedInheritorID;
     };
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index 2d6d1e54f..217526f6a 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -30,12 +30,12 @@
 #include "JSGlobalData.h"
 
 #include "ArgList.h"
-#include "Heap.h"
 #include "CommonIdentifiers.h"
 #include "DebuggerActivation.h"
 #include "FunctionConstructor.h"
 #include "GCActivityCallback.h"
 #include "GetterSetter.h"
+#include "Heap.h"
 #include "HostCallReturnValue.h"
 #include "IncrementalSweeper.h"
 #include "Interpreter.h"
@@ -45,9 +45,10 @@
 #include "JSClassRef.h"
 #include "JSFunction.h"
 #include "JSLock.h"
+#include "JSNameScope.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
-#include "JSStaticScopeObject.h"
+#include "JSWithScope.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -99,12 +100,19 @@ extern const HashTable stringConstructorTable;
 #if ENABLE(ASSEMBLER) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
 static bool enableAssembler(ExecutableAllocator& executableAllocator)
 {
-    if (!executableAllocator.isValid() || !Options::useJIT())
+    if (!executableAllocator.isValid() || (!Options::useJIT() && !Options::useRegExpJIT()))
         return false;
 
 #if USE(CF)
-    RetainPtr<CFStringRef> canUseJITKey(AdoptCF, CFStringCreateWithCString(0 , "JavaScriptCoreUseJIT", kCFStringEncodingMacRoman));
-    RetainPtr<CFBooleanRef> canUseJIT(AdoptCF, (CFBooleanRef)CFPreferencesCopyAppValue(canUseJITKey.get(), kCFPreferencesCurrentApplication));
+#if COMPILER(GCC) && !COMPILER(CLANG)
+    // FIXME: remove this once the EWS have been upgraded to LLVM.
+    // Work around a bug of GCC with strict-aliasing.
+    RetainPtr<CFStringRef> canUseJITKeyRetain(AdoptCF, CFStringCreateWithCString(0 , "JavaScriptCoreUseJIT", kCFStringEncodingMacRoman));
+    CFStringRef canUseJITKey = canUseJITKeyRetain.get();
+#else
+    CFStringRef canUseJITKey = CFSTR("JavaScriptCoreUseJIT");
+#endif // COMPILER(GCC) && !COMPILER(CLANG)
+    RetainPtr<CFBooleanRef> canUseJIT(AdoptCF, (CFBooleanRef)CFPreferencesCopyAppValue(canUseJITKey, kCFPreferencesCurrentApplication));
     if (canUseJIT)
         return kCFBooleanTrue == canUseJIT.get();
 #endif
@@ -119,7 +127,11 @@ static bool enableAssembler(ExecutableAllocator& executableAllocator)
 #endif
 
 JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType threadStackType, HeapType heapType)
-    : heap(this, heapType)
+    :
+#if ENABLE(ASSEMBLER)
+      executableAllocator(*this),
+#endif
+      heap(this, heapType)
     , globalDataType(globalDataType)
     , clientData(0)
     , topCallFrame(CallFrame::noCaller())
@@ -145,9 +157,6 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , identifierTable(globalDataType == Default ? wtfThreadData().currentIdentifierTable() : createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
-#if ENABLE(ASSEMBLER)
-    , executableAllocator(*this)
-#endif
     , parserArena(adoptPtr(new ParserArena))
     , keywords(adoptPtr(new Keywords(this)))
     , interpreter(0)
@@ -173,6 +182,8 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , m_newStringsSinceLastHashConst(0)
 #if ENABLE(ASSEMBLER) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
     , m_canUseAssembler(enableAssembler(executableAllocator))
+    , m_canUseJIT(m_canUseAssembler && Options::useJIT())
+    , m_canUseRegExpJIT(m_canUseAssembler && Options::useRegExpJIT())
 #endif
 #if ENABLE(GC_VALIDATION)
     , m_initializingObjectClass(0)
@@ -186,23 +197,21 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     IdentifierTable* existingEntryIdentifierTable = wtfThreadData().setCurrentIdentifierTable(identifierTable);
     structureStructure.set(*this, Structure::createStructure(*this));
     debuggerActivationStructure.set(*this, DebuggerActivation::createStructure(*this, 0, jsNull()));
-    activationStructure.set(*this, JSActivation::createStructure(*this, 0, jsNull()));
     interruptedExecutionErrorStructure.set(*this, InterruptedExecutionError::createStructure(*this, 0, jsNull()));
     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
-    staticScopeStructure.set(*this, JSStaticScopeObject::createStructure(*this, 0, jsNull()));
-    strictEvalActivationStructure.set(*this, StrictEvalActivation::createStructure(*this, 0, jsNull()));
     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
     notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, 0, jsNull()));
     propertyNameIteratorStructure.set(*this, JSPropertyNameIterator::createStructure(*this, 0, jsNull()));
     getterSetterStructure.set(*this, GetterSetter::createStructure(*this, 0, jsNull()));
     apiWrapperStructure.set(*this, JSAPIValueWrapper::createStructure(*this, 0, jsNull()));
-    scopeChainNodeStructure.set(*this, ScopeChainNode::createStructure(*this, 0, jsNull()));
+    JSScopeStructure.set(*this, JSScope::createStructure(*this, 0, jsNull()));
     executableStructure.set(*this, ExecutableBase::createStructure(*this, 0, jsNull()));
     nativeExecutableStructure.set(*this, NativeExecutable::createStructure(*this, 0, jsNull()));
     evalExecutableStructure.set(*this, EvalExecutable::createStructure(*this, 0, jsNull()));
     programExecutableStructure.set(*this, ProgramExecutable::createStructure(*this, 0, jsNull()));
     functionExecutableStructure.set(*this, FunctionExecutable::createStructure(*this, 0, jsNull()));
     regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
+    sharedSymbolTableStructure.set(*this, SharedSymbolTable::createStructure(*this, 0, jsNull()));
     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
 
     wtfThreadData().setCurrentIdentifierTable(existingEntryIdentifierTable);
@@ -211,13 +220,13 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     jitStubs = adoptPtr(new JITThunks(this));
 #endif
     
-    interpreter->initialize(&llintData, this->canUseJIT());
+    interpreter->initialize(this->canUseJIT());
     
     initializeHostCallReturnValue(); // This is needed to convince the linker not to drop host call return support.
 
     heap.notifyIsSafeToCollect();
     
-    llintData.performAssertions(*this);
+    LLInt::Data::performAssertions(*this);
 }
 
 JSGlobalData::~JSGlobalData()
@@ -371,12 +380,13 @@ NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function, Intrins
     ASSERT(canUseJIT());
     return jitStubs->hostFunctionStub(this, function, intrinsic != NoIntrinsic ? thunkGeneratorForIntrinsic(intrinsic) : 0, intrinsic);
 }
-#else
+
+#else // !ENABLE(JIT)
 NativeExecutable* JSGlobalData::getHostFunction(NativeFunction function, NativeFunction constructor)
 {
     return NativeExecutable::create(*this, function, constructor);
 }
-#endif
+#endif // !ENABLE(JIT)
 
 JSGlobalData::ClientData::~ClientData()
 {
@@ -386,7 +396,7 @@ void JSGlobalData::resetDateCache()
 {
     cachedUTCOffset = std::numeric_limits<double>::quiet_NaN();
     dstOffsetCache.reset();
-    cachedDateString = UString();
+    cachedDateString = String();
     cachedDateStringValue = std::numeric_limits<double>::quiet_NaN();
     dateInstanceCache.reset();
 }
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index 4604737d2..e4e6784da 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -76,7 +76,6 @@ namespace JSC {
     class RegExpCache;
     class Stringifier;
     class Structure;
-    class UString;
 #if ENABLE(REGEXP_TRACING)
     class RegExp;
 #endif
@@ -193,7 +192,15 @@ namespace JSC {
         JSLock m_apiLock;
 
     public:
-        Heap heap; // The heap is our first data member to ensure that it's destructed after all the objects that reference it.
+#if ENABLE(ASSEMBLER)
+        // executableAllocator should be destructed after the heap, as the heap can call executableAllocator
+        // in its destructor.
+        ExecutableAllocator executableAllocator;
+#endif
+
+        // The heap should be just after executableAllocator and before other members to ensure that it's
+        // destructed after all the objects that reference it.
+        Heap heap;
 
         GlobalDataType globalDataType;
         ClientData* clientData;
@@ -221,23 +228,21 @@ namespace JSC {
         
         Strong<Structure> structureStructure;
         Strong<Structure> debuggerActivationStructure;
-        Strong<Structure> activationStructure;
         Strong<Structure> interruptedExecutionErrorStructure;
         Strong<Structure> terminatedExecutionErrorStructure;
-        Strong<Structure> staticScopeStructure;
-        Strong<Structure> strictEvalActivationStructure;
         Strong<Structure> stringStructure;
         Strong<Structure> notAnObjectStructure;
         Strong<Structure> propertyNameIteratorStructure;
         Strong<Structure> getterSetterStructure;
         Strong<Structure> apiWrapperStructure;
-        Strong<Structure> scopeChainNodeStructure;
+        Strong<Structure> JSScopeStructure;
         Strong<Structure> executableStructure;
         Strong<Structure> nativeExecutableStructure;
         Strong<Structure> evalExecutableStructure;
         Strong<Structure> programExecutableStructure;
         Strong<Structure> functionExecutableStructure;
         Strong<Structure> regExpStructure;
+        Strong<Structure> sharedSymbolTableStructure;
         Strong<Structure> structureChainStructure;
 
         IdentifierTable* identifierTable;
@@ -274,16 +279,12 @@ namespace JSC {
             return m_enabledProfiler;
         }
 
-#if ENABLE(ASSEMBLER)
-        ExecutableAllocator executableAllocator;
-#endif
-
 #if !ENABLE(JIT)
         bool canUseJIT() { return false; } // interpreter only
 #elif !ENABLE(CLASSIC_INTERPRETER) && !ENABLE(LLINT)
         bool canUseJIT() { return true; } // jit only
 #else
-        bool canUseJIT() { return m_canUseAssembler; }
+        bool canUseJIT() { return m_canUseJIT; }
 #endif
 
 #if !ENABLE(YARR_JIT)
@@ -291,7 +292,7 @@ namespace JSC {
 #elif !ENABLE(CLASSIC_INTERPRETER) && !ENABLE(LLINT)
         bool canUseRegExpJIT() { return true; } // jit only
 #else
-        bool canUseRegExpJIT() { return m_canUseAssembler; }
+        bool canUseRegExpJIT() { return m_canUseRegExpJIT; }
 #endif
 
         PrivateName m_inheritorIDKey;
@@ -317,8 +318,6 @@ namespace JSC {
         const ClassInfo* const jsArrayClassInfo;
         const ClassInfo* const jsFinalObjectClassInfo;
 
-        LLInt::Data llintData;
-
         ReturnAddressPtr exceptionLocation;
         JSValue hostCallReturnValue;
         CallFrame* callFrameForThrow;
@@ -362,7 +361,7 @@ namespace JSC {
         double cachedUTCOffset;
         DSTOffsetCache dstOffsetCache;
         
-        UString cachedDateString;
+        String cachedDateString;
         double cachedDateStringValue;
 
         int maxReentryDepth;
@@ -417,6 +416,7 @@ namespace JSC {
         { \
             ASSERT(!m_##type##ArrayDescriptor.m_classInfo || m_##type##ArrayDescriptor.m_classInfo == descriptor.m_classInfo); \
             m_##type##ArrayDescriptor = descriptor; \
+            ASSERT(m_##type##ArrayDescriptor.m_classInfo); \
         } \
         const TypedArrayDescriptor& type##ArrayDescriptor() const { ASSERT(m_##type##ArrayDescriptor.m_classInfo); return m_##type##ArrayDescriptor; }
 
@@ -441,6 +441,8 @@ namespace JSC {
         void createNativeThunk();
 #if ENABLE(ASSEMBLER) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
         bool m_canUseAssembler;
+        bool m_canUseJIT;
+        bool m_canUseRegExpJIT;
 #endif
 #if ENABLE(GC_VALIDATION)
         const ClassInfo* m_initializingObjectClass;
@@ -470,6 +472,11 @@ namespace JSC {
     }
 #endif
 
+    inline Heap* WeakSet::heap() const
+    {
+        return &m_globalData->heap;
+    }
+
 } // namespace JSC
 
 #endif // JSGlobalData_h
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index ff7b1486f..97e9153cb 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -30,10 +30,6 @@
 #include "config.h"
 #include "JSGlobalObject.h"
 
-#include "JSCallbackConstructor.h"
-#include "JSCallbackFunction.h"
-#include "JSCallbackObject.h"
-
 #include "Arguments.h"
 #include "ArrayConstructor.h"
 #include "ArrayPrototype.h"
@@ -42,18 +38,25 @@
 #include "CodeBlock.h"
 #include "DateConstructor.h"
 #include "DatePrototype.h"
+#include "Debugger.h"
 #include "Error.h"
 #include "ErrorConstructor.h"
 #include "ErrorPrototype.h"
 #include "FunctionConstructor.h"
 #include "FunctionPrototype.h"
 #include "GetterSetter.h"
+#include "Interpreter.h"
+#include "JSActivation.h"
 #include "JSBoundFunction.h"
+#include "JSCallbackConstructor.h"
+#include "JSCallbackFunction.h"
+#include "JSCallbackObject.h"
 #include "JSFunction.h"
 #include "JSGlobalObjectFunctions.h"
 #include "JSLock.h"
+#include "JSNameScope.h"
 #include "JSONObject.h"
-#include "Interpreter.h"
+#include "JSWithScope.h"
 #include "Lookup.h"
 #include "MathObject.h"
 #include "NameConstructor.h"
@@ -70,16 +73,15 @@
 #include "RegExpMatchesArray.h"
 #include "RegExpObject.h"
 #include "RegExpPrototype.h"
-#include "ScopeChainMark.h"
+#include "StrictEvalActivation.h"
 #include "StringConstructor.h"
 #include "StringPrototype.h"
-#include "Debugger.h"
 
 #include "JSGlobalObject.lut.h"
 
 namespace JSC {
 
-const ClassInfo JSGlobalObject::s_info = { "GlobalObject", &JSSegmentedVariableObject::s_info, 0, ExecState::globalObjectTable, CREATE_METHOD_TABLE(JSGlobalObject) };
+const ClassInfo JSGlobalObject::s_info = { "GlobalObject", &Base::s_info, 0, ExecState::globalObjectTable, CREATE_METHOD_TABLE(JSGlobalObject) };
 
 const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = { &allowsAccessFrom, &supportsProfiling, &supportsRichSourceInfo, &shouldInterruptScript, &javaScriptExperimentsEnabled };
 
@@ -106,15 +108,8 @@ static const int initialTickCountThreshold = 255;
 // Preferred number of milliseconds between each timeout check
 static const int preferredScriptCheckTimeInterval = 1000;
 
-template <typename T> static inline void visitIfNeeded(SlotVisitor& visitor, WriteBarrier<T>* v)
-{
-    if (*v)
-        visitor.append(v);
-}
-
 JSGlobalObject::JSGlobalObject(JSGlobalData& globalData, Structure* structure, const GlobalObjectMethodTable* globalObjectMethodTable)
-    : JSSegmentedVariableObject(globalData, structure, &m_symbolTable)
-    , m_globalScopeChain()
+    : Base(globalData, structure, 0)
     , m_masqueradesAsUndefinedWatchpoint(adoptRef(new WatchpointSet(InitializedWatching)))
     , m_weakRandom(Options::forceWeakRandomSeed() ? Options::forcedWeakRandomSeed() : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
     , m_evalEnabled(true)
@@ -136,13 +131,17 @@ void JSGlobalObject::destroy(JSCell* cell)
     static_cast<JSGlobalObject*>(cell)->JSGlobalObject::~JSGlobalObject();
 }
 
+void JSGlobalObject::setGlobalThis(JSGlobalData& globalData, JSObject* globalThis)
+{ 
+    m_globalThis.set(globalData, this, globalThis);
+}
+
 void JSGlobalObject::init(JSObject* thisValue)
 {
     ASSERT(globalData().apiLock().currentThreadIsHoldingLock());
-    
-    m_globalScopeChain.set(globalData(), this, ScopeChainNode::create(0, this, &globalData(), this, thisValue));
 
-    JSGlobalObject::globalExec()->init(0, 0, m_globalScopeChain.get(), CallFrame::noCaller(), 0, 0);
+    setGlobalThis(globalData(), thisValue);
+    JSGlobalObject::globalExec()->init(0, 0, this, CallFrame::noCaller(), 0, 0);
 
     m_debugger = 0;
 
@@ -156,7 +155,7 @@ void JSGlobalObject::put(JSCell* cell, ExecState* exec, PropertyName propertyNam
 
     if (symbolTablePut(thisObject, exec, propertyName, value, slot.isStrictMode()))
         return;
-    JSSegmentedVariableObject::put(thisObject, exec, propertyName, value, slot);
+    Base::put(thisObject, exec, propertyName, value, slot);
 }
 
 void JSGlobalObject::putDirectVirtual(JSObject* object, ExecState* exec, PropertyName propertyName, JSValue value, unsigned attributes)
@@ -169,7 +168,7 @@ void JSGlobalObject::putDirectVirtual(JSObject* object, ExecState* exec, Propert
 
     JSValue valueBefore = thisObject->getDirect(exec->globalData(), propertyName);
     PutPropertySlot slot;
-    JSSegmentedVariableObject::put(thisObject, exec, propertyName, value, slot);
+    Base::put(thisObject, exec, propertyName, value, slot);
     if (!valueBefore) {
         JSValue valueAfter = thisObject->getDirect(exec->globalData(), propertyName);
         if (valueAfter)
@@ -212,11 +211,16 @@ void JSGlobalObject::reset(JSValue prototype)
     m_applyFunction.set(exec->globalData(), this, applyFunction);
     m_objectPrototype.set(exec->globalData(), this, ObjectPrototype::create(exec, this, ObjectPrototype::createStructure(exec->globalData(), this, jsNull())));
     GetterSetter* protoAccessor = GetterSetter::create(exec);
-    protoAccessor->setGetter(exec->globalData(), JSFunction::create(exec, this, 0, "", globalFuncProtoGetter));
-    protoAccessor->setSetter(exec->globalData(), JSFunction::create(exec, this, 0, "", globalFuncProtoSetter));
+    protoAccessor->setGetter(exec->globalData(), JSFunction::create(exec, this, 0, String(), globalFuncProtoGetter));
+    protoAccessor->setSetter(exec->globalData(), JSFunction::create(exec, this, 0, String(), globalFuncProtoSetter));
     m_objectPrototype->putDirectAccessor(exec->globalData(), exec->propertyNames().underscoreProto, protoAccessor, Accessor | DontEnum);
     m_functionPrototype->structure()->setPrototypeWithoutTransition(exec->globalData(), m_objectPrototype.get());
 
+    m_nameScopeStructure.set(exec->globalData(), this, JSNameScope::createStructure(exec->globalData(), this, jsNull()));
+    m_activationStructure.set(exec->globalData(), this, JSActivation::createStructure(exec->globalData(), this, jsNull()));
+    m_strictEvalActivationStructure.set(exec->globalData(), this, StrictEvalActivation::createStructure(exec->globalData(), this, jsNull()));
+    m_withScopeStructure.set(exec->globalData(), this, JSWithScope::createStructure(exec->globalData(), this, jsNull()));
+
     m_emptyObjectStructure.set(exec->globalData(), this, m_objectPrototype->inheritorID(exec->globalData()));
     m_nullPrototypeObjectStructure.set(exec->globalData(), this, createEmptyObjectStructure(exec->globalData(), this, jsNull()));
 
@@ -267,12 +271,12 @@ void JSGlobalObject::reset(JSValue prototype)
 
     Structure* nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(exec->globalData(), this, m_errorPrototype.get());
     Structure* nativeErrorStructure = NativeErrorConstructor::createStructure(exec->globalData(), this, m_functionPrototype.get());
-    m_evalErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "EvalError"));
-    m_rangeErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "RangeError"));
-    m_referenceErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "ReferenceError"));
-    m_syntaxErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "SyntaxError"));
-    m_typeErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "TypeError"));
-    m_URIErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, "URIError"));
+    m_evalErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("EvalError")));
+    m_rangeErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("RangeError")));
+    m_referenceErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("ReferenceError")));
+    m_syntaxErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("SyntaxError")));
+    m_typeErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("TypeError")));
+    m_URIErrorConstructor.set(exec->globalData(), this, NativeErrorConstructor::create(exec, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("URIError")));
 
     m_objectPrototype->putDirectWithoutTransition(exec->globalData(), exec->propertyNames().constructor, objectConstructor, DontEnum);
     m_functionPrototype->putDirectWithoutTransition(exec->globalData(), exec->propertyNames().constructor, functionConstructor, DontEnum);
@@ -300,7 +304,7 @@ void JSGlobalObject::reset(JSValue prototype)
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "TypeError"), m_typeErrorConstructor.get(), DontEnum);
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "URIError"), m_URIErrorConstructor.get(), DontEnum);
 
-    m_evalFunction.set(exec->globalData(), this, JSFunction::create(exec, this, 1, exec->propertyNames().eval.ustring(), globalFuncEval));
+    m_evalFunction.set(exec->globalData(), this, JSFunction::create(exec, this, 1, exec->propertyNames().eval.string(), globalFuncEval));
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().eval, m_evalFunction.get(), DontEnum);
 
     putDirectWithoutTransition(exec->globalData(), Identifier(exec, "JSON"), JSONObject::create(exec, this, JSONObject::createStructure(exec->globalData(), this, m_objectPrototype.get())), DontEnum);
@@ -327,7 +331,7 @@ void JSGlobalObject::reset(JSValue prototype)
 
 void JSGlobalObject::createThrowTypeError(ExecState* exec)
 {
-    JSFunction* thrower = JSFunction::create(exec, this, 0, "", globalFuncThrowTypeError);
+    JSFunction* thrower = JSFunction::create(exec, this, 0, String(), globalFuncThrowTypeError);
     GetterSetter* getterSetter = GetterSetter::create(exec);
     getterSetter->setGetter(exec->globalData(), thrower);
     getterSetter->setSetter(exec->globalData(), thrower);
@@ -351,54 +355,58 @@ void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-    JSSegmentedVariableObject::visitChildren(thisObject, visitor);
-
-    visitIfNeeded(visitor, &thisObject->m_globalScopeChain);
-    visitIfNeeded(visitor, &thisObject->m_methodCallDummy);
-
-    visitIfNeeded(visitor, &thisObject->m_regExpConstructor);
-    visitIfNeeded(visitor, &thisObject->m_errorConstructor);
-    visitIfNeeded(visitor, &thisObject->m_evalErrorConstructor);
-    visitIfNeeded(visitor, &thisObject->m_rangeErrorConstructor);
-    visitIfNeeded(visitor, &thisObject->m_referenceErrorConstructor);
-    visitIfNeeded(visitor, &thisObject->m_syntaxErrorConstructor);
-    visitIfNeeded(visitor, &thisObject->m_typeErrorConstructor);
-    visitIfNeeded(visitor, &thisObject->m_URIErrorConstructor);
-
-    visitIfNeeded(visitor, &thisObject->m_evalFunction);
-    visitIfNeeded(visitor, &thisObject->m_callFunction);
-    visitIfNeeded(visitor, &thisObject->m_applyFunction);
-    visitIfNeeded(visitor, &thisObject->m_throwTypeErrorGetterSetter);
-
-    visitIfNeeded(visitor, &thisObject->m_objectPrototype);
-    visitIfNeeded(visitor, &thisObject->m_functionPrototype);
-    visitIfNeeded(visitor, &thisObject->m_arrayPrototype);
-    visitIfNeeded(visitor, &thisObject->m_booleanPrototype);
-    visitIfNeeded(visitor, &thisObject->m_stringPrototype);
-    visitIfNeeded(visitor, &thisObject->m_numberPrototype);
-    visitIfNeeded(visitor, &thisObject->m_datePrototype);
-    visitIfNeeded(visitor, &thisObject->m_regExpPrototype);
-    visitIfNeeded(visitor, &thisObject->m_errorPrototype);
-
-    visitIfNeeded(visitor, &thisObject->m_argumentsStructure);
-    visitIfNeeded(visitor, &thisObject->m_arrayStructure);
-    visitIfNeeded(visitor, &thisObject->m_booleanObjectStructure);
-    visitIfNeeded(visitor, &thisObject->m_callbackConstructorStructure);
-    visitIfNeeded(visitor, &thisObject->m_callbackFunctionStructure);
-    visitIfNeeded(visitor, &thisObject->m_callbackObjectStructure);
-    visitIfNeeded(visitor, &thisObject->m_dateStructure);
-    visitIfNeeded(visitor, &thisObject->m_emptyObjectStructure);
-    visitIfNeeded(visitor, &thisObject->m_nullPrototypeObjectStructure);
-    visitIfNeeded(visitor, &thisObject->m_errorStructure);
-    visitIfNeeded(visitor, &thisObject->m_functionStructure);
-    visitIfNeeded(visitor, &thisObject->m_boundFunctionStructure);
-    visitIfNeeded(visitor, &thisObject->m_namedFunctionStructure);
-    visitIfNeeded(visitor, &thisObject->m_numberObjectStructure);
-    visitIfNeeded(visitor, &thisObject->m_privateNameStructure);
-    visitIfNeeded(visitor, &thisObject->m_regExpMatchesArrayStructure);
-    visitIfNeeded(visitor, &thisObject->m_regExpStructure);
-    visitIfNeeded(visitor, &thisObject->m_stringObjectStructure);
-    visitIfNeeded(visitor, &thisObject->m_internalFunctionStructure);
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(&thisObject->m_globalThis);
+    visitor.append(&thisObject->m_methodCallDummy);
+
+    visitor.append(&thisObject->m_regExpConstructor);
+    visitor.append(&thisObject->m_errorConstructor);
+    visitor.append(&thisObject->m_evalErrorConstructor);
+    visitor.append(&thisObject->m_rangeErrorConstructor);
+    visitor.append(&thisObject->m_referenceErrorConstructor);
+    visitor.append(&thisObject->m_syntaxErrorConstructor);
+    visitor.append(&thisObject->m_typeErrorConstructor);
+    visitor.append(&thisObject->m_URIErrorConstructor);
+
+    visitor.append(&thisObject->m_evalFunction);
+    visitor.append(&thisObject->m_callFunction);
+    visitor.append(&thisObject->m_applyFunction);
+    visitor.append(&thisObject->m_throwTypeErrorGetterSetter);
+
+    visitor.append(&thisObject->m_objectPrototype);
+    visitor.append(&thisObject->m_functionPrototype);
+    visitor.append(&thisObject->m_arrayPrototype);
+    visitor.append(&thisObject->m_booleanPrototype);
+    visitor.append(&thisObject->m_stringPrototype);
+    visitor.append(&thisObject->m_numberPrototype);
+    visitor.append(&thisObject->m_datePrototype);
+    visitor.append(&thisObject->m_regExpPrototype);
+    visitor.append(&thisObject->m_errorPrototype);
+
+    visitor.append(&thisObject->m_withScopeStructure);
+    visitor.append(&thisObject->m_strictEvalActivationStructure);
+    visitor.append(&thisObject->m_activationStructure);
+    visitor.append(&thisObject->m_nameScopeStructure);
+    visitor.append(&thisObject->m_argumentsStructure);
+    visitor.append(&thisObject->m_arrayStructure);
+    visitor.append(&thisObject->m_booleanObjectStructure);
+    visitor.append(&thisObject->m_callbackConstructorStructure);
+    visitor.append(&thisObject->m_callbackFunctionStructure);
+    visitor.append(&thisObject->m_callbackObjectStructure);
+    visitor.append(&thisObject->m_dateStructure);
+    visitor.append(&thisObject->m_emptyObjectStructure);
+    visitor.append(&thisObject->m_nullPrototypeObjectStructure);
+    visitor.append(&thisObject->m_errorStructure);
+    visitor.append(&thisObject->m_functionStructure);
+    visitor.append(&thisObject->m_boundFunctionStructure);
+    visitor.append(&thisObject->m_namedFunctionStructure);
+    visitor.append(&thisObject->m_numberObjectStructure);
+    visitor.append(&thisObject->m_privateNameStructure);
+    visitor.append(&thisObject->m_regExpMatchesArrayStructure);
+    visitor.append(&thisObject->m_regExpStructure);
+    visitor.append(&thisObject->m_stringObjectStructure);
+    visitor.append(&thisObject->m_internalFunctionStructure);
 }
 
 ExecState* JSGlobalObject::globalExec()
@@ -414,9 +422,9 @@ void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
         GlobalPropertyInfo& global = globals[i];
         ASSERT(global.attributes & DontDelete);
         
-        int index = symbolTable().size();
+        int index = symbolTable()->size();
         SymbolTableEntry newEntry(index, global.attributes);
-        symbolTable().add(global.identifier.impl(), newEntry);
+        symbolTable()->add(global.identifier.impl(), newEntry);
         registerAt(index).set(globalData(), this, global.value);
     }
 }
@@ -424,7 +432,7 @@ void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
 bool JSGlobalObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
-    if (getStaticFunctionSlot<JSSegmentedVariableObject>(exec, ExecState::globalObjectTable(exec), thisObject, propertyName, slot))
+    if (getStaticFunctionSlot<Base>(exec, ExecState::globalObjectTable(exec), thisObject, propertyName, slot))
         return true;
     return symbolTableGet(thisObject, propertyName, slot);
 }
@@ -432,7 +440,7 @@ bool JSGlobalObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyN
 bool JSGlobalObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
-    if (getStaticFunctionDescriptor<JSSegmentedVariableObject>(exec, ExecState::globalObjectTable(exec), thisObject, propertyName, descriptor))
+    if (getStaticFunctionDescriptor<Base>(exec, ExecState::globalObjectTable(exec), thisObject, propertyName, descriptor))
         return true;
     return symbolTableGet(thisObject, propertyName, descriptor);
 }
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 248004bd5..406a65b51 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -77,6 +77,7 @@ namespace JSC {
 
     class JSGlobalObject : public JSSegmentedVariableObject {
     private:
+        typedef JSSegmentedVariableObject Base;
         typedef HashSet<RefPtr<OpaqueJSWeakObjectMap> > WeakMapSet;
 
         struct JSGlobalObjectRareData {
@@ -93,7 +94,7 @@ namespace JSC {
 
         Register m_globalCallFrame[RegisterFile::CallFrameHeaderSize];
 
-        WriteBarrier<ScopeChainNode> m_globalScopeChain;
+        WriteBarrier<JSObject> m_globalThis;
         WriteBarrier<JSObject> m_methodCallDummy;
 
         WriteBarrier<RegExpConstructor> m_regExpConstructor;
@@ -120,6 +121,10 @@ namespace JSC {
         WriteBarrier<RegExpPrototype> m_regExpPrototype;
         WriteBarrier<ErrorPrototype> m_errorPrototype;
 
+        WriteBarrier<Structure> m_withScopeStructure;
+        WriteBarrier<Structure> m_strictEvalActivationStructure;
+        WriteBarrier<Structure> m_activationStructure;
+        WriteBarrier<Structure> m_nameScopeStructure;
         WriteBarrier<Structure> m_argumentsStructure;
         WriteBarrier<Structure> m_arrayStructure;
         WriteBarrier<Structure> m_booleanObjectStructure;
@@ -149,8 +154,6 @@ namespace JSC {
 
         WeakRandom m_weakRandom;
 
-        SymbolTable m_symbolTable;
-
         bool m_evalEnabled;
         bool m_experimentsEnabled;
 
@@ -166,8 +169,6 @@ namespace JSC {
         }
         
     public:
-        typedef JSSegmentedVariableObject Base;
-
         static JSGlobalObject* create(JSGlobalData& globalData, Structure* structure)
         {
             JSGlobalObject* globalObject = new (NotNull, allocateCell<JSGlobalObject>(globalData.heap)) JSGlobalObject(globalData, structure);
@@ -252,6 +253,10 @@ namespace JSC {
 
         JSObject* methodCallDummy() const { return m_methodCallDummy.get(); }
 
+        Structure* withScopeStructure() const { return m_withScopeStructure.get(); }
+        Structure* strictEvalActivationStructure() const { return m_strictEvalActivationStructure.get(); }
+        Structure* activationStructure() const { return m_activationStructure.get(); }
+        Structure* nameScopeStructure() const { return m_nameScopeStructure.get(); }
         Structure* argumentsStructure() const { return m_argumentsStructure.get(); }
         Structure* arrayStructure() const { return m_arrayStructure.get(); }
         Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(); }
@@ -292,8 +297,6 @@ namespace JSC {
         static bool supportsProfiling(const JSGlobalObject*) { return false; }
         static bool supportsRichSourceInfo(const JSGlobalObject*) { return true; }
 
-        ScopeChainNode* globalScopeChain() { return m_globalScopeChain.get(); }
-
         JS_EXPORT_PRIVATE ExecState* globalExec();
 
         static bool shouldInterruptScript(const JSGlobalObject*) { return true; }
@@ -307,6 +310,7 @@ namespace JSC {
         void resetPrototype(JSGlobalData&, JSValue prototype);
 
         JSGlobalData& globalData() const { return *Heap::heap(this)->globalData(); }
+        JSObject* globalThis() const;
 
         static Structure* createStructure(JSGlobalData& globalData, JSValue prototype)
         {
@@ -329,7 +333,7 @@ namespace JSC {
         unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
     protected:
 
-        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | JSSegmentedVariableObject::StructureFlags;
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | Base::StructureFlags;
 
         struct GlobalPropertyInfo {
             GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
@@ -351,6 +355,7 @@ namespace JSC {
         // FIXME: Fold reset into init.
         JS_EXPORT_PRIVATE void init(JSObject* thisValue);
         void reset(JSValue prototype);
+        void setGlobalThis(JSGlobalData&, JSObject* globalThis);
 
         void createThrowTypeError(ExecState*);
 
@@ -368,7 +373,7 @@ namespace JSC {
     inline bool JSGlobalObject::hasOwnPropertyForWrite(ExecState* exec, PropertyName propertyName)
     {
         PropertySlot slot;
-        if (JSSegmentedVariableObject::getOwnPropertySlot(this, exec, propertyName, slot))
+        if (Base::getOwnPropertySlot(this, exec, propertyName, slot))
             return true;
         bool slotIsWriteable;
         return symbolTableGet(this, propertyName, slot, slotIsWriteable);
@@ -376,7 +381,7 @@ namespace JSC {
 
     inline bool JSGlobalObject::symbolTableHasProperty(PropertyName propertyName)
     {
-        SymbolTableEntry entry = symbolTable().inlineGet(propertyName.publicName());
+        SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.publicName());
         return !entry.isNull();
     }
 
@@ -491,6 +496,16 @@ namespace JSC {
         return true;
     }
 
+    inline JSObject* JSScope::globalThis()
+    { 
+        return globalObject()->globalThis();
+    }
+
+    inline JSObject* JSGlobalObject::globalThis() const
+    { 
+        return m_globalThis.get();
+    }
+
 } // namespace JSC
 
 #endif // JSGlobalObject_h
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index e8017b904..4588ec2d9 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -34,7 +34,6 @@
 #include "LiteralParser.h"
 #include "Nodes.h"
 #include "Parser.h"
-#include "UStringBuilder.h"
 #include <wtf/dtoa.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -42,6 +41,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StringExtras.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/unicode/UTF8.h>
 
 using namespace WTF;
@@ -53,7 +53,7 @@ static JSValue encode(ExecState* exec, const char* doNotEscape)
 {
     CString cstr = exec->argument(0).toString(exec)->value(exec).utf8(true);
     if (!cstr.data())
-        return throwError(exec, createURIError(exec, "String contained an illegal UTF-16 sequence."));
+        return throwError(exec, createURIError(exec, ASCIILiteral("String contained an illegal UTF-16 sequence.")));
 
     JSStringBuilder builder;
     const char* p = cstr.data();
@@ -114,7 +114,7 @@ static JSValue decode(ExecState* exec, const CharType* characters, int length, c
             }
             if (charLen == 0) {
                 if (strict)
-                    return throwError(exec, createURIError(exec, "URI error"));
+                    return throwError(exec, createURIError(exec, ASCIILiteral("URI error")));
                 // The only case where we don't use "strict" mode is the "unescape" function.
                 // For that, it's good to support the wonky "%u" syntax for compatibility with WinIE.
                 if (k <= length - 6 && p[1] == 'u'
@@ -142,7 +142,7 @@ static JSValue decode(ExecState* exec, const CharType* characters, int length, c
 static JSValue decode(ExecState* exec, const char* doNotUnescape, bool strict)
 {
     JSStringBuilder builder;
-    UString str = exec->argument(0).toString(exec)->value(exec);
+    String str = exec->argument(0).toString(exec)->value(exec);
     
     if (str.is8Bit())
         return decode(exec, str.characters8(), str.length(), doNotUnescape, strict);
@@ -232,7 +232,7 @@ double parseIntOverflow(const UChar* s, int length, int radix)
 // ES5.1 15.1.2.2
 template <typename CharType>
 ALWAYS_INLINE
-static double parseInt(const UString& s, const CharType* data, int radix)
+static double parseInt(const String& s, const CharType* data, int radix)
 {
     // 1. Let inputString be ToString(string).
     // 2. Let S be a newly created substring of inputString consisting of the first character that is not a
@@ -313,7 +313,7 @@ static double parseInt(const UString& s, const CharType* data, int radix)
     return sign * number;
 }
 
