Attachment 454649 Details for Bug 237863 – Patch

[patch] Patch

bug-237863-20220314192511.patch (text/plain), 246.34 KB, created by Yusuke Suzuki on 2022-03-14 19:25:13 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2022-03-14 19:25:13 PDT

Size: 246.34 KB

patch

obsolete

>Subversion Revision: 291199
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 87c9b1cdad585be1b58cb09b8ee219e02838a5d5..8ce4848ddd46a1312074c707c499b2a83a1354fd 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,156 @@
>+2022-03-14  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Use constants buffer in DFG
>+        https://bugs.webkit.org/show_bug.cgi?id=237863
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * assembler/MacroAssemblerARM64.h:
>+        (JSC::MacroAssemblerARM64::transfer64):
>+        (JSC::MacroAssemblerARM64::transferPtr):
>+        * assembler/MacroAssemblerRISCV64.h:
>+        (JSC::MacroAssemblerRISCV64::transfer64):
>+        (JSC::MacroAssemblerRISCV64::transferPtr):
>+        * assembler/MacroAssemblerX86_64.h:
>+        (JSC::MacroAssemblerX86_64::transfer64):
>+        (JSC::MacroAssemblerX86_64::transferPtr):
>+        * bytecode/CodeBlock.cpp:
>+        (JSC::CodeBlock::setupWithUnlinkedBaselineCode):
>+        (JSC::CodeBlock::~CodeBlock):
>+        (JSC::CodeBlock::propagateTransitions):
>+        (JSC::CodeBlock::finalizeJITInlineCaches):
>+        (JSC::CodeBlock::getICStatusMap):
>+        (JSC::CodeBlock::findStubInfo):
>+        (JSC::CodeBlock::resetBaselineJITData):
>+        (JSC::CodeBlock::stronglyVisitStrongReferences):
>+        (JSC::CodeBlock::findPC):
>+        * bytecode/CodeBlock.h:
>+        (JSC::CodeBlock::offsetOfJITData):
>+        (JSC::CodeBlock::baselineJITData):
>+        (JSC::CodeBlock::setDFGJITData):
>+        (JSC::CodeBlock::dfgJITData):
>+        (JSC::CodeBlock::offsetOfBaselineJITData): Deleted.
>+        * dfg/DFGByteCodeParser.cpp:
>+        (JSC::DFG::ByteCodeParser::inliningCost):
>+        * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
>+        * dfg/DFGGraph.cpp:
>+        (JSC::DFG::Graph::watchCondition):
>+        (JSC::DFG::Graph::watchConditions):
>+        (JSC::DFG::Graph::watchGlobalProperty):
>+        (JSC::DFG::Graph::tryGetConstantProperty):
>+        (JSC::DFG::Graph::tryGetConstantClosureVar):
>+        (JSC::DFG::Graph::tryGetFoldableView):
>+        (JSC::DFG::Graph::getRegExpPrototypeProperty):
>+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):
>+        (JSC::DFG::Graph::canDoFastSpread):
>+        * dfg/DFGGraph.h:
>+        * dfg/DFGJITCode.h:
>+        * dfg/DFGJITCompiler.cpp:
>+        (JSC::DFG::JITCompiler::compileEntry):
>+        (JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
>+        (JSC::DFG::JITCompiler::compile):
>+        (JSC::DFG::JITCompiler::compileFunction):
>+        (JSC::DFG::JITCompiler::loadUnlinkedConstant):
>+        (JSC::DFG::JITCompiler::storeUnlinkedConstant):
>+        (JSC::DFG::JITCompiler::UnlinkedConstant::UnlinkedConstant):
>+        (JSC::DFG::JITCompiler::UnlinkedConstant::materialize):
>+        (JSC::DFG::JITCompiler::UnlinkedConstant::poke):
>+        * dfg/DFGJITCompiler.h:
>+        (JSC::DFG::JITCompiler::branchWeakPtr): Deleted.
>+        * dfg/DFGJITFinalizer.cpp:
>+        (JSC::DFG::JITFinalizer::finalize):
>+        * dfg/DFGPlan.cpp:
>+        (JSC::DFG::Plan::compileInThreadImpl):
>+        (JSC::DFG::Plan::addUnlinkedConstant):
>+        (JSC::DFG::Plan::finalizeJITData):
>+        * dfg/DFGPlan.h:
>+        * dfg/DFGSaneStringGetByValSlowPathGenerator.h:
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::emitGetCallee):
>+        (JSC::DFG::SpeculativeJIT::silentFill):
>+        (JSC::DFG::SpeculativeJIT::compileDeleteById):
>+        (JSC::DFG::SpeculativeJIT::compileDeleteByVal):
>+        (JSC::DFG::SpeculativeJIT::compileInById):
>+        (JSC::DFG::SpeculativeJIT::compileInByVal):
>+        (JSC::DFG::SpeculativeJIT::compileHasPrivate):
>+        (JSC::DFG::SpeculativeJIT::compilePushWithScope):
>+        (JSC::DFG::SpeculativeJIT::compileStringSlice):
>+        (JSC::DFG::SpeculativeJIT::compileToLowerCase):
>+        (JSC::DFG::SpeculativeJIT::compileCurrentBlock):
>+        (JSC::DFG::SpeculativeJIT::compileCheckTraps):
>+        (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
>+        (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
>+        (JSC::DFG::SpeculativeJIT::compilePutByVal):
>+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
>+        (JSC::DFG::SpeculativeJIT::compileFromCharCode):
>+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
>+        * dfg/DFGSpeculativeJIT.h:
>+        (JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):
>+        * dfg/DFGSpeculativeJIT64.cpp:
>+        (JSC::DFG::SpeculativeJIT::cachedGetById):
>+        (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
>+        (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
>+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
>+        (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
>+        (JSC::DFG::SpeculativeJIT::genericJSValueNonPeepholeStrictEq):
>+        (JSC::DFG::SpeculativeJIT::emitCall):
>+        (JSC::DFG::SpeculativeJIT::compileCompareEqPtr):
>+        (JSC::DFG::SpeculativeJIT::emitUntypedBranch):
>+        (JSC::DFG::SpeculativeJIT::compileGetByVal):
>+        (JSC::DFG::SpeculativeJIT::compileRegExpTestInline):
>+        (JSC::DFG::SpeculativeJIT::compile):
>+        * dfg/DFGThunks.cpp:
>+        (JSC::DFG::osrEntryThunkGenerator):
>+        * dfg/DFGTierUpCheckInjectionPhase.cpp:
>+        (JSC::DFG::TierUpCheckInjectionPhase::run):
>+        * jit/AssemblyHelpers.cpp:
>+        (JSC::AssemblyHelpers::emitPutCodeBlockToFrameInPrologue):
>+        * jit/AssemblyHelpers.h:
>+        * jit/CCallHelpers.h:
>+        (JSC::CCallHelpers::pokeForArgument):
>+        (JSC::CCallHelpers::setupArgumentsImpl):
>+        * jit/GPRInfo.h:
>+        (JSC::GPRInfo::toRegister):
>+        * jit/JIT.cpp:
>+        (JSC::JIT::emitPutCodeBlockToFrameInPrologue):
>+        (JSC::JIT::privateCompileMainPass):
>+        (JSC::JIT::emitMaterializeMetadataAndConstantPoolRegisters):
>+        (JSC::JIT::compileAndLinkWithoutFinalizing):
>+        * jit/JIT.h:
>+        * jit/JITCompilationMode.cpp:
>+        (WTF::printInternal):
>+        * jit/JITCompilationMode.h:
>+        (JSC::isDFG):
>+        (JSC::isUnlinked):
>+        * jit/JITOpcodes.cpp:
>+        (JSC::JIT::emit_op_catch):
>+        * jit/JITOperations.cpp:
>+        (JSC::JSC_DEFINE_JIT_OPERATION):
>+        * jit/JITOperations.h:
>+        * jit/JITPlan.cpp:
>+        (JSC::JITPlan::tier const):
>+        (JSC::JITPlan::reportCompileTimes const):
>+        * jit/JITPlan.h:
>+        (JSC::JITPlan::isDFG const):
>+        (JSC::JITPlan::isUnlinked const):
>+        * jit/RegisterSet.cpp:
>+        (JSC::RegisterSet::llintBaselineCalleeSaveRegisters):
>+        (JSC::RegisterSet::dfgCalleeSaveRegisters):
>+        (JSC::RegisterSet::ftlCalleeSaveRegisters):
>+        * llint/LLIntData.h:
>+        * llint/LowLevelInterpreter.asm:
>+        * profiler/ProfilerCompilationKind.cpp:
>+        (WTF::printInternal):
>+        * profiler/ProfilerCompilationKind.h:
>+        * runtime/ArrayBuffer.h:
>+        (JSC::ArrayBufferContents::dataWithoutPACValidation const):
>+        (JSC::ArrayBuffer::dataWithoutPACValidation):
>+        (JSC::ArrayBuffer::dataWithoutPACValidation const):
>+        * runtime/JSArrayBufferViewInlines.h:
>+        (JSC::JSArrayBufferView::byteOffsetImpl):
>+        * runtime/JSGlobalObject.h:
>+        (JSC::JSGlobalObject::offsetOfGlobalThis):
>+
> 2022-03-11  Adrian Perez de Castro  <aperez@igalia.com>
> 
>         [GLib] Expose ArrayBuffer in the public API
>diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
>index 633773aeec9d1c967fa98a5acb2a12452eb2507c..c8d7e7ddda3642c40ee4f5458b98fbed9079d277 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
>@@ -1960,6 +1960,17 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
>         store64(dataTempRegister, address);
>     }
> 
>+    void transfer64(Address src, Address dest)
>+    {
>+        load64(src, getCachedDataTempRegisterIDAndInvalidate());
>+        store64(getCachedDataTempRegisterIDAndInvalidate(), dest);
>+    }
>+
>+    void transferPtr(Address src, Address dest)
>+    {
>+        transfer64(src, dest);
>+    }
>+
>     DataLabel32 store64WithAddressOffsetPatch(RegisterID src, Address address)
>     {
>         DataLabel32 label(this);
>diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerRISCV64.h b/Source/JavaScriptCore/assembler/MacroAssemblerRISCV64.h
>index 364686dff68994deaa04e956636ad62f02ec1155..b3bf6ebf97021536828d28d01ad480c358cb9f23 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssemblerRISCV64.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssemblerRISCV64.h
>@@ -1171,6 +1171,18 @@ class MacroAssemblerRISCV64 : public AbstractMacroAssembler<Assembler> {
>         m_assembler.sdInsn(temp.memory(), immRegister, Imm::S<0>());
>     }
> 
>+    void transfer64(Address src, Address dest)
>+    {
>+        auto temp = temps<Data>();
>+        load64(src, temp.data());
>+        store64(temp.data(), dest);
>+    }
>+
>+    void transferPtr(Address src, Address dest)
>+    {
>+        transfer64(src, dest);
>+    }
>+
>     void storePair32(RegisterID src1, RegisterID src2, RegisterID dest)
>     {
>         storePair32(src1, src2, dest, TrustedImm32(0));
>diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
>index b2e911aa13663a2509840a05688412f2928ef463..1bec9e855bfca81b091448adacd52f8ff1e57659 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
>@@ -1026,6 +1026,17 @@ class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
>         move(imm, scratchRegister());
>         m_assembler.movq_rm(scratchRegister(), address.offset, address.base, address.index, address.scale);
>     }
>+
>+    void transfer64(Address src, Address dest)
>+    {
>+        load64(src, scratchRegister());
>+        store64(scratchRegister(), dest);
>+    }
>+
>+    void transferPtr(Address src, Address dest)
>+    {
>+        transfer64(src, dest);
>+    }
>     
>     DataLabel32 store64WithAddressOffsetPatch(RegisterID src, Address address)
>     {
>diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
>index 098aed935a68f7d6687bd3523253077f31ed19f2..2596f834906b3d81dc3c73437eb12136d02ed1ac 100644
>--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
>+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
>@@ -787,9 +787,9 @@ void CodeBlock::setupWithUnlinkedBaselineCode(Ref<BaselineJITCode> jitCode)
> 
>     {
>         ConcurrentJSLocker locker(m_lock);
>-        ASSERT(!m_baselineJITData);
>-        m_baselineJITData = BaselineJITData::create(jitCode->m_constantPool.size());
>-        m_baselineJITData->m_stubInfos = FixedVector<StructureStubInfo>(jitCode->m_unlinkedStubInfos.size());
>+        ASSERT(!m_jitData);
>+        auto baselineJITData = BaselineJITData::create(jitCode->m_constantPool.size());
>+        baselineJITData->m_stubInfos = FixedVector<StructureStubInfo>(jitCode->m_unlinkedStubInfos.size());
>         for (auto& unlinkedCallLinkInfo : jitCode->m_unlinkedCalls) {
>             CallLinkInfo* callLinkInfo = getCallLinkInfoForBytecodeIndex(locker, unlinkedCallLinkInfo.bytecodeIndex);
>             ASSERT(callLinkInfo);
>@@ -800,28 +800,29 @@ void CodeBlock::setupWithUnlinkedBaselineCode(Ref<BaselineJITCode> jitCode)
>             auto entry = jitCode->m_constantPool.at(i);
>             switch (entry.type()) {
>             case JITConstantPool::Type::GlobalObject:
>-                m_baselineJITData->at(i) = m_globalObject.get();
>+                baselineJITData->at(i) = m_globalObject.get();
>                 break;
>             case JITConstantPool::Type::StructureStubInfo: {
>                 unsigned index = bitwise_cast<uintptr_t>(entry.pointer());
>                 UnlinkedStructureStubInfo& unlinkedStubInfo = jitCode->m_unlinkedStubInfos[index];
>-                StructureStubInfo& stubInfo = m_baselineJITData->m_stubInfos[index];
>+                StructureStubInfo& stubInfo = baselineJITData->m_stubInfos[index];
>                 stubInfo.initializeFromUnlinkedStructureStubInfo(this, unlinkedStubInfo);
>-                m_baselineJITData->at(i) = &stubInfo;
>+                baselineJITData->at(i) = &stubInfo;
>                 break;
>             }
>             case JITConstantPool::Type::FunctionDecl: {
>                 unsigned index = bitwise_cast<uintptr_t>(entry.pointer());
>-                m_baselineJITData->at(i) = functionDecl(index);
>+                baselineJITData->at(i) = functionDecl(index);
>                 break;
>             }
>             case JITConstantPool::Type::FunctionExpr: {
>                 unsigned index = bitwise_cast<uintptr_t>(entry.pointer());
>-                m_baselineJITData->at(i) = functionExpr(index);
>+                baselineJITData->at(i) = functionExpr(index);
>                 break;
>             }
>             }
>         }
>+        m_jitData = baselineJITData.release();
>     }
> 
>     switch (codeType()) {
>@@ -906,20 +907,24 @@ CodeBlock::~CodeBlock()
>     // destructors.
> 
> #if ENABLE(JIT)
>-    if (auto* jitData = m_baselineJITData.get()) {
>-        for (auto& stubInfo : jitData->m_stubInfos) {
>-            stubInfo.aboutToDie();
>-            stubInfo.deref();
>-        }
>-    }
>-#if ENABLE(DFG_JIT)
>     if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>         for (auto* stubInfo : jitCode()->dfgCommon()->m_stubInfos) {
>             stubInfo->aboutToDie();
>             stubInfo->deref();
>         }
>-    }
>+        if (m_jitData)
>+            delete bitwise_cast<DFG::DFGJITData*>(m_jitData);
> #endif
>+    } else {
>+        if (auto* jitData = baselineJITData()) {
>+            for (auto& stubInfo : jitData->m_stubInfos) {
>+                stubInfo.aboutToDie();
>+                stubInfo.deref();
>+            }
>+            delete jitData;
>+        }
>+    }
> #endif // ENABLE(JIT)
> }
> 
>@@ -1248,18 +1253,17 @@ void CodeBlock::propagateTransitions(const ConcurrentJSLocker&, Visitor& visitor
>     }
> 
> #if ENABLE(JIT)
>-    if (JITCode::isJIT(jitType())) {
>-        if (auto* jitData = m_baselineJITData.get()) {
>-            for (auto& stubInfo : jitData->m_stubInfos)
>-                stubInfo.propagateTransitions(visitor);
>-        }
>-    }
>-#if ENABLE(DFG_JIT)
>     if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>         for (auto* stubInfo : jitCode()->dfgCommon()->m_stubInfos)
>             stubInfo->propagateTransitions(visitor);
>-    }
> #endif
>+    } else {
>+        if (auto* jitData = baselineJITData()) {
>+            for (auto& stubInfo : jitData->m_stubInfos)
>+                stubInfo.propagateTransitions(visitor);
>+        }
>+    }
> #endif // ENABLE(JIT)
>     
> #if ENABLE(DFG_JIT)
>@@ -1585,15 +1589,8 @@ void CodeBlock::finalizeLLIntInlineCaches()
> #if ENABLE(JIT)
> void CodeBlock::finalizeJITInlineCaches()
> {
>-    if (auto* jitData = m_baselineJITData.get()) {
>-        for (auto& stubInfo : jitData->m_stubInfos) {
>-            ConcurrentJSLockerBase locker(NoLockingNecessary);
>-            stubInfo.visitWeakReferences(locker, this);
>-        }
>-    }
>-
>-#if ENABLE(DFG_JIT)
>     if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>         DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
>         for (auto* callLinkInfo : dfgCommon->m_callLinkInfos)
>             callLinkInfo->visitWeak(vm());
>@@ -1601,8 +1598,15 @@ void CodeBlock::finalizeJITInlineCaches()
>             ConcurrentJSLockerBase locker(NoLockingNecessary);
>             stubInfo->visitWeakReferences(locker, this);
>         }
>-    }
> #endif
>+    } else {
>+        if (auto* jitData = baselineJITData()) {
>+            for (auto& stubInfo : jitData->m_stubInfos) {
>+                ConcurrentJSLockerBase locker(NoLockingNecessary);
>+                stubInfo.visitWeakReferences(locker, this);
>+            }
>+        }
>+    }
> }
> #endif
> 
>@@ -1689,12 +1693,8 @@ void CodeBlock::getICStatusMap(const ConcurrentJSLocker&, ICStatusMap& result)
>     }
> #if ENABLE(JIT)
>     if (JITCode::isJIT(jitType())) {
>-        if (auto* jitData = m_baselineJITData.get()) {
>-            for (auto& stubInfo : jitData->m_stubInfos)
>-                result.add(stubInfo.codeOrigin, ICStatus()).iterator->value.stubInfo = &stubInfo;
>-        }
>-#if ENABLE(DFG_JIT)
>         if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>             DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
>             for (auto* stubInfo : dfgCommon->m_stubInfos)
>                 result.add(stubInfo->codeOrigin, ICStatus()).iterator->value.stubInfo = stubInfo;
>@@ -1710,8 +1710,13 @@ void CodeBlock::getICStatusMap(const ConcurrentJSLocker&, ICStatusMap& result)
>                 result.add(pair.first, ICStatus()).iterator->value.inStatus = pair.second.get();
>             for (auto& pair : dfgCommon->recordedStatuses.deletes)
>                 result.add(pair.first, ICStatus()).iterator->value.deleteStatus = pair.second.get();
>-        }
> #endif
>+        } else {
>+            if (auto* jitData = baselineJITData()) {
>+                for (auto& stubInfo : jitData->m_stubInfos)
>+                    result.add(stubInfo.codeOrigin, ICStatus()).iterator->value.stubInfo = &stubInfo;
>+            }
>+        }
>     }
> #else
>     UNUSED_PARAM(result);
>@@ -1728,21 +1733,21 @@ void CodeBlock::getICStatusMap(ICStatusMap& result)
> StructureStubInfo* CodeBlock::findStubInfo(CodeOrigin codeOrigin)
> {
>     ConcurrentJSLocker locker(m_lock);
>-    if (auto* jitData = m_baselineJITData.get()) {
>-        for (auto& stubInfo : jitData->m_stubInfos) {
>-            if (stubInfo.codeOrigin == codeOrigin)
>-                return &stubInfo;
>-        }
>-    }
>-
>-#if ENABLE(DFG_JIT)
>     if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>         for (auto* stubInfo : jitCode()->dfgCommon()->m_stubInfos) {
>             if (stubInfo->codeOrigin == codeOrigin)
>                 return stubInfo;
>         }
>-    }
> #endif
>+    } else {
>+        if (auto* jitData = baselineJITData()) {
>+            for (auto& stubInfo : jitData->m_stubInfos) {
>+                if (stubInfo.codeOrigin == codeOrigin)
>+                    return &stubInfo;
>+            }
>+        }
>+    }
>     return nullptr;
> }
> 
>@@ -1781,7 +1786,7 @@ void CodeBlock::resetBaselineJITData()
>     RELEASE_ASSERT(!JITCode::isJIT(jitType()));
>     ConcurrentJSLocker locker(m_lock);
>     
>-    if (auto* jitData = m_baselineJITData.get()) {
>+    if (auto* jitData = baselineJITData()) {
>         // We can clear these because no other thread will have references to any stub infos, call
>         // link infos, or by val infos if we don't have JIT code. Attempts to query these data
>         // structures using the concurrent API (getICStatusMap and friends) will return nothing if we
>@@ -1802,7 +1807,7 @@ void CodeBlock::resetBaselineJITData()
>         // We can clear this because the DFG's queries to these data structures are guarded by whether
>         // there is JIT code.
> 
>-        m_baselineJITData = nullptr;
>+        m_jitData = nullptr;
>     }
> }
> #endif
>@@ -1848,19 +1853,19 @@ void CodeBlock::stronglyVisitStrongReferences(const ConcurrentJSLocker& locker,
>     });
> 
> #if ENABLE(JIT)
>-    if (auto* jitData = m_baselineJITData.get()) {
>-        for (auto& stubInfo : jitData->m_stubInfos)
>-            stubInfo.visitAggregate(visitor);
>-    }
>-#endif
>-
>-#if ENABLE(DFG_JIT)
>     if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>         DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
>         for (auto* stubInfo : dfgCommon->m_stubInfos)
>             stubInfo->visitAggregate(visitor);
>         dfgCommon->recordedStatuses.visitAggregate(visitor);
>         visitOSRExitTargets(locker, visitor);
>+#endif
>+    } else {
>+        if (auto* jitData = baselineJITData()) {
>+            for (auto& stubInfo : jitData->m_stubInfos)
>+                stubInfo.visitAggregate(visitor);
>+        }
>     }
> #endif
> }
>@@ -3477,21 +3482,22 @@ std::optional<CodeOrigin> CodeBlock::findPC(void* pc)
> 
>     {
>         ConcurrentJSLocker locker(m_lock);
>-        if (auto* jitData = m_baselineJITData.get()) {
>-            for (auto& stubInfo : jitData->m_stubInfos) {
>-                if (stubInfo.containsPC(pc))
>-                    return stubInfo.codeOrigin;
>-            }
>-        }
>-#if ENABLE(DFG_JIT)
>         if (JITCode::isOptimizingJIT(jitType())) {
>+#if ENABLE(DFG_JIT)
>             DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
>             for (auto* stubInfo : dfgCommon->m_stubInfos) {
>                 if (stubInfo->containsPC(pc))
>                     return stubInfo->codeOrigin;
>             }
>-        }
> #endif
>+        } else {
>+            if (auto* jitData = baselineJITData()) {
>+                for (auto& stubInfo : jitData->m_stubInfos) {
>+                    if (stubInfo.containsPC(pc))
>+                        return stubInfo.codeOrigin;
>+                }
>+            }
>+        }
>     }
> 
>     return m_jitCode->findPC(this, pc);
>diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
>index 46963d73de23e01fd1525451a8347b6c775c1826..4579aed7400888e90ab81263afdfa5c050c40a2a 100644
>--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
>@@ -79,6 +79,7 @@ namespace JSC {
> 
> #if ENABLE(DFG_JIT)
> namespace DFG {
>+class DFGJITData;
> struct OSRExitState;
> } // namespace DFG
> #endif
>@@ -247,7 +248,7 @@ class CodeBlock : public JSCell {
> 
>     std::optional<BytecodeIndex> bytecodeIndexFromCallSiteIndex(CallSiteIndex);
> 
>-    // Because we might throw out baseline JIT code and all its baseline JIT data (m_baselineJITData),
>+    // Because we might throw out baseline JIT code and all its baseline JIT data (m_jitData),
>     // you need to be careful about the lifetime of when you use the return value of this function.
>     // The return value may have raw pointers into this data structure that gets thrown away.
>     // Specifically, you need to ensure that no GC can be finalized (typically that means no
>@@ -258,7 +259,7 @@ class CodeBlock : public JSCell {
> #if ENABLE(JIT)
>     void setupWithUnlinkedBaselineCode(Ref<BaselineJITCode>);
> 
>-    static ptrdiff_t offsetOfBaselineJITData() { return OBJECT_OFFSETOF(CodeBlock, m_baselineJITData); }
>+    static ptrdiff_t offsetOfJITData() { return OBJECT_OFFSETOF(CodeBlock, m_jitData); }
> 
>     StructureStubInfo* addOptimizingStubInfo(AccessType, CodeOrigin);
> 
>@@ -534,9 +535,25 @@ class CodeBlock : public JSCell {
>     StringJumpTable& baselineStringSwitchJumpTable(int tableIndex);
>     BaselineJITData* baselineJITData()
>     {
>-        RELEASE_ASSERT(jitType() == JITType::BaselineJIT);
>-        return m_baselineJITData.get();
>+        if (!JITCode::isOptimizingJIT(jitType()))
>+            return bitwise_cast<BaselineJITData*>(m_jitData);
>+        return nullptr;
>     }
>+
>+#if ENABLE(DFG_JIT)
>+    void setDFGJITData(std::unique_ptr<DFG::DFGJITData>&& jitData)
>+    {
>+        ASSERT(!m_jitData);
>+        m_jitData = jitData.release();
>+    }
>+
>+    DFG::DFGJITData* dfgJITData()
>+    {
>+        if (JITCode::isOptimizingJIT(jitType()))
>+            return bitwise_cast<DFG::DFGJITData*>(m_jitData);
>+        return nullptr;
>+    }
>+#endif
> #endif
>     size_t numberOfUnlinkedSwitchJumpTables() const { return m_unlinkedCode->numberOfUnlinkedSwitchJumpTables(); }
>     const UnlinkedSimpleJumpTable& unlinkedSwitchJumpTable(int tableIndex) { return m_unlinkedCode->unlinkedSwitchJumpTable(tableIndex); }
>@@ -937,7 +954,7 @@ class CodeBlock : public JSCell {
>     RefPtr<JITCode> m_jitCode;
> #if ENABLE(JIT)
> public:
>-    std::unique_ptr<BaselineJITData> m_baselineJITData;
>+    void* m_jitData { nullptr };
> private:
> #endif
> #if ENABLE(DFG_JIT)
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index d98fb76ecb613d26fb6f26d5ba15b3e3db786b01..28f1215b368e3e8a01f0e16d5216862e0f18cb83 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -1566,6 +1566,11 @@ unsigned ByteCodeParser::inliningCost(CallVariant callee, int argumentCountInclu
>         return UINT_MAX;
>     }
> 
>+    if (m_graph.m_plan.isUnlinked()) {
>+        VERBOSE_LOG("    Failing because the compilation mode is unlinked DFG.\n");
>+        return UINT_MAX;
>+    }
>+
>     FunctionExecutable* executable = callee.functionExecutable();
>     if (!executable) {
>         VERBOSE_LOG("    Failing because there is no function executable.\n");
>diff --git a/Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h b/Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h
>index 23fd4547c59b92a9343742a584f7ddcdf291f9eb..4e03aa3ede4289e08c258882908b54b63f39adbb 100644
>--- a/Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h
>+++ b/Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h
>@@ -75,7 +75,7 @@ class CallArrayAllocatorWithVariableSizeSlowPathGenerator final : public Jumping
> public:
>     CallArrayAllocatorWithVariableSizeSlowPathGenerator(
>         MacroAssembler::JumpList from, SpeculativeJIT* jit, P_JITOperation_GStZB function,
>-        GPRReg resultGPR, CCallHelpers::TrustedImmPtr globalObject, RegisteredStructure contiguousStructure, RegisteredStructure arrayStorageStructure, GPRReg sizeGPR, GPRReg storageGPR)
>+        GPRReg resultGPR, JITCompiler::UnlinkedConstant globalObject, RegisteredStructure contiguousStructure, RegisteredStructure arrayStorageStructure, GPRReg sizeGPR, GPRReg storageGPR)
>         : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
>         , m_function(function)
>         , m_contiguousStructure(contiguousStructure)
>@@ -115,7 +115,7 @@ class CallArrayAllocatorWithVariableSizeSlowPathGenerator final : public Jumping
>     RegisteredStructure m_contiguousStructure;
>     RegisteredStructure m_arrayStorageOrContiguousStructure;
>     GPRReg m_resultGPR;
>-    CCallHelpers::TrustedImmPtr m_globalObject;
>+    JITCompiler::UnlinkedConstant m_globalObject;
>     GPRReg m_sizeGPR;
>     GPRReg m_storageGPR;
>     Vector<SilentRegisterSavePlan, 2> m_plans;
>@@ -125,7 +125,7 @@ class CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator final
> public:
>     CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator(
>         MacroAssembler::JumpList from, SpeculativeJIT* jit, P_JITOperation_GStZB function,
>-        GPRReg resultGPR, CCallHelpers::TrustedImmPtr globalObject, GPRReg structureGPR, GPRReg sizeGPR, GPRReg storageGPR)
>+        GPRReg resultGPR, JITCompiler::UnlinkedConstant globalObject, GPRReg structureGPR, GPRReg sizeGPR, GPRReg storageGPR)
>         : JumpingSlowPathGenerator<MacroAssembler::JumpList>(from, jit)
>         , m_function(function)
>         , m_resultGPR(resultGPR)
>@@ -152,7 +152,7 @@ class CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator final
> 
>     P_JITOperation_GStZB m_function;
>     GPRReg m_resultGPR;
>-    CCallHelpers::TrustedImmPtr m_globalObject;
>+    JITCompiler::UnlinkedConstant m_globalObject;
>     GPRReg m_structureGPR;
>     GPRReg m_sizeGPR;
>     GPRReg m_storageGPR;
>diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
>index 144cc192873d076e1effbf84dde6e161a85c1778..63bf4bcede14d4084151ebba0ace33e416f60f60 100644
>--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
>@@ -1061,6 +1061,9 @@ void Graph::clearFlagsOnAllNodes(NodeFlags flags)
> 
> bool Graph::watchCondition(const ObjectPropertyCondition& key)
> {
>+    if (m_plan.isUnlinked())
>+        return false;
>+
>     if (!key.isWatchable())
>         return false;
> 
>@@ -1081,6 +1084,9 @@ bool Graph::watchCondition(const ObjectPropertyCondition& key)
> 
> bool Graph::watchConditions(const ObjectPropertyConditionSet& keys)
> {
>+    if (m_plan.isUnlinked())
>+        return false;
>+
>     if (!keys.isValid())
>         return false;
> 
>@@ -1098,6 +1104,9 @@ bool Graph::isSafeToLoad(JSObject* base, PropertyOffset offset)
> 
> bool Graph::watchGlobalProperty(JSGlobalObject* globalObject, unsigned identifierNumber)
> {
>+    if (m_plan.isUnlinked())
>+        return false;
>+
>     UniquedStringImpl* uid = identifiers()[identifierNumber];
>     // If we already have a WatchpointSet, and it is already invalidated, it means that this scope operation must be changed from GlobalProperty to GlobalLexicalVar,
>     // but we still have stale metadata here since we have not yet executed this bytecode operation since the invalidation. Just emitting ForceOSRExit to update the
>@@ -1267,6 +1276,9 @@ unsigned Graph::requiredRegisterCountForExecutionAndExit()
> JSValue Graph::tryGetConstantProperty(
>     JSValue base, const RegisteredStructureSet& structureSet, PropertyOffset offset)
> {
>+    if (m_plan.isUnlinked())
>+        return JSValue();
>+
>     if (!base || !base.isObject())
>         return JSValue();
>     
>@@ -1352,6 +1364,9 @@ AbstractValue Graph::inferredValueForProperty(
> JSValue Graph::tryGetConstantClosureVar(JSValue base, ScopeOffset offset)
> {
>     // This has an awesome concurrency story. See comment for GetGlobalVar in ByteCodeParser.