-static double parseInt(const UString& s, int radix)
+static double parseInt(const String& s, int radix)
 {
     if (s.is8Bit())
         return parseInt(s, s.characters8(), radix);
@@ -432,7 +432,7 @@ static double toDouble(const CharType* characters, unsigned size)
 }
 
 // See ecma-262 9.3.1
-double jsToNumber(const UString& s)
+double jsToNumber(const String& s)
 {
     unsigned size = s.length();
 
@@ -450,7 +450,7 @@ double jsToNumber(const UString& s)
     return toDouble(s.characters16(), size);
 }
 
-static double parseFloat(const UString& s)
+static double parseFloat(const String& s)
 {
     unsigned size = s.length();
 
@@ -499,13 +499,13 @@ EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
     JSObject* thisObject = exec->hostThisValue().toThisObject(exec);
     JSObject* unwrappedObject = thisObject->unwrappedObject();
     if (!unwrappedObject->isGlobalObject() || jsCast<JSGlobalObject*>(unwrappedObject)->evalFunction() != exec->callee())
-        return throwVMError(exec, createEvalError(exec, "The \"this\" value passed to eval must be the global object from which eval originated"));
+        return throwVMError(exec, createEvalError(exec, ASCIILiteral("The \"this\" value passed to eval must be the global object from which eval originated")));
 
     JSValue x = exec->argument(0);
     if (!x.isString())
         return JSValue::encode(x);
 
-    UString s = x.toString(exec)->value(exec);
+    String s = x.toString(exec)->value(exec);
 
     if (s.is8Bit()) {
         LiteralParser<LChar> preparser(exec, s.characters8(), s.length(), NonStrictJSON);
@@ -518,11 +518,11 @@ EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
     }
 
     EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false);
-    JSObject* error = eval->compile(exec, jsCast<JSGlobalObject*>(unwrappedObject)->globalScopeChain());
+    JSObject* error = eval->compile(exec, jsCast<JSGlobalObject*>(unwrappedObject));
     if (error)
         return throwVMError(exec, error);
 
-    return JSValue::encode(exec->interpreter()->execute(eval, exec, thisObject, jsCast<JSGlobalObject*>(unwrappedObject)->globalScopeChain()));
+    return JSValue::encode(exec->interpreter()->execute(eval, exec, thisObject, jsCast<JSGlobalObject*>(unwrappedObject)));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
@@ -548,7 +548,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
     }
 
     // If ToString throws, we shouldn't call ToInt32.
-    UString s = value.toString(exec)->value(exec);
+    String s = value.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -615,7 +615,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
         "*+-./@_";
 
     JSStringBuilder builder;
-    UString str = exec->argument(0).toString(exec)->value(exec);
+    String str = exec->argument(0).toString(exec)->value(exec);
     if (str.is8Bit()) {
         const LChar* c = str.characters8();
         for (unsigned k = 0; k < str.length(); k++, c++) {
@@ -653,8 +653,8 @@ EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec)
 {
-    UStringBuilder builder;
-    UString str = exec->argument(0).toString(exec)->value(exec);
+    StringBuilder builder;
+    String str = exec->argument(0).toString(exec)->value(exec);
     int k = 0;
     int len = str.length();
     
@@ -699,7 +699,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec)
         }
     }
 
-    return JSValue::encode(jsString(exec, builder.toUString()));
+    return JSValue::encode(jsString(exec, builder.toString()));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
index 8833bf6d0..757c9dcac 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
@@ -56,7 +56,7 @@ namespace JSC {
     ALWAYS_INLINE double parseIntOverflow(const char* s, int length, int radix) { return parseIntOverflow(reinterpret_cast<const LChar*>(s), length, radix); }
     double parseIntOverflow(const UChar*, int length, int radix);
     bool isStrWhiteSpace(UChar);
-    double jsToNumber(const UString& s);
+    double jsToNumber(const WTF::String&);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalThis.cpp b/Source/JavaScriptCore/runtime/JSGlobalThis.cpp
index b2bbae5d7..a3f2e7785 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalThis.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalThis.cpp
@@ -44,8 +44,7 @@ void JSGlobalThis::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
 
     Base::visitChildren(thisObject, visitor);
-    if (thisObject->m_unwrappedObject)
-        visitor.append(&thisObject->m_unwrappedObject);
+    visitor.append(&thisObject->m_unwrappedObject);
 }
 
 void JSGlobalThis::setUnwrappedObject(JSGlobalData& globalData, JSGlobalObject* globalObject)
diff --git a/Source/JavaScriptCore/runtime/JSLock.cpp b/Source/JavaScriptCore/runtime/JSLock.cpp
index be30c0c9c..c57c9cdc5 100644
--- a/Source/JavaScriptCore/runtime/JSLock.cpp
+++ b/Source/JavaScriptCore/runtime/JSLock.cpp
@@ -25,7 +25,7 @@
 #include "CallFrame.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 
 #if USE(PTHREADS)
 #include <pthread.h>
diff --git a/Source/JavaScriptCore/runtime/JSNameScope.cpp b/Source/JavaScriptCore/runtime/JSNameScope.cpp
new file mode 100644
index 000000000..5dc665c44
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSNameScope.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2008, 2009, 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSNameScope.h"
+
+#include "Error.h"
+
+namespace JSC {
+
+ASSERT_CLASS_FITS_IN_CELL(JSNameScope);
+
+const ClassInfo JSNameScope::s_info = { "NameScope", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSNameScope) };
+
+void JSNameScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSNameScope* thisObject = jsCast<JSNameScope*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_registerStore);
+}
+
+JSObject* JSNameScope::toThisObject(JSCell*, ExecState* exec)
+{
+    return exec->globalThisValue();
+}
+
+void JSNameScope::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+    JSNameScope* thisObject = jsCast<JSNameScope*>(cell);
+    if (slot.isStrictMode()) {
+        // Double lookup in strict mode, but this only occurs when
+        // a) indirectly writing to an exception slot
+        // b) writing to a function expression name
+        // (a) is unlikely, and (b) is an error.
+        // Also with a single entry the symbol table lookup should simply be
+        // a pointer compare.
+        PropertySlot slot;
+        bool isWritable = true;
+        symbolTableGet(thisObject, propertyName, slot, isWritable);
+        if (!isWritable) {
+            throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
+            return;
+        }
+    }
+    if (symbolTablePut(thisObject, exec, propertyName, value, slot.isStrictMode()))
+        return;
+    
+    ASSERT_NOT_REACHED();
+}
+
+bool JSNameScope::getOwnPropertySlot(JSCell* cell, ExecState*, PropertyName propertyName, PropertySlot& slot)
+{
+    return symbolTableGet(jsCast<JSNameScope*>(cell), propertyName, slot);
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSNameScope.h b/Source/JavaScriptCore/runtime/JSNameScope.h
new file mode 100644
index 000000000..e67370d92
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSNameScope.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSNameScope_h
+#define JSNameScope_h
+
+#include "JSGlobalObject.h"
+#include "JSVariableObject.h"
+
+namespace JSC {
+
+// Used for scopes with a single named variable: catch and named function expression.
+class JSNameScope : public JSVariableObject {
+public:
+    typedef JSVariableObject Base;
+
+    static JSNameScope* create(ExecState* exec, const Identifier& identifier, JSValue value, unsigned attributes)
+    {
+        JSNameScope* scopeObject = new (NotNull, allocateCell<JSNameScope>(*exec->heap())) JSNameScope(exec, exec->scope());
+        scopeObject->finishCreation(exec, identifier, value, attributes);
+        return scopeObject;
+    }
+
+    static JSNameScope* create(ExecState* exec, const Identifier& identifier, JSValue value, unsigned attributes, JSScope* next)
+    {
+        JSNameScope* scopeObject = new (NotNull, allocateCell<JSNameScope>(*exec->heap())) JSNameScope(exec, next);
+        scopeObject->finishCreation(exec, identifier, value, attributes);
+        return scopeObject;
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+    bool isDynamicScope(bool& requiresDynamicChecks) const;
+    static JSObject* toThisObject(JSCell*, ExecState*);
+    static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(globalData, globalObject, proto, TypeInfo(NameScopeObjectType, StructureFlags), &s_info); }
+
+    static const ClassInfo s_info;
+
+protected:
+    void finishCreation(ExecState* exec, const Identifier& identifier, JSValue value, unsigned attributes)
+    {
+        Base::finishCreation(exec->globalData());
+        m_registerStore.set(exec->globalData(), this, value);
+        symbolTable()->add(identifier.impl(), SymbolTableEntry(-1, attributes));
+    }
+
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | Base::StructureFlags;
+
+private:
+    JSNameScope(ExecState* exec, JSScope* next)
+        : Base(
+            exec->globalData(),
+            exec->lexicalGlobalObject()->nameScopeStructure(),
+            reinterpret_cast<Register*>(&m_registerStore + 1),
+            next
+        )
+    {
+    }
+
+    WriteBarrier<Unknown> m_registerStore;
+};
+
+inline bool JSNameScope::isDynamicScope(bool&) const
+{
+    return false;
+}
+
+}
+
+#endif // JSNameScope_h
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 065ae3828..45854dcea 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -36,9 +36,8 @@
 #include "LocalScope.h"
 #include "Lookup.h"
 #include "PropertyNameArray.h"
-#include "UStringBuilder.h"
-#include "UStringConcatenate.h"
 #include <wtf/MathExtras.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace JSC {
 
@@ -94,7 +93,7 @@ private:
 
         JSObject* object() const { return m_object.get(); }
 
-        bool appendNextProperty(Stringifier&, UStringBuilder&);
+        bool appendNextProperty(Stringifier&, StringBuilder&);
 
     private:
         Local<JSObject> m_object;
@@ -107,17 +106,17 @@ private:
 
     friend class Holder;
 
-    static void appendQuotedString(UStringBuilder&, const UString&);
+    static void appendQuotedString(StringBuilder&, const String&);
 
     JSValue toJSON(JSValue, const PropertyNameForFunctionCall&);
 
     enum StringifyResult { StringifyFailed, StringifySucceeded, StringifyFailedDueToUndefinedValue };
-    StringifyResult appendStringifiedValue(UStringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
+    StringifyResult appendStringifiedValue(StringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
 
     bool willIndent() const;
     void indent();
     void unindent();
-    void startNewLine(UStringBuilder&) const;
+    void startNewLine(StringBuilder&) const;
 
     ExecState* const m_exec;
     const Local<Unknown> m_replacer;
@@ -125,11 +124,11 @@ private:
     PropertyNameArray m_arrayReplacerPropertyNames;
     CallType m_replacerCallType;
     CallData m_replacerCallData;
-    const UString m_gap;
+    const String m_gap;
 
     Vector<Holder, 16> m_holderStack;
-    UString m_repeatedGap;
-    UString m_indent;
+    String m_repeatedGap;
+    String m_indent;
 };
 
 // ------------------------------ helper functions --------------------------------
@@ -148,7 +147,7 @@ static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
     return value;
 }
 
-static inline UString gap(ExecState* exec, JSValue space)
+static inline String gap(ExecState* exec, JSValue space)
 {
     const unsigned maxGapLength = 10;
     space = unwrapBoxedPrimitive(exec, space);
@@ -166,11 +165,11 @@ static inline UString gap(ExecState* exec, JSValue space)
         UChar spaces[maxGapLength];
         for (int i = 0; i < count; ++i)
             spaces[i] = ' ';
-        return UString(spaces, count);
+        return String(spaces, count);
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    UString spaces = space.getString(exec);
+    String spaces = space.getString(exec);
     if (spaces.length() > maxGapLength) {
         spaces = spaces.substringSharingImpl(0, maxGapLength);
     }
@@ -194,7 +193,7 @@ JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
 {
     if (!m_value) {
         if (m_identifier)
-            m_value = jsString(exec, m_identifier->ustring());
+            m_value = jsString(exec, m_identifier->string());
         else
             m_value = jsNumber(m_number);
     }
@@ -245,17 +244,17 @@ Local<Unknown> Stringifier::stringify(Handle<Unknown> value)
     PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
     object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value.get());
 
-    UStringBuilder result;
+    StringBuilder result;
     if (appendStringifiedValue(result, value.get(), object, emptyPropertyName) != StringifySucceeded)
         return Local<Unknown>(m_exec->globalData(), jsUndefined());
     if (m_exec->hadException())
         return Local<Unknown>(m_exec->globalData(), jsNull());
 
-    return Local<Unknown>(m_exec->globalData(), jsString(m_exec, result.toUString()));
+    return Local<Unknown>(m_exec->globalData(), jsString(m_exec, result.toString()));
 }
 
 template <typename CharType>
-static void appendStringToUStringBuilder(UStringBuilder& builder, const CharType* data, int length)
+static void appendStringToStringBuilder(StringBuilder& builder, const CharType* data, int length)
 {
     for (int i = 0; i < length; ++i) {
         int start = i;
@@ -303,16 +302,16 @@ static void appendStringToUStringBuilder(UStringBuilder& builder, const CharType
     }
 }
     
-void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& value)
+void Stringifier::appendQuotedString(StringBuilder& builder, const String& value)
 {
     int length = value.length();
 
     builder.append('"');
 
     if (value.is8Bit())
-        appendStringToUStringBuilder<LChar>(builder, value.characters8(), length);
+        appendStringToStringBuilder<LChar>(builder, value.characters8(), length);
     else
-        appendStringToUStringBuilder<UChar>(builder, value.characters16(), length);
+        appendStringToStringBuilder<UChar>(builder, value.characters16(), length);
 
     builder.append('"');
 }
@@ -341,7 +340,7 @@ inline JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionC
     return call(m_exec, object, callType, callData, value, args);
 }
 
-Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
+Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
 {
     // Call the toJSON function.
     value = toJSON(value, propertyName);
@@ -362,7 +361,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
         return StringifyFailedDueToUndefinedValue;
 
     if (value.isNull()) {
-        builder.append("null");
+        builder.appendLiteral("null");
         return StringifySucceeded;
     }
 
@@ -372,11 +371,14 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
         return StringifyFailed;
 
     if (value.isBoolean()) {
-        builder.append(value.isTrue() ? "true" : "false");
+        if (value.isTrue())
+            builder.appendLiteral("true");
+        else
+            builder.appendLiteral("false");
         return StringifySucceeded;
     }
 
-    UString stringValue;
+    String stringValue;
     if (value.getString(m_exec, stringValue)) {
         appendQuotedString(builder, stringValue);
         return StringifySucceeded;
@@ -385,9 +387,9 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     if (value.isNumber()) {
         double number = value.asNumber();
         if (!isfinite(number))
-            builder.append("null");
+            builder.appendLiteral("null");
         else
-            builder.append(UString::number(number));
+            builder.append(String::numberToStringECMAScript(number));
         return StringifySucceeded;
     }
 
@@ -399,7 +401,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     CallData callData;
     if (object->methodTable()->getCallData(object, callData) != CallTypeNone) {
         if (holder->inherits(&JSArray::s_info)) {
-            builder.append("null");
+            builder.appendLiteral("null");
             return StringifySucceeded;
         }
         return StringifyFailedDueToUndefinedValue;
@@ -408,7 +410,7 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder&
     // Handle cycle detection, and put the holder on the stack.
     for (unsigned i = 0; i < m_holderStack.size(); i++) {
         if (m_holderStack[i].object() == object) {
-            throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
+            throwError(m_exec, createTypeError(m_exec, ASCIILiteral("JSON.stringify cannot serialize cyclic structures.")));
             return StringifyFailed;
         }
     }
@@ -448,7 +450,7 @@ inline void Stringifier::indent()
     // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
     unsigned newSize = m_indent.length() + m_gap.length();
     if (newSize > m_repeatedGap.length())
-        m_repeatedGap = makeUString(m_repeatedGap, m_gap);
+        m_repeatedGap = makeString(m_repeatedGap, m_gap);
     ASSERT(newSize <= m_repeatedGap.length());
     m_indent = m_repeatedGap.substringSharingImpl(0, newSize);
 }
@@ -459,7 +461,7 @@ inline void Stringifier::unindent()
     m_indent = m_repeatedGap.substringSharingImpl(0, m_indent.length() - m_gap.length());
 }
 
-inline void Stringifier::startNewLine(UStringBuilder& builder) const
+inline void Stringifier::startNewLine(StringBuilder& builder) const
 {
     if (m_gap.isEmpty())
         return;
@@ -477,7 +479,7 @@ inline Stringifier::Holder::Holder(JSGlobalData& globalData, JSObject* object)
 {
 }
 
-bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBuilder& builder)
+bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBuilder& builder)
 {
     ASSERT(m_index <= m_size);
 
@@ -555,7 +557,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
         stringifier.startNewLine(builder);
 
         // Append the property name.
-        appendQuotedString(builder, propertyName.ustring());
+        appendQuotedString(builder, propertyName.string());
         builder.append(':');
         if (stringifier.willIndent())
             builder.append(' ');
@@ -570,7 +572,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBu
 
     switch (stringifyResult) {
         case StringifyFailed:
-            builder.append("null");
+            builder.appendLiteral("null");
             break;
         case StringifySucceeded:
             break;
@@ -704,11 +706,11 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             }
             case ArrayEndVisitMember: {
                 JSArray* array = arrayStack.peek();
-                JSValue filteredValue = callReviver(array, jsString(m_exec, UString::number(indexStack.last())), outValue);
+                JSValue filteredValue = callReviver(array, jsString(m_exec, String::number(indexStack.last())), outValue);
                 if (filteredValue.isUndefined())
                     array->methodTable()->deletePropertyByIndex(array, m_exec, indexStack.last());
                 else
-                    array->putDirectIndex(m_exec, indexStack.last(), filteredValue, false);
+                    array->putDirectIndex(m_exec, indexStack.last(), filteredValue);
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -767,7 +769,7 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 JSObject* object = objectStack.peek();
                 Identifier prop = propertyStack.last()[indexStack.last()];
                 PutPropertySlot slot;
-                JSValue filteredValue = callReviver(object, jsString(m_exec, prop.ustring()), outValue);
+                JSValue filteredValue = callReviver(object, jsString(m_exec, prop.string()), outValue);
                 if (filteredValue.isUndefined())
                     object->methodTable()->deleteProperty(object, m_exec, prop);
                 else
@@ -810,8 +812,8 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
 EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
 {
     if (!exec->argumentCount())
-        return throwVMError(exec, createError(exec, "JSON.parse requires at least one parameter"));
-    UString source = exec->argument(0).toString(exec)->value(exec);
+        return throwVMError(exec, createError(exec, ASCIILiteral("JSON.parse requires at least one parameter")));
+    String source = exec->argument(0).toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
 
@@ -844,7 +846,7 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
 {
     if (!exec->argumentCount())
-        return throwVMError(exec, createError(exec, "No input to stringify"));
+        return throwVMError(exec, createError(exec, ASCIILiteral("No input to stringify")));
     LocalScope scope(exec->globalData());
     Local<Unknown> value(exec->globalData(), exec->argument(0));
     Local<Unknown> replacer(exec->globalData(), exec->argument(1));
@@ -852,12 +854,12 @@ EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
     return JSValue::encode(Stringifier(exec, replacer, space).stringify(value).get());
 }
 
-UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
+String JSONStringify(ExecState* exec, JSValue value, unsigned indent)
 {
     LocalScope scope(exec->globalData());
     Local<Unknown> result = Stringifier(exec, Local<Unknown>(exec->globalData(), jsNull()), Local<Unknown>(exec->globalData(), jsNumber(indent))).stringify(Local<Unknown>(exec->globalData(), value));
     if (result.isUndefinedOrNull())
-        return UString();
+        return String();
     return result.getString(exec);
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSONObject.h b/Source/JavaScriptCore/runtime/JSONObject.h
index 3b8647714..b537b9144 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.h
+++ b/Source/JavaScriptCore/runtime/JSONObject.h
@@ -61,7 +61,7 @@ namespace JSC {
 
     };
 
-    UString JSONStringify(ExecState* exec, JSValue value, unsigned indent);
+    String JSONStringify(ExecState*, JSValue, unsigned indent);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index c40c625e1..812ba3bc8 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -154,7 +154,7 @@ void JSFinalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 #endif
 }
 
-UString JSObject::className(const JSObject* object)
+String JSObject::className(const JSObject* object)
 {
     const ClassInfo* info = object->classInfo();
     ASSERT(info);
@@ -182,7 +182,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
             prototype = obj->prototype();
             if (prototype.isNull()) {
                 if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getCallableObject(value)) && slot.isStrictMode())
-                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                    throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
                 return;
             }
         }
@@ -195,7 +195,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
         if (offset != invalidOffset) {
             if (attributes & ReadOnly) {
                 if (slot.isStrictMode())
-                    throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
+                    throwError(exec, createTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError)));
                 return;
             }
 
@@ -204,7 +204,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
                     if (slot.isStrictMode())
-                        throwError(exec, createTypeError(exec, "setting a property that has only a getter"));
+                        throwError(exec, createTypeError(exec, ASCIILiteral("setting a property that has only a getter")));
                     return;
                 }
                 
@@ -229,7 +229,7 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
     }
     
     if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getCallableObject(value)) && slot.isStrictMode())
-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
     return;
 }
 
@@ -389,7 +389,7 @@ JSValue JSObject::defaultValue(const JSObject* object, ExecState* exec, Preferre
 
     ASSERT(!exec->hadException());
 
-    return throwError(exec, createTypeError(exec, "No default value"));
+    return throwError(exec, createTypeError(exec, ASCIILiteral("No default value")));
 }
 
 const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, PropertyName propertyName) const
@@ -409,7 +409,7 @@ bool JSObject::hasInstance(JSObject*, ExecState* exec, JSValue value, JSValue pr
         return false;
 
     if (!proto.isObject()) {
-        throwError(exec, createTypeError(exec, "instanceof called on an object with an invalid prototype property."));
+        throwError(exec, createTypeError(exec, ASCIILiteral("instanceof called on an object with an invalid prototype property.")));
         return false;
     }
 
@@ -718,7 +718,7 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName
         // unless extensions are prevented!
         if (!object->isExtensible()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to define property on object that is not extensible."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to define property on object that is not extensible.")));
             return false;
         }
         PropertyDescriptor oldDescriptor;
@@ -736,12 +736,12 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName
     if (!current.configurable()) {
         if (descriptor.configurable()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to configurable attribute of unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to configurable attribute of unconfigurable property.")));
             return false;
         }
         if (descriptor.enumerablePresent() && descriptor.enumerable() != current.enumerable()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change enumerable attribute of unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property.")));
             return false;
         }
     }
@@ -759,7 +759,7 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName
     if (descriptor.isDataDescriptor() != current.isDataDescriptor()) {
         if (!current.configurable()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change access mechanism for an unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change access mechanism for an unconfigurable property.")));
             return false;
         }
         object->methodTable()->deleteProperty(object, exec, propertyName);
@@ -771,13 +771,13 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName
         if (!current.configurable()) {
             if (!current.writable() && descriptor.writable()) {
                 if (throwException)
-                    throwError(exec, createTypeError(exec, "Attempting to change writable attribute of unconfigurable property."));
+                    throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change writable attribute of unconfigurable property.")));
                 return false;
             }
             if (!current.writable()) {
                 if (descriptor.value() && !sameValue(exec, current.value(), descriptor.value())) {
                     if (throwException)
-                        throwError(exec, createTypeError(exec, "Attempting to change value of a readonly property."));
+                        throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change value of a readonly property.")));
                     return false;
                 }
             }
@@ -793,12 +793,12 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName
     if (!current.configurable()) {
         if (descriptor.setterPresent() && !(current.setterPresent() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change the setter of an unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change the setter of an unconfigurable property.")));
             return false;
         }
         if (descriptor.getterPresent() && !(current.getterPresent() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change the getter of an unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change the getter of an unconfigurable property.")));
             return false;
         }
     }
@@ -818,7 +818,7 @@ bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName
     return true;
 }
 
-JSObject* throwTypeError(ExecState* exec, const UString& message)
+JSObject* throwTypeError(ExecState* exec, const String& message)
 {
     return throwError(exec, createTypeError(exec, message));
 }
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 82da5eef9..f4b847b4c 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -30,7 +30,7 @@
 #include "JSCell.h"
 #include "PropertySlot.h"
 #include "PutPropertySlot.h"
-#include "ScopeChain.h"
+
 #include "StorageBarrier.h"
 #include "Structure.h"
 #include "JSGlobalData.h"
@@ -65,7 +65,7 @@ namespace JSC {
     class Structure;
     struct HashTable;
 
-    JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const UString&);
+    JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String&);
     extern JS_EXPORTDATA const char* StrictModeReadonlyPropertyWriteError;
 
     // ECMA 262-3 8.6.1
@@ -99,7 +99,7 @@ namespace JSC {
 
         JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
 
-        JS_EXPORT_PRIVATE static UString className(const JSObject*);
+        JS_EXPORT_PRIVATE static String className(const JSObject*);
 
         JSValue prototype() const;
         void setPrototype(JSGlobalData&, JSValue prototype);
@@ -254,7 +254,7 @@ namespace JSC {
 
         bool isGlobalObject() const;
         bool isVariableObject() const;
-        bool isStaticScopeObject() const;
+        bool isNameScopeObject() const;
         bool isActivationObject() const;
         bool isErrorInstance() const;
         bool isGlobalThis() const;
@@ -314,8 +314,6 @@ namespace JSC {
             return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
         }
 
-        static const unsigned StructureFlags = 0;
-
         // To instantiate objects you likely want JSFinalObject, below.
         // To create derived types you likely want JSNonFinalObject, below.
         JSObject(JSGlobalData&, Structure*);
@@ -473,9 +471,9 @@ inline bool JSObject::isVariableObject() const
     return structure()->typeInfo().type() >= VariableObjectType;
 }
 
-inline bool JSObject::isStaticScopeObject() const
+inline bool JSObject::isNameScopeObject() const
 {
-    return structure()->typeInfo().type() == StaticScopeObjectType;
+    return structure()->typeInfo().type() == NameScopeObjectType;
 }
 
 inline bool JSObject::isActivationObject() const
@@ -622,7 +620,7 @@ ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, PropertyName
 // identifier. The first time we perform a property access with a given string, try
 // performing the property map lookup without forming an identifier. We detect this
 // case by checking whether the hash has yet been set for this string.
-ALWAYS_INLINE JSValue JSCell::fastGetOwnProperty(ExecState* exec, const UString& name)
+ALWAYS_INLINE JSValue JSCell::fastGetOwnProperty(ExecState* exec, const String& name)
 {
     if (!structure()->typeInfo().overridesGetOwnPropertySlot() && !structure()->hasGetterSetterProperties()) {
         PropertyOffset offset = name.impl()->hasHash()
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index aaf946d3d..b1376c5e8 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -103,8 +103,7 @@ void JSPropertyNameIterator::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
     visitor.appendValues(thisObject->m_jsStrings.get(), thisObject->m_jsStringsSize);
-    if (thisObject->m_cachedPrototypeChain)
-        visitor.append(&thisObject->m_cachedPrototypeChain);
+    visitor.append(&thisObject->m_cachedPrototypeChain);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 653ee0463..057ffe293 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -87,7 +87,7 @@ namespace JSC {
             Base::finishCreation(exec->globalData());
             PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
             for (size_t i = 0; i < m_jsStringsSize; ++i)
-                m_jsStrings[i].set(exec->globalData(), this, jsOwnedString(exec, propertyNameVector[i].ustring()));
+                m_jsStrings[i].set(exec->globalData(), this, jsOwnedString(exec, propertyNameVector[i].string()));
             m_offsetBase = object->structure()->firstValidOffset();
         }
 
diff --git a/Source/JavaScriptCore/runtime/JSScope.cpp b/Source/JavaScriptCore/runtime/JSScope.cpp
new file mode 100644
index 000000000..b22211970
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSScope.cpp
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSScope.h"
+
+#include "JSActivation.h"
+#include "JSGlobalObject.h"
+#include "JSNameScope.h"
+#include "JSWithScope.h"
+
+namespace JSC {
+
+ASSERT_CLASS_FITS_IN_CELL(JSScope);
+
+void JSScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSScope* thisObject = jsCast<JSScope*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_next);
+}
+
+bool JSScope::isDynamicScope(bool& requiresDynamicChecks) const
+{
+    switch (structure()->typeInfo().type()) {
+    case GlobalObjectType:
+        return static_cast<const JSGlobalObject*>(this)->isDynamicScope(requiresDynamicChecks);
+    case ActivationObjectType:
+        return static_cast<const JSActivation*>(this)->isDynamicScope(requiresDynamicChecks);
+    case NameScopeObjectType:
+        return static_cast<const JSNameScope*>(this)->isDynamicScope(requiresDynamicChecks);
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+
+    return false;
+}
+
+JSObject* JSScope::objectAtScope(JSScope* scope)
+{
+    JSObject* object = scope;
+    if (object->structure()->typeInfo().type() == WithScopeType)
+        return jsCast<JSWithScope*>(object)->object();
+
+    return object;
+}
+
+int JSScope::localDepth()
+{
+    int scopeDepth = 0;
+    ScopeChainIterator iter = this->begin();
+    ScopeChainIterator end = this->end();
+    while (!iter->inherits(&JSActivation::s_info)) {
+        ++iter;
+        if (iter == end)
+            break;
+        ++scopeDepth;
+    }
+    return scopeDepth;
+}
+
+JSValue JSScope::resolve(CallFrame* callFrame, const Identifier& identifier)
+{
+    JSScope* scope = callFrame->scope();
+    ASSERT(scope);
+
+    do {
+        JSObject* object = JSScope::objectAtScope(scope);
+        PropertySlot slot(object);
+        if (object->getPropertySlot(callFrame, identifier, slot))
+            return slot.getValue(callFrame, identifier);
+    } while ((scope = scope->next()));
+
+    return throwError(callFrame, createUndefinedVariableError(callFrame, identifier));
+}
+
+JSValue JSScope::resolveSkip(CallFrame* callFrame, const Identifier& identifier, int skip)
+{
+    JSScope* scope = callFrame->scope();
+    ASSERT(scope);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        if (callFrame->uncheckedR(codeBlock->activationRegister()).jsValue())
+            scope = scope->next();
+    }
+    while (skip--) {
+        scope = scope->next();
+        ASSERT(scope);
+    }
+
+    do {
+        JSObject* object = JSScope::objectAtScope(scope);
+        PropertySlot slot(object);
+        if (object->getPropertySlot(callFrame, identifier, slot))
+            return slot.getValue(callFrame, identifier);
+    } while ((scope = scope->next()));
+
+    return throwError(callFrame, createUndefinedVariableError(callFrame, identifier));
+}
+
+JSValue JSScope::resolveGlobal(
+    CallFrame* callFrame,
+    const Identifier& identifier,
+    JSGlobalObject* globalObject,
+    WriteBarrierBase<Structure>* cachedStructure,
+    PropertyOffset* cachedOffset
+)
+{
+    if (globalObject->structure() == cachedStructure->get())
+        return globalObject->getDirectOffset(*cachedOffset);
+
+    PropertySlot slot(globalObject);
+    if (!globalObject->getPropertySlot(callFrame, identifier, slot))
+        return throwError(callFrame, createUndefinedVariableError(callFrame, identifier));
+
+    JSValue result = slot.getValue(callFrame, identifier);
+    if (callFrame->globalData().exception)
+        return JSValue();
+
+    if (slot.isCacheableValue() && !globalObject->structure()->isUncacheableDictionary() && slot.slotBase() == globalObject) {
+        cachedStructure->set(callFrame->globalData(), callFrame->codeBlock()->ownerExecutable(), globalObject->structure());
+        *cachedOffset = slot.cachedOffset();
+    }
+    return result;
+}
+
+JSValue JSScope::resolveGlobalDynamic(
+    CallFrame* callFrame,
+    const Identifier& identifier,
+    int skip,
+    WriteBarrierBase<Structure>* cachedStructure,
+    PropertyOffset* cachedOffset
+)
+{
+    JSScope* scope = callFrame->scope();
+    ASSERT(scope);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        if (callFrame->uncheckedR(codeBlock->activationRegister()).jsValue())
+            scope = scope->next();
+    }
+    while (skip--) {
+        JSObject* object = JSScope::objectAtScope(scope);
+        if (!object->hasCustomProperties())
+            continue;
+
+        PropertySlot slot(object);
+        if (!object->getPropertySlot(callFrame, identifier, slot))
+            continue;
+
+        JSValue result = slot.getValue(callFrame, identifier);
+        if (callFrame->globalData().exception)
+            return JSValue();
+        return result;
+    }
+
+    return resolveGlobal(callFrame, identifier, callFrame->lexicalGlobalObject(), cachedStructure, cachedOffset);
+}
+
+JSValue JSScope::resolveBase(CallFrame* callFrame, const Identifier& identifier, bool isStrict)
+{
+    JSScope* scope = callFrame->scope();
+    ASSERT(scope);
+
+    do {
+        JSObject* object = JSScope::objectAtScope(scope);
+
+        PropertySlot slot(object);
+        if (!object->getPropertySlot(callFrame, identifier, slot))
+            continue;
+
+        return JSValue(object);
+    } while ((scope = scope->next()));
+
+    if (!isStrict)
+        return callFrame->lexicalGlobalObject();
+
+    return throwError(callFrame, createErrorForInvalidGlobalAssignment(callFrame, identifier.string()));
+}
+
+JSValue JSScope::resolveWithBase(CallFrame* callFrame, const Identifier& identifier, Register* base)
+{
+    JSScope* scope = callFrame->scope();
+    ASSERT(scope);
+
+    do {
+        JSObject* object = JSScope::objectAtScope(scope);
+
+        PropertySlot slot(object);
+        if (!object->getPropertySlot(callFrame, identifier, slot))
+            continue;
+
+        JSValue value = slot.getValue(callFrame, identifier);
+        if (callFrame->globalData().exception)
+            return JSValue();
+
+        *base = JSValue(object);
+        return value;
+    } while ((scope = scope->next()));
+
+    return throwError(callFrame, createUndefinedVariableError(callFrame, identifier));
+}
+
+JSValue JSScope::resolveWithThis(CallFrame* callFrame, const Identifier& identifier, Register* base)
+{
+    JSScope* scope = callFrame->scope();
+    ASSERT(scope);
+
+    do {
+        JSObject* object = JSScope::objectAtScope(scope);
+
+        PropertySlot slot(object);
+        if (!object->getPropertySlot(callFrame, identifier, slot))
+            continue;
+
+        JSValue value = slot.getValue(callFrame, identifier);
+        if (callFrame->globalData().exception)
+            return JSValue();
+
+        *base = object->structure()->typeInfo().isEnvironmentRecord() ? jsUndefined() : JSValue(object);
+        return value;
+    } while ((scope = scope->next()));
+
+    return throwError(callFrame, createUndefinedVariableError(callFrame, identifier));
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSScope.h b/Source/JavaScriptCore/runtime/JSScope.h
new file mode 100644
index 000000000..011aff57e
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSScope.h
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSScope_h
+#define JSScope_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class ScopeChainIterator;
+
+class JSScope : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    friend class LLIntOffsetsExtractor;
+    static size_t offsetOfNext();
+
+    JS_EXPORT_PRIVATE static JSObject* objectAtScope(JSScope*);
+
+    static JSValue resolve(CallFrame*, const Identifier&);
+    static JSValue resolveSkip(CallFrame*, const Identifier&, int skip);
+    static JSValue resolveGlobal(
+        CallFrame*,
+        const Identifier&,
+        JSGlobalObject* globalObject,
+        WriteBarrierBase<Structure>* cachedStructure,
+        PropertyOffset* cachedOffset
+    );
+    static JSValue resolveGlobalDynamic(
+        CallFrame*,
+        const Identifier&,
+        int skip,
+        WriteBarrierBase<Structure>* cachedStructure,
+        PropertyOffset* cachedOffset
+    );
+    static JSValue resolveBase(CallFrame*, const Identifier&, bool isStrict);
+    static JSValue resolveWithBase(CallFrame*, const Identifier&, Register* base);
+    static JSValue resolveWithThis(CallFrame*, const Identifier&, Register* base);
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    bool isDynamicScope(bool& requiresDynamicChecks) const;
+
+    ScopeChainIterator begin();
+    ScopeChainIterator end();
+    JSScope* next();
+    int localDepth();
+
+    JSGlobalObject* globalObject();
+    JSGlobalData* globalData();
+    JSObject* globalThis();
+
+protected:
+    JSScope(JSGlobalData&, Structure*, JSScope* next);
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+private:
+    WriteBarrier<JSScope> m_next;
+};
+
+inline JSScope::JSScope(JSGlobalData& globalData, Structure* structure, JSScope* next)
+    : Base(globalData, structure)
+    , m_next(globalData, this, next, WriteBarrier<JSScope>::MayBeNull)
+{
+}
+
+class ScopeChainIterator {
+public:
+    ScopeChainIterator(JSScope* node)
+        : m_node(node)
+    {
+    }
+
+    JSObject* get() const { return JSScope::objectAtScope(m_node); }
+    JSObject* operator->() const { return JSScope::objectAtScope(m_node); }
+
+    ScopeChainIterator& operator++() { m_node = m_node->next(); return *this; }
+
+    // postfix ++ intentionally omitted
+
+    bool operator==(const ScopeChainIterator& other) const { return m_node == other.m_node; }
+    bool operator!=(const ScopeChainIterator& other) const { return m_node != other.m_node; }
+
+private:
+    JSScope* m_node;
+};
+
+inline ScopeChainIterator JSScope::begin()
+{
+    return ScopeChainIterator(this); 
+}
+
+inline ScopeChainIterator JSScope::end()
+{ 
+    return ScopeChainIterator(0); 
+}
+
+inline JSScope* JSScope::next()
+{ 
+    return m_next.get();
+}
+
+inline JSGlobalObject* JSScope::globalObject()
+{ 
+    return structure()->globalObject();
+}
+
+inline JSGlobalData* JSScope::globalData()
+{ 
+    return Heap::heap(this)->globalData();
+}
+
+inline Register& Register::operator=(JSScope* scope)
+{
+    *this = JSValue(scope);
+    return *this;
+}
+
+inline JSScope* Register::scope() const
+{
+    return jsCast<JSScope*>(jsValue());
+}
+
+inline JSGlobalData& ExecState::globalData() const
+{
+    ASSERT(scope()->globalData());
+    return *scope()->globalData();
+}
+
+inline JSGlobalObject* ExecState::lexicalGlobalObject() const
+{
+    return scope()->globalObject();
+}
+
+inline JSObject* ExecState::globalThisValue() const
+{
+    return scope()->globalThis();
+}
+
+inline size_t JSScope::offsetOfNext()
+{
+    return OBJECT_OFFSETOF(JSScope, m_next);
+}
+
+} // namespace JSC
+
+#endif // JSScope_h
diff --git a/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h b/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
index f1fe0483d..1fd96c17a 100644
--- a/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
@@ -82,8 +82,8 @@ public:
 protected:
     static const unsigned StructureFlags = OverridesVisitChildren | JSSymbolTableObject::StructureFlags;
 