>+
>+    if (m_plan.isUnlinked())
>+        return JSValue();
>     
>     if (!base)
>         return JSValue();
>@@ -1402,6 +1417,8 @@ JSValue Graph::tryGetConstantClosureVar(Node* node, ScopeOffset offset)
> 
> JSArrayBufferView* Graph::tryGetFoldableView(JSValue value)
> {
>+    if (m_plan.isUnlinked())
>+        return nullptr;
>     if (!value)
>         return nullptr;
>     JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(m_vm, value);
>@@ -1730,6 +1747,9 @@ MethodOfGettingAValueProfile Graph::methodOfGettingAValueProfileFor(Node* curren
> 
> bool Graph::getRegExpPrototypeProperty(JSObject* regExpPrototype, Structure* regExpPrototypeStructure, UniquedStringImpl* uid, JSValue& returnJSValue)
> {
>+    if (m_plan.isUnlinked())
>+        return false;
>+
>     PropertyOffset offset = regExpPrototypeStructure->getConcurrently(uid);
>     if (!isValidOffset(offset))
>         return false;
>@@ -1777,6 +1797,9 @@ bool Graph::isStringPrototypeMethodSane(JSGlobalObject* globalObject, UniquedStr
> 
> bool Graph::canOptimizeStringObjectAccess(const CodeOrigin& codeOrigin)
> {
>+    if (m_plan.isUnlinked())
>+        return false;
>+
>     if (hasExitSite(codeOrigin, BadCache) || hasExitSite(codeOrigin, BadConstantCache))
>         return false;
> 
>@@ -1829,6 +1852,9 @@ bool Graph::canDoFastSpread(Node* node, const AbstractValue& value)
>     // The parameter 'value' is the AbstractValue for child1 (the thing being spread).
>     ASSERT(node->op() == Spread);
> 
>+    if (m_plan.isUnlinked())
>+        return false;
>+
>     if (node->child1().useKind() != ArrayUse) {
>         // Note: we only speculate on ArrayUse when we've set up the necessary watchpoints
>         // to prove that the iteration protocol is non-observable starting from ArrayPrototype.
>diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
>index fb90041c5ac0f850d815099852ab2209268048b5..d0fa76bf0c07e1aac588bb0582bdc9e2fd3537d5 100644
>--- a/Source/JavaScriptCore/dfg/DFGGraph.h
>+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
>@@ -476,19 +476,6 @@ class Graph final : public virtual Scannable {
>         return jsCast<JSObject*>(object->methodTable(m_vm)->toThis(object, object, ECMAMode::sloppy()));
>     }
>     
>-    ScriptExecutable* executableFor(InlineCallFrame* inlineCallFrame)
>-    {
>-        if (!inlineCallFrame)
>-            return m_codeBlock->ownerExecutable();
>-        
>-        return inlineCallFrame->baselineCodeBlock->ownerExecutable();
>-    }
>-    
>-    ScriptExecutable* executableFor(const CodeOrigin& codeOrigin)
>-    {
>-        return executableFor(codeOrigin.inlineCallFrame());
>-    }
>-    
>     CodeBlock* baselineCodeBlockFor(InlineCallFrame* inlineCallFrame)
>     {
>         if (!inlineCallFrame)
>@@ -503,6 +490,8 @@ class Graph final : public virtual Scannable {
>     
>     bool masqueradesAsUndefinedWatchpointIsStillValid(const CodeOrigin& codeOrigin)
>     {
>+        if (m_plan.isUnlinked())
>+            return false;
>         return globalObjectFor(codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid();
>     }
>     
>@@ -795,12 +784,17 @@ class Graph final : public virtual Scannable {
> 
>     bool isWatchingHavingABadTimeWatchpoint(Node* node)
>     {
>+        if (m_plan.isUnlinked())
>+            return false;
>         JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
>         return watchpoints().isWatched(globalObject->havingABadTimeWatchpoint());
>     }
> 
>     bool isWatchingGlobalObjectWatchpoint(JSGlobalObject* globalObject, InlineWatchpointSet& set)
>     {
>+        if (m_plan.isUnlinked())
>+            return false;
>+
>         if (watchpoints().isWatched(set))
>             return true;
> 
>@@ -819,6 +813,9 @@ class Graph final : public virtual Scannable {
> 
>     bool isWatchingArrayIteratorProtocolWatchpoint(Node* node)
>     {
>+        if (m_plan.isUnlinked())
>+            return false;
>+
>         JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
>         InlineWatchpointSet& set = globalObject->arrayIteratorProtocolWatchpointSet();
>         return isWatchingGlobalObjectWatchpoint(globalObject, set);
>@@ -826,6 +823,9 @@ class Graph final : public virtual Scannable {
> 
>     bool isWatchingNumberToStringWatchpoint(Node* node)
>     {
>+        if (m_plan.isUnlinked())
>+            return false;
>+
>         JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
>         InlineWatchpointSet& set = globalObject->numberToStringWatchpointSet();
>         return isWatchingGlobalObjectWatchpoint(globalObject, set);
>diff --git a/Source/JavaScriptCore/dfg/DFGJITCode.h b/Source/JavaScriptCore/dfg/DFGJITCode.h
>index 453c3dcdaed1f3c3c2af14b812b8a23a56d11ca2..40587e9ad5ed9051d1c210bca1dfeb8bb5ed124b 100644
>--- a/Source/JavaScriptCore/dfg/DFGJITCode.h
>+++ b/Source/JavaScriptCore/dfg/DFGJITCode.h
>@@ -49,6 +49,23 @@ namespace DFG {
> 
> class JITCompiler;
> 
>+class DFGJITData final : public TrailingArray<DFGJITData, void*> {
>+    WTF_MAKE_FAST_ALLOCATED;
>+    friend class LLIntOffsetsExtractor;
>+public:
>+    using Base = TrailingArray<DFGJITData, void*>;
>+
>+    static std::unique_ptr<DFGJITData> create(unsigned poolSize)
>+    {
>+        return std::unique_ptr<DFGJITData> { new (NotNull, fastMalloc(Base::allocationSize(poolSize))) DFGJITData(poolSize) };
>+    }
>+
>+    explicit DFGJITData(unsigned size)
>+        : Base(size)
>+    {
>+    }
>+};
>+
> class JITCode final : public DirectJITCode {
> public:
>     JITCode();
>diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
>index 45f343f0dd05907f09917db03a1f414dd68014cb..fdb4ef8399a86ab48ae22acd5ea0ee0386e44977 100644
>--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
>@@ -40,6 +40,7 @@
> #include "JSCJSValueInlines.h"
> #include "LinkBuffer.h"
> #include "MaxFrameExtentForSlowPathCall.h"
>+#include "ProbeContext.h"
> #include "ThunkGenerators.h"
> #include "VM.h"
> 
>@@ -110,13 +111,24 @@ void JITCompiler::compileEntry()
>     // check) which will be dependent on stack layout. (We'd need to account for this in
>     // both normal return code and when jumping to an exception handler).
>     emitFunctionPrologue();
>-    emitPutToCallFrameHeader(m_codeBlock, CallFrameSlot::codeBlock);
>+    if (m_codeBlock->codeType() == FunctionCode)
>+        emitPutCodeBlockToFrameInPrologue(GPRInfo::regT0, m_codeBlock->isConstructor());
>+#if ASSERT_ENABLED
>+    probeDebug([=](Probe::Context& ctx) {
>+        CodeBlock* codeBlock = ctx.fp<CallFrame*>()->codeBlock();
>+        RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlock->jitType()));
>+    });
>+#endif
> }
> 
> void JITCompiler::compileSetupRegistersForEntry()
> {
>     emitSaveCalleeSaves();
>     emitMaterializeTagCheckRegisters();    
>+#if USE(JSVALUE64)
>+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::constantsRegister);
>+    loadPtr(Address(GPRInfo::constantsRegister, CodeBlock::offsetOfJITData()), GPRInfo::constantsRegister);
>+#endif
> }
> 
> void JITCompiler::compileEntryExecutionFlag()
>@@ -340,7 +352,8 @@ void JITCompiler::compile()
>     if (maxFrameExtentForSlowPathCall)
>         addPtr(TrustedImm32(-static_cast<int32_t>(maxFrameExtentForSlowPathCall)), stackPointerRegister);
> 
>-    m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
>+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::argumentGPR0);
>+    m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, GPRInfo::argumentGPR0);
> 
>     // Generate slow path code.