-    JSSegmentedVariableObject(JSGlobalData& globalData, Structure* structure, SymbolTable* symbolTable)
-        : JSSymbolTableObject(globalData, structure, symbolTable)
+    JSSegmentedVariableObject(JSGlobalData& globalData, Structure* structure, JSScope* scope)
+        : JSSymbolTableObject(globalData, structure, scope)
     {
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 14187f422..e69de29bb 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -1,95 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-
-#include "JSStaticScopeObject.h"
-
-#include "Error.h"
-
-namespace JSC {
-ASSERT_CLASS_FITS_IN_CELL(JSStaticScopeObject);
-
-const ClassInfo JSStaticScopeObject::s_info = { "Object", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSStaticScopeObject) };
-
-void JSStaticScopeObject::destroy(JSCell* cell)
-{
-    static_cast<JSStaticScopeObject*>(cell)->JSStaticScopeObject::~JSStaticScopeObject();
-}
-
-void JSStaticScopeObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
-    JSStaticScopeObject* thisObject = jsCast<JSStaticScopeObject*>(cell);
-    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
-    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
-    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-    JSVariableObject::visitChildren(thisObject, visitor);
-    visitor.append(&thisObject->m_registerStore);
-}
-
-JSObject* JSStaticScopeObject::toThisObject(JSCell*, ExecState* exec)
-{
-    return exec->globalThisValue();
-}
-
-void JSStaticScopeObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
-{
-    JSStaticScopeObject* thisObject = jsCast<JSStaticScopeObject*>(cell);
-    if (slot.isStrictMode()) {
-        // Double lookup in strict mode, but this only occurs when
-        // a) indirectly writing to an exception slot
-        // b) writing to a function expression name
-        // (a) is unlikely, and (b) is an error.
-        // Also with a single entry the symbol table lookup should simply be
-        // a pointer compare.
-        PropertySlot slot;
-        bool isWritable = true;
-        symbolTableGet(thisObject, propertyName, slot, isWritable);
-        if (!isWritable) {
-            throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
-            return;
-        }
-    }
-    if (symbolTablePut(thisObject, exec, propertyName, value, slot.isStrictMode()))
-        return;
-    
-    ASSERT_NOT_REACHED();
-}
-
-void JSStaticScopeObject::putDirectVirtual(JSObject* object, ExecState* exec, PropertyName propertyName, JSValue value, unsigned attributes)
-{
-    JSStaticScopeObject* thisObject = jsCast<JSStaticScopeObject*>(object);
-    if (symbolTablePutWithAttributes(thisObject, exec->globalData(), propertyName, value, attributes))
-        return;
-    
-    ASSERT_NOT_REACHED();
-}
-
-bool JSStaticScopeObject::getOwnPropertySlot(JSCell* cell, ExecState*, PropertyName propertyName, PropertySlot& slot)
-{
-    return symbolTableGet(jsCast<JSStaticScopeObject*>(cell), propertyName, slot);
-}
-
-}
diff --git a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
index f351349a6..e69de29bb 100644
--- a/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/Source/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSStaticScopeObject_h
-#define JSStaticScopeObject_h
-
-#include "JSVariableObject.h"
-
-namespace JSC{
-    
-    class JSStaticScopeObject : public JSVariableObject {
-    public:
-        typedef JSVariableObject Base;
-
-        static JSStaticScopeObject* create(ExecState* exec, const Identifier& identifier, JSValue value, unsigned attributes)
-        {
-            JSStaticScopeObject* scopeObject = new (NotNull, allocateCell<JSStaticScopeObject>(*exec->heap())) JSStaticScopeObject(exec);
-            scopeObject->finishCreation(exec, identifier, value, attributes);
-            return scopeObject;
-        }
-
-        static void visitChildren(JSCell*, SlotVisitor&);
-        bool isDynamicScope(bool& requiresDynamicChecks) const;
-        static JSObject* toThisObject(JSCell*, ExecState*);
-        static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
-        static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
-
-        static void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
-
-        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(globalData, globalObject, proto, TypeInfo(StaticScopeObjectType, StructureFlags), &s_info); }
-
-        static const ClassInfo s_info;
-
-    protected:
-        void finishCreation(ExecState* exec, const Identifier& identifier, JSValue value, unsigned attributes)
-        {
-            Base::finishCreation(exec->globalData());
-            m_registerStore.set(exec->globalData(), this, value);
-            symbolTable().add(identifier.impl(), SymbolTableEntry(-1, attributes));
-        }
-        static const unsigned StructureFlags = IsEnvironmentRecord | OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
-
-    private:
-        JSStaticScopeObject(ExecState* exec)
-            : JSVariableObject(exec->globalData(), exec->globalData().staticScopeStructure.get(), &m_symbolTable, reinterpret_cast<Register*>(&m_registerStore + 1))
-        {
-        }
-
-        static void destroy(JSCell*);
-
-        SymbolTable m_symbolTable;
-        WriteBarrier<Unknown> m_registerStore;
-    };
-
-    inline bool JSStaticScopeObject::isDynamicScope(bool&) const
-    {
-        return false;
-    }
-
-}
-
-#endif // JSStaticScopeObject_h
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 4eb2a5297..f0e796d89 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -130,7 +130,10 @@ void JSRopeString::resolveRope(ExecState* exec) const
     for (size_t i = 0; i < s_maxInternalRopeLength && m_fibers[i]; ++i) {
         StringImpl* string = m_fibers[i]->m_value.impl();
         unsigned length = string->length();
-        StringImpl::copyChars(position, string->characters(), length);
+        if (string->is8Bit())
+            StringImpl::copyChars(position, string->characters8(), length);
+        else
+            StringImpl::copyChars(position, string->characters16(), length);
         position += length;
         m_fibers[i].clear();
     }
@@ -139,7 +142,7 @@ void JSRopeString::resolveRope(ExecState* exec) const
 }
 
 // Overview: These functions convert a JSString from holding a string in rope form
-// down to a simple UString representation.  It does so by building up the string
+// down to a simple String representation. It does so by building up the string
 // backwards, since we want to avoid recursion, we expect that the tree structure
 // representing the rope is likely imbalanced with more nodes down the left side
 // (since appending to the string is likely more common) - and as such resolving
@@ -202,7 +205,10 @@ void JSRopeString::resolveRopeSlowCase(UChar* buffer) const
         StringImpl* string = static_cast<StringImpl*>(currentFiber->m_value.impl());
         unsigned length = string->length();
         position -= length;
-        StringImpl::copyChars(position, string->characters(), length);
+        if (string->is8Bit())
+            StringImpl::copyChars(position, string->characters8(), length);
+        else
+            StringImpl::copyChars(position, string->characters16(), length);
     }
 
     ASSERT(buffer == position);
@@ -214,7 +220,7 @@ void JSRopeString::outOfMemory(ExecState* exec) const
     for (size_t i = 0; i < s_maxInternalRopeLength && m_fibers[i]; ++i)
         m_fibers[i].clear();
     ASSERT(isRope());
-    ASSERT(m_value == UString());
+    ASSERT(m_value.isNull());
     if (exec)
         throwOutOfMemoryError(exec);
 }
@@ -225,7 +231,7 @@ JSString* JSRopeString::getIndexSlowCase(ExecState* exec, unsigned i)
     resolveRope(exec);
     // Return a safe no-value result, this should never be used, since the excetion will be thrown.
     if (exec->exception())
-        return jsString(exec, "");
+        return jsEmptyString(exec);
     ASSERT(!isRope());
     ASSERT(i < m_value.length());
     return jsSingleCharacterSubstring(exec, m_value, i);
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index e91553aeb..7821b42b8 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -37,27 +37,25 @@ namespace JSC {
 
     JSString* jsEmptyString(JSGlobalData*);
     JSString* jsEmptyString(ExecState*);
-    JSString* jsString(JSGlobalData*, const UString&); // returns empty string if passed null string
-    JSString* jsString(ExecState*, const UString&); // returns empty string if passed null string
+    JSString* jsString(JSGlobalData*, const String&); // returns empty string if passed null string
+    JSString* jsString(ExecState*, const String&); // returns empty string if passed null string
 
     JSString* jsSingleCharacterString(JSGlobalData*, UChar);
     JSString* jsSingleCharacterString(ExecState*, UChar);
-    JSString* jsSingleCharacterSubstring(ExecState*, const UString&, unsigned offset);
-    JSString* jsSubstring(JSGlobalData*, const UString&, unsigned offset, unsigned length);
-    JSString* jsSubstring(ExecState*, const UString&, unsigned offset, unsigned length);
+    JSString* jsSingleCharacterSubstring(ExecState*, const String&, unsigned offset);
+    JSString* jsSubstring(JSGlobalData*, const String&, unsigned offset, unsigned length);
+    JSString* jsSubstring(ExecState*, const String&, unsigned offset, unsigned length);
 
     // Non-trivial strings are two or more characters long.
     // These functions are faster than just calling jsString.
-    JSString* jsNontrivialString(JSGlobalData*, const UString&);
-    JSString* jsNontrivialString(ExecState*, const UString&);
-    JSString* jsNontrivialString(JSGlobalData*, const char*);
-    JSString* jsNontrivialString(ExecState*, const char*);
+    JSString* jsNontrivialString(JSGlobalData*, const String&);
+    JSString* jsNontrivialString(ExecState*, const String&);
 
     // Should be used for strings that are owned by an object that will
     // likely outlive the JSValue this makes, such as the parse tree or a
-    // DOM object that contains a UString
-    JSString* jsOwnedString(JSGlobalData*, const UString&); 
-    JSString* jsOwnedString(ExecState*, const UString&); 
+    // DOM object that contains a String
+    JSString* jsOwnedString(JSGlobalData*, const String&);
+    JSString* jsOwnedString(ExecState*, const String&);
 
     JSRopeString* jsStringBuilder(JSGlobalData*);
 
@@ -136,8 +134,8 @@ namespace JSC {
             return newString;
         }
 
-        const UString& value(ExecState*) const;
-        const UString& tryGetValue() const;
+        const String& value(ExecState*) const;
+        const String& tryGetValue() const;
         unsigned length() { return m_length; }
 
         JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
@@ -190,9 +188,9 @@ namespace JSC {
             Is8Bit = 1u
         };
 
-        // A string is represented either by a UString or a rope of fibers.
+        // A string is represented either by a String or a rope of fibers.
         unsigned m_length;
-        mutable UString m_value;
+        mutable String m_value;
 
     private:
         friend class LLIntOffsetsExtractor;
@@ -203,7 +201,7 @@ namespace JSC {
         static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&);
         static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
 
-        UString& string() { ASSERT(!isRope()); return m_value; }
+        String& string() { ASSERT(!isRope()); return m_value; }
 
         friend JSValue jsString(ExecState*, JSString*, JSString*);
         friend JSString* jsSubstring(ExecState*, JSString*, unsigned offset, unsigned length);
@@ -340,41 +338,33 @@ namespace JSC {
     {
         if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
-        return JSString::create(*globalData, UString(&c, 1).impl());
+        return JSString::create(*globalData, String(&c, 1).impl());
     }
 
-    ALWAYS_INLINE JSString* jsSingleCharacterSubstring(ExecState* exec, const UString& s, unsigned offset)
+    ALWAYS_INLINE JSString* jsSingleCharacterSubstring(ExecState* exec, const String& s, unsigned offset)
     {
         JSGlobalData* globalData = &exec->globalData();
         ASSERT(offset < static_cast<unsigned>(s.length()));
-        UChar c = s[offset];
+        UChar c = s.characterAt(offset);
         if (c <= maxSingleCharacterString)
             return globalData->smallStrings.singleCharacterString(globalData, c);
         return JSString::create(*globalData, StringImpl::create(s.impl(), offset, 1));
     }
 
-    inline JSString* jsNontrivialString(JSGlobalData* globalData, const char* s)
-    {
-        ASSERT(s);
-        ASSERT(s[0]);
-        ASSERT(s[1]);
-        return JSString::create(*globalData, UString(s).impl());
-    }
-
-    inline JSString* jsNontrivialString(JSGlobalData* globalData, const UString& s)
+    inline JSString* jsNontrivialString(JSGlobalData* globalData, const String& s)
     {
         ASSERT(s.length() > 1);
         return JSString::create(*globalData, s.impl());
     }
 
-    inline const UString& JSString::value(ExecState* exec) const
+    inline const String& JSString::value(ExecState* exec) const
     {
         if (isRope())
             static_cast<const JSRopeString*>(this)->resolveRope(exec);
         return m_value;
     }
 
-    inline const UString& JSString::tryGetValue() const
+    inline const String& JSString::tryGetValue() const
     {
         if (isRope())
             static_cast<const JSRopeString*>(this)->resolveRope(0);
@@ -390,13 +380,13 @@ namespace JSC {
         return jsSingleCharacterSubstring(exec, m_value, i);
     }
 
-    inline JSString* jsString(JSGlobalData* globalData, const UString& s)
+    inline JSString* jsString(JSGlobalData* globalData, const String& s)
     {
         int size = s.length();
         if (!size)
             return globalData->smallStrings.emptyString(globalData);
         if (size == 1) {
-            UChar c = s[0];
+            UChar c = s.characterAt(0);
             if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
@@ -414,7 +404,7 @@ namespace JSC {
         return jsSubstring(globalData, s->value(exec), offset, length);
     }
 
-    inline JSString* jsSubstring8(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
+    inline JSString* jsSubstring8(JSGlobalData* globalData, const String& s, unsigned offset, unsigned length)
     {
         ASSERT(offset <= static_cast<unsigned>(s.length()));
         ASSERT(length <= static_cast<unsigned>(s.length()));
@@ -422,14 +412,14 @@ namespace JSC {
         if (!length)
             return globalData->smallStrings.emptyString(globalData);
         if (length == 1) {
-            UChar c = s[offset];
+            UChar c = s.characterAt(offset);
             if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return JSString::createHasOtherOwner(*globalData, StringImpl::create8(s.impl(), offset, length));
     }
 
-    inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
+    inline JSString* jsSubstring(JSGlobalData* globalData, const String& s, unsigned offset, unsigned length)
     {
         ASSERT(offset <= static_cast<unsigned>(s.length()));
         ASSERT(length <= static_cast<unsigned>(s.length()));
@@ -437,20 +427,20 @@ namespace JSC {
         if (!length)
             return globalData->smallStrings.emptyString(globalData);
         if (length == 1) {
-            UChar c = s[offset];
+            UChar c = s.characterAt(offset);
             if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
         return JSString::createHasOtherOwner(*globalData, StringImpl::create(s.impl(), offset, length));
     }
 
-    inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
+    inline JSString* jsOwnedString(JSGlobalData* globalData, const String& s)
     {
         int size = s.length();
         if (!size)
             return globalData->smallStrings.emptyString(globalData);
         if (size == 1) {
-            UChar c = s[0];
+            UChar c = s.characterAt(0);
             if (c <= maxSingleCharacterString)
                 return globalData->smallStrings.singleCharacterString(globalData, c);
         }
@@ -463,13 +453,12 @@ namespace JSC {
     }
 
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
-    inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
+    inline JSString* jsString(ExecState* exec, const String& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
-    inline JSString* jsSubstring8(ExecState* exec, const UString& s, unsigned offset, unsigned length) { return jsSubstring8(&exec->globalData(), s, offset, length); }
-    inline JSString* jsSubstring(ExecState* exec, const UString& s, unsigned offset, unsigned length) { return jsSubstring(&exec->globalData(), s, offset, length); }
-    inline JSString* jsNontrivialString(ExecState* exec, const UString& s) { return jsNontrivialString(&exec->globalData(), s); }
-    inline JSString* jsNontrivialString(ExecState* exec, const char* s) { return jsNontrivialString(&exec->globalData(), s); }
-    inline JSString* jsOwnedString(ExecState* exec, const UString& s) { return jsOwnedString(&exec->globalData(), s); } 
+    inline JSString* jsSubstring8(ExecState* exec, const String& s, unsigned offset, unsigned length) { return jsSubstring8(&exec->globalData(), s, offset, length); }
+    inline JSString* jsSubstring(ExecState* exec, const String& s, unsigned offset, unsigned length) { return jsSubstring(&exec->globalData(), s, offset, length); }
+    inline JSString* jsNontrivialString(ExecState* exec, const String& s) { return jsNontrivialString(&exec->globalData(), s); }
+    inline JSString* jsOwnedString(ExecState* exec, const String& s) { return jsOwnedString(&exec->globalData(), s); }
 
     ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
     {
@@ -527,14 +516,14 @@ namespace JSC {
         return toStringSlowCase(exec);
     }
 
-    inline UString JSValue::toUString(ExecState* exec) const
+    inline String JSValue::toWTFString(ExecState* exec) const
     {
         if (isString())
             return static_cast<JSString*>(asCell())->value(exec);
-        return toUStringSlowCase(exec);
+        return toWTFStringSlowCase(exec);
     }
 
-    ALWAYS_INLINE UString inlineJSValueNotStringtoUString(const JSValue& value, ExecState* exec)
+    ALWAYS_INLINE String inlineJSValueNotStringtoString(const JSValue& value, ExecState* exec)
     {
         JSGlobalData& globalData = exec->globalData();
         if (value.isInt32())
@@ -542,22 +531,22 @@ namespace JSC {
         if (value.isDouble())
             return globalData.numericStrings.add(value.asDouble());
         if (value.isTrue())
-            return globalData.propertyNames->trueKeyword.ustring();
+            return globalData.propertyNames->trueKeyword.string();
         if (value.isFalse())
-            return globalData.propertyNames->falseKeyword.ustring();
+            return globalData.propertyNames->falseKeyword.string();
         if (value.isNull())
-            return globalData.propertyNames->nullKeyword.ustring();
+            return globalData.propertyNames->nullKeyword.string();
         if (value.isUndefined())
-            return globalData.propertyNames->undefinedKeyword.ustring();
+            return globalData.propertyNames->undefinedKeyword.string();
         return value.toString(exec)->value(exec);
     }
 
-    ALWAYS_INLINE UString JSValue::toUStringInline(ExecState* exec) const
+    ALWAYS_INLINE String JSValue::toWTFStringInline(ExecState* exec) const
     {
         if (isString())
             return static_cast<JSString*>(asCell())->value(exec);
 
-        return inlineJSValueNotStringtoUString(*this, exec);
+        return inlineJSValueNotStringtoString(*this, exec);
     }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSStringBuilder.h b/Source/JavaScriptCore/runtime/JSStringBuilder.h
index 1a2b812f0..e7778e4fb 100644
--- a/Source/JavaScriptCore/runtime/JSStringBuilder.h
+++ b/Source/JavaScriptCore/runtime/JSStringBuilder.h
@@ -28,7 +28,6 @@
 
 #include "ExceptionHelpers.h"
 #include "JSString.h"
-#include "UStringConcatenate.h"
 #include <wtf/Vector.h>
 
 namespace JSC {
@@ -92,7 +91,7 @@ public:
         m_okay &= buffer16.tryAppend(str, len);
     }
 
-    void append(const UString& str)
+    void append(const String& str)
     {
         unsigned length = str.length();
 
@@ -129,12 +128,12 @@ public:
             buffer8.shrinkToFit();
             if (!buffer8.data())
                 return throwOutOfMemoryError(exec);
-            return jsString(exec, UString::adopt(buffer8));
+            return jsString(exec, String::adopt(buffer8));
         }
         buffer16.shrinkToFit();
         if (!buffer16.data())
             return throwOutOfMemoryError(exec);
-        return jsString(exec, UString::adopt(buffer16));
+        return jsString(exec, String::adopt(buffer16));
     }
 
 protected:
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.cpp b/Source/JavaScriptCore/runtime/JSStringJoiner.cpp
index ea260243b..cbf9ba48b 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.cpp
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.cpp
@@ -27,15 +27,15 @@
 #include "JSStringJoiner.h"
 
 #include "ExceptionHelpers.h"
+#include "JSScope.h"
 #include "JSString.h"
-#include "ScopeChain.h"
 #include <wtf/text/StringImpl.h>
 
 
 namespace JSC {
 
 // The destination is 16bits, at least one string is 16 bits.
-static inline void appendStringToData(UChar*& data, const UString& string)
+static inline void appendStringToData(UChar*& data, const String& string)
 {
     if (string.isNull())
         return;
@@ -57,7 +57,7 @@ static inline void appendStringToData(UChar*& data, const UString& string)
 }
 
 // If the destination is 8bits, we know every string has to be 8bit.
-static inline void appendStringToData(LChar*& data, const UString& string)
+static inline void appendStringToData(LChar*& data, const String& string)
 {
     if (string.isNull())
         return;
@@ -73,7 +73,7 @@ static inline void appendStringToData(LChar*& data, const UString& string)
 }
 
 template<typename CharacterType>
-static inline PassRefPtr<StringImpl> joinStrings(const Vector<UString>& strings, const UString& separator, unsigned outputLength)
+static inline PassRefPtr<StringImpl> joinStrings(const Vector<String>& strings, const String& separator, unsigned outputLength)
 {
     ASSERT(outputLength);
 
@@ -82,7 +82,7 @@ static inline PassRefPtr<StringImpl> joinStrings(const Vector<UString>& strings,
     if (!outputStringImpl)
         return PassRefPtr<StringImpl>();
 
-    const UString firstString = strings.first();
+    const String firstString = strings.first();
     appendStringToData(data, firstString);
 
     for (size_t i = 1; i < strings.size(); ++i) {
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.h b/Source/JavaScriptCore/runtime/JSStringJoiner.h
index 49f846c1f..5cb841a80 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.h
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.h
@@ -27,8 +27,8 @@
 #define JSStringJoiner_h
 
 #include "JSValue.h"
-#include "UString.h"
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -37,21 +37,21 @@ class ExecState;
 
 class JSStringJoiner {
 public:
-    JSStringJoiner(const UString& separator, size_t stringCount);
+    JSStringJoiner(const String& separator, size_t stringCount);
 
-    void append(const UString&);
+    void append(const String&);
     JSValue build(ExecState*);
 
 private:
-    UString m_separator;
-    Vector<UString> m_strings;
+    String m_separator;
+    Vector<String> m_strings;
 
     unsigned m_cumulatedStringsLength;
     bool m_isValid;
     bool m_is8Bits;
 };
 
-inline JSStringJoiner::JSStringJoiner(const UString& separator, size_t stringCount)
+inline JSStringJoiner::JSStringJoiner(const String& separator, size_t stringCount)
     : m_separator(separator)
     , m_cumulatedStringsLength(0)
     , m_isValid(true)
@@ -61,7 +61,7 @@ inline JSStringJoiner::JSStringJoiner(const UString& separator, size_t stringCou
     m_isValid = m_strings.tryReserveCapacity(stringCount);
 }
 
-inline void JSStringJoiner::append(const UString& str)
+inline void JSStringJoiner::append(const String& str)
 {
     if (!m_isValid)
         return;
diff --git a/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp b/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
index 927ad25cf..72caa33db 100644
--- a/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSSymbolTableObject.cpp
@@ -31,20 +31,26 @@
 
 #include "JSActivation.h"
 #include "JSGlobalObject.h"
-#include "JSStaticScopeObject.h"
+#include "JSNameScope.h"
 #include "PropertyNameArray.h"
 
 namespace JSC {
 
-void JSSymbolTableObject::destroy(JSCell* cell)
+void JSSymbolTableObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
-    static_cast<JSSymbolTableObject*>(cell)->JSSymbolTableObject::~JSSymbolTableObject();
+    JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_symbolTable);
 }
 
 bool JSSymbolTableObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
     JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(cell);
-    if (thisObject->symbolTable().contains(propertyName.publicName()))
+    if (thisObject->symbolTable()->contains(propertyName.publicName()))
         return false;
 
     return JSObject::deleteProperty(thisObject, exec, propertyName);
@@ -53,8 +59,8 @@ bool JSSymbolTableObject::deleteProperty(JSCell* cell, ExecState* exec, Property
 void JSSymbolTableObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     JSSymbolTableObject* thisObject = jsCast<JSSymbolTableObject*>(object);
-    SymbolTable::const_iterator end = thisObject->symbolTable().end();
-    for (SymbolTable::const_iterator it = thisObject->symbolTable().begin(); it != end; ++it) {
+    SymbolTable::const_iterator end = thisObject->symbolTable()->end();
+    for (SymbolTable::const_iterator it = thisObject->symbolTable()->begin(); it != end; ++it) {
         if (!(it->second.getAttributes() & DontEnum) || (mode == IncludeDontEnumProperties))
             propertyNames.add(Identifier(exec, it->first.get()));
     }
@@ -67,22 +73,4 @@ void JSSymbolTableObject::putDirectVirtual(JSObject*, ExecState*, PropertyName,
     ASSERT_NOT_REACHED();
 }
 
-bool JSSymbolTableObject::isDynamicScope(bool& requiresDynamicChecks) const
-{
-    switch (structure()->typeInfo().type()) {
-    case GlobalObjectType:
-        return static_cast<const JSGlobalObject*>(this)->isDynamicScope(requiresDynamicChecks);
-    case ActivationObjectType:
-        return static_cast<const JSActivation*>(this)->isDynamicScope(requiresDynamicChecks);
-    case StaticScopeObjectType:
-        return static_cast<const JSStaticScopeObject*>(this)->isDynamicScope(requiresDynamicChecks);
-    default:
-        ASSERT_NOT_REACHED();
-        break;
-    }
-
-    return false;
-}
-
 } // namespace JSC
-
diff --git a/Source/JavaScriptCore/runtime/JSSymbolTableObject.h b/Source/JavaScriptCore/runtime/JSSymbolTableObject.h
index 2bbe21d06..1913d018b 100644
--- a/Source/JavaScriptCore/runtime/JSSymbolTableObject.h
+++ b/Source/JavaScriptCore/runtime/JSSymbolTableObject.h
@@ -29,50 +29,49 @@
 #ifndef JSSymbolTableObject_h
 #define JSSymbolTableObject_h
 
-#include "JSObject.h"
+#include "JSScope.h"
 #include "PropertyDescriptor.h"
 #include "SymbolTable.h"
 
 namespace JSC {
 
-class JSSymbolTableObject : public JSNonFinalObject {
+class JSSymbolTableObject : public JSScope {
 public:
-    typedef JSNonFinalObject Base;
+    typedef JSScope Base;
     
-    SymbolTable& symbolTable() const { return *m_symbolTable; }
-    
-    JS_EXPORT_PRIVATE static void destroy(JSCell*);
+    SharedSymbolTable* symbolTable() const { return m_symbolTable.get(); }
     
     static NO_RETURN_DUE_TO_ASSERT void putDirectVirtual(JSObject*, ExecState*, PropertyName, JSValue, unsigned attributes);
     
     JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, PropertyName);
     JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
     
-    bool isDynamicScope(bool& requiresDynamicChecks) const;
-    
 protected:
-    static const unsigned StructureFlags = OverridesGetPropertyNames | JSNonFinalObject::StructureFlags;
+    static const unsigned StructureFlags = IsEnvironmentRecord | OverridesVisitChildren | OverridesGetPropertyNames | Base::StructureFlags;
     
-    JSSymbolTableObject(JSGlobalData& globalData, Structure* structure, SymbolTable* symbolTable)
-        : JSNonFinalObject(globalData, structure)
-        , m_symbolTable(symbolTable)
+    JSSymbolTableObject(JSGlobalData& globalData, Structure* structure, JSScope* scope)
+        : Base(globalData, structure, scope)
     {
     }
-    
-    void finishCreation(JSGlobalData& globalData)
+
+    void finishCreation(JSGlobalData& globalData, SharedSymbolTable* symbolTable = 0)
     {
         Base::finishCreation(globalData);
-        ASSERT(m_symbolTable);
+        if (!symbolTable)
+            symbolTable = SharedSymbolTable::create(globalData);
+        m_symbolTable.set(globalData, this, symbolTable);
     }
-    
-    SymbolTable* m_symbolTable;
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<SharedSymbolTable> m_symbolTable;
 };
 
 template<typename SymbolTableObjectType>
 inline bool symbolTableGet(
     SymbolTableObjectType* object, PropertyName propertyName, PropertySlot& slot)
 {
-    SymbolTable& symbolTable = object->symbolTable();
+    SymbolTable& symbolTable = *object->symbolTable();
     SymbolTable::iterator iter = symbolTable.find(propertyName.publicName());
     if (iter == symbolTable.end())
         return false;
@@ -86,7 +85,7 @@ template<typename SymbolTableObjectType>
 inline bool symbolTableGet(
     SymbolTableObjectType* object, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
-    SymbolTable& symbolTable = object->symbolTable();
+    SymbolTable& symbolTable = *object->symbolTable();
     SymbolTable::iterator iter = symbolTable.find(propertyName.publicName());
     if (iter == symbolTable.end())
         return false;
@@ -102,7 +101,7 @@ inline bool symbolTableGet(
     SymbolTableObjectType* object, PropertyName propertyName, PropertySlot& slot,
     bool& slotIsWriteable)
 {
-    SymbolTable& symbolTable = object->symbolTable();
+    SymbolTable& symbolTable = *object->symbolTable();
     SymbolTable::iterator iter = symbolTable.find(propertyName.publicName());
     if (iter == symbolTable.end())
         return false;
@@ -121,7 +120,7 @@ inline bool symbolTablePut(
     JSGlobalData& globalData = exec->globalData();
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(object));
     
-    SymbolTable& symbolTable = object->symbolTable();
+    SymbolTable& symbolTable = *object->symbolTable();
     SymbolTable::iterator iter = symbolTable.find(propertyName.publicName());
     if (iter == symbolTable.end())
         return false;
@@ -146,8 +145,8 @@ inline bool symbolTablePutWithAttributes(
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(object));
     
-    SymbolTable::iterator iter = object->symbolTable().find(propertyName.publicName());
-    if (iter == object->symbolTable().end())
+    SymbolTable::iterator iter = object->symbolTable()->find(propertyName.publicName());
+    if (iter == object->symbolTable()->end())
         return false;
     SymbolTableEntry& entry = iter->second;
     ASSERT(!entry.isNull());
diff --git a/Source/JavaScriptCore/runtime/JSType.h b/Source/JavaScriptCore/runtime/JSType.h
index c9603437b..b8ab330f5 100644
--- a/Source/JavaScriptCore/runtime/JSType.h
+++ b/Source/JavaScriptCore/runtime/JSType.h
@@ -49,10 +49,11 @@ enum JSType {
     NumberObjectType,
     ErrorInstanceType,
     GlobalThisType,
+    WithScopeType,
 
-    StaticScopeObjectType,
+    NameScopeObjectType,
     // VariableObjectType must be less than MOST of the types of its subclasses and only its subclasses.
-    // We use >=VariableObjectType checks to test for Global & Activation objects, but exclude StaticScopes.
+    // We use >=VariableObjectType checks to test for Global & Activation objects, but exclude NameScopes.
     VariableObjectType,
     GlobalObjectType,
     ActivationObjectType,
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index c34431178..caff9973b 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -143,7 +143,7 @@ void JSValue::putToPrimitive(ExecState* exec, PropertyName propertyName, JSValue
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
                     if (slot.isStrictMode())
-                        throwError(exec, createTypeError(exec, "setting a property that has only a getter"));
+                        throwError(exec, createTypeError(exec, ASCIILiteral("setting a property that has only a getter")));
                     return;
                 }
                 
@@ -283,9 +283,9 @@ JSString* JSValue::toStringSlowCase(ExecState* exec) const
     return value.toString(exec);
 }
 
-UString JSValue::toUStringSlowCase(ExecState* exec) const
+String JSValue::toWTFStringSlowCase(ExecState* exec) const
 {
-    return inlineJSValueNotStringtoUString(*this, exec);
+    return inlineJSValueNotStringtoString(*this, exec);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSValue.h b/Source/JavaScriptCore/runtime/JSValue.h
index 7aa5453e4..ce9405817 100644
--- a/Source/JavaScriptCore/runtime/JSValue.h
+++ b/Source/JavaScriptCore/runtime/JSValue.h
@@ -44,7 +44,6 @@ namespace JSC {
     class PropertyName;
     class PropertySlot;
     class PutPropertySlot;
-    class UString;
 #if ENABLE(DFG_JIT)
     namespace DFG {
         class AssemblyHelpers;
@@ -55,9 +54,11 @@ namespace JSC {
         class SpeculativeJIT;
     }
 #endif
+#if ENABLE(LLINT_C_LOOP)
     namespace LLInt {
-        class Data;
+        class CLoop;
     }
+#endif
 
     struct ClassInfo;
     struct Instruction;
@@ -121,7 +122,9 @@ namespace JSC {
         friend class DFG::OSRExitCompiler;
         friend class DFG::SpeculativeJIT;
 #endif
-        friend class LLInt::Data;
+#if ENABLE(LLINT_C_LOOP)
+        friend class LLInt::CLoop;
+#endif
 
     public:
 #if USE(JSVALUE32_64)
@@ -198,8 +201,8 @@ namespace JSC {
         bool inherits(const ClassInfo*) const;
         
         // Extracting the value.
-        bool getString(ExecState* exec, UString&) const;
-        UString getString(ExecState* exec) const; // null string if not a string
+        bool getString(ExecState*, WTF::String&) const;
+        WTF::String getString(ExecState*) const; // null string if not a string
         JSObject* getObject() const; // 0 if not an object
 
         // Extracting integer values.
@@ -215,8 +218,8 @@ namespace JSC {
         // been set in the ExecState already.
         double toNumber(ExecState*) const;
         JSString* toString(ExecState*) const;
-        UString toUString(ExecState*) const;
-        UString toUStringInline(ExecState*) const;
+        WTF::String toWTFString(ExecState*) const;
+        WTF::String toWTFStringInline(ExecState*) const;
         JSObject* toObject(ExecState*) const;
         JSObject* toObject(ExecState*, JSGlobalObject*) const;
 
@@ -267,7 +270,7 @@ namespace JSC {
         inline const JSValue asValue() const { return *this; }
         JS_EXPORT_PRIVATE double toNumberSlowCase(ExecState*) const;
         JS_EXPORT_PRIVATE JSString* toStringSlowCase(ExecState*) const;
-        JS_EXPORT_PRIVATE UString toUStringSlowCase(ExecState*) const;
+        JS_EXPORT_PRIVATE WTF::String toWTFStringSlowCase(ExecState*) const;
         JS_EXPORT_PRIVATE JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
         JS_EXPORT_PRIVATE JSObject* toThisObjectSlowCase(ExecState*) const;
 
@@ -292,6 +295,14 @@ namespace JSC {
          */
         uint32_t tag() const;
         int32_t payload() const;
+
+#if ENABLE(LLINT_C_LOOP)
+        // This should only be used by the LLInt C Loop interpreter who needs
+        // synthesize JSValue from its "register"s holding tag and payload
+        // values.
+        explicit JSValue(int32_t tag, int32_t payload);
+#endif
+
 #elif USE(JSVALUE64)
         /*
          * On 64-bit platforms USE(JSVALUE64) should be defined, and we use a NaN-encoded
diff --git a/Source/JavaScriptCore/runtime/JSValueInlineMethods.h b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
index 1373558f7..4c582ab2a 100644
--- a/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
+++ b/Source/JavaScriptCore/runtime/JSValueInlineMethods.h
@@ -307,6 +307,14 @@ namespace JSC {
         u.asBits.payload = i;
     }
 
+#if ENABLE(LLINT_C_LOOP)
+    inline JSValue::JSValue(int32_t tag, int32_t payload)
+    {
+        u.asBits.tag = tag;
+        u.asBits.payload = payload;
+    }
+#endif
+
     inline bool JSValue::isNumber() const
     {
         return isInt32() || isDouble();
@@ -323,7 +331,7 @@ namespace JSC {
         return payload();
     }
 
-#else // USE(JSVALUE32_64)
+#else // !USE(JSVALUE32_64) i.e. USE(JSVALUE64)
 
     // JSValue member functions.
     inline EncodedJSValue JSValue::encode(JSValue value)
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.cpp b/Source/JavaScriptCore/runtime/JSVariableObject.cpp
index 7210c9b90..c815dcd11 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.cpp
@@ -31,9 +31,4 @@
 
 namespace JSC {
 
-void JSVariableObject::destroy(JSCell* cell)
-{
-    static_cast<JSVariableObject*>(cell)->JSVariableObject::~JSVariableObject();
-}
-
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSVariableObject.h b/Source/JavaScriptCore/runtime/JSVariableObject.h
index 2f0dd42e5..c9f989e68 100644
--- a/Source/JavaScriptCore/runtime/JSVariableObject.h
+++ b/Source/JavaScriptCore/runtime/JSVariableObject.h
@@ -48,53 +48,34 @@ namespace JSC {
     public:
         typedef JSSymbolTableObject Base;
 
-        WriteBarrier<Unknown>& registerAt(int index) const { return m_registers[index]; }
+        WriteBarrierBase<Unknown>& registerAt(int index) const { return m_registers[index]; }
 
-        WriteBarrier<Unknown>* const * addressOfRegisters() const { return &m_registers; }
+        WriteBarrierBase<Unknown>* const * addressOfRegisters() const { return &m_registers; }
         static size_t offsetOfRegisters() { return OBJECT_OFFSETOF(JSVariableObject, m_registers); }
 
-        JS_EXPORT_PRIVATE static void destroy(JSCell*);
-
     protected:
-        static const unsigned StructureFlags = JSSymbolTableObject::StructureFlags;
-
-        JSVariableObject(JSGlobalData& globalData, Structure* structure, SymbolTable* symbolTable, Register* registers)
-            : JSSymbolTableObject(globalData, structure, symbolTable)
-            , m_registers(reinterpret_cast<WriteBarrier<Unknown>*>(registers))
+        static const unsigned StructureFlags = Base::StructureFlags;
+
+        JSVariableObject(
+            JSGlobalData& globalData,
+            Structure* structure,
+            Register* registers,
+            JSScope* scope
+        )
+            : Base(globalData, structure, scope)
+            , m_registers(reinterpret_cast<WriteBarrierBase<Unknown>*>(registers))
         {
         }
 
-        void finishCreation(JSGlobalData& globalData)
+        void finishCreation(JSGlobalData& globalData, SharedSymbolTable* symbolTable = 0)
         {
-            Base::finishCreation(globalData);
-            COMPILE_ASSERT(sizeof(WriteBarrier<Unknown>) == sizeof(Register), Register_should_be_same_size_as_WriteBarrier);
+            Base::finishCreation(globalData, symbolTable);
+            COMPILE_ASSERT(sizeof(WriteBarrierBase<Unknown>) == sizeof(Register), Register_should_be_same_size_as_WriteBarrierBase);
         }
 
-        PassOwnArrayPtr<WriteBarrier<Unknown> > copyRegisterArray(JSGlobalData&, WriteBarrier<Unknown>* src, size_t count, size_t callframeStarts);
-        void setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray);
-
-        WriteBarrier<Unknown>* m_registers; // "r" in the register file.
-        OwnArrayPtr<WriteBarrier<Unknown> > m_registerArray; // Independent copy of registers, used when a variable object copies its registers out of the register file.
+        WriteBarrierBase<Unknown>* m_registers; // "r" in the register file.
     };
 
-    inline PassOwnArrayPtr<WriteBarrier<Unknown> > JSVariableObject::copyRegisterArray(JSGlobalData& globalData, WriteBarrier<Unknown>* src, size_t count, size_t callframeStarts)
-    {
-        OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[count]);
-        for (size_t i = 0; i < callframeStarts; i++)
-            registerArray[i].set(globalData, this, src[i].get());
-        for (size_t i = callframeStarts + RegisterFile::CallFrameHeaderSize; i < count; i++)
-            registerArray[i].set(globalData, this, src[i].get());
-
-        return registerArray.release();
-    }
-
-    inline void JSVariableObject::setRegisters(WriteBarrier<Unknown>* registers, PassOwnArrayPtr<WriteBarrier<Unknown> > registerArray)
-    {
-        ASSERT(registerArray != m_registerArray);
-        m_registerArray = registerArray;
-        m_registers = registers;
-    }
-
 } // namespace JSC
 
 #endif // JSVariableObject_h
diff --git a/Source/JavaScriptCore/runtime/UStringBuilder.h b/Source/JavaScriptCore/runtime/JSWithScope.cpp
index 31ccf382a..0c4b6e2cc 100644
--- a/Source/JavaScriptCore/runtime/UStringBuilder.h
+++ b/Source/JavaScriptCore/runtime/JSWithScope.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,21 +23,24 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef UStringBuilder_h
-#define UStringBuilder_h
-
-#include <wtf/text/StringBuilder.h>
+#include "config.h"
+#include "JSWithScope.h"
 
 namespace JSC {
 
-class UStringBuilder : public StringBuilder {
-public:
-    using StringBuilder::append;
-    void append(const UString& str) { append(String(str.impl())); }
+ASSERT_CLASS_FITS_IN_CELL(JSWithScope);
 
-    UString toUString() { return toString().impl(); }
-};
+const ClassInfo JSWithScope::s_info = { "WithScope", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSWithScope) };
 
-} // namespace JSC
+void JSWithScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSWithScope* thisObject = jsCast<JSWithScope*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
 
-#endif // UStringBuilder_h
+    Base::visitChildren(thisObject, visitor);
+    visitor.append(&thisObject->m_object);
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSWithScope.h b/Source/JavaScriptCore/runtime/JSWithScope.h
new file mode 100644
index 000000000..ba2b793a9
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSWithScope.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWithScope_h
+#define JSWithScope_h
+
+#include "JSGlobalObject.h"
+
+namespace JSC {
+
+class JSWithScope : public JSScope {
+public:
+    typedef JSScope Base;
+
+    static JSWithScope* create(ExecState* exec, JSObject* object)
+    {
+        JSWithScope* withScope = new (NotNull, allocateCell<JSWithScope>(*exec->heap())) JSWithScope(exec, object);
+        withScope->finishCreation(exec->globalData());
+        return withScope;
+    }
+
+    static JSWithScope* create(ExecState* exec, JSObject* object, JSScope* next)
+    {
+        JSWithScope* withScope = new (NotNull, allocateCell<JSWithScope>(*exec->heap())) JSWithScope(exec, object, next);
+        withScope->finishCreation(exec->globalData());
+        return withScope;
+    }
+
+    JSObject* object() { return m_object.get(); }
+
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto)
+    {
+        return Structure::create(globalData, globalObject, proto, TypeInfo(WithScopeType, StructureFlags), &s_info);
+    }
+
+    static JS_EXPORTDATA const ClassInfo s_info;
+
+protected:
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+private:
+    JSWithScope(ExecState* exec, JSObject* object)
+        : Base(
+            exec->globalData(),
+            exec->lexicalGlobalObject()->withScopeStructure(),
+            exec->scope()
+        )
+        , m_object(exec->globalData(), this, object)
+    {
+    }
+
+    JSWithScope(ExecState* exec, JSObject* object, JSScope* next)
+        : Base(
+            exec->globalData(),
+            exec->lexicalGlobalObject()->withScopeStructure(),
+            next
+        )
+        , m_object(exec->globalData(), this, object)
+    {
+    }
+
+    WriteBarrier<JSObject> m_object;
+};
+
+} // namespace JSC
+
+#endif // JSWithScope_h
diff --git a/Source/JavaScriptCore/runtime/JSWrapperObject.cpp b/Source/JavaScriptCore/runtime/JSWrapperObject.cpp
index f8f5727d8..4a46c2c69 100644
--- a/Source/JavaScriptCore/runtime/JSWrapperObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSWrapperObject.cpp
@@ -33,9 +33,9 @@ void JSWrapperObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
     JSObject::visitChildren(thisObject, visitor);
-    if (thisObject->m_internalValue)
-        visitor.append(&thisObject->m_internalValue);
+    visitor.append(&thisObject->m_internalValue);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/LiteralParser.cpp b/Source/JavaScriptCore/runtime/LiteralParser.cpp
index e1f85cefe..30a478d48 100644
--- a/Source/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/Source/JavaScriptCore/runtime/LiteralParser.cpp
@@ -31,9 +31,9 @@
 #include "JSString.h"
 #include "Lexer.h"
 #include "StrongInlines.h"
-#include "UStringBuilder.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/dtoa.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace JSC {
 
@@ -269,7 +269,7 @@ template <ParserMode mode> TokenType LiteralParser<CharType>::Lexer::lex(Literal
             return lexIdentifier(token);
         if (*m_ptr == '\'') {
             if (mode == StrictJSON) {
-                m_lexErrorMessage = "Single quotes (\') are not allowed in JSON";
+                m_lexErrorMessage = ASCIILiteral("Single quotes (\') are not allowed in JSON");
                 return TokError;
             }
             return lexString<mode, '\''>(token);
@@ -344,7 +344,7 @@ template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType LiteralParse
 {
     ++m_ptr;
     const CharType* runStart = m_ptr;
-    UStringBuilder builder;
+    StringBuilder builder;
     do {
         runStart = m_ptr;
         while (m_ptr < m_end && isSafeStringCharacter<mode, CharType, terminator>(*m_ptr))
@@ -356,7 +356,7 @@ template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType LiteralParse
                 builder.append(runStart, m_ptr - runStart);
             ++m_ptr;
             if (m_ptr >= m_end) {
-                m_lexErrorMessage = "Unterminated string";
+                m_lexErrorMessage = ASCIILiteral("Unterminated string");
                 return TokError;
             }
             switch (*m_ptr) {
@@ -395,12 +395,12 @@ template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType LiteralParse
 
                 case 'u':
                     if ((m_end - m_ptr) < 5) { 
-                        m_lexErrorMessage = "\\u must be followed by 4 hex digits";
+                        m_lexErrorMessage = ASCIILiteral("\\u must be followed by 4 hex digits");
                         return TokError;
                     } // uNNNN == 5 characters
                     for (int i = 1; i < 5; i++) {
                         if (!isASCIIHexDigit(m_ptr[i])) {
-                            m_lexErrorMessage = String::format("\"\\%s\" is not a valid unicode escape", UString(m_ptr, 5).ascii().data()).impl();
+                            m_lexErrorMessage = String::format("\"\\%s\" is not a valid unicode escape", String(m_ptr, 5).ascii().data()).impl();
                             return TokError;
                         }
                     }
@@ -421,16 +421,16 @@ template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType LiteralParse
     } while ((mode != NonStrictJSON) && m_ptr != runStart && (m_ptr < m_end) && *m_ptr != terminator);
 
     if (m_ptr >= m_end || *m_ptr != terminator) {
-        m_lexErrorMessage = "Unterminated string";
+        m_lexErrorMessage = ASCIILiteral("Unterminated string");
         return TokError;
     }
 
     if (builder.isEmpty()) {
-        token.stringBuffer = UString();
+        token.stringBuffer = String();
         setParserTokenString<CharType>(token, runStart);
         token.stringLength = m_ptr - runStart;
     } else {
-        token.stringBuffer = builder.toUString();
+        token.stringBuffer = builder.toString();
         if (token.stringBuffer.is8Bit()) {
             token.stringIs8Bit = 1;
             token.stringToken8 = token.stringBuffer.characters8();
@@ -474,7 +474,7 @@ TokenType LiteralParser<CharType>::Lexer::lexNumber(LiteralParserToken<CharType>
         while (m_ptr < m_end && isASCIIDigit(*m_ptr))
             ++m_ptr;
     } else {
-        m_lexErrorMessage = "Invalid number";
+        m_lexErrorMessage = ASCIILiteral("Invalid number");
         return TokError;
     }
 
@@ -483,7 +483,7 @@ TokenType LiteralParser<CharType>::Lexer::lexNumber(LiteralParserToken<CharType>
         ++m_ptr;
         // [0-9]+
         if (m_ptr >= m_end || !isASCIIDigit(*m_ptr)) {
-            m_lexErrorMessage = "Invalid digits after decimal point";
+            m_lexErrorMessage = ASCIILiteral("Invalid digits after decimal point");
             return TokError;
         }
 
@@ -518,7 +518,7 @@ TokenType LiteralParser<CharType>::Lexer::lexNumber(LiteralParserToken<CharType>
 
         // [0-9]+
         if (m_ptr >= m_end || !isASCIIDigit(*m_ptr)) {
-            m_lexErrorMessage = "Exponent symbols should be followed by an optional '+' or '-' and then by at least one number";
+            m_lexErrorMessage = ASCIILiteral("Exponent symbols should be followed by an optional '+' or '-' and then by at least one number");
             return TokError;
         }
         
@@ -555,7 +555,7 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                 TokenType lastToken = m_lexer.currentToken().type;
                 if (m_lexer.next() == TokRBracket) {
                     if (lastToken == TokComma) {
-                        m_parseErrorMessage = "Unexpected comma at the end of array expression";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected comma at the end of array expression");
                         return JSValue();
                     }
                     m_lexer.next();
@@ -574,7 +574,7 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                     goto doParseArrayStartExpression;
 
                 if (m_lexer.currentToken().type != TokRBracket) {
-                    m_parseErrorMessage = "Expected ']'";
+                    m_parseErrorMessage = ASCIILiteral("Expected ']'");
                     return JSValue();
                 }
                 
@@ -594,7 +594,7 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
 
                     // Check for colon
                     if (m_lexer.next() != TokColon) {
-                        m_parseErrorMessage = "Expected ':' before value in object property definition";
+                        m_parseErrorMessage = ASCIILiteral("Expected ':' before value in object property definition");
                         return JSValue();
                     }
                     
@@ -607,7 +607,7 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                     goto startParseExpression;
                 }
                 if (type != TokRBrace)  {
-                    m_parseErrorMessage = "Expected '}'";
+                    m_parseErrorMessage = ASCIILiteral("Expected '}'");
                     return JSValue();
                 }
                 m_lexer.next();
@@ -619,14 +619,14 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
             case DoParseObjectStartExpression: {
                 TokenType type = m_lexer.next();
                 if (type != TokString && (m_mode == StrictJSON || type != TokIdentifier)) {
-                    m_parseErrorMessage = "Property name must be a string literal";
+                    m_parseErrorMessage = ASCIILiteral("Property name must be a string literal");
                     return JSValue();
                 }
                 LiteralParserToken<CharType> identifierToken = m_lexer.currentToken();
 
                 // Check for colon
                 if (m_lexer.next() != TokColon) {
-                    m_parseErrorMessage = "Expected ':'";
+                    m_parseErrorMessage = ASCIILiteral("Expected ':'");
                     return JSValue();
                 }
 
@@ -645,7 +645,7 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                 if (m_lexer.currentToken().type == TokComma)
                     goto doParseObjectStartExpression;
                 if (m_lexer.currentToken().type != TokRBrace) {
-                    m_parseErrorMessage = "Expected '}'";
+                    m_parseErrorMessage = ASCIILiteral("Expected '}'");
                     return JSValue();
                 }
                 m_lexer.next();
@@ -664,9 +664,9 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                         LiteralParserToken<CharType> stringToken = m_lexer.currentToken();
                         m_lexer.next();
                         if (stringToken.stringIs8Bit)
-                            lastValue = jsString(m_exec, makeIdentifier(stringToken.stringToken8, stringToken.stringLength).ustring());
+                            lastValue = jsString(m_exec, makeIdentifier(stringToken.stringToken8, stringToken.stringLength).string());
                         else
-                            lastValue = jsString(m_exec, makeIdentifier(stringToken.stringToken16, stringToken.stringLength).ustring());
+                            lastValue = jsString(m_exec, makeIdentifier(stringToken.stringToken16, stringToken.stringLength).string());
                         break;
                     }
                     case TokNumber: {
@@ -690,47 +690,47 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                         lastValue = jsBoolean(false);
                         break;
                     case TokRBracket:
-                        m_parseErrorMessage = "Unexpected token ']'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ']'");
                         return JSValue();
                     case TokRBrace:
-                        m_parseErrorMessage = "Unexpected token '}'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '}'");
                         return JSValue();
                     case TokIdentifier: {
                         const LiteralParserToken<CharType>& token = m_lexer.currentToken();
                         if (token.stringIs8Bit)
-                            m_parseErrorMessage = String::format("Unexpected identifier \"%s\"", UString(m_lexer.currentToken().stringToken8, m_lexer.currentToken().stringLength).ascii().data()).impl();
+                            m_parseErrorMessage = String::format("Unexpected identifier \"%s\"", String(m_lexer.currentToken().stringToken8, m_lexer.currentToken().stringLength).ascii().data()).impl();
                         else
-                            m_parseErrorMessage = String::format("Unexpected identifier \"%s\"", UString(m_lexer.currentToken().stringToken16, m_lexer.currentToken().stringLength).ascii().data()).impl();
+                            m_parseErrorMessage = String::format("Unexpected identifier \"%s\"", String(m_lexer.currentToken().stringToken16, m_lexer.currentToken().stringLength).ascii().data()).impl();
                         return JSValue();
                     }
                     case TokColon:
-                        m_parseErrorMessage = "Unexpected token ':'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ':'");
                         return JSValue();
                     case TokLParen:
-                        m_parseErrorMessage = "Unexpected token '('";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '('");
                         return JSValue();
                     case TokRParen:
-                        m_parseErrorMessage = "Unexpected token ')'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ')'");
                         return JSValue();
                     case TokComma:
-                        m_parseErrorMessage = "Unexpected token ','";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ','");
                         return JSValue();
                     case TokDot:
-                        m_parseErrorMessage = "Unexpected token '.'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '.'");
                         return JSValue();
                     case TokAssign:
-                        m_parseErrorMessage = "Unexpected token '='";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '='");
                         return JSValue();
                     case TokSemi:
-                        m_parseErrorMessage = "Unexpected token ';'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ';'");
                         return JSValue();
                     case TokEnd:
-                        m_parseErrorMessage = "Unexpected EOF";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected EOF");
                         return JSValue();
                     case TokError:
                     default:
                         // Error
-                        m_parseErrorMessage = "Could not parse value expression";
+                        m_parseErrorMessage = ASCIILiteral("Could not parse value expression");
                         return JSValue();
                 }
                 break;
@@ -748,50 +748,50 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                         goto startParseExpression;
                     }
                     case TokRBracket:
-                        m_parseErrorMessage = "Unexpected token ']'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ']'");
                         return JSValue();
                     case TokLBrace:
-                        m_parseErrorMessage = "Unexpected token '{'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '{'");
                         return JSValue();
                     case TokRBrace:
-                        m_parseErrorMessage = "Unexpected token '}'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '}'");
                         return JSValue();
                     case TokIdentifier:
-                        m_parseErrorMessage = "Unexpected identifier";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected identifier");
                         return JSValue();
                     case TokColon:
-                        m_parseErrorMessage = "Unexpected token ':'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ':'");
                         return JSValue();
                     case TokRParen:
-                        m_parseErrorMessage = "Unexpected token ')'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ')'");
                         return JSValue();
                     case TokComma:
-                        m_parseErrorMessage = "Unexpected token ','";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ','");
                         return JSValue();
                     case TokTrue:
-                        m_parseErrorMessage = "Unexpected token 'true'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token 'true'");
                         return JSValue();
                     case TokFalse:
-                        m_parseErrorMessage = "Unexpected token 'false'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token 'false'");
                         return JSValue();
                     case TokNull:
-                        m_parseErrorMessage = "Unexpected token 'null'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token 'null'");
                         return JSValue();
                     case TokEnd:
-                        m_parseErrorMessage = "Unexpected EOF";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected EOF");
                         return JSValue();
                     case TokDot:
-                        m_parseErrorMessage = "Unexpected token '.'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '.'");
                         return JSValue();
                     case TokAssign:
-                        m_parseErrorMessage = "Unexpected token '='";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token '='");
                         return JSValue();
                     case TokSemi:
-                        m_parseErrorMessage = "Unexpected token ';'";
+                        m_parseErrorMessage = ASCIILiteral("Unexpected token ';'");
                         return JSValue();
                     case TokError:
                     default:
-                        m_parseErrorMessage = "Could not parse statement";
+                        m_parseErrorMessage = ASCIILiteral("Could not parse statement");
                         return JSValue();
                 }
             }
@@ -801,7 +801,7 @@ JSValue LiteralParser<CharType>::parse(ParserState initialState)
                     return JSValue();
                 if (m_lexer.next() == TokEnd)
                     return lastValue;
-                m_parseErrorMessage = "Unexpected content at end of JSON literal";
+                m_parseErrorMessage = ASCIILiteral("Unexpected content at end of JSON literal");
                 return JSValue();
             }
             default:
diff --git a/Source/JavaScriptCore/runtime/LiteralParser.h b/Source/JavaScriptCore/runtime/LiteralParser.h
index abe3f95b7..c0f308ee5 100644
--- a/Source/JavaScriptCore/runtime/LiteralParser.h
+++ b/Source/JavaScriptCore/runtime/LiteralParser.h
@@ -29,7 +29,7 @@
 #include "Identifier.h"
 #include "JSGlobalObjectFunctions.h"
 #include "JSValue.h"
-#include "UString.h"
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -67,7 +67,7 @@ struct LiteralParserToken {
     TokenType type;
     const CharType* start;
     const CharType* end;
-    UString stringBuffer;
+    String stringBuffer;
     union {
         double numberToken;
         struct {
@@ -94,13 +94,13 @@ public:
     {
     }
     
-    UString getErrorMessage() 
+    String getErrorMessage()
     { 
         if (!m_lexer.getErrorMessage().isEmpty())
             return String::format("JSON Parse error: %s", m_lexer.getErrorMessage().ascii().data()).impl();
         if (!m_parseErrorMessage.isEmpty())
             return String::format("JSON Parse error: %s", m_parseErrorMessage.ascii().data()).impl();
-        return "JSON Parse error: Unable to parse JSON string";
+        return ASCIILiteral("JSON Parse error: Unable to parse JSON string");
     }
     
     JSValue tryLiteralParse()
@@ -133,10 +133,10 @@ private:
             return m_currentToken;
         }
         
-        UString getErrorMessage() { return m_lexErrorMessage; }
+        String getErrorMessage() { return m_lexErrorMessage; }
         
     private:
-        UString m_lexErrorMessage;
+        String m_lexErrorMessage;
         template <ParserMode mode> TokenType lex(LiteralParserToken<CharType>&);
         ALWAYS_INLINE TokenType lexIdentifier(LiteralParserToken<CharType>&);
         template <ParserMode mode, char terminator> ALWAYS_INLINE TokenType lexString(LiteralParserToken<CharType>&);
@@ -153,7 +153,7 @@ private:
     ExecState* m_exec;
     typename LiteralParser<CharType>::Lexer m_lexer;
     ParserMode m_mode;
-    UString m_parseErrorMessage;
+    String m_parseErrorMessage;
     static unsigned const MaximumCachableCharacter = 128;
     FixedArray<Identifier, MaximumCachableCharacter> m_shortIdentifiers;
     FixedArray<Identifier, MaximumCachableCharacter> m_recentIdentifiers;
diff --git a/Source/JavaScriptCore/runtime/MemoryStatistics.cpp b/Source/JavaScriptCore/runtime/MemoryStatistics.cpp
index 14b1c7d06..b35e9fbda 100644
--- a/Source/JavaScriptCore/runtime/MemoryStatistics.cpp
+++ b/Source/JavaScriptCore/runtime/MemoryStatistics.cpp
@@ -37,7 +37,7 @@ GlobalMemoryStatistics globalMemoryStatistics()
     GlobalMemoryStatistics stats;
 
     stats.stackBytes = RegisterFile::committedByteCount();
-#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED) || (PLATFORM(BLACKBERRY) && ENABLE(JIT))
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED) || ((PLATFORM(BLACKBERRY) || PLATFORM(EFL)) && ENABLE(JIT))
     stats.JITBytes = ExecutableAllocator::committedByteCount();
 #else
     stats.JITBytes = 0;
diff --git a/Source/JavaScriptCore/runtime/NameInstance.cpp b/Source/JavaScriptCore/runtime/NameInstance.cpp
index 410fe62e7..f257243e8 100644
--- a/Source/JavaScriptCore/runtime/NameInstance.cpp
+++ b/Source/JavaScriptCore/runtime/NameInstance.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "NameInstance.h"
 
+#include "JSScope.h"
+
 namespace JSC {
 
 const ClassInfo NameInstance::s_info = { "Name", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(NameInstance) };
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index b6aff916e..a4ba240fd 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -44,9 +44,9 @@ void NativeErrorConstructor::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
     InternalFunction::visitChildren(thisObject, visitor);
-    if (thisObject->m_errorStructure)
-        visitor.append(&thisObject->m_errorStructure);
+    visitor.append(&thisObject->m_errorStructure);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWithNativeErrorConstructor(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
index 76aea9da8..8db237028 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -34,7 +34,7 @@ namespace JSC {
     public:
         typedef InternalFunction Base;
 
-        static NativeErrorConstructor* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* prototypeStructure, const UString& name)
+        static NativeErrorConstructor* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, Structure* prototypeStructure, const String& name)
         {
             NativeErrorConstructor* constructor = new (NotNull, allocateCell<NativeErrorConstructor>(*exec->heap())) NativeErrorConstructor(globalObject, structure);
             constructor->finishCreation(exec, globalObject, prototypeStructure, name);
@@ -51,7 +51,7 @@ namespace JSC {
         Structure* errorStructure() { return m_errorStructure.get(); }
 
     protected:
-        void finishCreation(ExecState* exec, JSGlobalObject* globalObject, Structure* prototypeStructure, const UString& name)
+        void finishCreation(ExecState* exec, JSGlobalObject* globalObject, Structure* prototypeStructure, const String& name)
         {
             Base::finishCreation(exec->globalData(), name);
             ASSERT(inherits(&s_info));
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
index dfdd87f85..7fee213fa 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.cpp
@@ -24,7 +24,6 @@
 #include "JSGlobalObject.h"
 #include "JSString.h"
 #include "NativeErrorConstructor.h"
-#include "UString.h"
 
 namespace JSC {
 
@@ -35,7 +34,7 @@ NativeErrorPrototype::NativeErrorPrototype(ExecState* exec, Structure* structure
 {
 }
 
-void NativeErrorPrototype::finishCreation(ExecState* exec, JSGlobalObject* globalObject, const UString& nameAndMessage, NativeErrorConstructor* constructor)
+void NativeErrorPrototype::finishCreation(ExecState* exec, JSGlobalObject* globalObject, const WTF::String& nameAndMessage, NativeErrorConstructor* constructor)
 {
     Base::finishCreation(exec, globalObject);
     putDirect(exec->globalData(), exec->propertyNames().name, jsString(exec, nameAndMessage), DontEnum);
diff --git a/Source/JavaScriptCore/runtime/NativeErrorPrototype.h b/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
index 4bceb883a..c94f2b75a 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorPrototype.h
@@ -33,7 +33,7 @@ namespace JSC {
     public:
         typedef ErrorPrototype Base;
 
-        static NativeErrorPrototype* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const UString& name, NativeErrorConstructor* constructor)
+        static NativeErrorPrototype* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, const String& name, NativeErrorConstructor* constructor)
         {
             NativeErrorPrototype* prototype = new (NotNull, allocateCell<NativeErrorPrototype>(*exec->heap())) NativeErrorPrototype(exec, structure);
             prototype->finishCreation(exec, globalObject, name, constructor);
@@ -41,7 +41,7 @@ namespace JSC {
         }
 
     protected:
-        void finishCreation(ExecState*, JSGlobalObject*, const UString& nameAndMessage, NativeErrorConstructor*);
+        void finishCreation(ExecState*, JSGlobalObject*, const String& nameAndMessage, NativeErrorConstructor*);
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.cpp b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
index 1df7b6951..4a10efd6d 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -339,7 +339,7 @@ static char* toStringWithRadix(RadixBuffer& buffer, double number, unsigned radi
     return startOfResultString;
 }
 
-static UString toUStringWithRadix(int32_t number, unsigned radix)
+static String toStringWithRadix(int32_t number, unsigned radix)
 {
     LChar buf[1 + 32]; // Worst case is radix == 2, which gives us 32 digits + sign.
     LChar* end = buf + WTF_ARRAY_LENGTH(buf);
@@ -361,7 +361,7 @@ static UString toUStringWithRadix(int32_t number, unsigned radix)
     if (negative)
         *--p = '-';
 
-    return UString(p, static_cast<unsigned>(end - p));
+    return String(p, static_cast<unsigned>(end - p));
 }
 
 // toExponential converts a number to a string, always formatting as an expoential.
@@ -378,11 +378,11 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec)
     int decimalPlacesInExponent;
     bool isUndefined;
     if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlacesInExponent, isUndefined))
-        return throwVMError(exec, createRangeError(exec, "toExponential() argument must be between 0 and 20"));
+        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toExponential() argument must be between 0 and 20")));
 
     // Handle NaN and Infinity.
     if (!isfinite(x))
-        return JSValue::encode(jsString(exec, UString::number(x)));
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(x)));
 
     // Round if the argument is not undefined, always format as exponential.
     char buffer[WTF::NumberToStringBufferLength];
@@ -392,7 +392,7 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec)
     isUndefined
         ? converter.ToExponential(x, -1, &builder)
         : converter.ToExponential(x, decimalPlacesInExponent, &builder);
-    return JSValue::encode(jsString(exec, UString(builder.Finalize())));
+    return JSValue::encode(jsString(exec, String(builder.Finalize())));
 }
 
 // toFixed converts a number to a string, always formatting as an a decimal fraction.
@@ -409,20 +409,20 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec)
     int decimalPlaces;
     bool isUndefined; // This is ignored; undefined treated as 0.
     if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlaces, isUndefined))
-        return throwVMError(exec, createRangeError(exec, "toFixed() argument must be between 0 and 20"));
+        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toFixed() argument must be between 0 and 20")));
 
     // 15.7.4.5.7 states "If x >= 10^21, then let m = ToString(x)"
     // This also covers Ininity, and structure the check so that NaN
     // values are also handled by numberToString
     if (!(fabs(x) < 1e+21))
-        return JSValue::encode(jsString(exec, UString::number(x)));
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(x)));
 
     // The check above will return false for NaN or Infinity, these will be
     // handled by numberToString.
     ASSERT(isfinite(x));
 
     NumberToStringBuffer buffer;
-    return JSValue::encode(jsString(exec, UString(numberToFixedWidthString(x, decimalPlaces, buffer))));
+    return JSValue::encode(jsString(exec, String(numberToFixedWidthString(x, decimalPlaces, buffer))));
 }
 
 // toPrecision converts a number to a string, takeing an argument specifying a
@@ -442,18 +442,18 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec)
     int significantFigures;
     bool isUndefined;
     if (!getIntegerArgumentInRange(exec, 1, 21, significantFigures, isUndefined))
-        return throwVMError(exec, createRangeError(exec, "toPrecision() argument must be between 1 and 21"));
+        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toPrecision() argument must be between 1 and 21")));
 
     // To precision called with no argument is treated as ToString.
     if (isUndefined)
-        return JSValue::encode(jsString(exec, UString::number(x)));
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(x)));
 
     // Handle NaN and Infinity.
     if (!isfinite(x))
-        return JSValue::encode(jsString(exec, UString::number(x)));
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(x)));
 
     NumberToStringBuffer buffer;
-    return JSValue::encode(jsString(exec, UString(numberToFixedPrecisionString(x, significantFigures, buffer))));
+    return JSValue::encode(jsString(exec, String(numberToFixedPrecisionString(x, significantFigures, buffer))));
 }
 
 static inline int32_t extractRadixFromArgs(ExecState* exec)
@@ -485,7 +485,7 @@ static inline EncodedJSValue integerValueToString(ExecState* exec, int32_t radix
         return JSValue::encode(jsString(globalData, globalData->numericStrings.add(value)));
     }
 
-    return JSValue::encode(jsString(exec, toUStringWithRadix(value, radix)));
+    return JSValue::encode(jsString(exec, toStringWithRadix(value, radix)));
 
 }
 
@@ -497,7 +497,7 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec)
 
     int32_t radix = extractRadixFromArgs(exec);
     if (radix < 2 || radix > 36)
-        return throwVMError(exec, createRangeError(exec, "toString() radix argument must be between 2 and 36"));
+        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toString() radix argument must be between 2 and 36")));
 
     int32_t integerValue = static_cast<int32_t>(doubleValue);
     if (integerValue == doubleValue)
@@ -509,7 +509,7 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec)
     }
 
     if (!isfinite(doubleValue))
-        return JSValue::encode(jsString(exec, UString::number(doubleValue)));
+        return JSValue::encode(jsString(exec, String::numberToStringECMAScript(doubleValue)));
 
     RadixBuffer s;
     return JSValue::encode(jsString(exec, toStringWithRadix(s, doubleValue, radix)));
diff --git a/Source/JavaScriptCore/runtime/NumericStrings.h b/Source/JavaScriptCore/runtime/NumericStrings.h
index 7fa20c44d..4cd92fc1f 100644
--- a/Source/JavaScriptCore/runtime/NumericStrings.h
+++ b/Source/JavaScriptCore/runtime/NumericStrings.h
@@ -26,25 +26,25 @@
 #ifndef NumericStrings_h
 #define NumericStrings_h
 
-#include "UString.h"
 #include <wtf/FixedArray.h>
 #include <wtf/HashFunctions.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
     class NumericStrings {
     public:
-        ALWAYS_INLINE UString add(double d)
+        ALWAYS_INLINE String add(double d)
         {
             CacheEntry<double>& entry = lookup(d);
             if (d == entry.key && !entry.value.isNull())
                 return entry.value;
             entry.key = d;
-            entry.value = UString::number(d);
+            entry.value = String::numberToStringECMAScript(d);
             return entry.value;
         }
 
-        ALWAYS_INLINE UString add(int i)
+        ALWAYS_INLINE String add(int i)
         {
             if (static_cast<unsigned>(i) < cacheSize)
                 return lookupSmallString(static_cast<unsigned>(i));
@@ -52,11 +52,11 @@ namespace JSC {
             if (i == entry.key && !entry.value.isNull())
                 return entry.value;
             entry.key = i;
-            entry.value = UString::number(i);
+            entry.value = String::number(i);
             return entry.value;
         }
 
-        ALWAYS_INLINE UString add(unsigned i)
+        ALWAYS_INLINE String add(unsigned i)
         {
             if (i < cacheSize)
                 return lookupSmallString(static_cast<unsigned>(i));
@@ -64,7 +64,7 @@ namespace JSC {
             if (i == entry.key && !entry.value.isNull())
                 return entry.value;
             entry.key = i;
-            entry.value = UString::number(i);
+            entry.value = String::number(i);
             return entry.value;
         }
     private:
@@ -73,24 +73,24 @@ namespace JSC {
         template<typename T>
         struct CacheEntry {
             T key;
-            UString value;
+            String value;
         };
 
         CacheEntry<double>& lookup(double d) { return doubleCache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
         CacheEntry<int>& lookup(int i) { return intCache[WTF::IntHash<int>::hash(i) & (cacheSize - 1)]; }
         CacheEntry<unsigned>& lookup(unsigned i) { return unsignedCache[WTF::IntHash<unsigned>::hash(i) & (cacheSize - 1)]; }
-        ALWAYS_INLINE const UString& lookupSmallString(unsigned i)
+        ALWAYS_INLINE const String& lookupSmallString(unsigned i)
         {
             ASSERT(i < cacheSize);
             if (smallIntCache[i].isNull())
-                smallIntCache[i] = UString::number(i);
+                smallIntCache[i] = String::number(i);
             return smallIntCache[i];
         }
 