>     m_speculative->runSlowPathGenerators(m_pcToCodeOriginMapBuilder);
>@@ -413,7 +426,8 @@ void JITCompiler::compileFunction()
>     if (maxFrameExtentForSlowPathCall)
>         addPtr(TrustedImm32(-static_cast<int32_t>(maxFrameExtentForSlowPathCall)), stackPointerRegister);
> 
>-    m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
>+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::argumentGPR0);
>+    m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, GPRInfo::argumentGPR0);
>     
>     // The fast entry point into a function does not check the correct number of arguments
>     // have been passed to the call (we only use the fast entry point where we can statically
>@@ -432,7 +446,9 @@ void JITCompiler::compileFunction()
>         emitStoreCodeOrigin(CodeOrigin(BytecodeIndex(0)));
>         if (maxFrameExtentForSlowPathCall)
>             addPtr(TrustedImm32(-static_cast<int32_t>(maxFrameExtentForSlowPathCall)), stackPointerRegister);
>-        m_speculative->callOperationWithCallFrameRollbackOnException(m_codeBlock->isConstructor() ? operationConstructArityCheck : operationCallArityCheck, GPRInfo::regT0, m_codeBlock->globalObject());
>+        emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::argumentGPR0);
>+        loadPtr(Address(GPRInfo::argumentGPR0, CodeBlock::offsetOfGlobalObject()), GPRInfo::argumentGPR0);
>+        m_speculative->callOperationWithCallFrameRollbackOnException(m_codeBlock->isConstructor() ? operationConstructArityCheck : operationCallArityCheck, GPRInfo::returnValueGPR, GPRInfo::argumentGPR0);
>         if (maxFrameExtentForSlowPathCall)
>             addPtr(TrustedImm32(maxFrameExtentForSlowPathCall), stackPointerRegister);
>         branchTest32(Zero, GPRInfo::returnValueGPR).linkTo(fromArityCheck, this);
>@@ -643,6 +659,36 @@ void JITCompiler::makeCatchOSREntryBuffer()
>     }
> }
> 
>+void JITCompiler::loadUnlinkedConstant(UnlinkedConstant constant, GPRReg dest)
>+{
>+    constant.materialize(*this, dest);
>+}
>+
>+void JITCompiler::storeUnlinkedConstant(UnlinkedConstant constant, Address dest)
>+{
>+    constant.poke(*this, dest);
>+}
>+
>+JITCompiler::UnlinkedConstant::UnlinkedConstant(Graph& graph, JSCell* cell)
>+    : m_index(graph.m_plan.addUnlinkedConstant(SpeculativeJIT::TrustedImmPtr::weakPointer(graph, cell)))
>+{
>+}
>+
>+JITCompiler::UnlinkedConstant::UnlinkedConstant(Graph& graph, void* pointer, NonCellTag)
>+    : m_index(graph.m_plan.addUnlinkedConstant(CCallHelpers::TrustedImmPtr(pointer)))
>+{
>+}
>+
>+void JITCompiler::UnlinkedConstant::materialize(CCallHelpers& jit, GPRReg resultGPR)
>+{
>+    jit.loadPtr(CCallHelpers::Address(GPRInfo::constantsRegister, DFGJITData::offsetOfData() + sizeof(void*) * m_index), resultGPR);
>+}
>+
>+void JITCompiler::UnlinkedConstant::poke(CCallHelpers& jit, CCallHelpers::Address address)
>+{
>+    jit.transferPtr(CCallHelpers::Address(GPRInfo::constantsRegister, DFGJITData::offsetOfData() + sizeof(void*) * m_index), address);
>+}
>+
> } } // namespace JSC::DFG
> 
> #endif // ENABLE(DFG_JIT)
>diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
>index 984276838d3e890c51136e0a3d18ee0b97246c17..63f28640b196ff0a5e1101afdf472727e04e44a9 100644
>--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
>+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
>@@ -255,14 +255,6 @@ class JITCompiler : public CCallHelpers {
>             addWeakReference(structureSet[i]);
>     }
>     
>-    template<typename T>
>-    Jump branchWeakPtr(RelationalCondition cond, T left, JSCell* weakPtr)
>-    {
>-        Jump result = branchPtr(cond, left, TrustedImmPtr(weakPtr));
>-        addWeakReference(weakPtr);
>-        return result;
>-    }
>-
>     template<typename T>
>     Jump branchWeakStructure(RelationalCondition cond, T left, RegisteredStructure weakStructure)
>     {
>@@ -312,6 +304,35 @@ class JITCompiler : public CCallHelpers {
>         emitSaveCalleeSavesFor(&RegisterAtOffsetList::dfgCalleeSaveRegisters());
>     }
> 
>+    class UnlinkedConstant final : public CCallHelpers::ConstantMaterializer {
>+    public:
>+        enum NonCellTag { NonCell };
>+        UnlinkedConstant(Graph&, JSCell*);
>+
>+        void materialize(CCallHelpers&, GPRReg);
>+        void poke(CCallHelpers&, CCallHelpers::Address);
>+
>+        template<typename T>
>+        static UnlinkedConstant nonCellPtr(Graph& graph, T* pointer)
>+        {
>+            static_assert(!std::is_base_of_v<JSCell, T>);
>+            return UnlinkedConstant(graph, pointer, NonCell);
>+        }
>+
>+        static UnlinkedConstant structure(Graph& graph, RegisteredStructure structure)
>+        {
>+            return UnlinkedConstant(graph, structure.get());
>+        }
>+
>+    private:
>+        UnlinkedConstant(Graph&, void*, NonCellTag);
>+
>+        unsigned m_index { 0 };
>+    };
>+
>+    void loadUnlinkedConstant(UnlinkedConstant, GPRReg);
>+    void storeUnlinkedConstant(UnlinkedConstant, Address);
>+
> private:
>     friend class OSRExitJumpPlaceholder;
>     
>diff --git a/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp b/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
>index d63613297c27f3881586bcaa77e3accff4e264c7..5ece4567550da316b42693aa55bf66eae772e51a 100644
>--- a/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
>@@ -64,6 +64,7 @@ bool JITFinalizer::finalize()
>     CodeBlock* codeBlock = m_plan.codeBlock();
> 
>     codeBlock->setJITCode(m_jitCode.copyRef());
>+    codeBlock->setDFGJITData(m_plan.finalizeJITData());
> 
> #if ENABLE(FTL_JIT)
>     m_jitCode->optimizeAfterWarmUp(codeBlock);
>diff --git a/Source/JavaScriptCore/dfg/DFGPlan.cpp b/Source/JavaScriptCore/dfg/DFGPlan.cpp
>index f0ef9a8971274485f443c546a7469eb78b218d6d..ad1c682790b6b9f5469f53b93c218677ed4ae45a 100644
>--- a/Source/JavaScriptCore/dfg/DFGPlan.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGPlan.cpp
>@@ -112,6 +112,8 @@ Profiler::CompilationKind profilerCompilationKindForMode(JITCompilationMode mode
>         return Profiler::DFG;
>     case JITCompilationMode::DFG:
>         return Profiler::DFG;
>+    case JITCompilationMode::UnlinkedDFG:
>+        return Profiler::UnlinkedDFG;
>     case JITCompilationMode::FTL:
>         return Profiler::FTL;
>     case JITCompilationMode::FTLForOSREntry:
>@@ -315,7 +317,8 @@ Plan::CompilationPath Plan::compileInThreadImpl()
>     }
> 
>     switch (m_mode) {
>-    case JITCompilationMode::DFG: {
>+    case JITCompilationMode::DFG:
>+    case JITCompilationMode::UnlinkedDFG: {
>         dfg.m_fixpointState = FixpointConverged;
> 
>         RUN_PHASE(performTierUpCheckInjection);
>@@ -678,6 +681,21 @@ void Plan::cleanMustHandleValuesIfNecessary()
>     }
> }
> 
>+unsigned Plan::addUnlinkedConstant(CCallHelpers::TrustedImmPtr ptr)
>+{
>+    return m_constantPool.add(bitwise_cast<void*>(ptr.asIntptr()), m_constantPool.size()).iterator->value;
>+}
>+
>+std::unique_ptr<DFGJITData> Plan::finalizeJITData()
>+{
>+    if (m_constantPool.isEmpty())
>+        return nullptr;
>+    auto jitData = DFGJITData::create(m_constantPool.size());
>+    for (auto& pair : m_constantPool)
>+        jitData->at(pair.value) = pair.key;
>+    return jitData;
>+}
>+
> } } // namespace JSC::DFG
> 
> #endif // ENABLE(DFG_JIT)
>diff --git a/Source/JavaScriptCore/dfg/DFGPlan.h b/Source/JavaScriptCore/dfg/DFGPlan.h
>index 40803296a6dbe0e47ea3833dbbf24a6c2903b6e2..daee1e07187462ded34ba4f80f70d04c7fc1121b 100644
>--- a/Source/JavaScriptCore/dfg/DFGPlan.h
>+++ b/Source/JavaScriptCore/dfg/DFGPlan.h
>@@ -48,6 +48,7 @@ class CodeBlock;
> namespace DFG {
> 
> class ThreadData;
>+class DFGJITData;
> 
> #if ENABLE(DFG_JIT)
> 
>@@ -101,6 +102,9 @@ class Plan final : public JITPlan {
>     DeferredCompilationCallback* callback() const { return m_callback.get(); }
>     void setCallback(Ref<DeferredCompilationCallback>&& callback) { m_callback = WTFMove(callback); }
> 
>+    unsigned addUnlinkedConstant(CCallHelpers::TrustedImmPtr);
>+    std::unique_ptr<DFGJITData> finalizeJITData();
>+
> private:
>     CompilationPath compileInThreadImpl() override;
>     
>@@ -134,6 +138,7 @@ class Plan final : public JITPlan {
>     Vector<BytecodeIndex> m_tierUpAndOSREnterBytecodes;
> 
>     RefPtr<DeferredCompilationCallback> m_callback;
>+    HashMap<void*, unsigned> m_constantPool;
> };
> 
> #endif // ENABLE(DFG_JIT)
>diff --git a/Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h b/Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h
>index fabce0182de900253f0df3f0bf2e930187c0ff14..643bd25c09c2a32022457a15d616946191123abe 100644
>--- a/Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h
>+++ b/Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h
>@@ -37,7 +37,7 @@ namespace JSC { namespace DFG {
> class SaneStringGetByValSlowPathGenerator final : public JumpingSlowPathGenerator<MacroAssembler::Jump> {
> public:
>     SaneStringGetByValSlowPathGenerator(
>-        const MacroAssembler::Jump& from, SpeculativeJIT* jit, JSValueRegs resultRegs, CCallHelpers::TrustedImmPtr globalObject, GPRReg baseReg, GPRReg propertyReg)
>+        const MacroAssembler::Jump& from, SpeculativeJIT* jit, JSValueRegs resultRegs, JITCompiler::UnlinkedConstant globalObject, GPRReg baseReg, GPRReg propertyReg)
>         : JumpingSlowPathGenerator<MacroAssembler::Jump>(from, jit)
>         , m_resultRegs(resultRegs)
>         , m_globalObject(globalObject)
>@@ -79,7 +79,7 @@ class SaneStringGetByValSlowPathGenerator final : public JumpingSlowPathGenerato
>     }
> 
>     JSValueRegs m_resultRegs;
>-    CCallHelpers::TrustedImmPtr m_globalObject;
>+    JITCompiler::UnlinkedConstant m_globalObject;
>     GPRReg m_baseReg;
>     GPRReg m_propertyReg;
>     Vector<SilentRegisterSavePlan, 2> m_plans;
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 360e18183ecba1e0cc05d76c72cdf1219eccb16d..7f72c5c7776efa739e1205227efabc37da5c11da 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -61,6 +61,7 @@
> #include "JSPropertyNameEnumerator.h"
> #include "JSSetIterator.h"
> #include "LLIntThunks.h"
>+#include "ProbeContext.h"
> #include "RegExpObject.h"
> #include "ScopedArguments.h"
> #include "TypeProfilerLog.h"
>@@ -205,11 +206,8 @@ void SpeculativeJIT::emitGetCallee(CodeOrigin origin, GPRReg calleeGPR)
>             m_jit.loadPtr(
>                 JITCompiler::addressFor(inlineCallFrame->calleeRecovery.virtualRegister()),
>                 calleeGPR);
>-        } else {
>-            m_jit.move(
>-                TrustedImmPtr::weakPointer(m_jit.graph(), inlineCallFrame->calleeRecovery.constant().asCell()),
>-                calleeGPR);
>-        }
>+        } else
>+            m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), inlineCallFrame->calleeRecovery.constant().asCell()), calleeGPR);
>     } else
>         m_jit.loadPtr(JITCompiler::addressFor(CallFrameSlot::callee), calleeGPR);
> }
>@@ -686,7 +684,7 @@ void SpeculativeJIT::silentFill(const SilentRegisterSavePlan& plan)
>         break;
>     case SetCellConstant:
>         ASSERT(plan.node()->constant()->value().isCell());
>-        m_jit.move(TrustedImmPtr(plan.node()->constant()), plan.gpr());
>+        m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, plan.node()->constant()->value().asCell()), plan.gpr());
>         break;
> #if USE(JSVALUE64)
>     case SetTrustedJSConstant:
>@@ -1191,22 +1189,22 @@ void SpeculativeJIT::compileDeleteById(Node* node)
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             slowPath = slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationDeleteByIdOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, JSValueRegs(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, JSValueRegs(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>         } else {
>             slowPath = slowPathCall(
>                 slowCases, this, operationDeleteByIdOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), JSValueRegs(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), JSValueRegs(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>         }
> #else
>         std::unique_ptr<SlowPathGenerator> slowPath;
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             slowPath = slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationDeleteByIdOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>         } else {
>             slowPath = slowPathCall(
>                 slowCases, this, operationDeleteByIdOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>         }
> #endif
> 
>@@ -1227,7 +1225,7 @@ void SpeculativeJIT::compileDeleteById(Node* node)
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationDeleteByIdGeneric, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), nullptr, baseRegs, node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>+    callOperation(operationDeleteByIdGeneric, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), nullptr, baseRegs, node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
>     m_jit.exceptionCheck();
> 
>     unblessedBooleanResult(resultGPR, node);
>@@ -1277,22 +1275,22 @@ void SpeculativeJIT::compileDeleteByVal(Node* node)
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             slowPath = slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationDeleteByValOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, JSValueRegs(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, JSValueRegs(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>         } else {
>             slowPath = slowPathCall(
>                 slowCases, this, operationDeleteByValOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), JSValueRegs(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), JSValueRegs(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>         }
> #else
>         std::unique_ptr<SlowPathGenerator> slowPath;
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             slowPath = slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationDeleteByValOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>         } else {
>             slowPath = slowPathCall(
>                 slowCases, this, operationDeleteByValOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
>         }
> #endif
> 
>@@ -1314,7 +1312,7 @@ void SpeculativeJIT::compileDeleteByVal(Node* node)
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationDeleteByValGeneric, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), nullptr, baseRegs, keyRegs, TrustedImm32(node->ecmaMode().value()));
>+    callOperation(operationDeleteByValGeneric, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), nullptr, baseRegs, keyRegs, TrustedImm32(node->ecmaMode().value()));
>     m_jit.exceptionCheck();
> 
>     unblessedBooleanResult(resultGPR, node);
>@@ -1352,12 +1350,12 @@ void SpeculativeJIT::compileInById(Node* node)
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationInByIdOptimize,
>             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits());
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits());
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, operationInByIdOptimize,
>             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits());
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits());
>     }
> 
>     m_jit.addInById(gen, slowPath.get());
>@@ -1402,12 +1400,12 @@ void SpeculativeJIT::compileInByVal(Node* node)
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationInByValOptimize,
>             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, operationInByValOptimize,
>             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
>     }
> 
>     m_jit.addInByVal(gen, slowPath.get());
>@@ -1456,12 +1454,12 @@ void SpeculativeJIT::compileHasPrivate(Node* node, AccessType type)
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), type == AccessType::HasPrivateName ? operationHasPrivateNameOptimize : operationHasPrivateBrandOptimize,
>             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyOrBrandGPR));
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyOrBrandGPR));
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, type == AccessType::HasPrivateName ? operationHasPrivateNameOptimize : operationHasPrivateBrandOptimize,
>             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyOrBrandGPR));
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyOrBrandGPR));
>     }
> 
>     m_jit.addInByVal(gen, slowPath.get());
>@@ -1495,7 +1493,7 @@ void SpeculativeJIT::compilePushWithScope(Node* node)
>         speculateObject(objectEdge, objectGPR);
> 
>         flushRegisters();
>-        callOperation(operationPushWithScopeObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), currentScopeGPR, objectGPR);
>+        callOperation(operationPushWithScopeObject, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), currentScopeGPR, objectGPR);
>         // No exception check here as we did not have to call toObject().