         FixedArray<CacheEntry<double>, cacheSize> doubleCache;
         FixedArray<CacheEntry<int>, cacheSize> intCache;
         FixedArray<CacheEntry<unsigned>, cacheSize> unsignedCache;
-        FixedArray<UString, cacheSize> smallIntCache;
+        FixedArray<String, cacheSize> smallIntCache;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 5a6fcddf0..ed0d0cfc7 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -84,7 +84,7 @@ ObjectConstructor::ObjectConstructor(JSGlobalObject* globalObject, Structure* st
 
 void ObjectConstructor::finishCreation(ExecState* exec, ObjectPrototype* objectPrototype)
 {
-    Base::finishCreation(exec->globalData(), Identifier(exec, "Object").ustring());
+    Base::finishCreation(exec->globalData(), Identifier(exec, "Object").string());
     // ECMA 15.2.3.1
     putDirectWithoutTransition(exec->globalData(), exec->propertyNames().prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
     // no. of arguments for constructor
@@ -137,7 +137,7 @@ CallType ObjectConstructor::getCallData(JSCell*, CallData& callData)
 EncodedJSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
-        return throwVMError(exec, createTypeError(exec, "Requested prototype of a value that is not an object."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Requested prototype of a value that is not an object.")));
     JSObject* object = asObject(exec->argument(0));
     if (!object->allowsAccessFrom(exec->trueCallerFrame()))
         return JSValue::encode(jsUndefined());
@@ -147,8 +147,8 @@ EncodedJSValue JSC_HOST_CALL objectConstructorGetPrototypeOf(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
-        return throwVMError(exec, createTypeError(exec, "Requested property descriptor of a value that is not an object."));
-    UString propertyName = exec->argument(1).toString(exec)->value(exec);
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Requested property descriptor of a value that is not an object.")));
+    String propertyName = exec->argument(1).toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
     JSObject* object = asObject(exec->argument(0));
@@ -179,13 +179,13 @@ EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState
 EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
-        return throwVMError(exec, createTypeError(exec, "Requested property names of a value that is not an object."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Requested property names of a value that is not an object.")));
     PropertyNameArray properties(exec);
     asObject(exec->argument(0))->methodTable()->getOwnPropertyNames(asObject(exec->argument(0)), exec, properties, IncludeDontEnumProperties);
     JSArray* names = constructEmptyArray(exec);
     size_t numProperties = properties.size();
     for (size_t i = 0; i < numProperties; i++)
-        names->push(exec, jsOwnedString(exec, properties[i].ustring()));
+        names->push(exec, jsOwnedString(exec, properties[i].string()));
     return JSValue::encode(names);
 }
 
@@ -193,13 +193,13 @@ EncodedJSValue JSC_HOST_CALL objectConstructorGetOwnPropertyNames(ExecState* exe
 EncodedJSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
-        return throwVMError(exec, createTypeError(exec, "Requested keys of a value that is not an object."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Requested keys of a value that is not an object.")));
     PropertyNameArray properties(exec);
     asObject(exec->argument(0))->methodTable()->getOwnPropertyNames(asObject(exec->argument(0)), exec, properties, ExcludeDontEnumProperties);
     JSArray* keys = constructEmptyArray(exec);
     size_t numProperties = properties.size();
     for (size_t i = 0; i < numProperties; i++)
-        keys->push(exec, jsOwnedString(exec, properties[i].ustring()));
+        keys->push(exec, jsOwnedString(exec, properties[i].string()));
     return JSValue::encode(keys);
 }
 
@@ -207,7 +207,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec)
 static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor& desc)
 {
     if (!in.isObject()) {
-        throwError(exec, createTypeError(exec, "Property description must be an object."));
+        throwError(exec, createTypeError(exec, ASCIILiteral("Property description must be an object.")));
         return false;
     }
     JSObject* description = asObject(in);
@@ -249,7 +249,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         if (!get.isUndefined()) {
             CallData callData;
             if (getCallData(get, callData) == CallTypeNone) {
-                throwError(exec, createTypeError(exec, "Getter must be a function."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Getter must be a function.")));
                 return false;
             }
         }
@@ -264,7 +264,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         if (!set.isUndefined()) {
             CallData callData;
             if (getCallData(set, callData) == CallTypeNone) {
-                throwError(exec, createTypeError(exec, "Setter must be a function."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Setter must be a function.")));
                 return false;
             }
         }
@@ -275,12 +275,12 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         return true;
 
     if (desc.value()) {
-        throwError(exec, createTypeError(exec, "Invalid property.  'value' present on property with getter or setter."));
+        throwError(exec, createTypeError(exec, ASCIILiteral("Invalid property.  'value' present on property with getter or setter.")));
         return false;
     }
 
     if (desc.writablePresent()) {
-        throwError(exec, createTypeError(exec, "Invalid property.  'writable' present on property with getter or setter."));
+        throwError(exec, createTypeError(exec, ASCIILiteral("Invalid property.  'writable' present on property with getter or setter.")));
         return false;
     }
     return true;
@@ -289,9 +289,9 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
 EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
-        return throwVMError(exec, createTypeError(exec, "Properties can only be defined on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Properties can only be defined on Objects.")));
     JSObject* O = asObject(exec->argument(0));
-    UString propertyName = exec->argument(1).toString(exec)->value(exec);
+    String propertyName = exec->argument(1).toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
     PropertyDescriptor descriptor;
@@ -340,20 +340,20 @@ static JSValue defineProperties(ExecState* exec, JSObject* object, JSObject* pro
 EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec)
 {
     if (!exec->argument(0).isObject())
-        return throwVMError(exec, createTypeError(exec, "Properties can only be defined on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Properties can only be defined on Objects.")));
     return JSValue::encode(defineProperties(exec, asObject(exec->argument(0)), exec->argument(1).toObject(exec)));
 }
 
 EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
 {
     if (!exec->argument(0).isObject() && !exec->argument(0).isNull())
-        return throwVMError(exec, createTypeError(exec, "Object prototype may only be an Object or null."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object prototype may only be an Object or null.")));
     JSValue proto = exec->argument(0);
     JSObject* newObject = proto.isObject() ? constructEmptyObject(exec, asObject(proto)->inheritorID(exec->globalData())) : constructEmptyObject(exec, exec->lexicalGlobalObject()->nullPrototypeObjectStructure());
     if (exec->argument(1).isUndefined())
         return JSValue::encode(newObject);
     if (!exec->argument(1).isObject())
-        return throwVMError(exec, createTypeError(exec, "Property descriptor list must be an Object."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Property descriptor list must be an Object.")));
     return JSValue::encode(defineProperties(exec, newObject, asObject(exec->argument(1))));
 }
 
@@ -362,7 +362,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorSeal(ExecState* exec)
     // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
-        return throwVMError(exec, createTypeError(exec, "Object.seal can only be called on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.seal can only be called on Objects.")));
     JSObject* object = asObject(obj);
 
     if (isJSFinalObject(object)) {
@@ -399,7 +399,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorFreeze(ExecState* exec)
     // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
-        return throwVMError(exec, createTypeError(exec, "Object.freeze can only be called on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.freeze can only be called on Objects.")));
     JSObject* object = asObject(obj);
 
     if (isJSFinalObject(object)) {
@@ -439,7 +439,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorPreventExtensions(ExecState* exec)
 {
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
-        return throwVMError(exec, createTypeError(exec, "Object.preventExtensions can only be called on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.preventExtensions can only be called on Objects.")));
     asObject(obj)->preventExtensions(exec->globalData());
     return JSValue::encode(obj);
 }
@@ -449,7 +449,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorIsSealed(ExecState* exec)
     // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
-        return throwVMError(exec, createTypeError(exec, "Object.isSealed can only be called on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.isSealed can only be called on Objects.")));
     JSObject* object = asObject(obj);
 
     if (isJSFinalObject(object))
@@ -479,7 +479,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorIsFrozen(ExecState* exec)
     // 1. If Type(O) is not Object throw a TypeError exception.
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
-        return throwVMError(exec, createTypeError(exec, "Object.isFrozen can only be called on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.isFrozen can only be called on Objects.")));
     JSObject* object = asObject(obj);
 
     if (isJSFinalObject(object))
@@ -509,7 +509,7 @@ EncodedJSValue JSC_HOST_CALL objectConstructorIsExtensible(ExecState* exec)
 {
     JSValue obj = exec->argument(0);
     if (!obj.isObject())
-        return throwVMError(exec, createTypeError(exec, "Object.isExtensible can only be called on Objects."));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Object.isExtensible can only be called on Objects.")));
     return JSValue::encode(jsBoolean(asObject(obj)->isExtensible()));
 }
 
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 6faa16848..800909385 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -157,7 +157,7 @@ EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec)
     JSValue get = exec->argument(1);
     CallData callData;
     if (getCallData(get, callData) == CallTypeNone)
-        return throwVMError(exec, createSyntaxError(exec, "invalid getter usage"));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("invalid getter usage")));
 
     PropertyDescriptor descriptor;
     descriptor.setGetter(get);
@@ -177,7 +177,7 @@ EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec)
     JSValue set = exec->argument(1);
     CallData callData;
     if (getCallData(set, callData) == CallTypeNone)
-        return throwVMError(exec, createSyntaxError(exec, "invalid setter usage"));
+        return throwVMError(exec, createTypeError(exec, ASCIILiteral("invalid setter usage")));
 
     PropertyDescriptor descriptor;
     descriptor.setSetter(set);
@@ -247,7 +247,7 @@ EncodedJSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull())
-        return JSValue::encode(jsNontrivialString(exec, thisValue.isUndefined() ? "[object Undefined]" : "[object Null]"));
+        return JSValue::encode(jsNontrivialString(exec, String(thisValue.isUndefined() ? ASCIILiteral("[object Undefined]") : ASCIILiteral("[object Null]"))));
     JSObject* thisObject = thisValue.toObject(exec);
 
     JSString* result = thisObject->structure()->objectToStringValue();
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index 88fffdac4..30ba0b27d 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -50,7 +50,7 @@ namespace JSC {
         return JSRopeString::create(globalData, s1, s2);
     }
 
-    ALWAYS_INLINE JSValue jsString(ExecState* exec, const UString& u1, const UString& u2, const UString& u3)
+    ALWAYS_INLINE JSValue jsString(ExecState* exec, const String& u1, const String& u2, const String& u3)
     {
         JSGlobalData* globalData = &exec->globalData();
 
@@ -221,7 +221,7 @@ namespace JSC {
             return v1.asNumber() < v2.asNumber();
 
         if (isJSString(v1) && isJSString(v2))
-            return asString(v1)->value(callFrame) < asString(v2)->value(callFrame);
+            return codePointCompareLessThan(asString(v1)->value(callFrame), asString(v2)->value(callFrame));
 
         double n1;
         double n2;
@@ -239,7 +239,7 @@ namespace JSC {
 
         if (wasNotString1 | wasNotString2)
             return n1 < n2;
-        return asString(p1)->value(callFrame) < asString(p2)->value(callFrame);
+        return codePointCompareLessThan(asString(p1)->value(callFrame), asString(p2)->value(callFrame));
     }
 
     // See ES5 11.8.3/11.8.4/11.8.5 for definition of leftFirst, this value ensures correct
@@ -255,7 +255,7 @@ namespace JSC {
             return v1.asNumber() <= v2.asNumber();
 
         if (isJSString(v1) && isJSString(v2))
-            return !(asString(v2)->value(callFrame) < asString(v1)->value(callFrame));
+            return !codePointCompareLessThan(asString(v2)->value(callFrame), asString(v1)->value(callFrame));
 
         double n1;
         double n2;
@@ -273,7 +273,7 @@ namespace JSC {
 
         if (wasNotString1 | wasNotString2)
             return n1 <= n2;
-        return !(asString(p2)->value(callFrame) < asString(p1)->value(callFrame));
+        return !codePointCompareLessThan(asString(p2)->value(callFrame), asString(p1)->value(callFrame));
     }
 
     // Fast-path choices here are based on frequency data from SunSpider:
@@ -347,33 +347,6 @@ namespace JSC {
         }
     }
 
-    ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain, bool isStrictPut)
-    {
-        ScopeChainIterator iter = scopeChain->begin();
-        ScopeChainIterator next = iter;
-        ++next;
-        ScopeChainIterator end = scopeChain->end();
-        ASSERT(iter != end);
-
-        PropertySlot slot;
-        JSObject* base;
-        while (true) {
-            base = iter->get();
-            if (next == end) {
-                if (isStrictPut && !base->getPropertySlot(callFrame, property, slot))
-                    return JSValue();
-                return base;
-            }
-            if (base->getPropertySlot(callFrame, property, slot))
-                return base;
-
-            iter = next;
-            ++next;
-        }
-
-        ASSERT_NOT_REACHED();
-        return JSValue();
-    }
 } // namespace JSC
 
 #endif // Operations_h
diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
index b5ce39c0d..16c0b5d43 100644
--- a/Source/JavaScriptCore/runtime/Options.cpp
+++ b/Source/JavaScriptCore/runtime/Options.cpp
@@ -138,6 +138,19 @@ void Options::initialize()
     ; // Deconfuse editors that do auto indentation
 #endif
     
+#if !ENABLE(JIT)
+    useJIT() = false;
+    useDFGJIT() = false;
+#endif
+#if !ENABLE(YARR_JIT)
+    useRegExpJIT() = false;
+#endif
+
+#if USE(CF) || OS(UNIX)
+    zombiesAreImmortal() = !!getenv("JSImmortalZombieEnabled");
+    useZombieMode() = zombiesAreImmortal() || !!getenv("JSZombieEnabled");
+#endif
+
     // Do range checks where needed and make corrections to the options:
     ASSERT(thresholdForOptimizeAfterLongWarmUp() >= thresholdForOptimizeAfterWarmUp());
     ASSERT(thresholdForOptimizeAfterWarmUp() >= thresholdForOptimizeSoon());
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index ab3f34bb6..5e53d1cf2 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -65,6 +65,7 @@ namespace JSC {
 #define JSC_OPTIONS(v) \
     v(bool, useJIT,    true) \
     v(bool, useDFGJIT, true) \
+    v(bool, useRegExpJIT, true) \
     \
     /* showDisassembly implies showDFGDisassembly. */ \
     v(bool, showDisassembly, false) \
@@ -117,7 +118,10 @@ namespace JSC {
     v(unsigned, opaqueRootMergeThreshold, 1000) \
     \
     v(bool, forceWeakRandomSeed, false) \
-    v(unsigned, forcedWeakRandomSeed, 0)
+    v(unsigned, forcedWeakRandomSeed, 0) \
+    \
+    v(bool, useZombieMode, false) \
+    v(bool, zombiesAreImmortal, false) 
 
 
 class Options {
diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
index 5953f5e87..2d0f27a3e 100644
--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -22,11 +22,11 @@
 #define PropertyMapHashTable_h
 
 #include "PropertyOffset.h"
-#include "UString.h"
 #include "WriteBarrier.h"
 #include <wtf/HashTable.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/text/StringImpl.h>
 
 
 #ifndef NDEBUG
@@ -44,7 +44,7 @@ extern int numRemoves;
 
 #endif
 
-#define PROPERTY_MAP_DELETED_ENTRY_KEY ((StringImpl*)1) 
+#define PROPERTY_MAP_DELETED_ENTRY_KEY ((StringImpl*)1)
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/PropertyNameArray.cpp b/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
index 9bae94097..08a5296a4 100644
--- a/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/Source/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -22,7 +22,7 @@
 #include "PropertyNameArray.h"
 
 #include "JSObject.h"
-#include "ScopeChain.h"
+
 #include "Structure.h"
 #include "StructureChain.h"
 
diff --git a/Source/JavaScriptCore/runtime/RegExp.cpp b/Source/JavaScriptCore/runtime/RegExp.cpp
index 64e553be1..7757274f1 100644
--- a/Source/JavaScriptCore/runtime/RegExp.cpp
+++ b/Source/JavaScriptCore/runtime/RegExp.cpp
@@ -40,7 +40,7 @@ namespace JSC {
 
 const ClassInfo RegExp::s_info = { "RegExp", 0, 0, 0, CREATE_METHOD_TABLE(RegExp) };
 
-RegExpFlags regExpFlags(const UString& string)
+RegExpFlags regExpFlags(const String& string)
 {
     RegExpFlags flags = NoFlags;
 
@@ -83,7 +83,7 @@ public:
 
     ~RegExpFunctionalTestCollector();
 
-    void outputOneTest(RegExp*, UString, int, int*, int);
+    void outputOneTest(RegExp*, String, int, int*, int);
     void clearRegExp(RegExp* regExp)
     {
         if (regExp == m_lastRegExp)
@@ -93,7 +93,7 @@ public:
 private:
     RegExpFunctionalTestCollector();
 
-    void outputEscapedUString(const UString&, bool escapeSlash = false);
+    void outputEscapedString(const String&, bool escapeSlash = false);
 
     static RegExpFunctionalTestCollector* s_instance;
     FILE* m_file;
@@ -111,12 +111,12 @@ RegExpFunctionalTestCollector* RegExpFunctionalTestCollector::get()
     return s_instance;
 }
 
-void RegExpFunctionalTestCollector::outputOneTest(RegExp* regExp, UString s, int startOffset, int* ovector, int result)
+void RegExpFunctionalTestCollector::outputOneTest(RegExp* regExp, String s, int startOffset, int* ovector, int result)
 {
     if ((!m_lastRegExp) || (m_lastRegExp != regExp)) {
         m_lastRegExp = regExp;
         fputc('/', m_file);
-        outputEscapedUString(regExp->pattern(), true);
+        outputEscapedString(regExp->pattern(), true);
         fputc('/', m_file);
         if (regExp->global())
             fputc('g', m_file);
@@ -128,7 +128,7 @@ void RegExpFunctionalTestCollector::outputOneTest(RegExp* regExp, UString s, int
     }
 
     fprintf(m_file, " \"");
-    outputEscapedUString(s);
+    outputEscapedString(s);
     fprintf(m_file, "\", %d, %d, (", startOffset, result);
     for (unsigned i = 0; i <= regExp->numSubpatterns(); i++) {
         int subpatternBegin = ovector[i * 2];
@@ -159,7 +159,7 @@ RegExpFunctionalTestCollector::~RegExpFunctionalTestCollector()
     s_instance = 0;
 }
 
-void RegExpFunctionalTestCollector::outputEscapedUString(const UString& s, bool escapeSlash)
+void RegExpFunctionalTestCollector::outputEscapedString(const String& s, bool escapeSlash)
 {
     int len = s.length();
     
@@ -217,7 +217,7 @@ void RegExpFunctionalTestCollector::outputEscapedUString(const UString& s, bool
 }
 #endif
 
-RegExp::RegExp(JSGlobalData& globalData, const UString& patternString, RegExpFlags flags)
+RegExp::RegExp(JSGlobalData& globalData, const String& patternString, RegExpFlags flags)
     : JSCell(globalData, globalData.regExpStructure.get())
     , m_state(NotCompiled)
     , m_patternString(patternString)
@@ -250,14 +250,14 @@ void RegExp::destroy(JSCell* cell)
     thisObject->RegExp::~RegExp();
 }
 
-RegExp* RegExp::createWithoutCaching(JSGlobalData& globalData, const UString& patternString, RegExpFlags flags)
+RegExp* RegExp::createWithoutCaching(JSGlobalData& globalData, const String& patternString, RegExpFlags flags)
 {
     RegExp* regExp = new (NotNull, allocateCell<RegExp>(globalData.heap)) RegExp(globalData, patternString, flags);
     regExp->finishCreation(globalData);
     return regExp;
 }
 
-RegExp* RegExp::create(JSGlobalData& globalData, const UString& patternString, RegExpFlags flags)
+RegExp* RegExp::create(JSGlobalData& globalData, const String& patternString, RegExpFlags flags)
 {
     return globalData.regExpCache()->lookupOrCreate(patternString, flags);
 }
@@ -318,7 +318,7 @@ void RegExp::compileIfNecessary(JSGlobalData& globalData, Yarr::YarrCharSize cha
     compile(&globalData, charSize);
 }
 
-int RegExp::match(JSGlobalData& globalData, const UString& s, unsigned startOffset, Vector<int, 32>& ovector)
+int RegExp::match(JSGlobalData& globalData, const String& s, unsigned startOffset, Vector<int, 32>& ovector)
 {
 #if ENABLE(REGEXP_TRACING)
     m_rtMatchCallCount++;
@@ -440,7 +440,7 @@ void RegExp::compileIfNecessaryMatchOnly(JSGlobalData& globalData, Yarr::YarrCha
     compileMatchOnly(&globalData, charSize);
 }
 
-MatchResult RegExp::match(JSGlobalData& globalData, const UString& s, unsigned startOffset)
+MatchResult RegExp::match(JSGlobalData& globalData, const String& s, unsigned startOffset)
 {
 #if ENABLE(REGEXP_TRACING)
     m_rtMatchCallCount++;
@@ -494,7 +494,7 @@ void RegExp::invalidateCode()
 }
 
 #if ENABLE(YARR_JIT_DEBUG)
-void RegExp::matchCompareWithInterpreter(const UString& s, int startOffset, int* offsetVector, int jitResult)
+void RegExp::matchCompareWithInterpreter(const String& s, int startOffset, int* offsetVector, int jitResult)
 {
     int offsetVectorSize = (m_numSubpatterns + 1) * 2;
     Vector<int, 32> interpreterOvector;
diff --git a/Source/JavaScriptCore/runtime/RegExp.h b/Source/JavaScriptCore/runtime/RegExp.h
index ad1020376..287444b95 100644
--- a/Source/JavaScriptCore/runtime/RegExp.h
+++ b/Source/JavaScriptCore/runtime/RegExp.h
@@ -26,10 +26,10 @@
 #include "MatchResult.h"
 #include "RegExpKey.h"
 #include "Structure.h"
-#include "UString.h"
 #include "yarr/Yarr.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
 
 #if ENABLE(YARR_JIT)
 #include "yarr/YarrJIT.h"
@@ -40,26 +40,26 @@ namespace JSC {
     struct RegExpRepresentation;
     class JSGlobalData;
 
-    JS_EXPORT_PRIVATE RegExpFlags regExpFlags(const UString&);
+    JS_EXPORT_PRIVATE RegExpFlags regExpFlags(const String&);
 
     class RegExp : public JSCell {
     public:
         typedef JSCell Base;
 
-        JS_EXPORT_PRIVATE static RegExp* create(JSGlobalData&, const UString& pattern, RegExpFlags);
+        JS_EXPORT_PRIVATE static RegExp* create(JSGlobalData&, const String& pattern, RegExpFlags);
         static void destroy(JSCell*);
 
         bool global() const { return m_flags & FlagGlobal; }
         bool ignoreCase() const { return m_flags & FlagIgnoreCase; }
         bool multiline() const { return m_flags & FlagMultiline; }
 
-        const UString& pattern() const { return m_patternString; }
+        const String& pattern() const { return m_patternString; }
 
         bool isValid() const { return !m_constructionError && m_flags != InvalidFlags; }
         const char* errorMessage() const { return m_constructionError; }
 
-        JS_EXPORT_PRIVATE int match(JSGlobalData&, const UString&, unsigned startOffset, Vector<int, 32>& ovector);
-        MatchResult match(JSGlobalData&, const UString&, unsigned startOffset);
+        JS_EXPORT_PRIVATE int match(JSGlobalData&, const String&, unsigned startOffset, Vector<int, 32>& ovector);
+        MatchResult match(JSGlobalData&, const String&, unsigned startOffset);
         unsigned numSubpatterns() const { return m_numSubpatterns; }
 
         bool hasCode()
@@ -87,9 +87,9 @@ namespace JSC {
 
     private:
         friend class RegExpCache;
-        RegExp(JSGlobalData&, const UString&, RegExpFlags);
+        RegExp(JSGlobalData&, const String&, RegExpFlags);
 
-        static RegExp* createWithoutCaching(JSGlobalData&, const UString&, RegExpFlags);
+        static RegExp* createWithoutCaching(JSGlobalData&, const String&, RegExpFlags);
 
         enum RegExpState {
             ParseError,
@@ -105,10 +105,10 @@ namespace JSC {
         void compileIfNecessaryMatchOnly(JSGlobalData&, Yarr::YarrCharSize);
 
 #if ENABLE(YARR_JIT_DEBUG)
-        void matchCompareWithInterpreter(const UString&, int startOffset, int* offsetVector, int jitResult);
+        void matchCompareWithInterpreter(const String&, int startOffset, int* offsetVector, int jitResult);
 #endif
 
-        UString m_patternString;
+        String m_patternString;
         RegExpFlags m_flags;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.cpp b/Source/JavaScriptCore/runtime/RegExpCache.cpp
index 53a13a4b5..c67dab8e6 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpCache.cpp
@@ -33,7 +33,7 @@
 
 namespace JSC {
 
-RegExp* RegExpCache::lookupOrCreate(const UString& patternString, RegExpFlags flags)
+RegExp* RegExpCache::lookupOrCreate(const String& patternString, RegExpFlags flags)
 {
     RegExpKey key(flags, patternString);
     if (RegExp* regExp = m_weakCache.get(key))
@@ -63,7 +63,7 @@ void RegExpCache::finalize(Handle<Unknown> handle, void*)
 
 void RegExpCache::addToStrongCache(RegExp* regExp)
 {
-    UString pattern = regExp->pattern();
+    String pattern = regExp->pattern();
     if (pattern.length() > maxStrongCacheablePatternLength)
         return;
     m_strongCache[m_nextEntryInStrongCache].set(*m_globalData, regExp);
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.h b/Source/JavaScriptCore/runtime/RegExpCache.h
index 4f3ea1536..c6a4a0aa2 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.h
+++ b/Source/JavaScriptCore/runtime/RegExpCache.h
@@ -28,7 +28,6 @@
 #include "RegExp.h"
 #include "RegExpKey.h"
 #include "Strong.h"
-#include "UString.h"
 #include "Weak.h"
 #include <wtf/FixedArray.h>
 #include <wtf/HashMap.h>
@@ -54,7 +53,7 @@ private:
 
     virtual void finalize(Handle<Unknown>, void* context);
 
-    RegExp* lookupOrCreate(const UString& patternString, RegExpFlags);
+    RegExp* lookupOrCreate(const WTF::String& patternString, RegExpFlags);
     void addToStrongCache(RegExp*);
     RegExpCacheMap m_weakCache; // Holds all regular expressions currently live.
     int m_nextEntryInStrongCache;
diff --git a/Source/JavaScriptCore/runtime/RegExpCachedResult.cpp b/Source/JavaScriptCore/runtime/RegExpCachedResult.cpp
index 07881451a..47cff15f1 100644
--- a/Source/JavaScriptCore/runtime/RegExpCachedResult.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpCachedResult.cpp
@@ -32,13 +32,10 @@ namespace JSC {
 
 void RegExpCachedResult::visitChildren(SlotVisitor& visitor)
 {
-    if (m_result) {
-        visitor.append(&m_lastInput);
-        visitor.append(&m_lastRegExp);
-    } else {
-        visitor.append(&m_reifiedInput);
-        visitor.append(&m_reifiedResult);
-    }
+    visitor.append(&m_lastInput);
+    visitor.append(&m_lastRegExp);
+    visitor.append(&m_reifiedInput);
+    visitor.append(&m_reifiedResult);
 }
 
 RegExpMatchesArray* RegExpCachedResult::lastResult(ExecState* exec, JSObject* owner)
diff --git a/Source/JavaScriptCore/runtime/RegExpCachedResult.h b/Source/JavaScriptCore/runtime/RegExpCachedResult.h
index a72244025..812ff4336 100644
--- a/Source/JavaScriptCore/runtime/RegExpCachedResult.h
+++ b/Source/JavaScriptCore/runtime/RegExpCachedResult.h
@@ -49,8 +49,6 @@ namespace JSC {
         {
             m_lastInput.set(globalData, owner, jsEmptyString(&globalData));
             m_lastRegExp.set(globalData, owner, emptyRegExp);
-            m_reifiedResult.clear();
-            m_reifiedInput.clear();
         }
 
         ALWAYS_INLINE void record(JSGlobalData& globalData, JSObject* owner, RegExp* regExp, JSString* input, MatchResult result)
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index 0b463474f..b8c4cd0b3 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -92,7 +92,7 @@ RegExpConstructor::RegExpConstructor(JSGlobalObject* globalObject, Structure* st
 
 void RegExpConstructor::finishCreation(ExecState* exec, RegExpPrototype* regExpPrototype)
 {
-    Base::finishCreation(exec->globalData(), Identifier(exec, "RegExp").ustring());
+    Base::finishCreation(exec->globalData(), Identifier(exec, "RegExp").string());
     ASSERT(inherits(&s_info));
 
     // ECMA 15.10.5.1 RegExp.prototype
@@ -262,7 +262,7 @@ JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const A
 
     if (arg0.inherits(&RegExpObject::s_info)) {
         if (!arg1.isUndefined())
-            return throwError(exec, createTypeError(exec, "Cannot supply flags when constructing one RegExp from another."));
+            return throwError(exec, createTypeError(exec, ASCIILiteral("Cannot supply flags when constructing one RegExp from another.")));
         // If called as a function, this just returns the first argument (see 15.10.3.1).
         if (callAsConstructor) {
             RegExp* regExp = static_cast<RegExpObject*>(asObject(arg0))->regExp();
@@ -271,7 +271,7 @@ JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const A
         return asObject(arg0);
     }
 
-    UString pattern = arg0.isUndefined() ? UString("") : arg0.toString(exec)->value(exec);
+    String pattern = arg0.isUndefined() ? String("") : arg0.toString(exec)->value(exec);
     if (exec->hadException())
         return 0;
 
@@ -281,7 +281,7 @@ JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const A
         if (exec->hadException())
             return 0;
         if (flags == InvalidFlags)
-            return throwError(exec, createSyntaxError(exec, "Invalid flags supplied to RegExp constructor."));
+            return throwError(exec, createSyntaxError(exec, ASCIILiteral("Invalid flags supplied to RegExp constructor.")));
     }
 
     RegExp* regExp = RegExp::create(exec->globalData(), pattern, flags);
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.h b/Source/JavaScriptCore/runtime/RegExpConstructor.h
index d714f2167..2cb1c1204 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.h
@@ -55,8 +55,8 @@ namespace JSC {
 
         static const ClassInfo s_info;
 
-        MatchResult performMatch(JSGlobalData&, RegExp*, JSString*, const UString&, int startOffset, int** ovector);
-        MatchResult performMatch(JSGlobalData&, RegExp*, JSString*, const UString&, int startOffset);
+        MatchResult performMatch(JSGlobalData&, RegExp*, JSString*, const String&, int startOffset, int** ovector);
+        MatchResult performMatch(JSGlobalData&, RegExp*, JSString*, const String&, int startOffset);
 
         void setMultiline(bool multiline) { m_multiline = multiline; }
         bool multiline() const { return m_multiline; }
@@ -101,7 +101,7 @@ namespace JSC {
       expression matching through the performMatch function. We use cached results to calculate, 
       e.g., RegExp.lastMatch and RegExp.leftParen.
     */
-    ALWAYS_INLINE MatchResult RegExpConstructor::performMatch(JSGlobalData& globalData, RegExp* regExp, JSString* string, const UString& input, int startOffset, int** ovector)
+    ALWAYS_INLINE MatchResult RegExpConstructor::performMatch(JSGlobalData& globalData, RegExp* regExp, JSString* string, const String& input, int startOffset, int** ovector)
     {
         int position = regExp->match(globalData, input, startOffset, m_ovector);
 
@@ -120,7 +120,7 @@ namespace JSC {
 
         return MatchResult(position, end);
     }
-    ALWAYS_INLINE MatchResult RegExpConstructor::performMatch(JSGlobalData& globalData, RegExp* regExp, JSString* string, const UString& input, int startOffset)
+    ALWAYS_INLINE MatchResult RegExpConstructor::performMatch(JSGlobalData& globalData, RegExp* regExp, JSString* string, const String& input, int startOffset)
     {
         MatchResult result = regExp->match(globalData, input, startOffset);
         if (result)
diff --git a/Source/JavaScriptCore/runtime/RegExpKey.h b/Source/JavaScriptCore/runtime/RegExpKey.h
index cdaff27f5..f93fbbc1d 100644
--- a/Source/JavaScriptCore/runtime/RegExpKey.h
+++ b/Source/JavaScriptCore/runtime/RegExpKey.h
@@ -28,8 +28,8 @@
 #ifndef RegExpKey_h
 #define RegExpKey_h
 
-#include "UString.h"
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -56,7 +56,7 @@ struct RegExpKey {
     {
     }
 
-    RegExpKey(RegExpFlags flags, const UString& pattern)
+    RegExpKey(RegExpFlags flags, const String& pattern)
         : flagsValue(flags)
         , pattern(pattern.impl())
     {
diff --git a/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp b/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp
index 80f1068f2..b2c3027b5 100644
--- a/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp
@@ -66,9 +66,9 @@ void RegExpMatchesArray::reifyAllProperties(ExecState* exec)
         for (unsigned i = 1; i <= numSubpatterns; ++i) {
             int start = subpatternResults[2 * i];
             if (start >= 0)
-                putDirectIndex(exec, i, jsSubstring(exec, m_input.get(), start, subpatternResults[2 * i + 1] - start), false);
+                putDirectIndex(exec, i, jsSubstring(exec, m_input.get(), start, subpatternResults[2 * i + 1] - start));
             else
-                putDirectIndex(exec, i, jsUndefined(), false);
+                putDirectIndex(exec, i, jsUndefined());
         }
     }
 
@@ -83,7 +83,7 @@ void RegExpMatchesArray::reifyMatchProperty(ExecState* exec)
 {
     ASSERT(m_state == ReifiedNone);
     ASSERT(m_result);
-    putDirectIndex(exec, 0, jsSubstring(exec, m_input.get(), m_result.start, m_result.end - m_result.start), false);
+    putDirectIndex(exec, 0, jsSubstring(exec, m_input.get(), m_result.start, m_result.end - m_result.start));
     m_state = ReifiedMatch;
 }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 8aeeb9edc..b346c7769 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -31,9 +31,8 @@
 #include "RegExpConstructor.h"
 #include "RegExpMatchesArray.h"
 #include "RegExpPrototype.h"
-#include "UStringBuilder.h"
-#include "UStringConcatenate.h"
 #include <wtf/PassOwnPtr.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace JSC {
 
@@ -81,11 +80,10 @@ void RegExpObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
     Base::visitChildren(thisObject, visitor);
-    if (thisObject->m_regExp)
-        visitor.append(&thisObject->m_regExp);
-    if (UNLIKELY(!thisObject->m_lastIndex.get().isInt32()))
-        visitor.append(&thisObject->m_lastIndex);
+    visitor.append(&thisObject->m_regExp);
+    visitor.append(&thisObject->m_lastIndex);
 }
 
 bool RegExpObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
@@ -132,7 +130,7 @@ void RegExpObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyN
 static bool reject(ExecState* exec, bool throwException, const char* message)
 {
     if (throwException)
-        throwTypeError(exec, message);
+        throwTypeError(exec, ASCIILiteral(message));
     return false;
 }
 
@@ -180,7 +178,7 @@ JSValue regExpObjectMultiline(ExecState*, JSValue slotBase, PropertyName)
 
 JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
 {
-    UString pattern = asRegExpObject(slotBase)->regExp()->pattern();
+    String pattern = asRegExpObject(slotBase)->regExp()->pattern();
     unsigned length = pattern.length();
     const UChar* characters = pattern.characters();
     bool previousCharacterWasBackslash = false;
@@ -193,7 +191,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
     // source cannot ever validly be "". If the source is empty, return a different Pattern
     // that would match the same thing.
     if (!length)
-        return jsString(exec, "(?:)");
+        return jsNontrivialString(exec, ASCIILiteral("(?:)"));
 
     // early return for strings that don't contain a forwards slash and LineTerminator
     for (unsigned i = 0; i < length; ++i) {
@@ -228,7 +226,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
 
     previousCharacterWasBackslash = false;
     inBrackets = false;
-    UStringBuilder result;
+    StringBuilder result;
     for (unsigned i = 0; i < length; ++i) {
         UChar ch = characters[i];
         if (!previousCharacterWasBackslash) {
@@ -253,9 +251,9 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
             else if (ch == '\r')
                 result.append('r');
             else if (ch == 0x2028)
-                result.append("u2028");
+                result.appendLiteral("u2028");
             else
-                result.append("u2029");
+                result.appendLiteral("u2029");
         } else
             result.append(ch);
 
@@ -265,7 +263,7 @@ JSValue regExpObjectSource(ExecState* exec, JSValue slotBase, PropertyName)
             previousCharacterWasBackslash = ch == '\\';
     }
 
-    return jsString(exec, result.toUString());
+    return jsString(exec, result.toString());
 }
 
 void RegExpObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
@@ -289,7 +287,7 @@ MatchResult RegExpObject::match(ExecState* exec, JSString* string)
 {
     RegExp* regExp = this->regExp();
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
-    UString input = string->value(exec);
+    String input = string->value(exec);
     JSGlobalData& globalData = exec->globalData();
     if (!regExp->global())
         return regExpConstructor->performMatch(globalData, regExp, string, input, 0);
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index 24c7c8027..3c742a0d3 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -34,7 +34,6 @@
 #include "RegExp.h"
 #include "RegExpCache.h"
 #include "StringRecursionChecker.h"
-#include "UStringConcatenate.h"
 
 namespace JSC {
 
@@ -107,10 +106,10 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
     
     if (arg0.inherits(&RegExpObject::s_info)) {
         if (!arg1.isUndefined())
-            return throwVMError(exec, createTypeError(exec, "Cannot supply flags when constructing one RegExp from another."));
+            return throwVMError(exec, createTypeError(exec, ASCIILiteral("Cannot supply flags when constructing one RegExp from another.")));
         regExp = asRegExpObject(arg0)->regExp();
     } else {
-        UString pattern = !exec->argumentCount() ? UString("") : arg0.toString(exec)->value(exec);
+        String pattern = !exec->argumentCount() ? String("") : arg0.toString(exec)->value(exec);
         if (exec->hadException())
             return JSValue::encode(jsUndefined());
 
@@ -120,7 +119,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
             if (exec->hadException())
                 return JSValue::encode(jsUndefined());
             if (flags == InvalidFlags)
-                return throwVMError(exec, createSyntaxError(exec, "Invalid flags supplied to RegExp constructor."));
+                return throwVMError(exec, createSyntaxError(exec, ASCIILiteral("Invalid flags supplied to RegExp constructor.")));
         }
         regExp = RegExp::create(exec->globalData(), pattern, flags);
     }
@@ -153,7 +152,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
         postfix[index++] = 'i';
     if (thisObject->get(exec, exec->propertyNames().multiline).toBoolean(exec))
         postfix[index] = 'm';
-    UString source = thisObject->get(exec, exec->propertyNames().source).toString(exec)->value(exec);
+    String source = thisObject->get(exec, exec->propertyNames().source).toString(exec)->value(exec);
     // If source is empty, use "/(?:)/" to avoid colliding with comment syntax
     return JSValue::encode(jsMakeNontrivialString(exec, "/", source, postfix));
 }
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.cpp b/Source/JavaScriptCore/runtime/ScopeChain.cpp
deleted file mode 100644
index e7ea07508..000000000
--- a/Source/JavaScriptCore/runtime/ScopeChain.cpp
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- *  Copyright (C) 2003, 2006, 2008 Apple Inc.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "ScopeChain.h"
-
-#include "JSActivation.h"
-#include "JSGlobalObject.h"
-#include "JSObject.h"
-#include "PropertyNameArray.h"
-#include <stdio.h>
-
-namespace JSC {
-
-ASSERT_HAS_TRIVIAL_DESTRUCTOR(ScopeChainNode);
-
-#ifndef NDEBUG
-
-void ScopeChainNode::print()
-{
-    ScopeChainIterator scopeEnd = end();
-    for (ScopeChainIterator scopeIter = begin(); scopeIter != scopeEnd; ++scopeIter) {
-        JSObject* o = scopeIter->get();
-        PropertyNameArray propertyNames(globalObject->globalExec());
-        o->methodTable()->getPropertyNames(o, globalObject->globalExec(), propertyNames, ExcludeDontEnumProperties);
-        PropertyNameArray::const_iterator propEnd = propertyNames.end();
-
-        dataLog("----- [scope %p] -----\n", o);
-        for (PropertyNameArray::const_iterator propIter = propertyNames.begin(); propIter != propEnd; propIter++) {
-            Identifier name = *propIter;
-            dataLog("%s, ", name.ustring().utf8().data());
-        }
-        dataLog("\n");
-    }
-}
-
-#endif
-
-const ClassInfo ScopeChainNode::s_info = { "ScopeChainNode", 0, 0, 0, CREATE_METHOD_TABLE(ScopeChainNode) };
-
-int ScopeChainNode::localDepth()
-{
-    int scopeDepth = 0;
-    ScopeChainIterator iter = this->begin();
-    ScopeChainIterator end = this->end();
-    while (!(*iter)->inherits(&JSActivation::s_info)) {
-        ++iter;
-        if (iter == end)
-            break;
-        ++scopeDepth;
-    }
-    return scopeDepth;
-}
-
-void ScopeChainNode::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
-    ScopeChainNode* thisObject = jsCast<ScopeChainNode*>(cell);
-    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
-    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
-    ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-    if (thisObject->next)
-        visitor.append(&thisObject->next);
-    visitor.append(&thisObject->object);
-    visitor.append(&thisObject->globalObject);
-    visitor.append(&thisObject->globalThis);
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ScopeChain.h b/Source/JavaScriptCore/runtime/ScopeChain.h
deleted file mode 100644
index c382008f1..000000000
--- a/Source/JavaScriptCore/runtime/ScopeChain.h
+++ /dev/null
@@ -1,172 +0,0 @@
-/*
- *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef ScopeChain_h
-#define ScopeChain_h
-
-#include "JSCell.h"
-#include "Structure.h"
-#include <wtf/FastAllocBase.h>
-
-namespace JSC {
-
-    class JSGlobalData;
-    class JSGlobalObject;
-    class JSObject;
-    class LLIntOffsetsExtractor;
-    class ScopeChainIterator;
-    class SlotVisitor;
-    
-    class ScopeChainNode : public JSCell {
-    private:
-        ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
-            : JSCell(*globalData, globalData->scopeChainNodeStructure.get())
-            , globalData(globalData)
-            , next(*globalData, this, next, WriteBarrier<ScopeChainNode>::MayBeNull)
-            , object(*globalData, this, object)
-            , globalObject(*globalData, this, globalObject)
-            , globalThis(*globalData, this, globalThis)
-        {
-        }
-
-    protected:
-        void finishCreation(JSGlobalData* globalData, JSGlobalObject* globalObject)
-        {
-            Base::finishCreation(*globalData);
-            ASSERT_UNUSED(globalObject, globalObject);
-        }
-
-    public:
-        typedef JSCell Base;
-
-        static ScopeChainNode* create(ExecState* exec, ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
-        {
-            ScopeChainNode* node = new (NotNull, allocateCell<ScopeChainNode>(*exec->heap())) ScopeChainNode(next, object, globalData, globalObject, globalThis);
-            node->finishCreation(globalData, globalObject);
-            return node;
-        }
-        static ScopeChainNode* create(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSGlobalObject* globalObject, JSObject* globalThis)
-        {
-            ScopeChainNode* node = new (NotNull, allocateCell<ScopeChainNode>(globalData->heap)) ScopeChainNode(next, object, globalData, globalObject, globalThis);
-            node->finishCreation(globalData, globalObject);
-            return node;
-        }
-        
-        JSGlobalData* globalData;
-        WriteBarrier<ScopeChainNode> next;
-        WriteBarrier<JSObject> object;
-        WriteBarrier<JSGlobalObject> globalObject;
-        WriteBarrier<JSObject> globalThis;
-
-        ScopeChainNode* push(JSObject*);
-        ScopeChainNode* pop();
-
-        ScopeChainIterator begin();
-        ScopeChainIterator end();
-
-        int localDepth();
-
-#ifndef NDEBUG        
-        void print();
-#endif
-        
-        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(globalData, globalObject, proto, TypeInfo(CompoundType, StructureFlags), &s_info); }
-        static void visitChildren(JSCell*, SlotVisitor&);
-        static JS_EXPORTDATA const ClassInfo s_info;
-
-    private:
-        friend class LLIntOffsetsExtractor;
-        
-        static const unsigned StructureFlags = OverridesVisitChildren;
-    };
-
-    inline ScopeChainNode* ScopeChainNode::push(JSObject* o)
-    {
-        ASSERT(o);
-        return ScopeChainNode::create(this, o, globalData, globalObject.get(), globalThis.get());
-    }
-
-    inline ScopeChainNode* ScopeChainNode::pop()
-    {
-        ASSERT(next);
-        return next.get();
-    }
-
-    class ScopeChainIterator {
-    public:
-        ScopeChainIterator(ScopeChainNode* node)
-            : m_node(node)
-        {
-        }
-
-        WriteBarrier<JSObject> const & operator*() const { return m_node->object; }
-        WriteBarrier<JSObject> const * operator->() const { return &(operator*()); }
-    
-        ScopeChainIterator& operator++() { m_node = m_node->next.get(); return *this; }
-
-        // postfix ++ intentionally omitted
-
-        bool operator==(const ScopeChainIterator& other) const { return m_node == other.m_node; }
-        bool operator!=(const ScopeChainIterator& other) const { return m_node != other.m_node; }
-
-    private:
-        ScopeChainNode* m_node;
-    };
-
-    inline ScopeChainIterator ScopeChainNode::begin()
-    {
-        return ScopeChainIterator(this); 
-    }
-
-    inline ScopeChainIterator ScopeChainNode::end()
-    { 
-        return ScopeChainIterator(0); 
-    }
-
-    ALWAYS_INLINE JSGlobalData& ExecState::globalData() const
-    {
-        ASSERT(scopeChain()->globalData);
-        return *scopeChain()->globalData;
-    }
-
-    ALWAYS_INLINE JSGlobalObject* ExecState::lexicalGlobalObject() const
-    {
-        return scopeChain()->globalObject.get();
-    }
-    
-    ALWAYS_INLINE JSObject* ExecState::globalThisValue() const
-    {
-        return scopeChain()->globalThis.get();
-    }
-    
-    ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
-    {
-        return static_cast<ScopeChainNode*>(jsValue().asCell());
-    }
-    
-    ALWAYS_INLINE Register& Register::operator=(ScopeChainNode* scopeChain)
-    {
-        *this = JSValue(scopeChain);
-        return *this;
-    }
-
-} // namespace JSC
-
-#endif // ScopeChain_h
diff --git a/Source/JavaScriptCore/runtime/ScopeChainMark.h b/Source/JavaScriptCore/runtime/ScopeChainMark.h
deleted file mode 100644
index 35701f11d..000000000
--- a/Source/JavaScriptCore/runtime/ScopeChainMark.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- *  Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef ScopeChainMark_h
-#define ScopeChainMark_h
-
-#include "ScopeChain.h"
-
-namespace JSC {
-
-} // namespace JSC
-
-#endif // ScopeChainMark_h
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.cpp b/Source/JavaScriptCore/runtime/SmallStrings.cpp
index f50f73d27..56a359279 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/Source/JavaScriptCore/runtime/SmallStrings.cpp
@@ -31,6 +31,7 @@
 #include "JSString.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/text/StringImpl.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/SmallStrings.h b/Source/JavaScriptCore/runtime/SmallStrings.h
index e609c5092..5bc9d2252 100644
--- a/Source/JavaScriptCore/runtime/SmallStrings.h
+++ b/Source/JavaScriptCore/runtime/SmallStrings.h
@@ -26,8 +26,8 @@
 #ifndef SmallStrings_h
 #define SmallStrings_h
 
-#include "UString.h"
 #include <wtf/FixedArray.h>
+#include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 
 #define JSC_COMMON_STRINGS_EACH_NAME(macro) \
@@ -41,6 +41,10 @@
     macro(string) \
     macro(true)
 
+namespace WTF {
+class StringImpl;
+}
+
 namespace JSC {
 
     class HeapRootVisitor;
@@ -71,7 +75,7 @@ namespace JSC {
             return m_singleCharacterStrings[character];
         }
 
-        JS_EXPORT_PRIVATE StringImpl* singleCharacterStringRep(unsigned char character);
+        JS_EXPORT_PRIVATE WTF::StringImpl* singleCharacterStringRep(unsigned char character);
 
         void finalizeSmallStrings();
 
diff --git a/Source/JavaScriptCore/runtime/StorageBarrier.h b/Source/JavaScriptCore/runtime/StorageBarrier.h
index 2a0c842ba..1fae82091 100644
--- a/Source/JavaScriptCore/runtime/StorageBarrier.h
+++ b/Source/JavaScriptCore/runtime/StorageBarrier.h
@@ -66,6 +66,8 @@ public:
     
     ConstPropertyStorage get() const { return m_storage; }
     PropertyStorage get() { return m_storage; }
+
+    bool operator!() { return !m_storage; }
     
 private:
     PropertyStorage m_storage;
diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
index 8b47a5d70..b1f28c8aa 100644
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "StrictEvalActivation.h"
 
+#include "JSGlobalObject.h"
+
 namespace JSC {
 
 ASSERT_HAS_TRIVIAL_DESTRUCTOR(StrictEvalActivation);
@@ -33,7 +35,11 @@ ASSERT_HAS_TRIVIAL_DESTRUCTOR(StrictEvalActivation);
 const ClassInfo StrictEvalActivation::s_info = { "Object", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(StrictEvalActivation) };
 
 StrictEvalActivation::StrictEvalActivation(ExecState* exec)
-    : JSNonFinalObject(exec->globalData(), exec->globalData().strictEvalActivationStructure.get())
+    : Base(
+        exec->globalData(),
+        exec->lexicalGlobalObject()->strictEvalActivationStructure(),
+        exec->scope()
+    )
 {
 }
 
diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.h b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
index d73eedf5a..9f64feb15 100644
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.h
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
@@ -26,13 +26,13 @@
 #ifndef StrictEvalActivation_h
 #define StrictEvalActivation_h
 
-#include "JSObject.h"
+#include "JSScope.h"
 
 namespace JSC {
 
-class StrictEvalActivation : public JSNonFinalObject {
+class StrictEvalActivation : public JSScope {
 public:
-    typedef JSNonFinalObject Base;
+    typedef JSScope Base;
 
     static StrictEvalActivation* create(ExecState* exec)
     {
@@ -52,7 +52,7 @@ public:
     static const ClassInfo s_info;
 
 protected:
-    static const unsigned StructureFlags = IsEnvironmentRecord | JSNonFinalObject::StructureFlags;
+    static const unsigned StructureFlags = IsEnvironmentRecord | Base::StructureFlags;
 
 private:
     StrictEvalActivation(ExecState*);
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index 3c037bcd1..113dee165 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -85,27 +85,27 @@ bool StringObject::defineOwnProperty(JSObject* object, ExecState* exec, Property
     if (propertyName == exec->propertyNames().length) {
         if (!object->isExtensible()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to define property on object that is not extensible."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to define property on object that is not extensible.")));
             return false;
         }
         if (descriptor.configurablePresent() && descriptor.configurable()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to configurable attribute of unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to configurable attribute of unconfigurable property.")));
             return false;
         }
         if (descriptor.enumerablePresent() && descriptor.enumerable()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change enumerable attribute of unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property.")));
             return false;
         }
         if (descriptor.isAccessorDescriptor()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change access mechanism for an unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change access mechanism for an unconfigurable property.")));
             return false;
         }
         if (descriptor.writablePresent() && descriptor.writable()) {
             if (throwException)
-                throwError(exec, createTypeError(exec, "Attempting to change writable attribute of unconfigurable property."));
+                throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change writable attribute of unconfigurable property.")));
             return false;
         }
         if (!descriptor.value())
@@ -113,7 +113,7 @@ bool StringObject::defineOwnProperty(JSObject* object, ExecState* exec, Property
         if (propertyName == exec->propertyNames().length && sameValue(exec, descriptor.value(), jsNumber(thisObject->internalValue()->length())))
             return true;
         if (throwException)
-            throwError(exec, createTypeError(exec, "Attempting to change value of a readonly property."));
+            throwError(exec, createTypeError(exec, ASCIILiteral("Attempting to change value of a readonly property.")));
         return false;
     }
 
@@ -138,7 +138,7 @@ void StringObject::getOwnPropertyNames(JSObject* object, ExecState* exec, Proper
     StringObject* thisObject = jsCast<StringObject*>(object);
     int size = thisObject->internalValue()->length();
     for (int i = 0; i < size; ++i)
-        propertyNames.add(Identifier(exec, UString::number(i)));
+        propertyNames.add(Identifier(exec, String::number(i)));
     if (mode == IncludeDontEnumProperties)
         propertyNames.add(exec->propertyNames().length);
     return JSObject::getOwnPropertyNames(thisObject, exec, propertyNames, mode);
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 001e5e8b0..73633a60b 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -162,7 +162,7 @@ bool StringPrototype::getOwnPropertyDescriptor(JSObject* object, ExecState* exec
 // Helper for producing a JSString for 'string', where 'string' was been produced by
 // calling ToString on 'originalValue'. In cases where 'originalValue' already was a
 // string primitive we can just use this, otherwise we need to allocate a new JSString.
-static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const UString& string)
+static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue, const String& string)
 {
     if (originalValue.isString()) {
         ASSERT(asString(originalValue)->value(exec) == string);
@@ -172,7 +172,7 @@ static inline JSString* jsStringWithReuse(ExecState* exec, JSValue originalValue
 }
 
 template <typename CharType>
-static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacement, const UString& source, const int* ovector, RegExp* reg, size_t i)
+static NEVER_INLINE String substituteBackreferencesSlow(const String& replacement, const String& source, const int* ovector, RegExp* reg, size_t i)
 {
     Vector<CharType> substitutedReplacement;
     int offset = 0;
@@ -184,7 +184,7 @@ static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacem
         if (ref == '$') {
             // "$$" -> "$"
             ++i;
-            substitutedReplacement.append(replacement.getCharacters<CharType>() + offset, i - offset);
+            substitutedReplacement.append(replacement.getCharactersWithUpconvert<CharType>() + offset, i - offset);
             offset = i + 1;
             continue;
         }
@@ -224,21 +224,21 @@ static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacem
             continue;
 
         if (i - offset)
-            substitutedReplacement.append(replacement.getCharacters<CharType>() + offset, i - offset);
+            substitutedReplacement.append(replacement.getCharactersWithUpconvert<CharType>() + offset, i - offset);
         i += 1 + advance;
         offset = i + 1;
         if (backrefStart >= 0)
-            substitutedReplacement.append(source.getCharacters<CharType>() + backrefStart, backrefLength);
+            substitutedReplacement.append(source.getCharactersWithUpconvert<CharType>() + backrefStart, backrefLength);
     } while ((i = replacement.find('$', i + 1)) != notFound);
 
     if (replacement.length() - offset)
-        substitutedReplacement.append(replacement.getCharacters<CharType>() + offset, replacement.length() - offset);
+        substitutedReplacement.append(replacement.getCharactersWithUpconvert<CharType>() + offset, replacement.length() - offset);
 
     substitutedReplacement.shrinkToFit();
-    return UString::adopt(substitutedReplacement);
+    return String::adopt(substitutedReplacement);
 }
 
-static inline UString substituteBackreferences(const UString& replacement, const UString& source, const int* ovector, RegExp* reg)
+static inline String substituteBackreferences(const String& replacement, const String& source, const int* ovector, RegExp* reg)
 {
     size_t i = replacement.find('$');
     if (UNLIKELY(i != notFound)) {
@@ -249,7 +249,7 @@ static inline UString substituteBackreferences(const UString& replacement, const
     return replacement;
 }
 
-static inline int localeCompare(const UString& a, const UString& b)
+static inline int localeCompare(const String& a, const String& b)
 {
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.characters()), a.length(), reinterpret_cast<const ::UChar*>(b.characters()), b.length());
 }
@@ -270,7 +270,7 @@ public:
     int length;
 };
 
-static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount)
+static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount)
 {
     if (rangeCount == 1) {
         int sourceSize = source.length();
@@ -278,7 +278,7 @@ static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourc
         int length = substringRanges[0].length;
         if (position <= 0 && length >= sourceSize)
             return sourceVal;
-        // We could call UString::substr, but this would result in redundant checks
+        // We could call String::substringSharingImpl(), but this would result in redundant checks.
         return jsString(exec, StringImpl::create(source.impl(), max(0, position), min(sourceSize, length)));
     }
 
@@ -287,7 +287,7 @@ static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourc
         totalLength += substringRanges[i].length;
 
     if (!totalLength)
-        return jsString(exec, "");
+        return jsEmptyString(exec);
 
     if (source.is8Bit()) {
         LChar* buffer;
@@ -325,7 +325,7 @@ static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourc
     return jsString(exec, impl.release());
 }
 
-static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const UString& source, const StringRange* substringRanges, int rangeCount, const UString* separators, int separatorCount)
+static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount, const String* separators, int separatorCount)
 {
     if (rangeCount == 1 && separatorCount == 0) {
         int sourceSize = source.length();
@@ -333,7 +333,7 @@ static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, J
         int length = substringRanges[0].length;
         if (position <= 0 && length >= sourceSize)
             return sourceVal;
-        // We could call UString::substr, but this would result in redundant checks
+        // We could call String::substringSharingImpl(), but this would result in redundant checks.
         return jsString(exec, StringImpl::create(source.impl(), max(0, position), min(sourceSize, length)));
     }
 
@@ -348,7 +348,7 @@ static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, J
     }
 
     if (!totalLength)
-        return jsString(exec, "");
+        return jsEmptyString(exec);
 
     if (source.is8Bit() && allSeperators8Bit) {
         LChar* buffer;
@@ -403,7 +403,7 @@ static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, J
     return jsString(exec, impl.release());
 }
 
-static NEVER_INLINE EncodedJSValue removeUsingRegExpSearch(ExecState* exec, JSString* string, const UString& source, RegExp* regExp)
+static NEVER_INLINE EncodedJSValue removeUsingRegExpSearch(ExecState* exec, JSString* string, const String& source, RegExp* regExp)
 {
     size_t lastIndex = 0;
     unsigned startPosition = 0;
@@ -444,13 +444,13 @@ static NEVER_INLINE EncodedJSValue removeUsingRegExpSearch(ExecState* exec, JSSt
 static NEVER_INLINE EncodedJSValue replaceUsingRegExpSearch(ExecState* exec, JSString* string, JSValue searchValue)
 {
     JSValue replaceValue = exec->argument(1);
-    UString replacementString;
+    String replacementString;
     CallData callData;
     CallType callType = getCallData(replaceValue, callData);
     if (callType == CallTypeNone)
         replacementString = replaceValue.toString(exec)->value(exec);
 
-    const UString& source = string->value(exec);
+    const String& source = string->value(exec);
     unsigned sourceLen = source.length();
     if (exec->hadException())
         return JSValue::encode(JSValue());
@@ -474,7 +474,7 @@ static NEVER_INLINE EncodedJSValue replaceUsingRegExpSearch(ExecState* exec, JSS
     unsigned startPosition = 0;
 
     Vector<StringRange, 16> sourceRanges;
-    Vector<UString, 16> replacements;
+    Vector<String, 16> replacements;
 
     // This is either a loop (if global is set) or a one-way (if not).
     if (global && callType == CallTypeJS) {
@@ -601,7 +601,7 @@ static NEVER_INLINE EncodedJSValue replaceUsingRegExpSearch(ExecState* exec, JSS
                     if (replLen)
                         replacements.append(substituteBackreferences(replacementString, source, ovector, regExp));
                     else
-                        replacements.append(UString());
+                        replacements.append(String());
                 }
             }
 
@@ -628,8 +628,8 @@ static NEVER_INLINE EncodedJSValue replaceUsingRegExpSearch(ExecState* exec, JSS
 
 static inline EncodedJSValue replaceUsingStringSearch(ExecState* exec, JSString* jsString, JSValue searchValue)
 {
-    const UString& string = jsString->value(exec);
-    UString searchString = searchValue.toUString(exec);
+    const String& string = jsString->value(exec);
+    String searchString = searchValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
@@ -651,19 +651,19 @@ static inline EncodedJSValue replaceUsingStringSearch(ExecState* exec, JSString*
             return JSValue::encode(jsUndefined());
     }
 
-    UString replaceString = replaceValue.toUString(exec);
+    String replaceString = replaceValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
     StringImpl* stringImpl = string.impl();
-    UString leftPart(StringImpl::create(stringImpl, 0, matchStart));
+    String leftPart(StringImpl::create(stringImpl, 0, matchStart));
 
     size_t matchEnd = matchStart + searchString.impl()->length();
     int ovector[2] = { matchStart,  matchEnd};
-    UString middlePart = substituteBackreferences(replaceString, string, ovector, 0);
+    String middlePart = substituteBackreferences(replaceString, string, ovector, 0);
 
     size_t leftLength = stringImpl->length() - matchEnd;
-    UString rightPart(StringImpl::create(stringImpl, matchEnd, leftLength));
+    String rightPart(StringImpl::create(stringImpl, matchEnd, leftLength));
     return JSValue::encode(JSC::jsString(exec, leftPart, middlePart, rightPart));
 }
 
@@ -699,7 +699,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     unsigned len = s.length();
     JSValue a0 = exec->argument(0);
     if (a0.isUInt32()) {
@@ -719,7 +719,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     unsigned len = s.length();
     JSValue a0 = exec->argument(0);
     if (a0.isUInt32()) {
@@ -753,11 +753,11 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
 
     JSValue a0 = exec->argument(0);
     JSValue a1 = exec->argument(1);
-    UString u2 = a0.toString(exec)->value(exec);
+    String u2 = a0.toString(exec)->value(exec);
 
     size_t result;
     if (a1.isUndefined())
@@ -788,13 +788,13 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     int len = s.length();
 
     JSValue a0 = exec->argument(0);
     JSValue a1 = exec->argument(1);
 
-    UString u2 = a0.toString(exec)->value(exec);
+    String u2 = a0.toString(exec)->value(exec);
     double dpos = a1.toIntegerPreserveNaN(exec);
     if (dpos < 0)
         dpos = 0;
@@ -813,7 +813,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
     JSString* string = thisValue.toString(exec);
-    UString s = string->value(exec);
+    String s = string->value(exec);
     JSGlobalData* globalData = &exec->globalData();
 
     JSValue a0 = exec->argument(0);
@@ -836,7 +836,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec)
          *  replaced with the result of the expression new RegExp(regexp).
          *  Per ECMA 15.10.4.1, if a0 is undefined substitute the empty string.
          */
-        regExp = RegExp::create(exec->globalData(), a0.isUndefined() ? UString("") : a0.toString(exec)->value(exec), NoFlags);
+        regExp = RegExp::create(exec->globalData(), a0.isUndefined() ? String("") : a0.toString(exec)->value(exec), NoFlags);
         if (!regExp->isValid())
             return throwVMError(exec, createSyntaxError(exec, regExp->errorMessage()));
     }
@@ -872,7 +872,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
     JSString* string = thisValue.toString(exec);
-    UString s = string->value(exec);
+    String s = string->value(exec);
     JSGlobalData* globalData = &exec->globalData();
 
     JSValue a0 = exec->argument(0);
@@ -887,7 +887,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec)
          *  replaced with the result of the expression new RegExp(regexp).
          *  Per ECMA 15.10.4.1, if a0 is undefined substitute the empty string.
          */
-        reg = RegExp::create(exec->globalData(), a0.isUndefined() ? UString("") : a0.toString(exec)->value(exec), NoFlags);
+        reg = RegExp::create(exec->globalData(), a0.isUndefined() ? String("") : a0.toString(exec)->value(exec), NoFlags);
         if (!reg->isValid())
             return throwVMError(exec, createSyntaxError(exec, reg->errorMessage()));
     }
@@ -901,7 +901,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     int len = s.length();
 
     JSValue a0 = exec->argument(0);
@@ -925,7 +925,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec)
 
 // Return true in case of early return (resultLength got to limitLength).
 template<typename CharacterType>
-static ALWAYS_INLINE bool splitStringByOneCharacterImpl(ExecState* exec, JSArray* result, const UString& input, StringImpl* string, UChar separatorCharacter, size_t& position, unsigned& resultLength, unsigned limitLength)
+static ALWAYS_INLINE bool splitStringByOneCharacterImpl(ExecState* exec, JSArray* result, const String& input, StringImpl* string, UChar separatorCharacter, size_t& position, unsigned& resultLength, unsigned limitLength)
 {
     // 12. Let q = p.
     size_t matchPosition;
@@ -939,7 +939,7 @@ static ALWAYS_INLINE bool splitStringByOneCharacterImpl(ExecState* exec, JSArray
         //    through q (exclusive).
         // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
         //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-        result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position), false);
+        result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position));
         // 3. Increment lengthA by 1.
         // 4. If lengthA == lim, return A.
         if (++resultLength == limitLength)
@@ -962,7 +962,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
 
     // 2. Let S be the result of calling ToString, giving it the this value as its argument.
     // 6. Let s be the number of characters in S.
-    UString input = thisValue.toString(exec)->value(exec);
+    String input = thisValue.toString(exec)->value(exec);
 
     // 3. Let A be a new array created as if by the expression new Array()
     //    where Array is the standard built-in constructor with that name.
@@ -993,7 +993,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
         if (separatorValue.isUndefined()) {
             // a. Call the [[DefineOwnProperty]] internal method of A with arguments "0",
             //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
+            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
             // b. Return A.
             return JSValue::encode(result);
         }
@@ -1006,7 +1006,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
             // d. Return A.
             if (!reg->match(*globalData, input, 0))
-                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
+                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
             return JSValue::encode(result);
         }
 
@@ -1037,7 +1037,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    through q (exclusive).
             // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
             //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position), false);
+            result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position));
             // 3. Increment lengthA by 1.
             // 4. If lengthA == lim, return A.
             if (++resultLength == limit)
@@ -1056,7 +1056,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
                 //   ToString(lengthA), Property Descriptor {[[Value]]: cap[i], [[Writable]]:
                 //   true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
                 int sub = ovector[i * 2];
-                result->putDirectIndex(exec, resultLength, sub < 0 ? jsUndefined() : jsSubstring(exec, input, sub, ovector[i * 2 + 1] - sub), false);
+                result->putDirectIndex(exec, resultLength, sub < 0 ? jsUndefined() : jsSubstring(exec, input, sub, ovector[i * 2 + 1] - sub));
                 // c Increment lengthA by 1.
                 // d If lengthA == lim, return A.
                 if (++resultLength == limit)
@@ -1064,7 +1064,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             }
         }
     } else {
-        UString separator = separatorValue.toString(exec)->value(exec);
+        String separator = separatorValue.toString(exec)->value(exec);
 
         // 9. If lim == 0, return A.
         if (!limit)
@@ -1075,7 +1075,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
         if (separatorValue.isUndefined()) {
             // a.  Call the [[DefineOwnProperty]] internal method of A with arguments "0",
             //     Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
+            result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
             // b.  Return A.
             return JSValue::encode(result);
         }
@@ -1088,7 +1088,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             //    Property Descriptor {[[Value]]: S, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
             // d. Return A.
             if (!separator.isEmpty())
-                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input), false);
+                result->putDirectIndex(exec, 0, jsStringWithReuse(exec, thisValue, input));
             return JSValue::encode(result);
         }
 
@@ -1099,7 +1099,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
             ASSERT(limit);
 
             do {
-                result->putDirectIndex(exec, position, jsSingleCharacterSubstring(exec, input, position), false);
+                result->putDirectIndex(exec, position, jsSingleCharacterSubstring(exec, input, position));
             } while (++position < limit);
 
             return JSValue::encode(result);
@@ -1139,7 +1139,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
                 //    through q (exclusive).
                 // 2. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA),
                 //    Property Descriptor {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-                result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position), false);
+                result->putDirectIndex(exec, resultLength, jsSubstring(exec, input, position, matchPosition - position));
                 // 3. Increment lengthA by 1.
                 // 4. If lengthA == lim, return A.
                 if (++resultLength == limit)
@@ -1156,7 +1156,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec)
     //     through s (exclusive).
     // 15. Call the [[DefineOwnProperty]] internal method of A with arguments ToString(lengthA), Property Descriptor
     //     {[[Value]]: T, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}, and false.
-    result->putDirectIndex(exec, resultLength++, jsSubstring(exec, input, position, input.length() - position), false);
+    result->putDirectIndex(exec, resultLength++, jsSubstring(exec, input, position, input.length() - position));
 
     // 16. Return A.
     return JSValue::encode(result);
@@ -1167,7 +1167,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     unsigned len;
     JSString* jsString = 0;
-    UString uString;
+    String uString;
     if (thisValue.isString()) {
         jsString = jsCast<JSString*>(thisValue.asCell());
         len = jsString->length();
@@ -1247,7 +1247,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec)
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
     JSString* sVal = thisValue.toString(exec);
-    const UString& s = sVal->value(exec);
+    const String& s = sVal->value(exec);
 
     int sSize = s.length();
     if (!sSize)
@@ -1257,7 +1257,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec)
     RefPtr<StringImpl> lower = ourImpl->lower();
     if (ourImpl == lower)
         return JSValue::encode(sVal);
-    return JSValue::encode(jsString(exec, UString(lower.release())));
+    return JSValue::encode(jsString(exec, String(lower.release())));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
@@ -1266,7 +1266,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
     JSString* sVal = thisValue.toString(exec);
-    const UString& s = sVal->value(exec);
+    const String& s = sVal->value(exec);
 
     int sSize = s.length();
     if (!sSize)
@@ -1276,7 +1276,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
     RefPtr<StringImpl> upper = sImpl->upper();
     if (sImpl == upper)
         return JSValue::encode(sVal);
-    return JSValue::encode(jsString(exec, UString(upper.release())));
+    return JSValue::encode(jsString(exec, String(upper.release())));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
@@ -1287,7 +1287,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
 
     JSValue a0 = exec->argument(0);
     return JSValue::encode(jsNumber(localeCompare(s, a0.toString(exec)->value(exec))));
@@ -1298,7 +1298,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<big>", s, "</big>"));
 }
 
@@ -1307,7 +1307,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<small>", s, "</small>"));
 }
 
@@ -1316,7 +1316,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<blink>", s, "</blink>"));
 }
 
@@ -1325,7 +1325,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<b>", s, "</b>"));
 }
 
@@ -1334,7 +1334,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<tt>", s, "</tt>"));
 }
 
@@ -1343,7 +1343,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<i>", s, "</i>"));
 }
 
@@ -1352,7 +1352,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<strike>", s, "</strike>"));
 }
 
@@ -1361,7 +1361,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<sub>", s, "</sub>"));
 }
 
@@ -1370,7 +1370,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     return JSValue::encode(jsMakeNontrivialString(exec, "<sup>", s, "</sup>"));
 }
 
@@ -1379,7 +1379,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     JSValue a0 = exec->argument(0);
     return JSValue::encode(jsMakeNontrivialString(exec, "<font color=\"", a0.toString(exec)->value(exec), "\">", s, "</font>"));
 }
@@ -1389,7 +1389,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     JSValue a0 = exec->argument(0);
 
     uint32_t smallInteger;
@@ -1434,7 +1434,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     JSValue a0 = exec->argument(0);
     return JSValue::encode(jsMakeNontrivialString(exec, "<a name=\"", a0.toString(exec)->value(exec), "\">", s, "</a>"));
 }
@@ -1444,9 +1444,9 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec)
     JSValue thisValue = exec->hostThisValue();
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwVMTypeError(exec);
-    UString s = thisValue.toString(exec)->value(exec);
+    String s = thisValue.toString(exec)->value(exec);
     JSValue a0 = exec->argument(0);
-    UString linkText = a0.toString(exec)->value(exec);
+    String linkText = a0.toString(exec)->value(exec);
 
     unsigned linkTextSize = linkText.length();
     unsigned stringSize = s.length();
@@ -1489,7 +1489,7 @@ static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKin
 {
     if (thisValue.isUndefinedOrNull()) // CheckObjectCoercible
         return throwTypeError(exec);
-    UString str = thisValue.toString(exec)->value(exec);
+    String str = thisValue.toString(exec)->value(exec);
     unsigned left = 0;
     if (trimKind & TrimLeft) {
         while (left < str.length() && isTrimWhitespace(str[left]))
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index e02105826..4c8ee8741 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -762,32 +762,24 @@ void Structure::visitChildren(JSCell* cell, SlotVisitor& visitor)
     Structure* thisObject = jsCast<Structure*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
     ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
     JSCell::visitChildren(thisObject, visitor);
-    if (thisObject->m_globalObject)
-        visitor.append(&thisObject->m_globalObject);
+    visitor.append(&thisObject->m_globalObject);
     if (!thisObject->isObject())
         thisObject->m_cachedPrototypeChain.clear();
     else {
-        if (thisObject->m_prototype)
-            visitor.append(&thisObject->m_prototype);
-        if (thisObject->m_cachedPrototypeChain)
-            visitor.append(&thisObject->m_cachedPrototypeChain);
+        visitor.append(&thisObject->m_prototype);
+        visitor.append(&thisObject->m_cachedPrototypeChain);
     }
-    if (thisObject->m_previous)
-        visitor.append(&thisObject->m_previous);
-    if (thisObject->m_specificValueInPrevious)
-        visitor.append(&thisObject->m_specificValueInPrevious);
-    if (thisObject->m_enumerationCache)
-        visitor.append(&thisObject->m_enumerationCache);
+    visitor.append(&thisObject->m_previous);
+    visitor.append(&thisObject->m_specificValueInPrevious);
+    visitor.append(&thisObject->m_enumerationCache);
     if (thisObject->m_propertyTable) {
         PropertyTable::iterator end = thisObject->m_propertyTable->end();
-        for (PropertyTable::iterator ptr = thisObject->m_propertyTable->begin(); ptr != end; ++ptr) {
-            if (ptr->specificValue)
-                visitor.append(&ptr->specificValue);
-        }
+        for (PropertyTable::iterator ptr = thisObject->m_propertyTable->begin(); ptr != end; ++ptr)
+            visitor.append(&ptr->specificValue);
     }
-    if (thisObject->m_objectToStringValue)
-        visitor.append(&thisObject->m_objectToStringValue);
+    visitor.append(&thisObject->m_objectToStringValue);
 }
 
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 2bb0107b7..57368bee8 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -36,12 +36,12 @@
 #include "Protect.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
-#include "UString.h"
 #include "Watchpoint.h"
 #include "Weak.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/text/StringImpl.h>
 
 
 namespace JSC {
@@ -259,7 +259,7 @@ namespace JSC {
         bool masqueradesAsUndefined(JSGlobalObject* lexicalGlobalObject);
 