>     } else {
>         ASSERT(objectEdge.useKind() == UntypedUse);
>@@ -1503,7 +1501,7 @@ void SpeculativeJIT::compilePushWithScope(Node* node)
>         JSValueRegs objectRegs = object.jsValueRegs();
> 
>         flushRegisters();
>-        callOperation(operationPushWithScope, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), currentScopeGPR, objectRegs);
>+        callOperation(operationPushWithScope, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), currentScopeGPR, objectRegs);
>         m_jit.exceptionCheck();
>     }
>     
>@@ -1922,12 +1920,12 @@ void SpeculativeJIT::compileStringSlice(Node* node)
> 
>     addSlowPathGenerator(slowPathCall(bigCharacter, this, operationSingleCharacterString, tempGPR, &vm, tempGPR));
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operationStringSubstr, tempGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startIndexGPR, tempGPR));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operationStringSubstr, tempGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startIndexGPR, tempGPR));
> 
>     if (endGPR)
>-        addSlowPathGenerator(slowPathCall(isRope, this, operationStringSlice, tempGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startGPR, *endGPR));
>+        addSlowPathGenerator(slowPathCall(isRope, this, operationStringSlice, tempGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startGPR, *endGPR));
>     else
>-        addSlowPathGenerator(slowPathCall(isRope, this, operationStringSlice, tempGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startGPR, TrustedImm32(std::numeric_limits<int32_t>::max())));
>+        addSlowPathGenerator(slowPathCall(isRope, this, operationStringSlice, tempGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startGPR, TrustedImm32(std::numeric_limits<int32_t>::max())));
> 
>     doneCases.link(&m_jit);
>     cellResult(tempGPR, node);
>@@ -1974,7 +1972,7 @@ void SpeculativeJIT::compileToLowerCase(Node* node)
>     
>     slowPath.link(&m_jit);
>     silentSpillAllRegisters(lengthGPR);
>-    callOperation(operationToLowerCase, lengthGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, indexGPR);
>+    callOperation(operationToLowerCase, lengthGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, indexGPR);
>     silentFillAllRegisters();
>     m_jit.exceptionCheck();
>     auto done = m_jit.jump();
>@@ -2193,10 +2191,20 @@ void SpeculativeJIT::compileCurrentBlock()
>     }
> 
>     if (m_block->isCatchEntrypoint) {
>+        // For catch entry point, OSR entry sets a new CodeBlock pointer.
>         m_jit.addPtr(CCallHelpers::TrustedImm32(-(m_jit.graph().frameRegisterCount() * sizeof(Register))), GPRInfo::callFrameRegister,  CCallHelpers::stackPointerRegister);
>         m_jit.emitSaveCalleeSaves();
>         m_jit.emitMaterializeTagCheckRegisters();
>-        m_jit.emitPutToCallFrameHeader(m_jit.codeBlock(), CallFrameSlot::codeBlock);
>+#if ASSERT_ENABLED
>+        m_jit.probeDebug([=](Probe::Context& ctx) {
>+            CodeBlock* codeBlock = ctx.fp<CallFrame*>()->codeBlock();
>+            RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlock->jitType()));
>+        });
>+#endif
>+#if USE(JSVALUE64)
>+        m_jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::constantsRegister);
>+        m_jit.loadPtr(CCallHelpers::Address(GPRInfo::constantsRegister, CodeBlock::offsetOfJITData()), GPRInfo::constantsRegister);
>+#endif
>     }
> 
>     m_stream->appendAndLog(VariableEvent::reset());
>@@ -2477,7 +2485,7 @@ void SpeculativeJIT::compileCheckTraps(Node* node)
>         JITCompiler::AbsoluteAddress(m_jit.vm().traps().trapBitsAddress()),
>         TrustedImm32(VMTraps::AsyncEvents));
> 
>-    addSlowPathGenerator(slowPathCall(needTrapHandling, this, operationHandleTraps, unusedGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic))));
>+    addSlowPathGenerator(slowPathCall(needTrapHandling, this, operationHandleTraps, unusedGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic))));
>     noResult(node);
> }
> 
>@@ -2542,7 +2550,7 @@ void SpeculativeJIT::compileContiguousPutByVal(Node* node)
>             node->ecmaMode().isStrict() ?
>                 (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsStrict) :
>                 (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsNonStrict : operationPutByValBeyondArrayBoundsNonStrict),
>-            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueRegs));
>+            NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueRegs));
>     }
> 
>     noResult(node, UseChildrenCalledExplicitly);
>@@ -2617,7 +2625,7 @@ void SpeculativeJIT::compileDoublePutByVal(Node* node)
>                 node->ecmaMode().isStrict() ?
>                     (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsStrict) :
>                     (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict),
>-                NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueReg));
>+                NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueReg));
>     }
> 
>     noResult(m_currentNode, UseChildrenCalledExplicitly);
>@@ -2675,9 +2683,9 @@ void SpeculativeJIT::compilePutByVal(Node* node)
> 
>             flushRegisters();
>             if (node->op() == PutByValDirect)
>-                callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs);
>+                callOperation(node->ecmaMode().isStrict() ? operationPutByValDirectStrict : operationPutByValDirectNonStrict, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs);
>             else
>-                callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs);
>+                callOperation(node->ecmaMode().isStrict() ? operationPutByValStrict : operationPutByValNonStrict, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyRegs, valueRegs);
>             m_jit.exceptionCheck();
> 
>             noResult(node);
>@@ -2730,11 +2738,11 @@ void SpeculativeJIT::compilePutByVal(Node* node)
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             slowPath = slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operation,
>-                NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, stubInfoGPR, nullptr);
>+                NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, stubInfoGPR, nullptr);
>         } else {
>             slowPath = slowPathCall(
>                 slowCases, this, operation,
>-                NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, gen.stubInfo(), nullptr);
>+                NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, gen.stubInfo(), nullptr);
>         }
> 
>         m_jit.addPutByVal(gen, slowPath.get());
>@@ -2825,7 +2833,7 @@ void SpeculativeJIT::compilePutByVal(Node* node)
>                 node->ecmaMode().isStrict() ?
>                     (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsStrict) :
>                     (node->op() == PutByValDirect ? operationPutByValDirectBeyondArrayBoundsNonStrict : operationPutByValBeyondArrayBoundsNonStrict),
>-                NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueRegs));
>+                NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueRegs));
>         }
> 
>         noResult(node, UseChildrenCalledExplicitly);
>@@ -2952,12 +2960,12 @@ void SpeculativeJIT::compileGetByValOnString(Node* node, const ScopedLambda<std:
>             m_jit.graph().registerAndWatchStructureTransition(objectPrototypeStructure);
> 
>             addSlowPathGenerator(makeUnique<SaneStringGetByValSlowPathGenerator>(
>-                outOfBounds, this, resultRegs, TrustedImmPtr::weakPointer(m_graph, globalObject), baseReg, propertyReg));
>+                outOfBounds, this, resultRegs, JITCompiler::UnlinkedConstant(m_graph, globalObject), baseReg, propertyReg));
>         } else {
>             addSlowPathGenerator(
>                 slowPathCall(
>                     outOfBounds, this, operationGetByValStringInt,
>-                    resultRegs, TrustedImmPtr::weakPointer(m_graph, globalObject), baseReg, propertyReg));
>+                    resultRegs, JITCompiler::UnlinkedConstant(m_graph, globalObject), baseReg, propertyReg));
>         }
>         
>         jsValueResult(resultRegs, m_currentNode);
>@@ -2981,7 +2989,7 @@ void SpeculativeJIT::compileFromCharCode(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationStringFromCharCodeUntyped, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), oprRegs);
>+        callOperation(operationStringFromCharCodeUntyped, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), oprRegs);
>         m_jit.exceptionCheck();
>         
>         jsValueResult(resultRegs, node);
>@@ -3001,7 +3009,7 @@ void SpeculativeJIT::compileFromCharCode(Node* node)
>     m_jit.loadPtr(MacroAssembler::BaseIndex(smallStringsReg, propertyReg, MacroAssembler::ScalePtr, 0), scratchReg);
> 
>     slowCases.append(m_jit.branchTest32(MacroAssembler::Zero, scratchReg));
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operationStringFromCharCode, scratchReg, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), propertyReg));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operationStringFromCharCode, scratchReg, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), propertyReg));
>     cellResult(scratchReg, m_currentNode);
> }
> 
>@@ -3925,9 +3933,9 @@ void SpeculativeJIT::compilePutByValForIntTypedArray(Node* node, TypedArrayType
>                 (node->op() == PutByValDirect ? operationPutByValDirectStrict : operationPutByValStrict) :
>                 (node->op() == PutByValDirect ? operationPutByValDirectNonStrict : operationPutByValNonStrict),
> #if USE(JSVALUE64)
>-            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueGPR));
>+            NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg, valueGPR));
> #else // not USE(JSVALUE64)
>-            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseReg), JSValueRegs(propertyTagGPR, propertyReg), JSValueRegs(valueTagGPR, valueGPR)));
>+            NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseReg), JSValueRegs(propertyTagGPR, propertyReg), JSValueRegs(valueTagGPR, valueGPR)));
> #endif
>     }
> 
>@@ -4035,7 +4043,7 @@ void SpeculativeJIT::compileGetByValForObjectWithString(Node* node, const Scoped
>         silentSpillAllRegisters(resultRegs);
>     else
>         flushRegisters();
>-    callOperation(operationGetByValObjectString, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR);
>+    callOperation(operationGetByValObjectString, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR);
>     if (canUseFlush == CanUseFlush::No)
>         silentFillAllRegisters();
>     m_jit.exceptionCheck();
>@@ -4062,7 +4070,7 @@ void SpeculativeJIT::compileGetByValForObjectWithSymbol(Node* node, const Scoped
>         silentSpillAllRegisters(resultRegs);
>     else
>         flushRegisters();
>-    callOperation(operationGetByValObjectSymbol, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR);
>+    callOperation(operationGetByValObjectSymbol, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR);
>     if (canUseFlush == CanUseFlush::No)
>         silentFillAllRegisters();
>     m_jit.exceptionCheck();
>@@ -4130,12 +4138,12 @@ void SpeculativeJIT::compileGetPrivateNameByVal(Node* node, JSValueRegs base, JS
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             return slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationGetPrivateNameOptimize,
>-                result.regs(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR,
>+                result.regs(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR,
>                 base, CCallHelpers::CellValue(property.payloadGPR()));
>         }
>         return slowPathCall(
>             slowCases, this, operationGetPrivateNameOptimize,
>-            result.regs(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(),
>+            result.regs(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(),
>             base, CCallHelpers::CellValue(property.payloadGPR()));
>     };
> 
>@@ -4215,7 +4223,7 @@ void SpeculativeJIT::compilePutByValForCellWithString(Node* node)
>         node->ecmaMode().isStrict() ?
>             (node->op() == PutByValDirect ? operationPutByValDirectCellStringStrict : operationPutByValCellStringStrict) :
>             (node->op() == PutByValDirect ? operationPutByValDirectCellStringNonStrict : operationPutByValCellStringNonStrict),
>-        TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3Regs);
>+        JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3Regs);
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -4238,7 +4246,7 @@ void SpeculativeJIT::compilePutByValForCellWithSymbol(Node* node)
>         node->ecmaMode().isStrict()
>             ? (node->op() == PutByValDirect ? operationPutByValDirectCellSymbolStrict : operationPutByValCellSymbolStrict)
>             : (node->op() == PutByValDirect ? operationPutByValDirectCellSymbolNonStrict : operationPutByValCellSymbolNonStrict),
>-        TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3Regs);
>+        JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR, arg3Regs);
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -4256,7 +4264,7 @@ void SpeculativeJIT::compileGetByValWithThis(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationGetByValWithThis, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, thisValueRegs, subscriptRegs);
>+    callOperation(operationGetByValWithThis, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, thisValueRegs, subscriptRegs);
>     m_jit.exceptionCheck();
> 
>     jsValueResult(resultRegs, node);
>@@ -4282,7 +4290,7 @@ void SpeculativeJIT::compilePutPrivateName(Node* node)
> 
>         flushRegisters();
>         auto operation = node->privateFieldPutKind().isDefine() ? operationPutByValDefinePrivateFieldGeneric : operationPutByValSetPrivateFieldGeneric;
>-        callOperation(operation, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, CCallHelpers::CellValue(propertyGPR), valueRegs, TrustedImmPtr(nullptr), TrustedImmPtr(nullptr));
>+        callOperation(operation, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, CCallHelpers::CellValue(propertyGPR), valueRegs, TrustedImmPtr(nullptr), TrustedImmPtr(nullptr));
>         m_jit.exceptionCheck();
> 
>         noResult(node);
>@@ -4326,11 +4334,11 @@ void SpeculativeJIT::compilePutPrivateName(Node* node)
>     if (JITCode::useDataIC(JITType::DFGJIT)) {
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operation,
>-            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, stubInfoGPR, nullptr);
>+            NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, stubInfoGPR, nullptr);
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, operation,
>-            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, gen.stubInfo(), nullptr);
>+            NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, gen.stubInfo(), nullptr);
>     }
> 
>     m_jit.addPutByVal(gen, slowPath.get());
>@@ -4400,11 +4408,11 @@ void SpeculativeJIT::compileCheckPrivateBrand(Node* node)
>     if (JITCode::useDataIC(JITType::DFGJIT)) {
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationCheckPrivateBrandOptimize, NoResult,
>-            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, baseRegs, CCallHelpers::CellValue(brandGPR));
>+            JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, baseRegs, CCallHelpers::CellValue(brandGPR));
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, operationCheckPrivateBrandOptimize, NoResult,
>-            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseRegs, CCallHelpers::CellValue(brandGPR));
>+            JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseRegs, CCallHelpers::CellValue(brandGPR));
>     }
> 
>     m_jit.addPrivateBrandAccess(gen, slowPath.get());
>@@ -4448,11 +4456,11 @@ void SpeculativeJIT::compileSetPrivateBrand(Node* node)
>     if (JITCode::useDataIC(JITType::DFGJIT)) {
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationSetPrivateBrandOptimize, NoResult,
>-            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(brandGPR));
>+            JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(brandGPR));
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, operationSetPrivateBrandOptimize, NoResult,
>-            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(brandGPR));
>+            JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(brandGPR));
>     }
> 
>     m_jit.addPrivateBrandAccess(gen, slowPath.get());
>@@ -4488,7 +4496,7 @@ void SpeculativeJIT::compileParseInt(Node* node)
>             flushRegisters();
>             JSValueRegsFlushedCallResult result(this);
>             JSValueRegs resultRegs = result.regs();
>-            callOperation(operationParseIntGeneric, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, radixGPR);
>+            callOperation(operationParseIntGeneric, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, radixGPR);
>             m_jit.exceptionCheck();
>             jsValueResult(resultRegs, node);
>             return;
>@@ -4501,7 +4509,7 @@ void SpeculativeJIT::compileParseInt(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationParseIntString, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueGPR, radixGPR);
>+        callOperation(operationParseIntString, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueGPR, radixGPR);
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>         return;
>@@ -4514,7 +4522,7 @@ void SpeculativeJIT::compileParseInt(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationParseIntNoRadixGeneric, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs);
>+        callOperation(operationParseIntNoRadixGeneric, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs);
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>         return;
>@@ -4527,7 +4535,7 @@ void SpeculativeJIT::compileParseInt(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationParseIntStringNoRadix, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueGPR);
>+    callOperation(operationParseIntStringNoRadix, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueGPR);
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -4550,11 +4558,12 @@ void SpeculativeJIT::compileOverridesHasInstance(Node* node)
>     // since it relies on OSR information. https://bugs.webkit.org/show_bug.cgi?id=154832
>     if (!hasInstanceValueNode->isCellConstant() || defaultHasInstanceFunction != hasInstanceValueNode->asCell()) {
>         JSValueRegs hasInstanceValueRegs = hasInstanceValue.jsValueRegs();
>+        m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, node->cellOperand()->cell()), resultGPR);
> #if USE(JSVALUE64)
>-        notDefault.append(m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.gpr(), TrustedImmPtr(node->cellOperand())));
>+        notDefault.append(m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.gpr(), resultGPR));
> #else
>         notDefault.append(m_jit.branchIfNotCell(hasInstanceValueRegs));
>-        notDefault.append(m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.payloadGPR(), TrustedImmPtr(node->cellOperand())));
>+        notDefault.append(m_jit.branchPtr(MacroAssembler::NotEqual, hasInstanceValueRegs.payloadGPR(), resultGPR));
> #endif
>     }
> 
>@@ -4588,10 +4597,10 @@ void SpeculativeJIT::compileInstanceOfForCells(Node* node, JSValueRegs valueRegs
>     std::unique_ptr<SlowPathGenerator> slowPath;
>     if (JITCode::useDataIC(JITType::DFGJIT)) {
>         slowPath = slowPathICCall(
>-            slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationInstanceOfOptimize, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stubInfoGPR, valueRegs, prototypeRegs);
>+            slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationInstanceOfOptimize, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stubInfoGPR, valueRegs, prototypeRegs);
>     } else {
>         slowPath = slowPathCall(
>-            slowCases, this, operationInstanceOfOptimize, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), gen.stubInfo(), valueRegs, prototypeRegs);
>+            slowCases, this, operationInstanceOfOptimize, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), gen.stubInfo(), valueRegs, prototypeRegs);
>     }
>     
>     m_jit.addInstanceOf(gen, slowPath.get());
>@@ -4701,7 +4710,7 @@ void SpeculativeJIT::compileValueBitNot(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationBitNotHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), operandGPR);
>+        callOperation(operationBitNotHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), operandGPR);