         PropertyOffset get(JSGlobalData&, PropertyName);
-        PropertyOffset get(JSGlobalData&, const UString& name);
+        PropertyOffset get(JSGlobalData&, const WTF::String& name);
         JS_EXPORT_PRIVATE PropertyOffset get(JSGlobalData&, PropertyName, unsigned& attributes, JSCell*& specificValue);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
@@ -501,7 +501,7 @@ namespace JSC {
         return entry ? entry->offset : invalidOffset;
     }
 
-    inline PropertyOffset Structure::get(JSGlobalData& globalData, const UString& name)
+    inline PropertyOffset Structure::get(JSGlobalData& globalData, const WTF::String& name)
     {
         ASSERT(structure()->classInfo() == &s_info);
         materializePropertyMapIfNecessary(globalData);
@@ -567,6 +567,8 @@ namespace JSC {
     ALWAYS_INLINE void MarkStack::internalAppend(JSCell* cell)
     {
         ASSERT(!m_isCheckingForDefaultMarkViolation);
+        if (!cell)
+            return;
 #if ENABLE(GC_VALIDATION)
         validate(cell);
 #endif
diff --git a/Source/JavaScriptCore/runtime/StructureTransitionTable.h b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
index 2067a8995..7c9d50894 100644
--- a/Source/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/Source/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -26,11 +26,11 @@
 #ifndef StructureTransitionTable_h
 #define StructureTransitionTable_h
 
-#include "UString.h"
 #include "WeakGCMap.h"
 #include <wtf/HashFunctions.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/StringImpl.h>
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.cpp b/Source/JavaScriptCore/runtime/SymbolTable.cpp
index 2a9d71629..1b7fd89c5 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.cpp
+++ b/Source/JavaScriptCore/runtime/SymbolTable.cpp
@@ -31,6 +31,8 @@
 
 namespace JSC {
 
+const ClassInfo SharedSymbolTable::s_info = { "SharedSymbolTable", 0, 0, 0, CREATE_METHOD_TABLE(SharedSymbolTable) };
+
 SymbolTableEntry& SymbolTableEntry::copySlow(const SymbolTableEntry& other)
 {
     ASSERT(other.isFat());
@@ -40,6 +42,12 @@ SymbolTableEntry& SymbolTableEntry::copySlow(const SymbolTableEntry& other)
     return *this;
 }
 
+void SharedSymbolTable::destroy(JSCell* cell)
+{
+    SharedSymbolTable* thisObject = jsCast<SharedSymbolTable*>(cell);
+    thisObject->SharedSymbolTable::~SharedSymbolTable();
+}
+
 void SymbolTableEntry::freeFatEntrySlow()
 {
     ASSERT(isFat());
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index 8b017efbc..08ea8c163 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -30,10 +30,10 @@
 #define SymbolTable_h
 
 #include "JSObject.h"
-#include "UString.h"
 #include "Watchpoint.h"
 #include <wtf/AlwaysInline.h>
 #include <wtf/HashTraits.h>
+#include <wtf/text/StringImpl.h>
 
 namespace JSC {
 
@@ -325,12 +325,28 @@ namespace JSC {
 
     typedef HashMap<RefPtr<StringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<StringImpl> >, SymbolTableIndexHashTraits> SymbolTable;
 
-    class SharedSymbolTable : public SymbolTable, public RefCounted<SharedSymbolTable> {
-        WTF_MAKE_FAST_ALLOCATED;
+    class SharedSymbolTable : public JSCell, public SymbolTable {
     public:
-        static PassRefPtr<SharedSymbolTable> create() { return adoptRef(new SharedSymbolTable); }
+        static SharedSymbolTable* create(JSGlobalData& globalData)
+        {
+            SharedSymbolTable* sharedSymbolTable = new (NotNull, allocateCell<SharedSymbolTable>(globalData.heap)) SharedSymbolTable(globalData);
+            sharedSymbolTable->finishCreation(globalData);
+            return sharedSymbolTable;
+        }
+        static void destroy(JSCell*);
+
+        static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
+        {
+            return Structure::create(globalData, globalObject, prototype, TypeInfo(LeafType, StructureFlags), &s_info);
+        }
+
+        static JS_EXPORTDATA const ClassInfo s_info;
+
     private:
-        SharedSymbolTable() { }
+        SharedSymbolTable(JSGlobalData& globalData)
+            : JSCell(globalData, globalData.sharedSymbolTableStructure.get())
+        {
+        }
     };
     
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/UString.cpp b/Source/JavaScriptCore/runtime/UString.cpp
deleted file mode 100644
index 5b1e9a0e0..000000000
--- a/Source/JavaScriptCore/runtime/UString.cpp
+++ /dev/null
@@ -1,475 +0,0 @@
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
- *  Copyright (C) 2009 Google Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "UString.h"
-
-#include "JSGlobalObjectFunctions.h"
-#include "Heap.h"
-#include "Identifier.h"
-#include "Operations.h"
-#include <ctype.h>
-#include <limits.h>
-#include <limits>
-#include <stdio.h>
-#include <stdlib.h>
-#include <wtf/ASCIICType.h>
-#include <wtf/Assertions.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StringExtras.h>
-#include <wtf/Vector.h>
-#include <wtf/dtoa.h>
-#include <wtf/unicode/UTF8.h>
-
-#if HAVE(STRINGS_H)
-#include <strings.h>
-#endif
-
-using namespace WTF;
-using namespace WTF::Unicode;
-using namespace std;
-
-namespace JSC {
-
-COMPILE_ASSERT(sizeof(UString) == sizeof(void*), UString_should_stay_small);
-
-// Construct a string with UTF-16 data.
-UString::UString(const UChar* characters, unsigned length)
-    : m_impl(characters ? StringImpl::create(characters, length) : 0)
-{
-}
-
-// Construct a string with UTF-16 data, from a null-terminated source.
-UString::UString(const UChar* characters)
-{
-    if (!characters)
-        return;
-
-    int length = 0;
-    while (characters[length] != UChar(0))
-        ++length;
-
-    m_impl = StringImpl::create(characters, length);
-}
-
-// Construct a string with latin1 data.
-UString::UString(const LChar* characters, unsigned length)
-    : m_impl(characters ? StringImpl::create(characters, length) : 0)
-{
-}
-
-UString::UString(const char* characters, unsigned length)
-    : m_impl(characters ? StringImpl::create(reinterpret_cast<const LChar*>(characters), length) : 0)
-{
-}
-
-// Construct a string with latin1 data, from a null-terminated source.
-UString::UString(const LChar* characters)
-    : m_impl(characters ? StringImpl::create(characters) : 0)
-{
-}
-
-UString::UString(const char* characters)
-    : m_impl(characters ? StringImpl::create(reinterpret_cast<const LChar*>(characters)) : 0)
-{
-}
-
-UString UString::number(int i)
-{
-    LChar buf[1 + sizeof(i) * 3];
-    LChar* end = buf + WTF_ARRAY_LENGTH(buf);
-    LChar* p = end;
-
-    if (i == 0)
-        *--p = '0';
-    else if (i == INT_MIN) {
-        char minBuf[1 + sizeof(i) * 3];
-        snprintf(minBuf, sizeof(minBuf), "%d", INT_MIN);
-        return UString(minBuf);
-    } else {
-        bool negative = false;
-        if (i < 0) {
-            negative = true;
-            i = -i;
-        }
-        while (i) {
-            *--p = static_cast<unsigned short>((i % 10) + '0');
-            i /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return UString(p, static_cast<unsigned>(end - p));
-}
-
-UString UString::number(long long i)
-{
-    LChar buf[1 + sizeof(i) * 3];
-    LChar* end = buf + WTF_ARRAY_LENGTH(buf);
-    LChar* p = end;
-
-    if (i == 0)
-        *--p = '0';
-    else if (i == std::numeric_limits<long long>::min()) {
-        char minBuf[1 + sizeof(i) * 3];
-#if OS(WINDOWS)
-        snprintf(minBuf, sizeof(minBuf), "%I64d", std::numeric_limits<long long>::min());
-#else
-        snprintf(minBuf, sizeof(minBuf), "%lld", std::numeric_limits<long long>::min());
-#endif
-        return UString(minBuf);
-    } else {
-        bool negative = false;
-        if (i < 0) {
-            negative = true;
-            i = -i;
-        }
-        while (i) {
-            *--p = static_cast<unsigned short>((i % 10) + '0');
-            i /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return UString(p, static_cast<unsigned>(end - p));
-}
-
-UString UString::number(unsigned u)
-{
-    LChar buf[sizeof(u) * 3];
-    LChar* end = buf + WTF_ARRAY_LENGTH(buf);
-    LChar* p = end;
-
-    if (u == 0)
-        *--p = '0';
-    else {
-        while (u) {
-            *--p = static_cast<unsigned short>((u % 10) + '0');
-            u /= 10;
-        }
-    }
-
-    return UString(p, static_cast<unsigned>(end - p));
-}
-
-UString UString::number(long l)
-{
-    LChar buf[1 + sizeof(l) * 3];
-    LChar* end = buf + WTF_ARRAY_LENGTH(buf);
-    LChar* p = end;
-
-    if (l == 0)
-        *--p = '0';
-    else if (l == LONG_MIN) {
-        char minBuf[1 + sizeof(l) * 3];
-        snprintf(minBuf, sizeof(minBuf), "%ld", LONG_MIN);
-        return UString(minBuf);
-    } else {
-        bool negative = false;
-        if (l < 0) {
-            negative = true;
-            l = -l;
-        }
-        while (l) {
-            *--p = static_cast<unsigned short>((l % 10) + '0');
-            l /= 10;
-        }
-        if (negative)
-            *--p = '-';
-    }
-
-    return UString(p, end - p);
-}
-
-UString UString::number(double d)
-{
-    NumberToStringBuffer buffer;
-    return UString(numberToString(d, buffer));
-}
-
-UString UString::substringSharingImpl(unsigned offset, unsigned length) const
-{
-    // FIXME: We used to check against a limit of Heap::minExtraCost / sizeof(UChar).
-
-    unsigned stringLength = this->length();
-    offset = min(offset, stringLength);
-    length = min(length, stringLength - offset);
-
-    if (!offset && length == stringLength)
-        return *this;
-    return UString(StringImpl::create(m_impl, offset, length));
-}
-
-bool operator==(const UString& s1, const char *s2)
-{
-    if (s1.isEmpty())
-        return !s2;
-
-    return equal(s1.impl(), s2);
-}
-
-// This method assumes that all simple checks have been performed by
-// the inlined operator==() in the header file.
-bool equalSlowCase(const UString& s1, const UString& s2)
-{
-    StringImpl* rep1 = s1.impl();
-    StringImpl* rep2 = s2.impl();
-    unsigned size1 = rep1->length();
-
-    // At this point we know 
-    //   (a) that the strings are the same length and
-    //   (b) that they are greater than zero length.
-    bool s1Is8Bit = rep1->is8Bit();
-    bool s2Is8Bit = rep2->is8Bit();
-    
-    if (s1Is8Bit) {
-        const LChar* d1 = rep1->characters8();
-        if (s2Is8Bit) {
-            const LChar* d2 = rep2->characters8();
-            
-            if (d1 == d2) // Check to see if the data pointers are the same.
-                return true;
-            
-            // Do quick checks for sizes 1 and 2.
-            switch (size1) {
-            case 1:
-                return d1[0] == d2[0];
-            case 2:
-                return (d1[0] == d2[0]) & (d1[1] == d2[1]);
-            default:
-                return (!memcmp(d1, d2, size1 * sizeof(LChar)));
-            }
-        }
-        
-        const UChar* d2 = rep2->characters16();
-        
-        for (unsigned i = 0; i < size1; i++) {
-            if (d1[i] != d2[i])
-                return false;
-        }
-        return true;
-    }
-    
-    if (s2Is8Bit) {
-        const UChar* d1 = rep1->characters16();
-        const LChar* d2 = rep2->characters8();
-        
-        for (unsigned i = 0; i < size1; i++) {
-            if (d1[i] != d2[i])
-                return false;
-        }
-        return true;
-        
-    }
-    
-    const UChar* d1 = rep1->characters16();
-    const UChar* d2 = rep2->characters16();
-    
-    if (d1 == d2) // Check to see if the data pointers are the same.
-        return true;
-    
-    // Do quick checks for sizes 1 and 2.
-    switch (size1) {
-    case 1:
-        return d1[0] == d2[0];
-    case 2:
-        return (d1[0] == d2[0]) & (d1[1] == d2[1]);
-    default:
-        return (!memcmp(d1, d2, size1 * sizeof(UChar)));
-    }
-}
-
-bool operator<(const UString& s1, const UString& s2)
-{
-    const unsigned l1 = s1.length();
-    const unsigned l2 = s2.length();
-    const unsigned lmin = l1 < l2 ? l1 : l2;
-    if (s1.is8Bit() && s2.is8Bit()) {
-        const LChar* c1 = s1.characters8();
-        const LChar* c2 = s2.characters8();
-        unsigned length = 0;
-        while (length < lmin && *c1 == *c2) {
-            c1++;
-            c2++;
-            length++;
-        }
-        if (length < lmin)
-            return (c1[0] < c2[0]);
-
-        return (l1 < l2);        
-    }
-    const UChar* c1 = s1.characters();
-    const UChar* c2 = s2.characters();
-    unsigned length = 0;
-    while (length < lmin && *c1 == *c2) {
-        c1++;
-        c2++;
-        length++;
-    }
-    if (length < lmin)
-        return (c1[0] < c2[0]);
-
-    return (l1 < l2);
-}
-
-bool operator>(const UString& s1, const UString& s2)
-{
-    const unsigned l1 = s1.length();
-    const unsigned l2 = s2.length();
-    const unsigned lmin = l1 < l2 ? l1 : l2;
-    const UChar* c1 = s1.characters();
-    const UChar* c2 = s2.characters();
-    unsigned l = 0;
-    while (l < lmin && *c1 == *c2) {
-        c1++;
-        c2++;
-        l++;
-    }
-    if (l < lmin)
-        return (c1[0] > c2[0]);
-
-    return (l1 > l2);
-}
-
-CString UString::ascii() const
-{
-    // Basic Latin1 (ISO) encoding - Unicode characters 0..255 are
-    // preserved, characters outside of this range are converted to '?'.
-
-    unsigned length = this->length();
-
-    if (this->is8Bit()) {
-        const LChar* characters = this->characters8();
-        
-        char* characterBuffer;
-        CString result = CString::newUninitialized(length, characterBuffer);
-        
-        for (unsigned i = 0; i < length; ++i) {
-            LChar ch = characters[i];
-            characterBuffer[i] = ch && (ch < 0x20 || ch > 0x7f) ? '?' : ch;
-        }
-        
-        return result;        
-    }
-
-    const UChar* characters = this->characters16();
-
-    char* characterBuffer;
-    CString result = CString::newUninitialized(length, characterBuffer);
-
-    for (unsigned i = 0; i < length; ++i) {
-        UChar ch = characters[i];
-        characterBuffer[i] = ch && (ch < 0x20 || ch >= 0x7f) ? '?' : ch;
-    }
-
-    return result;
-}
-
-CString UString::latin1() const
-{
-    // Basic Latin1 (ISO) encoding - Unicode characters 0..255 are
-    // preserved, characters outside of this range are converted to '?'.
-
-    unsigned length = this->length();
-    const UChar* characters = this->characters();
-
-    char* characterBuffer;
-    CString result = CString::newUninitialized(length, characterBuffer);
-
-    for (unsigned i = 0; i < length; ++i) {
-        UChar ch = characters[i];
-        characterBuffer[i] = ch > 0xff ? '?' : ch;
-    }
-
-    return result;
-}
-
-// Helper to write a three-byte UTF-8 code point to the buffer, caller must check room is available.
-static inline void putUTF8Triple(char*& buffer, UChar ch)
-{
-    ASSERT(ch >= 0x0800);
-    *buffer++ = static_cast<char>(((ch >> 12) & 0x0F) | 0xE0);
-    *buffer++ = static_cast<char>(((ch >> 6) & 0x3F) | 0x80);
-    *buffer++ = static_cast<char>((ch & 0x3F) | 0x80);
-}
-
-CString UString::utf8(bool strict) const
-{
-    unsigned length = this->length();
-
-    if (!length)
-        return CString("", 0);
-
-    // Allocate a buffer big enough to hold all the characters
-    // (an individual UTF-16 UChar can only expand to 3 UTF-8 bytes).
-    // Optimization ideas, if we find this function is hot:
-    //  * We could speculatively create a CStringBuffer to contain 'length' 
-    //    characters, and resize if necessary (i.e. if the buffer contains
-    //    non-ascii characters). (Alternatively, scan the buffer first for
-    //    ascii characters, so we know this will be sufficient).
-    //  * We could allocate a CStringBuffer with an appropriate size to
-    //    have a good chance of being able to write the string into the
-    //    buffer without reallocing (say, 1.5 x length).
-    if (length > numeric_limits<unsigned>::max() / 3)
-        return CString();
-
-    Vector<char, 1024> bufferVector(length * 3);
-    char* buffer = bufferVector.data();
-
-    if (is8Bit()) {
-        const LChar* characters = this->characters8();
-
-        ConversionResult result = convertLatin1ToUTF8(&characters, characters + length, &buffer, buffer + bufferVector.size());
-        ASSERT_UNUSED(result, result != targetExhausted); // (length * 3) should be sufficient for any conversion
-    } else {
-        const UChar* characters = this->characters16();
-
-        ConversionResult result = convertUTF16ToUTF8(&characters, characters + length, &buffer, buffer + bufferVector.size(), strict);
-        ASSERT(result != targetExhausted); // (length * 3) should be sufficient for any conversion
-
-        // Only produced from strict conversion.
-        if (result == sourceIllegal)
-            return CString();
-
-        // Check for an unconverted high surrogate.
-        if (result == sourceExhausted) {
-            if (strict)
-                return CString();
-            // This should be one unpaired high surrogate. Treat it the same
-            // was as an unpaired high surrogate would have been handled in
-            // the middle of a string with non-strict conversion - which is
-            // to say, simply encode it to UTF-8.
-            ASSERT((characters + 1) == (this->characters() + length));
-            ASSERT((*characters >= 0xD800) && (*characters <= 0xDBFF));
-            // There should be room left, since one UChar hasn't been converted.
-            ASSERT((buffer + 3) <= (buffer + bufferVector.size()));
-            putUTF8Triple(buffer, *characters);
-        }
-    }
-
-    return CString(bufferVector.data(), buffer - bufferVector.data());
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/UString.h b/Source/JavaScriptCore/runtime/UString.h
deleted file mode 100644
index 7677161a3..000000000
--- a/Source/JavaScriptCore/runtime/UString.h
+++ /dev/null
@@ -1,284 +0,0 @@
-/*
- * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef UString_h
-#define UString_h
-
-#include <wtf/text/StringImpl.h>
-
-namespace JSC {
-
-class UString {
-public:
-    // Construct a null string, distinguishable from an empty string.
-    UString() { }
-
-    // Construct a string with UTF-16 data.
-    JS_EXPORT_PRIVATE UString(const UChar* characters, unsigned length);
-
-    // Construct a string with UTF-16 data, from a null-terminated source.
-    JS_EXPORT_PRIVATE UString(const UChar*);
-
-    // Construct a string with latin1 data.
-    UString(const LChar* characters, unsigned length);
-    JS_EXPORT_PRIVATE UString(const char* characters, unsigned length);
-
-    // Construct a string with latin1 data, from a null-terminated source.
-    UString(const LChar* characters);
-    JS_EXPORT_PRIVATE UString(const char* characters);
-
-    // Construct a string referencing an existing StringImpl.
-    UString(StringImpl* impl) : m_impl(impl) { }
-    UString(PassRefPtr<StringImpl> impl) : m_impl(impl) { }
-    UString(RefPtr<StringImpl> impl) : m_impl(impl) { }
-
-    // Inline the destructor.
-    ALWAYS_INLINE ~UString() { }
-
-    void swap(UString& o) { m_impl.swap(o.m_impl); }
-
-    template<typename CharType, size_t inlineCapacity>
-    static UString adopt(Vector<CharType, inlineCapacity>& vector) { return StringImpl::adopt(vector); }
-
-    bool isNull() const { return !m_impl; }
-    bool isEmpty() const { return !m_impl || !m_impl->length(); }
-
-    StringImpl* impl() const { return m_impl.get(); }
-
-    unsigned length() const
-    {
-        if (!m_impl)
-            return 0;
-        return m_impl->length();
-    }
-
-    const UChar* characters() const
-    {
-        if (!m_impl)
-            return 0;
-        return m_impl->characters();
-    }
-
-    const LChar* characters8() const
-    {
-        if (!m_impl)
-            return 0;
-        ASSERT(m_impl->is8Bit());
-        return m_impl->characters8();
-    }
-
-    const UChar* characters16() const
-    {
-        if (!m_impl)
-            return 0;
-        ASSERT(!m_impl->is8Bit());
-        return m_impl->characters16();
-    }
-
-    template <typename CharType>
-    inline const CharType* getCharacters() const;
-
-    bool is8Bit() const { return m_impl->is8Bit(); }
-
-    JS_EXPORT_PRIVATE CString ascii() const;
-    CString latin1() const;
-    JS_EXPORT_PRIVATE CString utf8(bool strict = false) const;
-
-    UChar operator[](unsigned index) const
-    {
-        if (!m_impl || index >= m_impl->length())
-            return 0;
-        if (is8Bit())
-            return m_impl->characters8()[index];
-        return m_impl->characters16()[index];
-    }
-
-    JS_EXPORT_PRIVATE static UString number(int);
-    JS_EXPORT_PRIVATE static UString number(unsigned);
-    JS_EXPORT_PRIVATE static UString number(long);
-    static UString number(long long);
-    JS_EXPORT_PRIVATE static UString number(double);
-
-    // Find a single character or string, also with match function & latin1 forms.
-    size_t find(UChar c, unsigned start = 0) const
-        { return m_impl ? m_impl->find(c, start) : notFound; }
-
-    size_t find(const UString& str) const
-        { return m_impl ? m_impl->find(str.impl()) : notFound; }
-    size_t find(const UString& str, unsigned start) const
-        { return m_impl ? m_impl->find(str.impl(), start) : notFound; }
-
-    size_t find(const LChar* str, unsigned start = 0) const
-        { return m_impl ? m_impl->find(str, start) : notFound; }
-
-    // Find the last instance of a single character or string.
-    size_t reverseFind(UChar c, unsigned start = UINT_MAX) const
-        { return m_impl ? m_impl->reverseFind(c, start) : notFound; }
-    size_t reverseFind(const UString& str, unsigned start = UINT_MAX) const
-        { return m_impl ? m_impl->reverseFind(str.impl(), start) : notFound; }
-
-    JS_EXPORT_PRIVATE UString substringSharingImpl(unsigned pos, unsigned len = UINT_MAX) const;
-
-private:
-    RefPtr<StringImpl> m_impl;
-};
-
-template<>
-inline const LChar* UString::getCharacters<LChar>() const { return characters8(); }
-
-template<>
-inline const UChar* UString::getCharacters<UChar>() const { return characters(); }
-
-NEVER_INLINE bool equalSlowCase(const UString& s1, const UString& s2);
-
-ALWAYS_INLINE bool operator==(const UString& s1, const UString& s2)
-{
-    StringImpl* rep1 = s1.impl();
-    StringImpl* rep2 = s2.impl();
-
-    if (rep1 == rep2) // If they're the same rep, they're equal.
-        return true;
-
-    unsigned size1 = 0;
-    unsigned size2 = 0;
-
-    if (rep1)
-        size1 = rep1->length();
-
-    if (rep2)
-        size2 = rep2->length();
-
-    if (size1 != size2) // If the lengths are not the same, we're done.
-        return false;
-
-    if (!size1)
-        return true;
-
-    if (size1 == 1)
-        return (*rep1)[0u] == (*rep2)[0u];
-
-    return equalSlowCase(s1, s2);
-}
-
-
-inline bool operator!=(const UString& s1, const UString& s2)
-{
-    return !JSC::operator==(s1, s2);
-}
-
-JS_EXPORT_PRIVATE bool operator<(const UString& s1, const UString& s2);
-JS_EXPORT_PRIVATE bool operator>(const UString& s1, const UString& s2);
-
-JS_EXPORT_PRIVATE bool operator==(const UString& s1, const char* s2);
-
-inline bool operator!=(const UString& s1, const char* s2)
-{
-    return !JSC::operator==(s1, s2);
-}
-
-inline bool operator==(const char *s1, const UString& s2)
-{
-    return operator==(s2, s1);
-}
-
-inline bool operator!=(const char *s1, const UString& s2)
-{
-    return !JSC::operator==(s1, s2);
-}
-
-inline int codePointCompare(const UString& s1, const UString& s2)
-{
-    return codePointCompare(s1.impl(), s2.impl());
-}
-
-struct UStringHash {
-    static unsigned hash(StringImpl* key) { return key->hash(); }
-    static bool equal(const StringImpl* a, const StringImpl* b)
-    {
-        if (a == b)
-            return true;
-        if (!a || !b)
-            return false;
-
-        unsigned aLength = a->length();
-        unsigned bLength = b->length();
-        if (aLength != bLength)
-            return false;
-
-        // FIXME: perhaps we should have a more abstract macro that indicates when
-        // going 4 bytes at a time is unsafe
-#if CPU(ARM) || CPU(SH4) || CPU(MIPS) || CPU(SPARC)
-        const UChar* aChars = a->characters();
-        const UChar* bChars = b->characters();
-        for (unsigned i = 0; i != aLength; ++i) {
-            if (*aChars++ != *bChars++)
-                return false;
-        }
-        return true;
-#else
-        /* Do it 4-bytes-at-a-time on architectures where it's safe */
-        const uint32_t* aChars = reinterpret_cast<const uint32_t*>(a->characters());
-        const uint32_t* bChars = reinterpret_cast<const uint32_t*>(b->characters());
-
-        unsigned halfLength = aLength >> 1;
-        for (unsigned i = 0; i != halfLength; ++i)
-            if (*aChars++ != *bChars++)
-                return false;
-
-        if (aLength & 1 && *reinterpret_cast<const uint16_t*>(aChars) != *reinterpret_cast<const uint16_t*>(bChars))
-            return false;
-
-        return true;
-#endif
-    }
-
-    static unsigned hash(const RefPtr<StringImpl>& key) { return key->hash(); }
-    static bool equal(const RefPtr<StringImpl>& a, const RefPtr<StringImpl>& b)
-    {
-        return equal(a.get(), b.get());
-    }
-
-    static unsigned hash(const UString& key) { return key.impl()->hash(); }
-    static bool equal(const UString& a, const UString& b)
-    {
-        return equal(a.impl(), b.impl());
-    }
-
-    static const bool safeToCompareToEmptyOrDeleted = false;
-};
-
-} // namespace JSC
-
-namespace WTF {
-
-// UStringHash is the default hash for UString
-template<typename T> struct DefaultHash;
-template<> struct DefaultHash<JSC::UString> {
-    typedef JSC::UStringHash Hash;
-};
-
-template <> struct VectorTraits<JSC::UString> : SimpleClassVectorTraits { };
-
-} // namespace WTF
-
-#endif
-
diff --git a/Source/JavaScriptCore/runtime/UStringConcatenate.h b/Source/JavaScriptCore/runtime/UStringConcatenate.h
deleted file mode 100644
index cbd4e60ca..000000000
--- a/Source/JavaScriptCore/runtime/UStringConcatenate.h
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef UStringConcatenate_h
-#define UStringConcatenate_h
-
-#include "UString.h"
-#include <wtf/text/StringConcatenate.h>
-
-namespace WTF {
-
-template<>
-class StringTypeAdapter<JSC::UString> {
-public:
-    StringTypeAdapter<JSC::UString>(JSC::UString& string)
-        : m_string(string)
-        , m_length(string.length())
-    {
-    }
-
-    unsigned length() { return m_length; }
-
-    bool is8Bit() { return m_string.isNull() || m_string.is8Bit(); }
-
-    void writeTo(LChar* destination)
-    {
-        const LChar* characters = m_string.characters8();
-        for (unsigned i = 0; i < m_length; ++i)
-            destination[i] = characters[i];
-    }
-
-    void writeTo(UChar* destination)
-    {
-        if (is8Bit()) {
-            const LChar* characters = m_string.characters8();
-            for (unsigned i = 0; i < m_length; ++i)
-                destination[i] = characters[i];
-        } else {
-            const UChar* characters = m_string.characters16();
-            for (unsigned i = 0; i < m_length; ++i)
-                destination[i] = characters[i];
-        }
-    }
-
-private:
-    const JSC::UString& m_string;
-    unsigned m_length;
-};
-
-}; // namespace WTF
-
-namespace JSC {
-
-template<typename StringType1, typename StringType2>
-UString makeUString(StringType1 string1, StringType2 string2)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-template<typename StringType1, typename StringType2, typename StringType3>
-UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
-UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
-UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
-UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5, string6);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
-UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5, string6, string7);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
-UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
-{
-    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
-    if (!resultImpl)
-        CRASH();
-    return resultImpl;
-}
-
-} // namespace JSC
-
-#endif
diff --git a/Source/JavaScriptCore/testRegExp.cpp b/Source/JavaScriptCore/testRegExp.cpp
index 61c21c31b..b0b126f1c 100644
--- a/Source/JavaScriptCore/testRegExp.cpp
+++ b/Source/JavaScriptCore/testRegExp.cpp
@@ -24,11 +24,11 @@
 #include <wtf/CurrentTime.h>
 #include "InitializeThreading.h"
 #include "JSGlobalObject.h"
-#include "UStringBuilder.h"
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <wtf/text/StringBuilder.h>
 
 #if !OS(WINDOWS)
 #include <unistd.h>
@@ -63,8 +63,8 @@ struct CommandLine {
 
     bool interactive;
     bool verbose;
-    Vector<UString> arguments;
-    Vector<UString> files;
+    Vector<String> arguments;
+    Vector<String> files;
 };
 
 class StopWatch {
@@ -100,7 +100,7 @@ struct RegExpTest {
     {
     }
 
-    UString subject;
+    String subject;
     int offset;
     int result;
     Vector<int, 32> expectVector;
@@ -108,12 +108,12 @@ struct RegExpTest {
 
 class GlobalObject : public JSGlobalObject {
 private:
-    GlobalObject(JSGlobalData&, Structure*, const Vector<UString>& arguments);
+    GlobalObject(JSGlobalData&, Structure*, const Vector<String>& arguments);
 
 public:
     typedef JSGlobalObject Base;
 
-    static GlobalObject* create(JSGlobalData& globalData, Structure* structure, const Vector<UString>& arguments)
+    static GlobalObject* create(JSGlobalData& globalData, Structure* structure, const Vector<String>& arguments)
     {
         return new (NotNull, allocateCell<GlobalObject>(globalData.heap)) GlobalObject(globalData, structure, arguments);
     }
@@ -126,7 +126,7 @@ public:
     }
 
 protected:
-    void finishCreation(JSGlobalData& globalData, const Vector<UString>& arguments)
+    void finishCreation(JSGlobalData& globalData, const Vector<String>& arguments)
     {
         Base::finishCreation(globalData);
         UNUSED_PARAM(arguments);
@@ -138,7 +138,7 @@ ASSERT_CLASS_FITS_IN_CELL(GlobalObject);
 
 const ClassInfo GlobalObject::s_info = { "global", &JSGlobalObject::s_info, 0, ExecState::globalObjectTable, CREATE_METHOD_TABLE(GlobalObject) };
 
-GlobalObject::GlobalObject(JSGlobalData& globalData, Structure* structure, const Vector<UString>& arguments)
+GlobalObject::GlobalObject(JSGlobalData& globalData, Structure* structure, const Vector<String>& arguments)
     : JSGlobalObject(globalData, structure)
 {
     finishCreation(globalData, arguments);
@@ -239,7 +239,7 @@ static bool testOneRegExp(JSGlobalData& globalData, RegExp* regexp, RegExpTest*
     return result;
 }
 
-static int scanString(char* buffer, int bufferLength, UStringBuilder& builder, char termChar)
+static int scanString(char* buffer, int bufferLength, StringBuilder& builder, char termChar)
 {
     bool escape = false;
     
@@ -307,7 +307,7 @@ static int scanString(char* buffer, int bufferLength, UStringBuilder& builder, c
 
 static RegExp* parseRegExpLine(JSGlobalData& globalData, char* line, int lineLength)
 {
-    UStringBuilder pattern;
+    StringBuilder pattern;
     
     if (line[0] != '/')
         return 0;
@@ -319,12 +319,12 @@ static RegExp* parseRegExpLine(JSGlobalData& globalData, char* line, int lineLen
 
     ++i;
 
-    return RegExp::create(globalData, pattern.toUString(), regExpFlags(line + i));
+    return RegExp::create(globalData, pattern.toString(), regExpFlags(line + i));
 }
 
 static RegExpTest* parseTestLine(char* line, int lineLength)
 {
-    UStringBuilder subjectString;
+    StringBuilder subjectString;
     
     if ((line[0] != ' ') || (line[1] != '"'))
         return 0;
@@ -363,7 +363,7 @@ static RegExpTest* parseTestLine(char* line, int lineLength)
     
     RegExpTest* result = new RegExpTest();
     
-    result->subject = subjectString.toUString();
+    result->subject = subjectString.toString();
     result->offset = offset;
     result->result = matchResult;
 
@@ -394,10 +394,10 @@ static RegExpTest* parseTestLine(char* line, int lineLength)
     return result;
 }
 
-static bool runFromFiles(GlobalObject* globalObject, const Vector<UString>& files, bool verbose)
+static bool runFromFiles(GlobalObject* globalObject, const Vector<String>& files, bool verbose)
 {
-    UString script;
-    UString fileName;
+    String script;
+    String fileName;
     Vector<char> scriptBuffer;
     unsigned tests = 0;
     unsigned failures = 0;
diff --git a/Source/JavaScriptCore/tests/mozilla/expected.html b/Source/JavaScriptCore/tests/mozilla/expected.html
index 2283f77b5..06136de27 100644
--- a/Source/JavaScriptCore/tests/mozilla/expected.html
+++ b/Source/JavaScriptCore/tests/mozilla/expected.html
@@ -7,11 +7,11 @@
 <p class='results_summary'>
 Test List: All tests<br>
 Skip List: ecma/Date/15.9.2.1.js, ecma/Date/15.9.2.2-1.js, ecma/Date/15.9.2.2-2.js, ecma/Date/15.9.2.2-3.js, ecma/Date/15.9.2.2-4.js, ecma/Date/15.9.2.2-5.js, ecma/Date/15.9.2.2-6.js, ecma_3/Date/15.9.5.7.js, ecma/Date/15.9.5.14.js, ecma/Date/15.9.5.31-1.js, ecma/Date/15.9.5.34-1.js<br>
-1124 test(s) selected, 1116 test(s) completed, 46 failures reported (4.12% failed)<br>
-Engine command line: "/Volumes/Big/ggaren/webkit/WebKitBuild/Debug/jsc" <br>
-OS type: Darwin garen.apple.com 11.3.0 Darwin Kernel Version 11.3.0: Thu Jan 12 18:47:41 PST 2012; root:xnu-1699.24.23~1/RELEASE_X86_64 x86_64<br>
-Testcase execution time: 1 minutes, 8 seconds.<br>
-Tests completed on Tue Apr  3 22:31:56 2012.<br><br>
+1124 test(s) selected, 1116 test(s) completed, 44 failures reported (3.94% failed)<br>
+Engine command line: "/Volumes/Data/Saxony/OpenSource/WebKitBuild/Debug/jsc" <br>
+OS type: Darwin Bearclaw-Kaliber.local 12.0.0 Darwin Kernel Version 12.0.0: Sun Jun 24 23:00:16 PDT 2012; root:xnu-2050.7.9~1/RELEASE_X86_64 x86_64<br>
+Testcase execution time: 52 seconds.<br>
+Tests completed on Thu Sep  6 15:11:19 2012.<br><br>
 [ <a href='#fail_detail'>Failure Details</a> | <a href='#retest_list'>Retest List</a> | <a href='menu.html'>Test Selection Page</a> ]<br>
 <hr>
 <a name='fail_detail'></a>
@@ -29,6 +29,8 @@ Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 RegExp/hex-001.js JS regexp anchoring on empty match bug<br>
 BUGNUMBER: http://bugzilla.mozilla.org/show_bug.cgi?id=2157<br>
+Exception: TypeError: '/a||b/' is not a function (evaluating '/a||b/('')')<br>
+global code@./ecma_2/RegExp/regress-001.js:18<br>
 </tt><br>
 <a name='failure3'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/FunExpr/fe-001.js'>ecma_3/FunExpr/fe-001.js</a> failed</b> <br>
  [ <a href='#failure2'>Previous Failure</a> | <a href='#failure4'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
@@ -43,7 +45,10 @@ FAILED!: [reported from test()] <br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
+Exception: SyntaxError: Unexpected token '('<br>
+eval@[native code]<br>
+global code@./ecma_3/Statements/regress-194364.js:56<br>
+</tt><br>
 <a name='failure5'></a><dd><b>Testcase <a target='other_window' href='./ecma_3/Unicode/uc-001.js'>ecma_3/Unicode/uc-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=23610' target='other_window'>Bug Number 23610</a><br>
  [ <a href='#failure4'>Previous Failure</a> | <a href='#failure6'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Unicode format-control character (Category Cf) test.<br>
@@ -58,6 +63,9 @@ FAILED!: [reported from test()] <br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 JS1_2 Object.toString()<br>
+Exception: TypeError: '/^\{(.*)\}$/' is not a function (evaluating '/^\{(.*)\}$/(s)')<br>
+checkObjectToString@./js1_2/Objects/toString-001.js:103<br>
+global code@./js1_2/Objects/toString-001.js:64<br>
 </tt><br>
 <a name='failure7'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/Function_object.js'>js1_2/function/Function_object.js</a> failed</b> <br>
  [ <a href='#failure6'>Previous Failure</a> | <a href='#failure8'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
@@ -80,69 +88,53 @@ eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 JS_1.2 The variable statment<br>
+Exception: TypeError: '/abc/' is not a function (evaluating 'x("hi")')<br>
+global code@./js1_2/function/regexparg-1.js:80<br>
 </tt><br>
-<a name='failure10'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-1.js'>js1_2/function/tostring-1.js</a> failed</b> <br>
+<a name='failure10'></a><dd><b>Testcase <a target='other_window' href='./js1_2/operator/equality.js'>js1_2/operator/equality.js</a> failed</b> <br>
  [ <a href='#failure9'>Previous Failure</a> | <a href='#failure11'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-</tt><br>
-<a name='failure11'></a><dd><b>Testcase <a target='other_window' href='./js1_2/function/tostring-2.js'>js1_2/function/tostring-2.js</a> failed</b> <br>
- [ <a href='#failure10'>Previous Failure</a> | <a href='#failure12'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt><br>
-Failure messages were:<br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-} FAILED! expected: <br>
-</tt><br>
-<a name='failure12'></a><dd><b>Testcase <a target='other_window' href='./js1_2/operator/equality.js'>js1_2/operator/equality.js</a> failed</b> <br>
- [ <a href='#failure11'>Previous Failure</a> | <a href='#failure13'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt><br>
-Failure messages were:<br>
 (new String('x') == 'x')                  = true FAILED! expected: false<br>
 ('x' == new String('x'))                  = true FAILED! expected: false<br>
 </tt><br>
-<a name='failure13'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_lastIndex.js'>js1_2/regexp/RegExp_lastIndex.js</a> failed</b> <br>
- [ <a href='#failure12'>Previous Failure</a> | <a href='#failure14'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure11'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/RegExp_lastIndex.js'>js1_2/regexp/RegExp_lastIndex.js</a> failed</b> <br>
+ [ <a href='#failure10'>Previous Failure</a> | <a href='#failure12'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 re=/x./g; re.lastIndex=4; re.exec('xyabcdxa') = xa FAILED! expected: ["xa"]<br>
 re.exec('xyabcdef') = xy FAILED! expected: ["xy"]<br>
 </tt><br>
-<a name='failure14'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/regress-6359.js'>js1_2/regexp/regress-6359.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=6359' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=6359</a><br>
- [ <a href='#failure13'>Previous Failure</a> | <a href='#failure15'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure12'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/regress-6359.js'>js1_2/regexp/regress-6359.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=6359' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=6359</a><br>
+ [ <a href='#failure11'>Previous Failure</a> | <a href='#failure13'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 BUGNUMBER: http://bugzilla.mozilla.org/show_bug.cgi?id=6359<br>
+Exception: TypeError: '/(a*)b\1+/' is not a function (evaluating '/(a*)b\1+/("baaac")')<br>
+global code@./js1_2/regexp/regress-6359.js:56<br>
 </tt><br>
-<a name='failure15'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/regress-9141.js'>js1_2/regexp/regress-9141.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=9141' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=9141</a><br>
- [ <a href='#failure14'>Previous Failure</a> | <a href='#failure16'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure13'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/regress-9141.js'>js1_2/regexp/regress-9141.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=http://bugzilla.mozilla.org/show_bug.cgi?id=9141' target='other_window'>Bug Number http://bugzilla.mozilla.org/show_bug.cgi?id=9141</a><br>
+ [ <a href='#failure12'>Previous Failure</a> | <a href='#failure14'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 BUGNUMBER: http://bugzilla.mozilla.org/show_bug.cgi?id=9141<br>
+Exception: TypeError: '/(?:xx|x)*/' is not a function (evaluating '/(?:xx|x)*/(s)')<br>
+global code@./js1_2/regexp/regress-9141.js:73<br>
 </tt><br>
-<a name='failure16'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/simple_form.js'>js1_2/regexp/simple_form.js</a> failed</b> <br>
- [ <a href='#failure15'>Previous Failure</a> | <a href='#failure17'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure14'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/simple_form.js'>js1_2/regexp/simple_form.js</a> failed</b> <br>
+ [ <a href='#failure13'>Previous Failure</a> | <a href='#failure15'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 Executing script: simple_form.js<br>
 As described in Netscape doc "Whats new in JavaScript 1.2" RegExp: simple form<br>
+Exception: TypeError: '/[0-9]{3}/' is not a function (evaluating '/[0-9]{3}/('23 2 34 678 9 09')')<br>
+global code@./js1_2/regexp/simple_form.js:43<br>
 </tt><br>
-<a name='failure17'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/string_split.js'>js1_2/regexp/string_split.js</a> failed</b> <br>
- [ <a href='#failure16'>Previous Failure</a> | <a href='#failure18'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure15'></a><dd><b>Testcase <a target='other_window' href='./js1_2/regexp/string_split.js'>js1_2/regexp/string_split.js</a> failed</b> <br>
+ [ <a href='#failure14'>Previous Failure</a> | <a href='#failure16'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 'abc'.split(/[a-z]/) = ,,, FAILED! expected: ,,<br>
@@ -150,22 +142,22 @@ Failure messages were:<br>
 'abc'.split(new RegExp('[a-z]')) = ,,, FAILED! expected: ,,<br>
 'abc'.split(new RegExp('[a-z]')) = ,,, FAILED! expected: ,,<br>
 </tt><br>
-<a name='failure18'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/boolean-001.js'>js1_2/version120/boolean-001.js</a> failed</b> <br>
- [ <a href='#failure17'>Previous Failure</a> | <a href='#failure19'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure16'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/boolean-001.js'>js1_2/version120/boolean-001.js</a> failed</b> <br>
+ [ <a href='#failure15'>Previous Failure</a> | <a href='#failure17'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt><br>
 Failure messages were:<br>
 new Boolean(false) = true FAILED! expected: false<br>
 </tt><br>
-<a name='failure19'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/regress-99663.js'>js1_2/version120/regress-99663.js</a> failed</b> <br>
- [ <a href='#failure18'>Previous Failure</a> | <a href='#failure20'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure17'></a><dd><b>Testcase <a target='other_window' href='./js1_2/version120/regress-99663.js'>js1_2/version120/regress-99663.js</a> failed</b> <br>
+ [ <a href='#failure16'>Previous Failure</a> | <a href='#failure18'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Regression test for Bugzilla bug 99663<br>
 Failure messages were:<br>
 Section 1 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 Section 2 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 Section 3 of test - got Error: Can't find variable: it FAILED! expected: a "read-only" error<br>
 </tt><br>
-<a name='failure20'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/function-001-n.js'>js1_3/Script/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
- [ <a href='#failure19'>Previous Failure</a> | <a href='#failure21'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure18'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/function-001-n.js'>js1_3/Script/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
+ [ <a href='#failure17'>Previous Failure</a> | <a href='#failure19'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -173,15 +165,17 @@ BUGNUMBER: 10278<br>
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure21'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/script-001.js'>js1_3/Script/script-001.js</a> failed</b> <br>
- [ <a href='#failure20'>Previous Failure</a> | <a href='#failure22'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure19'></a><dd><b>Testcase <a target='other_window' href='./js1_3/Script/script-001.js'>js1_3/Script/script-001.js</a> failed</b> <br>
+ [ <a href='#failure18'>Previous Failure</a> | <a href='#failure20'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 script-001 NativeScript<br>
+Exception: ReferenceError: Can't find variable: Script<br>
+global code@./js1_3/Script/script-001.js:133<br>
 </tt><br>
-<a name='failure22'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
- [ <a href='#failure21'>Previous Failure</a> | <a href='#failure23'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure20'></a><dd><b>Testcase <a target='other_window' href='./js1_3/regress/function-001-n.js'>js1_3/regress/function-001-n.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=10278' target='other_window'>Bug Number 10278</a><br>
+ [ <a href='#failure19'>Previous Failure</a> | <a href='#failure21'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 3, got 0<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
@@ -189,90 +183,114 @@ BUGNUMBER: 10278<br>
 function-001.js functions not separated by semicolons are errors in version 120 and higher<br>
 eval("function f(){}function g(){}") = undefined FAILED! expected: error<br>
 </tt><br>
-<a name='failure23'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-001.js'>js1_5/Exceptions/catchguard-001.js</a> failed</b> <br>
+<a name='failure21'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-001.js'>js1_5/Exceptions/catchguard-001.js</a> failed</b> <br>
+ [ <a href='#failure20'>Previous Failure</a> | <a href='#failure22'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Exception: SyntaxError: Expected token ')'<br>
+</tt><br>
+<a name='failure22'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-002.js'>js1_5/Exceptions/catchguard-002.js</a> failed</b> <br>
+ [ <a href='#failure21'>Previous Failure</a> | <a href='#failure23'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<tt>Expected exit code 0, got 3<br>
+Testcase terminated with signal 0<br>
+Complete testcase output was:<br>
+Exception: SyntaxError: Expected token ')'<br>
+</tt><br>
+<a name='failure23'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-003.js'>js1_5/Exceptions/catchguard-003.js</a> failed</b> <br>
  [ <a href='#failure22'>Previous Failure</a> | <a href='#failure24'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure24'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-002.js'>js1_5/Exceptions/catchguard-002.js</a> failed</b> <br>
+Exception: SyntaxError: Expected token ')'<br>
+</tt><br>
+<a name='failure24'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/errstack-001.js'>js1_5/Exceptions/errstack-001.js</a> failed</b> <br>
  [ <a href='#failure23'>Previous Failure</a> | <a href='#failure25'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure25'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/catchguard-003.js'>js1_5/Exceptions/catchguard-003.js</a> failed</b> <br>
+Exception: TypeError: 'undefined' is not an object (evaluating 'stackFrames[4].substring')<br>
+global code@./js1_5/Exceptions/errstack-001.js:122<br>
+</tt><br>
+<a name='failure25'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
  [ <a href='#failure24'>Previous Failure</a> | <a href='#failure26'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure26'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/errstack-001.js'>js1_5/Exceptions/errstack-001.js</a> failed</b> <br>
+BUGNUMBER: 50447<br>
+STATUS: Test (non-ECMA) Error object properties fileName, lineNumber<br>
+Exception: TypeError: 'undefined' is not an object (evaluating 'e.fileName.search')<br>
+testRealError@./js1_5/Exceptions/regress-50447.js:65<br>
+test@./js1_5/Exceptions/regress-50447.js:44<br>
+global code@./js1_5/Exceptions/regress-50447.js:34<br>
+</tt><br>
+<a name='failure26'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
  [ <a href='#failure25'>Previous Failure</a> | <a href='#failure27'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Exceptions/regress-50447.js'>js1_5/Exceptions/regress-50447.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=50447' target='other_window'>Bug Number 50447</a><br>
+Exception: SyntaxError: Expected an identifier but found 'getter' instead<br>
+</tt><br>
+<a name='failure27'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-002.js'>js1_5/GetSet/getset-002.js</a> failed</b> <br>
  [ <a href='#failure26'>Previous Failure</a> | <a href='#failure28'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-BUGNUMBER: 50447<br>
-STATUS: Test (non-ECMA) Error object properties fileName, lineNumber<br>
+Exception: SyntaxError: Expected an identifier but found 'getter' instead<br>
 </tt><br>
-<a name='failure28'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-001.js'>js1_5/GetSet/getset-001.js</a> failed</b> <br>
+<a name='failure28'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-003.js'>js1_5/GetSet/getset-003.js</a> failed</b> <br>
  [ <a href='#failure27'>Previous Failure</a> | <a href='#failure29'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure29'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-002.js'>js1_5/GetSet/getset-002.js</a> failed</b> <br>
+Exception: SyntaxError: Expected an identifier but found 'setter' instead<br>
+</tt><br>
+<a name='failure29'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-001.js'>js1_5/Object/regress-90596-001.js</a> failed</b> <br>
  [ <a href='#failure28'>Previous Failure</a> | <a href='#failure30'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure30'></a><dd><b>Testcase <a target='other_window' href='./js1_5/GetSet/getset-003.js'>js1_5/GetSet/getset-003.js</a> failed</b> <br>
+Exception: TypeError: 'undefined' is not a function (evaluating 'obj.toSource()')<br>
+global code@./js1_5/Object/regress-90596-001.js:48<br>
+</tt><br>
+<a name='failure30'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
  [ <a href='#failure29'>Previous Failure</a> | <a href='#failure31'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure31'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-001.js'>js1_5/Object/regress-90596-001.js</a> failed</b> <br>
+Exception: ReferenceError: Can't find variable: uneval<br>
+global code@./js1_5/Object/regress-90596-002.js:48<br>
+</tt><br>
+<a name='failure31'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
  [ <a href='#failure30'>Previous Failure</a> | <a href='#failure32'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-90596-002.js'>js1_5/Object/regress-90596-002.js</a> failed</b> <br>
+Exception: TypeError: 'undefined' is not a function (evaluating 'obj1.toSource()')<br>
+global code@./js1_5/Object/regress-96284-001.js:49<br>
+</tt><br>
+<a name='failure32'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
  [ <a href='#failure31'>Previous Failure</a> | <a href='#failure33'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-001.js'>js1_5/Object/regress-96284-001.js</a> failed</b> <br>
+Exception: ReferenceError: Can't find variable: uneval<br>
+global code@./js1_5/Object/regress-96284-002.js:49<br>
+</tt><br>
+<a name='failure33'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
  [ <a href='#failure32'>Previous Failure</a> | <a href='#failure34'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure34'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Object/regress-96284-002.js'>js1_5/Object/regress-96284-002.js</a> failed</b> <br>
- [ <a href='#failure33'>Previous Failure</a> | <a href='#failure35'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure35'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-44009.js'>js1_5/Regress/regress-44009.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=44009' target='other_window'>Bug Number 44009</a><br>
- [ <a href='#failure34'>Previous Failure</a> | <a href='#failure36'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
-<tt>Expected exit code 0, got 3<br>
-Testcase terminated with signal 0<br>
-Complete testcase output was:<br>
 BUGNUMBER: 44009<br>
 STATUS: Testing that we don't crash on obj.toSource()<br>
+Exception: TypeError: 'undefined' is not a function (evaluating 'obj.toSource()')<br>
+testThis@./js1_5/Regress/regress-44009.js:60<br>
+test@./js1_5/Regress/regress-44009.js:48<br>
+global code@./js1_5/Regress/regress-44009.js:35<br>
 </tt><br>
-<a name='failure36'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
- [ <a href='#failure35'>Previous Failure</a> | <a href='#failure37'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure34'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-103602.js'>js1_5/Regress/regress-103602.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=103602' target='other_window'>Bug Number 103602</a><br>
+ [ <a href='#failure33'>Previous Failure</a> | <a href='#failure35'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Reassignment to a const is NOT an error per ECMA<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 1 of test -<br>
@@ -282,26 +300,32 @@ FAILED!: [reported from test()] Section 3 of test -<br>
 FAILED!: [reported from test()] Expected value '1', Actual value '2'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
- [ <a href='#failure36'>Previous Failure</a> | <a href='#failure38'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure35'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-104077.js'>js1_5/Regress/regress-104077.js</a> failed</b> <br>
+ [ <a href='#failure34'>Previous Failure</a> | <a href='#failure36'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
- [ <a href='#failure37'>Previous Failure</a> | <a href='#failure39'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+Exception: SyntaxError: Expected token ')'<br>
+</tt><br>
+<a name='failure36'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-127557.js'>js1_5/Regress/regress-127557.js</a> failed</b> <br>
+ [ <a href='#failure35'>Previous Failure</a> | <a href='#failure37'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
- [ <a href='#failure38'>Previous Failure</a> | <a href='#failure40'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+Exception: ReferenceError: Can't find variable: clone<br>
+global code@./js1_5/Regress/regress-127557.js:75<br>
+</tt><br>
+<a name='failure37'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-172699.js'>js1_5/Regress/regress-172699.js</a> failed</b> <br>
+ [ <a href='#failure36'>Previous Failure</a> | <a href='#failure38'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
- [ <a href='#failure39'>Previous Failure</a> | <a href='#failure41'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+Exception: URIError: URI error<br>
+decodeURI@[native code]<br>
+global code@./js1_5/Regress/regress-172699.js:61<br>
+</tt><br>
+<a name='failure38'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Regress/regress-179524.js'>js1_5/Regress/regress-179524.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=179524' target='other_window'>Bug Number 179524</a><br>
+ [ <a href='#failure37'>Previous Failure</a> | <a href='#failure39'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Don't crash on extraneous arguments to str.match(), etc.<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Section 14 of test -<br>
@@ -351,14 +375,16 @@ FAILED!: [reported from test()] Section 36 of test -<br>
 FAILED!: [reported from test()] Expected value 'SHOULD HAVE FALLEN INTO CATCH-BLOCK!', Actual value 'ABC Zbc'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
- [ <a href='#failure40'>Previous Failure</a> | <a href='#failure42'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure39'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/regress-220584.js'>js1_5/Scope/regress-220584.js</a> failed</b> <br>
+ [ <a href='#failure38'>Previous Failure</a> | <a href='#failure40'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
- [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+Exception: ReferenceError: Can't find variable: Script<br>
+global code@./js1_5/Scope/regress-220584.js:56<br>
+</tt><br>
+<a name='failure40'></a><dd><b>Testcase <a target='other_window' href='./js1_5/Scope/scope-001.js'>js1_5/Scope/scope-001.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=53268' target='other_window'>Bug Number 53268</a><br>
+ [ <a href='#failure39'>Previous Failure</a> | <a href='#failure41'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: Testing scope after changing obj.__proto__<br>
 Failure messages were:<br>
 FAILED!: [reported from test()] Step 1:  setting obj.__proto__ = global object<br>
@@ -369,8 +395,8 @@ FAILED!: [reported from test()] Type mismatch, expected type undefined, actual t
 FAILED!: [reported from test()] Expected value 'undefined', Actual value '1'<br>
 FAILED!: [reported from test()] <br>
 </tt><br>
-<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
- [ <a href='#failure42'>Previous Failure</a> | <a href='#failure44'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure41'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-301574.js'>js1_6/Regress/regress-301574.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=301574' target='other_window'>Bug Number 301574</a><br>
+ [ <a href='#failure40'>Previous Failure</a> | <a href='#failure42'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>STATUS: E4X should be enabled even when e4x=1 not specified<br>
 Failure messages were:<br>
 FAILED!: E4X should be enabled even when e4x=1 not specified: XML()<br>
@@ -380,26 +406,30 @@ FAILED!: E4X should be enabled even when e4x=1 not specified: XMLList()<br>
 FAILED!: Expected value 'No error', Actual value 'error: ReferenceError: Can't find variable: XML'<br>
 FAILED!: <br>
 </tt><br>
-<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
- [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+<a name='failure42'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-309242.js'>js1_6/Regress/regress-309242.js</a> failed</b> <br>
+ [ <a href='#failure41'>Previous Failure</a> | <a href='#failure43'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure45'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
- [ <a href='#failure44'>Previous Failure</a> | <a href='#failure46'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+Exception: SyntaxError: Unexpected token '<'<br>
+</tt><br>
+<a name='failure43'></a><dd><b>Testcase <a target='other_window' href='./js1_6/Regress/regress-314887.js'>js1_6/Regress/regress-314887.js</a> failed</b> <br>
+ [ <a href='#failure42'>Previous Failure</a> | <a href='#failure44'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
-Testcase produced no output!</tt><br>
-<a name='failure46'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
- [ <a href='#failure45'>Previous Failure</a> | <a href='#failure47'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
+Exception: SyntaxError: Unexpected token '<'<br>
+</tt><br>
+<a name='failure44'></a><dd><b>Testcase <a target='other_window' href='./js1_6/String/regress-306591.js'>js1_6/String/regress-306591.js</a> failed</b> <a href='http://bugzilla.mozilla.org/show_bug.cgi?id=306591' target='other_window'>Bug Number 306591</a><br>
+ [ <a href='#failure43'>Previous Failure</a> | <a href='#failure45'>Next Failure</a> | <a href='#tippy_top'>Top of Page</a> ]<br>
 <tt>Expected exit code 0, got 3<br>
 Testcase terminated with signal 0<br>
 Complete testcase output was:<br>
 BUGNUMBER: 306591<br>
 STATUS: String static methods<br>
 STATUS: See https://bugzilla.mozilla.org/show_bug.cgi?id=304828<br>
+Exception: TypeError: 'undefined' is not a function (evaluating 'String.split(new String('abc'), '')')<br>
+global code@./js1_6/String/regress-306591.js:48<br>
 </tt><br>
 </dl>
 [ <a href='#tippy_top'>Top of Page</a> | <a href='#fail_detail'>Top of Failures</a> ]<br>
@@ -407,9 +437,9 @@ STATUS: See https://bugzilla.mozilla.org/show_bug.cgi?id=304828<br>
 <pre>
 <a name='retest_list'></a>
 <h2>Retest List</h2><br>
-# Retest List, squirrelfish, generated Tue Apr  3 22:31:56 2012.
+# Retest List, squirrelfish, generated Thu Sep  6 15:11:19 2012.
 # Original test base was: All tests.
-# 1116 of 1124 test(s) were completed, 46 failures reported.
+# 1116 of 1124 test(s) were completed, 44 failures reported.
 ecma_2/Exceptions/function-001.js
 ecma_2/RegExp/regress-001.js
 ecma_3/FunExpr/fe-001.js
@@ -419,8 +449,6 @@ js1_2/Objects/toString-001.js
 js1_2/function/Function_object.js
 js1_2/function/function-001-n.js
 js1_2/function/regexparg-1.js
-js1_2/function/tostring-1.js
-js1_2/function/tostring-2.js
 js1_2/operator/equality.js
 js1_2/regexp/RegExp_lastIndex.js
 js1_2/regexp/regress-6359.js
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-1.js b/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-1.js
index d532d65af..cf83f48c1 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-1.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-1.js
@@ -34,6 +34,15 @@
     Date:               12 november 1997
 */
 
+// These test cases should not be testing for a particular
+// whitespace formatting (this is implementation defined).
+// Strip out whitespace, or in the case of whitespace
+// abutting a word character reduce to a single space.
+function simplify(str)
+{
+    return str.replace(/\s+/g, " ").replace(/ (\W)/g, "$1").replace(/(\W) /g, "$1").trim();
+}
+
     var SECTION = "tostring-1";
     var VERSION = "JS1_2";
     startTest();
@@ -60,28 +69,28 @@
 
     testcases[tc++] = new TestCase( SECTION,
                                     "stub.toString()",
-                                    t1.valueOf(),
-                                    stub.toString() );
+                                    simplify(t1.valueOf()),
+                                    simplify(stub.toString()) );
 
     testcases[tc++] = new TestCase( SECTION,
                                     "ToString.toString()",
-                                    t2.valueOf(),
-                                    ToString.toString() );
+                                    simplify(t2.valueOf()),
+                                    simplify(ToString.toString()) );
 
     testcases[tc++] = new TestCase( SECTION,
                                     "Add.toString()",
-                                    t3.valueOf(),
-                                    Add.toString() );
+                                    simplify(t3.valueOf()),
+                                    simplify(Add.toString()) );
 
     testcases[tc++] = new TestCase( SECTION,
                                     "noop.toString()",
-                                    t4.toString(),
-                                    noop.toString() );
+                                    simplify(t4.toString()),
+                                    simplify(noop.toString()) );
 
     testcases[tc++] = new TestCase( SECTION,
                                     "f.toString()",
-                                    t5.toString(),
-                                    f.toString() );
+                                    simplify(t5.toString()),
+                                    simplify(f.toString()) );
     test();
 
 function noop( value ) {
diff --git a/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-2.js b/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-2.js
index 146764d2f..8858d194e 100644
--- a/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-2.js
+++ b/Source/JavaScriptCore/tests/mozilla/js1_2/function/tostring-2.js
@@ -37,6 +37,15 @@
     Date:               12 november 1997
 */
 
+// These test cases should not be testing for a particular
+// whitespace formatting (this is implementation defined).
+// Strip out whitespace, or in the case of whitespace
+// abutting a word character reduce to a single space.
+function simplify(str)
+{
+    return str.replace(/\s+/g, " ").replace(/ (\W)/g, "$1").replace(/(\W) /g, "$1").trim();
+}
+
     var SECTION = "tostring-2";
     var VERSION = "JS1_2";
     startTest();
@@ -72,22 +81,26 @@ function ReallyDoesntEqual( a, b ) {
     return a !== b;
 }
 
+// Modified to match expected results; JSC won't automatically insert redundant braces into the result.
 var testor = new TestFunction( "TestOr", "a",  tab+"if (a == null || a == void 0) {\n"+
     tab +tab+"return 0;\n"+tab+"} else {\n"+tab+tab+"return a;\n"+tab+"}" );
 function TestOr( a ) {
- if ( a == null || a == void 0 )
+ if ( a == null || a == void 0 ) {
     return 0;
- else
+ } else {
     return a;
+ }
 }
 
+// Modified to match expected results; JSC won't automatically insert redundant braces into the result.
 var testand = new TestFunction( "TestAnd", "a", tab+"if (a != null && a != void 0) {\n"+
     tab+tab+"return a;\n" + tab+ "} else {\n"+tab+tab+"return 0;\n"+tab+"}" );
 function TestAnd( a ) {
- if ( a != null && a != void 0 )
+ if ( a != null && a != void 0 ) {
     return a;
- else
+ } else {
     return 0;
+ }
 }
 
 var or = new TestFunction( "Or", "a, b", tab + "return a | b;" );
@@ -107,48 +120,48 @@ function XOr( a, b ) {
 
     testcases[testcases.length] = new TestCase( SECTION,
         "Equals.toString()",
-        equals.valueOf(),
-        Equals.toString() );
+        simplify(equals.valueOf()),
+        simplify(Equals.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "ReallyEquals.toString()",
-        reallyequals.valueOf(),
-        ReallyEquals.toString() );
+        simplify(reallyequals.valueOf()),
+        simplify(ReallyEquals.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "DoesntEqual.toString()",
-        doesntequal.valueOf(),
-        DoesntEqual.toString() );
+        simplify(doesntequal.valueOf()),
+        simplify(DoesntEqual.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "ReallyDoesntEqual.toString()",
-        reallydoesntequal.valueOf(),
-        ReallyDoesntEqual.toString() );
+        simplify(reallydoesntequal.valueOf()),
+        simplify(ReallyDoesntEqual.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "TestOr.toString()",
-        testor.valueOf(),
-        TestOr.toString() );
+        simplify(testor.valueOf()),
+        simplify(TestOr.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "TestAnd.toString()",
-        testand.valueOf(),
-        TestAnd.toString() );
+        simplify(testand.valueOf()),
+        simplify(TestAnd.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "Or.toString()",
-        or.valueOf(),
-        Or.toString() );
+        simplify(or.valueOf()),
+        simplify(Or.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "And.toString()",
-        and.valueOf(),
-        And.toString() );
+        simplify(and.valueOf()),
+        simplify(And.toString()) );
 
     testcases[testcases.length] = new TestCase( SECTION,
         "XOr.toString()",
-        xor.valueOf(),
-        XOr.toString() );
+        simplify(xor.valueOf()),
+        simplify(XOr.toString()) );
 
     test();
 
diff --git a/Source/JavaScriptCore/tools/CodeProfile.h b/Source/JavaScriptCore/tools/CodeProfile.h
index ea360bcbc..db380eedb 100644
--- a/Source/JavaScriptCore/tools/CodeProfile.h
+++ b/Source/JavaScriptCore/tools/CodeProfile.h
@@ -33,6 +33,7 @@
 namespace JSC {
 
 class CodeProfile {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     CodeProfile(const SourceCode& source, CodeProfile* parent)
         : m_file(source.provider()->url().utf8())
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
index ba10171bf..5c2a287c8 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
@@ -27,12 +27,12 @@
 #include "config.h"
 #include "YarrInterpreter.h"
 
-#include "UString.h"
 #include "Yarr.h"
 #include "YarrCanonicalizeUCS2.h"
 #include <wtf/BumpPointerAllocator.h>
 #include <wtf/DataLog.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 
 #ifndef NDEBUG
 #include <stdio.h>
@@ -1934,7 +1934,7 @@ PassOwnPtr<BytecodePattern> byteCompile(YarrPattern& pattern, BumpPointerAllocat
     return ByteCompiler(pattern).compile(allocator);
 }
 
-unsigned interpret(BytecodePattern* bytecode, const UString& input, unsigned start, unsigned* output)
+unsigned interpret(BytecodePattern* bytecode, const String& input, unsigned start, unsigned* output)
 {
     if (input.is8Bit())
         return Interpreter<LChar>(bytecode, output, input.characters8(), input.length(), start).interpret();
diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.h b/Source/JavaScriptCore/yarr/YarrInterpreter.h
index 4ecd69eca..fb60bd979 100644
--- a/Source/JavaScriptCore/yarr/YarrInterpreter.h
+++ b/Source/JavaScriptCore/yarr/YarrInterpreter.h
@@ -376,7 +376,7 @@ private:
 };
 
 JS_EXPORT_PRIVATE PassOwnPtr<BytecodePattern> byteCompile(YarrPattern&, BumpPointerAllocator*);
-JS_EXPORT_PRIVATE unsigned interpret(BytecodePattern*, const UString& input, unsigned start, unsigned* output);
+JS_EXPORT_PRIVATE unsigned interpret(BytecodePattern*, const String& input, unsigned start, unsigned* output);
 unsigned interpret(BytecodePattern*, const LChar* input, unsigned length, unsigned start, unsigned* output);
 unsigned interpret(BytecodePattern*, const UChar* input, unsigned length, unsigned start, unsigned* output);
 
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.cpp b/Source/JavaScriptCore/yarr/YarrJIT.cpp
index eb9861fed..ee6e39753 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.cpp
+++ b/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -39,7 +39,7 @@ namespace JSC { namespace Yarr {
 
 template<YarrJITCompileMode compileMode>
 class YarrGenerator : private MacroAssembler {
-    friend void jitCompile(JSGlobalData*, YarrCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
+    friend void jitCompile(JSGlobalData*, YarrCodeBlock& jitObject, const String& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
 
 #if CPU(ARM)
     static const RegisterID input = ARMRegisters::r0;
diff --git a/Source/JavaScriptCore/yarr/YarrJIT.h b/Source/JavaScriptCore/yarr/YarrJIT.h
index 71928e73c..bb7033fde 100644
--- a/Source/JavaScriptCore/yarr/YarrJIT.h
+++ b/Source/JavaScriptCore/yarr/YarrJIT.h
@@ -31,7 +31,6 @@
 #include "JSGlobalData.h"
 #include "MacroAssemblerCodeRef.h"
 #include "MatchResult.h"
-#include "UString.h"
 #include "Yarr.h"
 #include "YarrPattern.h"
 
diff --git a/Source/JavaScriptCore/yarr/YarrParser.h b/Source/JavaScriptCore/yarr/YarrParser.h
index 1182d7907..4bab1a090 100644
--- a/Source/JavaScriptCore/yarr/YarrParser.h
+++ b/Source/JavaScriptCore/yarr/YarrParser.h
@@ -26,9 +26,9 @@
 #ifndef YarrParser_h
 #define YarrParser_h
 
-#include <runtime/UString.h>
 #include "Yarr.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/text/WTFString.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
@@ -47,7 +47,7 @@ template<class Delegate, typename CharType>
 class Parser {
 private:
     template<class FriendDelegate>
-    friend const char* parse(FriendDelegate& delegate, const UString& pattern, unsigned backReferenceLimit);
+    friend const char* parse(FriendDelegate&, const String& pattern, unsigned backReferenceLimit);
 
     enum ErrorCode {
         NoError,
@@ -228,7 +228,7 @@ private:
         UChar m_character;
     };
 
-    Parser(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit)
+    Parser(Delegate& delegate, const String& pattern, unsigned backReferenceLimit)
         : m_delegate(delegate)
         , m_backReferenceLimit(backReferenceLimit)
         , m_err(NoError)
@@ -868,7 +868,7 @@ private:
  */
 
 template<class Delegate>
-const char* parse(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit = quantifyInfinite)
+const char* parse(Delegate& delegate, const String& pattern, unsigned backReferenceLimit = quantifyInfinite)
 {
     if (pattern.is8Bit())
         return Parser<Delegate, LChar>(delegate, pattern, backReferenceLimit).parse();
diff --git a/Source/JavaScriptCore/yarr/YarrPattern.cpp b/Source/JavaScriptCore/yarr/YarrPattern.cpp
index bbda9c526..5080929f4 100644
--- a/Source/JavaScriptCore/yarr/YarrPattern.cpp
+++ b/Source/JavaScriptCore/yarr/YarrPattern.cpp
@@ -820,7 +820,7 @@ private:
     bool m_invertParentheticalAssertion;
 };
 
-const char* YarrPattern::compile(const UString& patternString)
+const char* YarrPattern::compile(const String& patternString)
 {
     YarrPatternConstructor constructor(*this);
 
@@ -853,7 +853,7 @@ const char* YarrPattern::compile(const UString& patternString)
     return 0;
 }
 
-YarrPattern::YarrPattern(const UString& pattern, bool ignoreCase, bool multiline, const char** error)
+YarrPattern::YarrPattern(const String& pattern, bool ignoreCase, bool multiline, const char** error)
     : m_ignoreCase(ignoreCase)
     , m_multiline(multiline)
     , m_containsBackreferences(false)
diff --git a/Source/JavaScriptCore/yarr/YarrPattern.h b/Source/JavaScriptCore/yarr/YarrPattern.h
index a31deee67..14e89b8e0 100644
--- a/Source/JavaScriptCore/yarr/YarrPattern.h
+++ b/Source/JavaScriptCore/yarr/YarrPattern.h
@@ -27,10 +27,10 @@
 #ifndef YarrPattern_h
 #define YarrPattern_h
 
-#include <runtime/UString.h>
 #include <wtf/CheckedArithmetic.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace JSC { namespace Yarr {
@@ -316,7 +316,7 @@ struct TermChain {
 };
 
 struct YarrPattern {
-    JS_EXPORT_PRIVATE YarrPattern(const UString& pattern, bool ignoreCase, bool multiline, const char** error);
+    JS_EXPORT_PRIVATE YarrPattern(const String& pattern, bool ignoreCase, bool multiline, const char** error);
 
     ~YarrPattern()
     {
@@ -405,7 +405,7 @@ struct YarrPattern {
     Vector<CharacterClass*> m_userCharacterClasses;
 
 private:
-    const char* compile(const UString& patternString);
+    const char* compile(const String& patternString);
 
     CharacterClass* newlineCached;
     CharacterClass* digitsCached;
diff --git a/Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp b/Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp
index 51fda94d8..aa98c4a35 100644
--- a/Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp
+++ b/Source/JavaScriptCore/yarr/YarrSyntaxChecker.cpp
@@ -50,7 +50,7 @@ public:
     void disjunction() {}
 };
 
-const char* checkSyntax(const UString& pattern)
+const char* checkSyntax(const String& pattern)
 {
     SyntaxChecker syntaxChecker;
     return parse(syntaxChecker, pattern);
diff --git a/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h b/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
index 2013671eb..104ced3ab 100644
--- a/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
+++ b/Source/JavaScriptCore/yarr/YarrSyntaxChecker.h
@@ -26,11 +26,11 @@
 #ifndef YarrSyntaxChecker_h
 #define YarrSyntaxChecker_h
 
-#include <runtime/UString.h>
+#include <wtf/text/WTFString.h>
 
 namespace JSC { namespace Yarr {
 
-const char* checkSyntax(const UString& pattern);
+const char* checkSyntax(const String& pattern);
 
 }} // JSC::YARR
 
diff --git a/Source/JavaScriptCore/yarr/yarr.pri b/Source/JavaScriptCore/yarr/yarr.pri
index 623098fd3..7e9b4d3f3 100644
--- a/Source/JavaScriptCore/yarr/yarr.pri
+++ b/Source/JavaScriptCore/yarr/yarr.pri
@@ -10,9 +10,3 @@ SOURCES += \
     $$PWD/YarrSyntaxChecker.cpp \
     $$PWD/YarrCanonicalizeUCS2.cpp
 
-# For UString.h
-v8 {
-    INCLUDEPATH += \
-        $$PWD/.. \
-        $$PWD/../runtime
-}