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
> 
>@@ -4716,7 +4725,7 @@ void SpeculativeJIT::compileValueBitNot(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationValueBitNot, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), operandRegs);
>+    callOperation(operationValueBitNot, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), operandRegs);
>     m_jit.exceptionCheck();
> 
>     jsValueResult(resultRegs, node);
>@@ -4756,7 +4765,7 @@ void SpeculativeJIT::emitUntypedOrAnyBigIntBitOp(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(snippetSlowPathFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(snippetSlowPathFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -4821,7 +4830,7 @@ void SpeculativeJIT::emitUntypedOrAnyBigIntBitOp(Node* node)
>         m_jit.moveValue(rightChild->asJSValue(), rightRegs);
>     }
> 
>-    callOperation(snippetSlowPathFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+    callOperation(snippetSlowPathFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
> 
>     silentFillAllRegisters();
>     m_jit.exceptionCheck();
>@@ -4884,13 +4893,13 @@ void SpeculativeJIT::compileValueBitwiseOp(Node* node)
> 
>         switch (op) {
>         case ValueBitAnd:
>-            callOperation(operationBitAndHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+            callOperation(operationBitAndHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>             break;
>         case ValueBitXor:
>-            callOperation(operationBitXorHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+            callOperation(operationBitXorHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>             break;
>         case ValueBitOr:
>-            callOperation(operationBitOrHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+            callOperation(operationBitOrHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>             break;
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>@@ -4974,7 +4983,7 @@ void SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(snippetSlowPathFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(snippetSlowPathFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -5040,7 +5049,7 @@ void SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp(Node* node)
>         m_jit.moveValue(rightChild->asJSValue(), rightRegs);
>     }
> 
>-    callOperation(snippetSlowPathFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+    callOperation(snippetSlowPathFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
> 
>     silentFillAllRegisters();
>     m_jit.exceptionCheck();
>@@ -5069,7 +5078,7 @@ void SpeculativeJIT::compileValueLShiftOp(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationBitLShiftHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationBitLShiftHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>         return;
>@@ -5096,7 +5105,7 @@ void SpeculativeJIT::compileValueBitRShift(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationBitRShiftHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationBitRShiftHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -5184,7 +5193,7 @@ void SpeculativeJIT::compileValueAdd(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>         // FIXME: call a more specialized function
>-        callOperation(operationValueAddNotNumber, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(operationValueAddNotNumber, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -5205,7 +5214,7 @@ void SpeculativeJIT::compileValueAdd(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationAddHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationAddHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -5221,7 +5230,7 @@ void SpeculativeJIT::compileValueAdd(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationValueAddNotNumber, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(operationValueAddNotNumber, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
>     
>         jsValueResult(resultRegs, node);
>@@ -5284,7 +5293,7 @@ void SpeculativeJIT::compileValueSub(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationValueSub, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(operationValueSub, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -5305,7 +5314,7 @@ void SpeculativeJIT::compileValueSub(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationSubHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationSubHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
> 
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>@@ -5412,9 +5421,9 @@ void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathI
>             }
> 
>             if (addICGenerationState->shouldSlowPathRepatch)
>-                addICGenerationState->slowPathCall = callOperation(repatchingFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), innerLeftRegs, innerRightRegs, TrustedImmPtr(mathIC));
>+                addICGenerationState->slowPathCall = callOperation(repatchingFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), innerLeftRegs, innerRightRegs, TrustedImmPtr(mathIC));
>             else
>-                addICGenerationState->slowPathCall = callOperation(nonRepatchingFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), innerLeftRegs, innerRightRegs);
>+                addICGenerationState->slowPathCall = callOperation(nonRepatchingFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), innerLeftRegs, innerRightRegs);
> 
>             silentFill(savePlans);
>             m_jit.exceptionCheck();
>@@ -5443,7 +5452,7 @@ void SpeculativeJIT::compileMathIC(Node* node, JITBinaryMathIC<Generator>* mathI
>         }
> 
>         flushRegisters();
>-        callOperation(nonRepatchingFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(nonRepatchingFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
>     }
> 
>@@ -5476,7 +5485,7 @@ void SpeculativeJIT::compileInstanceOfCustom(Node* node)
> 
>     MacroAssembler::Jump slowCase = m_jit.jump();
> 
>-    addSlowPathGenerator(slowPathCall(slowCase, this, operationInstanceOfCustom, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, constructorGPR, hasInstanceRegs));
>+    addSlowPathGenerator(slowPathCall(slowCase, this, operationInstanceOfCustom, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, constructorGPR, hasInstanceRegs));
> 
>     unblessedBooleanResult(resultGPR, node);
> }
>@@ -5575,9 +5584,9 @@ void SpeculativeJIT::compileToObjectOrCallObjectConstructor(Node* node)
>         UniquedStringImpl* errorMessage = nullptr;
>         if (node->identifierNumber() != UINT32_MAX)
>             errorMessage = identifierUID(node->identifierNumber());
>-        addSlowPathGenerator(slowPathCall(slowCases, this, operationToObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, errorMessage));
>+        addSlowPathGenerator(slowPathCall(slowCases, this, operationToObject, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, errorMessage));
>     } else
>-        addSlowPathGenerator(slowPathCall(slowCases, this, operationCallObjectConstructor, resultGPR, TrustedImmPtr(node->cellOperand()), valueRegs));
>+        addSlowPathGenerator(slowPathCall(slowCases, this, operationCallObjectConstructor, resultGPR, JITCompiler::UnlinkedConstant(m_graph, node->cellOperand()->cell()), valueRegs));
> 
>     cellResult(resultGPR, node);
> }
>@@ -5721,7 +5730,7 @@ void SpeculativeJIT::compileArithAbs(Node* node)
>         JSValueRegs op1Regs = op1.jsValueRegs();
>         flushRegisters();
>         FPRResult result(this);
>-        callOperation(operationArithAbs, result.fpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+        callOperation(operationArithAbs, result.fpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>         m_jit.exceptionCheck();
>         doubleResult(result.fpr(), node);
>         break;
>@@ -5745,7 +5754,7 @@ void SpeculativeJIT::compileArithClz32(Node* node)
>     GPRTemporary result(this);
>     GPRReg resultReg = result.gpr();
>     flushRegisters();
>-    callOperation(operationArithClz32, resultReg, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+    callOperation(operationArithClz32, resultReg, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>     m_jit.exceptionCheck();
>     strictInt32Result(resultReg, node);
> }
>@@ -5769,7 +5778,7 @@ void SpeculativeJIT::compileArithDoubleUnaryOp(Node* node, double (*doubleFuncti
>     JSValueRegs op1Regs = op1.jsValueRegs();
>     flushRegisters();
>     FPRResult result(this);
>-    callOperation(operation, result.fpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+    callOperation(operation, result.fpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>     m_jit.exceptionCheck();
>     doubleResult(result.fpr(), node);
> }
>@@ -5886,7 +5895,7 @@ void SpeculativeJIT::compileIncOrDec(Node* node)
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>     auto operation = node->op() == Inc ? operationInc : operationDec;
>-    callOperation(operation, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+    callOperation(operation, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -6025,9 +6034,9 @@ void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC
>             silentSpill(savePlans);
> 
>             if (icGenerationState->shouldSlowPathRepatch)
>-                icGenerationState->slowPathCall = callOperation(repatchingFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), childRegs, TrustedImmPtr(mathIC));
>+                icGenerationState->slowPathCall = callOperation(repatchingFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), childRegs, TrustedImmPtr(mathIC));
>             else
>-                icGenerationState->slowPathCall = callOperation(nonRepatchingFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), childRegs);
>+                icGenerationState->slowPathCall = callOperation(nonRepatchingFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), childRegs);
> 
>             silentFill(savePlans);
>             m_jit.exceptionCheck();
>@@ -6048,7 +6057,7 @@ void SpeculativeJIT::compileMathIC(Node* node, JITUnaryMathIC<Generator>* mathIC
>         });
>     } else {
>         flushRegisters();
>-        callOperation(nonRepatchingFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), childRegs);
>+        callOperation(nonRepatchingFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), childRegs);
>         m_jit.exceptionCheck();
>     }
> 
>@@ -6113,7 +6122,7 @@ void SpeculativeJIT::compileValueMul(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationMulHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationMulHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
> 
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>@@ -6131,7 +6140,7 @@ void SpeculativeJIT::compileValueMul(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationValueMul, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(operationValueMul, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -6313,7 +6322,7 @@ void SpeculativeJIT::compileValueDiv(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationDivHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationDivHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
> 
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>@@ -6331,7 +6340,7 @@ void SpeculativeJIT::compileValueDiv(Node* node)
>         flushRegisters();
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
>-        callOperation(operationValueDiv, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+        callOperation(operationValueDiv, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>         m_jit.exceptionCheck();
> 
>         jsValueResult(resultRegs, node);
>@@ -6415,7 +6424,7 @@ void SpeculativeJIT::compileValueDiv(Node* node)
>         m_jit.moveValue(rightChild->asJSValue(), rightRegs);
>     }
> 
>-    callOperation(operationValueDiv, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+    callOperation(operationValueDiv, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
> 
>     silentFillAllRegisters();
>     m_jit.exceptionCheck();
>@@ -6579,7 +6588,7 @@ void SpeculativeJIT::compileArithFRound(Node* node)
>     JSValueRegs op1Regs = op1.jsValueRegs();
>     flushRegisters();
>     FPRResult result(this);
>-    callOperation(operationArithFRound, result.fpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+    callOperation(operationArithFRound, result.fpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>     m_jit.exceptionCheck();
>     doubleResult(result.fpr(), node);
> }
>@@ -6604,7 +6613,7 @@ void SpeculativeJIT::compileValueMod(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationModHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationModHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
> 
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>@@ -6621,7 +6630,7 @@ void SpeculativeJIT::compileValueMod(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationValueMod, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs, op2Regs);
>+    callOperation(operationValueMod, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs, op2Regs);
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -7018,7 +7027,7 @@ void SpeculativeJIT::compileArithRounding(Node* node)
>         ASSERT(node->op() == ArithTrunc);
>         operation = operationArithTrunc;
>     }
>-    callOperation(operation, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs);
>+    callOperation(operation, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs);
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -7051,7 +7060,7 @@ void SpeculativeJIT::compileArithSqrt(Node* node)
>     JSValueRegs op1Regs = op1.jsValueRegs();
>     flushRegisters();
>     FPRResult result(this);
>-    callOperation(operationArithSqrt, result.fpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+    callOperation(operationArithSqrt, result.fpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>     m_jit.exceptionCheck();
>     doubleResult(result.fpr(), node);
> }
>@@ -7179,7 +7188,7 @@ void SpeculativeJIT::compileValuePow(Node* node)
>         JSValueRegsFlushedCallResult result(this);
>         JSValueRegs resultRegs = result.regs();
> 
>-        callOperation(operationPowHeapBigInt, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+        callOperation(operationPowHeapBigInt, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
> 
>         m_jit.exceptionCheck();
>         jsValueResult(resultRegs, node);
>@@ -7198,7 +7207,7 @@ void SpeculativeJIT::compileValuePow(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationValuePow, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>+    callOperation(operationValuePow, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftRegs, rightRegs);
>     m_jit.exceptionCheck();
> 
>     jsValueResult(resultRegs, node);
>@@ -7935,7 +7944,7 @@ void SpeculativeJIT::compileStringEquality(
>     done.link(&m_jit);
>     addSlowPathGenerator(
>         slowPathCall(
>-            slowCase, this, operationCompareStringEq, leftTempGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR));
>+            slowCase, this, operationCompareStringEq, leftTempGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR));
>     
>     blessedBooleanResult(leftTempGPR, node);
> }
>@@ -8085,7 +8094,7 @@ void SpeculativeJIT::compileStringCompare(Node* node, MacroAssembler::Relational
>     GPRReg resultGPR = result.gpr();
> 
>     flushRegisters();
>-    callOperation(compareFunction, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+    callOperation(compareFunction, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>     m_jit.exceptionCheck();
> 
>     unblessedBooleanResult(resultGPR, node);
>@@ -8186,7 +8195,7 @@ void SpeculativeJIT::compileSameValue(Node* node)
> 
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationSameValue, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>+    callOperation(operationSameValue, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>     m_jit.exceptionCheck();
> 
>     unblessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
>@@ -8272,7 +8281,7 @@ void SpeculativeJIT::compileConstantStoragePointer(Node* node)
> {
>     GPRTemporary storage(this);
>     GPRReg storageGPR = storage.gpr();
>-    m_jit.move(TrustedImmPtr(node->storagePointer()), storageGPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant::nonCellPtr(m_graph, node->storagePointer()), storageGPR);
>     storageResult(storageGPR, node);
> }
> 
>@@ -8325,7 +8334,7 @@ void SpeculativeJIT::compileGetIndexedPropertyStorage(Node* node)
>         addSlowPathGenerator(
>             slowPathCall(
>                 m_jit.branchIfRopeStringImpl(storageReg),
>-                this, operationResolveRope, storageReg, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg));
>+                this, operationResolveRope, storageReg, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg));
> 
>         m_jit.loadPtr(MacroAssembler::Address(storageReg, StringImpl::dataOffset()), storageReg);
>         break;
>@@ -8436,7 +8445,7 @@ void SpeculativeJIT::compileGetByValOnDirectArguments(Node* node, const ScopedLa
>         addSlowPathGenerator(
>             slowPathCall(
>                 isOutOfBounds, this, operationGetByValObjectInt,
>-                extractResult(resultRegs), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>+                extractResult(resultRegs), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>     }
>     
>     jsValueResult(resultRegs, node);
>@@ -8542,8 +8551,8 @@ void SpeculativeJIT::compileGetGlobalThis(Node* node)
> {
>     GPRTemporary result(this);
>     GPRReg resultGPR = result.gpr();
>-    auto* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
>-    m_jit.loadPtr(globalObject->addressOfGlobalThis(), resultGPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, m_jit.graph().globalObjectFor(node->origin.semantic)), resultGPR);
>+    m_jit.loadPtr(CCallHelpers::Address(resultGPR, JSGlobalObject::offsetOfGlobalThis()), resultGPR);
>     cellResult(resultGPR, node);
> }
> 
>@@ -8705,7 +8714,8 @@ void SpeculativeJIT::compileNewFunctionCommon(GPRReg resultGPR, RegisteredStruct
>     emitAllocateJSObjectWithKnownSize<ClassType>(resultGPR, TrustedImmPtr(structure), butterfly, scratch1GPR, scratch2GPR, slowPath, size);
>     
>     m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, JSFunction::offsetOfScopeChain()));
>-    m_jit.storePtr(TrustedImmPtr::weakPointer(m_jit.graph(), executable), JITCompiler::Address(resultGPR, JSFunction::offsetOfExecutableOrRareData()));
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), executable), scratch1GPR);
>+    m_jit.storePtr(scratch1GPR, JITCompiler::Address(resultGPR, JSFunction::offsetOfExecutableOrRareData()));
>     m_jit.mutatorFence(vm());
> }
> 
>@@ -8800,7 +8810,7 @@ void SpeculativeJIT::compileSetFunctionName(Node* node)
>     JSValueRegs nameValueRegs = nameValue.jsValueRegs();
> 
>     flushRegisters();
>-    callOperation(operationSetFunctionName, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), funcGPR, nameValueRegs);
>+    callOperation(operationSetFunctionName, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), funcGPR, nameValueRegs);
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -8817,7 +8827,7 @@ void SpeculativeJIT::compileVarargsLength(Node* node)
>     flushRegisters();
>     unlock(GPRInfo::returnValueGPR);
> 
>-    callOperation(operationSizeOfVarargs, GPRInfo::returnValueGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentsRegs, data->offset);
>+    callOperation(operationSizeOfVarargs, GPRInfo::returnValueGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentsRegs, data->offset);
>     m_jit.exceptionCheck();
> 
>     lock(GPRInfo::returnValueGPR);
>@@ -8854,7 +8864,7 @@ void SpeculativeJIT::compileLoadVarargs(Node* node)
> 
>     m_jit.store32(argumentCountIncludingThis, JITCompiler::payloadFor(data->machineCount));
> 
>-    callOperation(operationLoadVarargs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), data->machineStart.offset(), argumentsRegs, data->offset, argumentCountIncludingThis, data->mandatoryMinimum);
>+    callOperation(operationLoadVarargs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), data->machineStart.offset(), argumentsRegs, data->offset, argumentCountIncludingThis, data->mandatoryMinimum);
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -8985,10 +8995,8 @@ void SpeculativeJIT::compileCreateActivation(Node* node)
>     // Don't need a memory barriers since we just fast-created the activation, so the
>     // activation must be young.
>     m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, JSScope::offsetOfNext()));
>-    m_jit.storePtr(
>-        TrustedImmPtr(node->cellOperand()),
>-        JITCompiler::Address(resultGPR, JSLexicalEnvironment::offsetOfSymbolTable()));
>-        
>+    m_jit.storeUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, node->cellOperand()->cell()), JITCompiler::Address(resultGPR, JSLexicalEnvironment::offsetOfSymbolTable()));
>+
>     // Must initialize all members to undefined or the TDZ empty value.
>     for (unsigned i = 0; i < table->scopeSize(); ++i) {
>         m_jit.storeTrustedValue(
>@@ -9115,12 +9123,8 @@ void SpeculativeJIT::compileCreateDirectArguments(Node* node)
>                 JITCompiler::addressFor(
>                     inlineCallFrame->calleeRecovery.virtualRegister()),
>                 scratch1GPR);
>-        } else {
>-            m_jit.move(
>-                TrustedImmPtr::weakPointer(
>-                    m_jit.graph(), inlineCallFrame->calleeRecovery.constant().asCell()),
>-                scratch1GPR);
>-        }
>+        } else
>+            m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), inlineCallFrame->calleeRecovery.constant().asCell()), scratch1GPR);
>     } else
>         m_jit.loadPtr(JITCompiler::addressFor(CallFrameSlot::callee), scratch1GPR);
> 
>@@ -9360,7 +9364,7 @@ void SpeculativeJIT::compileCreateRest(Node* node)
> 
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationCreateRest, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentsStartGPR, Imm32(node->numberOfArgumentsToSkip()), arrayLengthGPR);
>+    callOperation(operationCreateRest, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentsStartGPR, Imm32(node->numberOfArgumentsToSkip()), arrayLengthGPR);
>     m_jit.exceptionCheck();
> 
>     cellResult(resultGPR, node);
>@@ -9454,7 +9458,7 @@ void SpeculativeJIT::compileSpread(Node* node)
>             done.append(m_jit.jump());
>         }
>         
>-        addSlowPathGenerator(slowPathCall(slowPath, this, operationSpreadFastArray, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argument));
>+        addSlowPathGenerator(slowPathCall(slowPath, this, operationSpreadFastArray, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argument));
> 
>         done.link(&m_jit);
>         m_jit.mutatorFence(vm());
>@@ -9464,7 +9468,7 @@ void SpeculativeJIT::compileSpread(Node* node)
> 
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(operationSpreadFastArray, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argument);
>+        callOperation(operationSpreadFastArray, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argument);
>         m_jit.exceptionCheck();
>         cellResult(resultGPR, node);
> #endif // USE(JSVALUE64)
>@@ -9473,7 +9477,7 @@ void SpeculativeJIT::compileSpread(Node* node)
> 
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(operationSpreadGeneric, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argument);
>+        callOperation(operationSpreadGeneric, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argument);
>         m_jit.exceptionCheck();
>         cellResult(resultGPR, node);
>     }
>@@ -9610,7 +9614,7 @@ void SpeculativeJIT::compileNewArray(Node* node)
>     GPRReg resultGPR = result.gpr();
> 
>     callOperation(
>-        operationNewArray, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
>+        operationNewArray, resultGPR, JITCompiler::UnlinkedConstant(m_graph, globalObject), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
>         static_cast<void*>(buffer), size_t(node->numChildren()));
>     m_jit.exceptionCheck();
> 
>@@ -9769,7 +9773,7 @@ void SpeculativeJIT::compileNewArrayWithSpread(Node* node)
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
> 
>-    callOperation(operationNewArrayWithSpreadSlow, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), buffer, node->numChildren());
>+    callOperation(operationNewArrayWithSpreadSlow, resultGPR, JITCompiler::UnlinkedConstant(m_graph, globalObject), buffer, node->numChildren());
>     m_jit.exceptionCheck();
> 
>     cellResult(resultGPR, node);
>@@ -9949,7 +9953,7 @@ void SpeculativeJIT::compileArraySlice(Node* node)
>         }
> 
>         addSlowPathGenerator(makeUnique<CallArrayAllocatorWithVariableStructureVariableSizeSlowPathGenerator>(
>-            slowCases, this, operationNewArrayWithSize, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), tempValue, sizeGPR, storageResultGPR));
>+            slowCases, this, operationNewArrayWithSize, resultGPR, JITCompiler::UnlinkedConstant(m_graph, globalObject), tempValue, sizeGPR, storageResultGPR));
>     }
> 
>     GPRTemporary temp4(this);
>@@ -10168,7 +10172,7 @@ void SpeculativeJIT::compileArrayIndexOf(Node* node)
> 
>         flushRegisters();
> 
>-        callOperation(operationArrayIndexOfString, lengthGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), storageGPR, searchElementGPR, indexGPR);
>+        callOperation(operationArrayIndexOfString, lengthGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), storageGPR, searchElementGPR, indexGPR);
>         m_jit.exceptionCheck();
> 
>         strictInt32Result(lengthGPR, node);
>@@ -10183,11 +10187,11 @@ void SpeculativeJIT::compileArrayIndexOf(Node* node)
>         flushRegisters();
>         switch (node->arrayMode().type()) {
>         case Array::Double:
>-            callOperation(operationArrayIndexOfValueDouble, lengthGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), storageGPR, searchElementRegs, indexGPR);
>+            callOperation(operationArrayIndexOfValueDouble, lengthGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), storageGPR, searchElementRegs, indexGPR);
>             break;
>         case Array::Int32:
>         case Array::Contiguous:
>-            callOperation(operationArrayIndexOfValueInt32OrContiguous, lengthGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), storageGPR, searchElementRegs, indexGPR);
>+            callOperation(operationArrayIndexOfValueInt32OrContiguous, lengthGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), storageGPR, searchElementRegs, indexGPR);
>             break;
>         default:
>             RELEASE_ASSERT_NOT_REACHED();
>@@ -10256,7 +10260,7 @@ void SpeculativeJIT::compileArrayPush(Node* node)
>             m_jit.boxInt32(storageLengthGPR, resultRegs);
> 
>             addSlowPathGenerator(
>-                slowPathCall(slowPath, this, operationArrayPush, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, baseGPR));
>+                slowPathCall(slowPath, this, operationArrayPush, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, baseGPR));
> 
>             jsValueResult(resultRegs, node);
>             return;
>@@ -10302,7 +10306,7 @@ void SpeculativeJIT::compileArrayPush(Node* node)
> 
>         MacroAssembler::Jump fastPath = m_jit.branchPtr(MacroAssembler::NotEqual, bufferGPR, TrustedImmPtr(static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer())));
> 
>-        addSlowPathGenerator(slowPathCall(m_jit.jump(), this, operationArrayPushMultiple, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, bufferGPR, TrustedImm32(elementCount)));
>+        addSlowPathGenerator(slowPathCall(m_jit.jump(), this, operationArrayPushMultiple, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, bufferGPR, TrustedImm32(elementCount)));
> 
>         base.use();
>         storage.use();
>@@ -10327,7 +10331,7 @@ void SpeculativeJIT::compileArrayPush(Node* node)
>             m_jit.boxInt32(storageLengthGPR, resultRegs);
> 
>             addSlowPathGenerator(
>-                slowPathCall(slowPath, this, operationArrayPushDouble, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueFPR, baseGPR));
>+                slowPathCall(slowPath, this, operationArrayPushDouble, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueFPR, baseGPR));
> 
>             jsValueResult(resultRegs, node);
>             return;
>@@ -10371,7 +10375,7 @@ void SpeculativeJIT::compileArrayPush(Node* node)
> 
>         MacroAssembler::Jump fastPath = m_jit.branchPtr(MacroAssembler::NotEqual, bufferGPR, TrustedImmPtr(static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer())));
> 
>-        addSlowPathGenerator(slowPathCall(m_jit.jump(), this, operationArrayPushDoubleMultiple, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, bufferGPR, TrustedImm32(elementCount)));
>+        addSlowPathGenerator(slowPathCall(m_jit.jump(), this, operationArrayPushDoubleMultiple, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, bufferGPR, TrustedImm32(elementCount)));
> 
>         base.use();
>         storage.use();
>@@ -10404,7 +10408,7 @@ void SpeculativeJIT::compileArrayPush(Node* node)
>             m_jit.boxInt32(storageLengthGPR, resultRegs);
> 
>             addSlowPathGenerator(
>-                slowPathCall(slowPath, this, operationArrayPush, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, baseGPR));
>+                slowPathCall(slowPath, this, operationArrayPush, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, baseGPR));
> 
>             jsValueResult(resultRegs, node);
>             return;
>@@ -10448,7 +10452,7 @@ void SpeculativeJIT::compileArrayPush(Node* node)
>         MacroAssembler::Jump fastPath = m_jit.branchPtr(MacroAssembler::NotEqual, bufferGPR, TrustedImmPtr(static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer())));
> 
>         addSlowPathGenerator(
>-            slowPathCall(m_jit.jump(), this, operationArrayPushMultiple, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, bufferGPR, TrustedImm32(elementCount)));
>+            slowPathCall(m_jit.jump(), this, operationArrayPushMultiple, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, bufferGPR, TrustedImm32(elementCount)));
> 
>         base.use();
>         storage.use();
>@@ -10503,8 +10507,6 @@ void SpeculativeJIT::compileIsObject(Node* node)
> 
> void SpeculativeJIT::compileTypeOfIsObject(Node* node)
> {
>-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
>-    
>     JSValueOperand value(this, node->child1());
>     JSValueRegs valueRegs = value.jsValueRegs();
>     
>@@ -10536,7 +10538,7 @@ void SpeculativeJIT::compileTypeOfIsObject(Node* node)
>     
>     addSlowPathGenerator(
>         slowPathCall(
>-            slowPath, this, operationTypeOfIsObject, resultGPR, globalObject,
>+            slowPath, this, operationTypeOfIsObject, resultGPR, JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.graph().globalObjectFor(node->origin.semantic)),
>             valueRegs.payloadGPR()));
>     
>     done.link(&m_jit);
>@@ -10546,8 +10548,6 @@ void SpeculativeJIT::compileTypeOfIsObject(Node* node)
> 
> void SpeculativeJIT::compileIsCallable(Node* node, S_JITOperation_GC slowPathOperation)
> {
>-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
>-    
>     JSValueOperand value(this, node->child1());
>     JSValueRegs valueRegs = value.jsValueRegs();
>     
>@@ -10573,7 +10573,7 @@ void SpeculativeJIT::compileIsCallable(Node* node, S_JITOperation_GC slowPathOpe
>     
>     addSlowPathGenerator(
>         slowPathCall(
>-            slowPath, this, slowPathOperation, resultGPR, globalObject,
>+            slowPath, this, slowPathOperation, resultGPR, JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.graph().globalObjectFor(node->origin.semantic)),
>             valueRegs.payloadGPR()));
>     
>     done.link(&m_jit);
>@@ -10589,14 +10589,12 @@ void SpeculativeJIT::compileIsConstructor(Node* node)
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
> 
>-    callOperation(operationIsConstructor, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputRegs);
>+    callOperation(operationIsConstructor, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputRegs);
>     unblessedBooleanResult(resultGPR, node);
> }
> 
> void SpeculativeJIT::compileTypeOf(Node* node)
> {
>-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
>-    
>     JSValueOperand value(this, node->child1());
>     JSValueRegs valueRegs = value.jsValueRegs();
>     
>@@ -10619,7 +10617,7 @@ void SpeculativeJIT::compileTypeOf(Node* node)
> 
>     addSlowPathGenerator(
>         slowPathCall(
>-            slowPath, this, operationTypeOfObject, resultGPR, globalObject,
>+            slowPath, this, operationTypeOfObject, resultGPR, JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.graph().globalObjectFor(node->origin.semantic)),
>             valueRegs.payloadGPR()));
>     
>     cellResult(resultGPR, node);
>@@ -10668,7 +10666,7 @@ void SpeculativeJIT::compileCheckIsConstant(Node* node)
> {
>     if (node->child1().useKind() == CellUse) {
>         SpeculateCellOperand cell(this, node->child1());
>-        speculationCheck(BadConstantValue, JSValueSource::unboxedCell(cell.gpr()), node->child1(), m_jit.branchWeakPtr(JITCompiler::NotEqual, cell.gpr(), node->cellOperand()->cell()));
>+        speculationCheck(BadConstantValue, JSValueSource::unboxedCell(cell.gpr()), node->child1(), m_jit.branchPtr(JITCompiler::NotEqual, cell.gpr(), TrustedImmPtr::weakPointer(m_graph, node->cellOperand()->cell())));
>     } else {
>         ASSERT(!node->constant()->value().isCell() || !node->constant()->value());
>         JSValueOperand operand(this, node->child1());
>@@ -10939,13 +10937,13 @@ void SpeculativeJIT::compileCallDOM(Node* node)
>     unsigned argumentCountIncludingThis = signature->argumentCount + 1;
>     switch (argumentCountIncludingThis) {
>     case 1:
>-        callOperation(reinterpret_cast<J_JITOperation_GP>(function.get()), extractResult(resultRegs), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regs[0]);
>+        callOperation(reinterpret_cast<J_JITOperation_GP>(function.get()), extractResult(resultRegs), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regs[0]);
>         break;
>     case 2:
>-        callOperation(reinterpret_cast<J_JITOperation_GPP>(function.get()), extractResult(resultRegs), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regs[0], regs[1]);
>+        callOperation(reinterpret_cast<J_JITOperation_GPP>(function.get()), extractResult(resultRegs), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regs[0], regs[1]);
>         break;
>     case 3:
>-        callOperation(reinterpret_cast<J_JITOperation_GPPP>(function.get()), extractResult(resultRegs), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regs[0], regs[1], regs[2]);
>+        callOperation(reinterpret_cast<J_JITOperation_GPPP>(function.get()), extractResult(resultRegs), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regs[0], regs[1], regs[2]);
>         break;
>     default:
>         RELEASE_ASSERT_NOT_REACHED();
>@@ -10969,9 +10967,9 @@ void SpeculativeJIT::compileCallDOMGetter(Node* node)
> 
>         flushRegisters();
>         if (Options::useJITCage())
>-            m_jit.setupArguments<J_JITOperation_GJIP>(TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), identifierUID(node->callDOMGetterData()->identifierNumber), getter.executableAddress());
>+            m_jit.setupArguments<J_JITOperation_GJIP>(JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), identifierUID(node->callDOMGetterData()->identifierNumber), getter.executableAddress());
>         else
>-            m_jit.setupArguments<J_JITOperation_GJI>(TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), identifierUID(node->callDOMGetterData()->identifierNumber));
>+            m_jit.setupArguments<J_JITOperation_GJI>(JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), identifierUID(node->callDOMGetterData()->identifierNumber));
> 
>         m_jit.storePtr(GPRInfo::callFrameRegister, &vm().topCallFrame);
>         m_jit.emitStoreCodeOrigin(m_currentNode->origin.semantic);
>@@ -11112,10 +11110,10 @@ void SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf(Node*
>         flushRegisters();
> 
>         if (node->op() == ToString)
>-            callOperation(operationToString, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+            callOperation(operationToString, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>         else {
>             ASSERT(node->op() == CallStringConstructor);
>-            callOperation(operationCallStringConstructor, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+            callOperation(operationCallStringConstructor, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>         }
>         m_jit.exceptionCheck();
>         cellResult(resultGPR, node);
>@@ -11142,12 +11140,12 @@ void SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf(Node*
>             slowPath2.link(&m_jit);
>         }
>         if (node->op() == ToString)
>-            callOperation(operationToString, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+            callOperation(operationToString, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>         else if (node->op() == StringValueOf)
>-            callOperation(operationStringValueOf, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+            callOperation(operationStringValueOf, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>         else {
>             ASSERT(node->op() == CallStringConstructor);
>-            callOperation(operationCallStringConstructor, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>+            callOperation(operationCallStringConstructor, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs);
>         }
>         m_jit.exceptionCheck();
>         if (done.isSet())
>@@ -11218,10 +11216,10 @@ void SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf(Node*
>             needCall.link(&m_jit);
>         }
>         if (node->op() == ToString)
>-            callOperation(operationToStringOnCell, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1GPR);
>+            callOperation(operationToStringOnCell, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1GPR);
>         else {
>             ASSERT(node->op() == CallStringConstructor);
>-            callOperation(operationCallStringConstructorOnCell, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1GPR);
>+            callOperation(operationCallStringConstructorOnCell, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1GPR);
>         }
>         m_jit.exceptionCheck();
>         if (done.isSet())
>@@ -11274,7 +11272,7 @@ void SpeculativeJIT::compileFunctionToString(Node* node)
>     continuation.link(&m_jit);
>     slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, result.gpr()));
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operationFunctionToString, result.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), function.gpr()));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operationFunctionToString, result.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), function.gpr()));
> 
>     cellResult(result.gpr(), node);
> }
>@@ -11288,7 +11286,7 @@ void SpeculativeJIT::compileNumberToStringWithValidRadixConstant(Node* node, int
> {
>     auto callToString = [&] (auto operation, GPRReg resultGPR, auto valueReg) {
>         flushRegisters();
>-        callOperation(operation, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueReg, TrustedImm32(radix));
>+        callOperation(operation, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueReg, TrustedImm32(radix));
>         m_jit.exceptionCheck();
>         cellResult(resultGPR, node);
>     };
>@@ -11333,7 +11331,7 @@ void SpeculativeJIT::compileNumberToStringWithRadix(Node* node)
> 
>     auto callToString = [&] (auto operation, GPRReg resultGPR, auto valueReg, GPRReg radixGPR) {
>         flushRegisters();
>-        callOperation(operation, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueReg, radixGPR);
>+        callOperation(operation, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueReg, radixGPR);
>         m_jit.exceptionCheck();
>         cellResult(resultGPR, node);
>     };
>@@ -11431,7 +11429,7 @@ void SpeculativeJIT::compileNewSymbol(Node* node)
>         flushRegisters();
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(operationNewSymbolWithStringDescription, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR);
>+        callOperation(operationNewSymbolWithStringDescription, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR);
>         m_jit.exceptionCheck();
>         cellResult(resultGPR, node);
>         return;
>@@ -11442,7 +11440,7 @@ void SpeculativeJIT::compileNewSymbol(Node* node)
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationNewSymbolWithDescription, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputRegs);
>+    callOperation(operationNewSymbolWithDescription, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), inputRegs);
>     m_jit.exceptionCheck();
>     cellResult(resultGPR, node);
> }
>@@ -11565,7 +11563,7 @@ void SpeculativeJIT::emitNewTypedArrayWithSizeInRegister(Node* node, TypedArrayT
>     
>     addSlowPathGenerator(slowPathCall(
>         slowCases, this, operationNewTypedArrayWithSizeForType(typedArrayType),
>-        resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), structure, sizeGPR, storageGPR));
>+        resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), structure, sizeGPR, storageGPR));
> 
>     cellResult(resultGPR, node);
> }
>@@ -11590,13 +11588,11 @@ void SpeculativeJIT::compileNewRegexp(Node* node)
>     auto butterfly = TrustedImmPtr(nullptr);
>     emitAllocateJSObject<RegExpObject>(resultGPR, TrustedImmPtr(structure), butterfly, scratch1GPR, scratch2GPR, slowPath);
> 
>-    m_jit.storePtr(
>-        TrustedImmPtr(node->cellOperand()),
>-        CCallHelpers::Address(resultGPR, RegExpObject::offsetOfRegExpAndFlags()));
>+    m_jit.storeUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, node->cellOperand()->cell()), CCallHelpers::Address(resultGPR, RegExpObject::offsetOfRegExpAndFlags()));
>     m_jit.storeValue(lastIndexRegs, CCallHelpers::Address(resultGPR, RegExpObject::offsetOfLastIndex()));
>     m_jit.mutatorFence(vm());
> 
>-    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewRegexpWithLastIndex, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regexp, lastIndexRegs));
>+    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewRegexpWithLastIndex, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regexp, lastIndexRegs));
> 
>     cellResult(resultGPR, node);
> }
>@@ -12522,7 +12518,7 @@ void SpeculativeJIT::emitSwitchCharStringJump(Node* node, SwitchData* data, GPRR
> {
>     m_jit.loadPtr(MacroAssembler::Address(value, JSString::offsetOfValue()), scratch);
>     auto isRope = m_jit.branchIfRopeStringImpl(scratch);
>-    addSlowPathGenerator(slowPathCall(isRope, this, operationResolveRope, scratch, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), value));
>+    addSlowPathGenerator(slowPathCall(isRope, this, operationResolveRope, scratch, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), value));
>     
>     addBranch(
>         m_jit.branch32(
>@@ -12764,7 +12760,7 @@ void SpeculativeJIT::emitSwitchStringOnString(Node* node, SwitchData* data, GPRR
> 
>     if (!canDoBinarySwitch || totalLength > Options::maximumBinaryStringSwitchTotalLength()) {
>         flushRegisters();
>-        callOperation(operationSwitchString, string, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), &unlinkedTable, string);
>+        callOperation(operationSwitchString, string, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), &unlinkedTable, string);
>         m_jit.exceptionCheck();
>         m_jit.farJump(string, JSSwitchPtrTag);
>         return;
>@@ -12801,7 +12797,7 @@ void SpeculativeJIT::emitSwitchStringOnString(Node* node, SwitchData* data, GPRR
>     
>     slowCases.link(&m_jit);
>     silentSpillAllRegisters(string);
>-    callOperation(operationSwitchString, string, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), &unlinkedTable, string);
>+    callOperation(operationSwitchString, string, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), &unlinkedTable, string);
>     silentFillAllRegisters();
>     m_jit.exceptionCheck();
>     m_jit.farJump(string, JSSwitchPtrTag);
>@@ -12948,7 +12944,7 @@ void SpeculativeJIT::compilePutAccessorById(Node* node)
>     GPRReg accessorGPR = accessor.gpr();
> 
>     flushRegisters();
>-    callOperation(node->op() == PutGetterById ? operationPutGetterById : operationPutSetterById, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), accessorGPR);
>+    callOperation(node->op() == PutGetterById ? operationPutGetterById : operationPutSetterById, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), accessorGPR);
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -12966,7 +12962,7 @@ void SpeculativeJIT::compilePutGetterSetterById(Node* node)
>     GPRReg setterGPR = setter.gpr();
> 
>     flushRegisters();
>-    callOperation(operationPutGetterSetter, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterGPR, setterGPR);
>+    callOperation(operationPutGetterSetter, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterGPR, setterGPR);
> #else
>     // These JSValues may be JSUndefined OR JSFunction*.
>     // At that time,
>@@ -12978,7 +12974,7 @@ void SpeculativeJIT::compilePutGetterSetterById(Node* node)
>     JSValueRegs setterRegs = setter.jsValueRegs();
> 
>     flushRegisters();
>-    callOperation(operationPutGetterSetter, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterRegs.payloadGPR(), setterRegs.payloadGPR());
>+    callOperation(operationPutGetterSetter, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterRegs.payloadGPR(), setterRegs.payloadGPR());
> #endif
>     m_jit.exceptionCheck();
> 
>@@ -12992,7 +12988,7 @@ void SpeculativeJIT::compileResolveScope(Node* node)
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>     flushRegisters();
>-    callOperation(operationResolveScope, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()));
>+    callOperation(operationResolveScope, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()));
>     m_jit.exceptionCheck();
>     cellResult(resultGPR, node);
> }
>@@ -13004,7 +13000,7 @@ void SpeculativeJIT::compileResolveScopeForHoistingFuncDeclInEval(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationResolveScopeForHoistingFuncDeclInEval, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()));
>+    callOperation(operationResolveScopeForHoistingFuncDeclInEval, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()));
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -13032,7 +13028,7 @@ void SpeculativeJIT::compileGetDynamicVar(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationGetDynamicVar, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()), node->getPutInfo());
>+    callOperation(operationGetDynamicVar, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()), node->getPutInfo());
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -13046,7 +13042,7 @@ void SpeculativeJIT::compilePutDynamicVar(Node* node)
>     JSValueRegs valueRegs = value.jsValueRegs();
> 
>     flushRegisters();
>-    callOperation(node->ecmaMode().isStrict() ? operationPutDynamicVarStrict : operationPutDynamicVarNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, valueRegs, identifierUID(node->identifierNumber()), node->getPutInfo());
>+    callOperation(node->ecmaMode().isStrict() ? operationPutDynamicVarStrict : operationPutDynamicVarNonStrict, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, valueRegs, identifierUID(node->identifierNumber()), node->getPutInfo());
>     m_jit.exceptionCheck();
>     noResult(node);
> }
>@@ -13112,7 +13108,7 @@ void SpeculativeJIT::compilePutAccessorByVal(Node* node)
>     GPRReg accessorGPR = accessor.gpr();
> 
>     flushRegisters();
>-    callOperation(operation, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, subscriptRegs, node->accessorAttributes(), accessorGPR);
>+    callOperation(operation, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, subscriptRegs, node->accessorAttributes(), accessorGPR);
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -13289,7 +13285,7 @@ void SpeculativeJIT::compileStringReplace(Node* node)
> 
>                 flushRegisters();
>                 GPRFlushedCallResult result(this);
>-                callOperation(operationStringProtoFuncReplaceRegExpEmptyStr, result.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, regExpGPR);
>+                callOperation(operationStringProtoFuncReplaceRegExpEmptyStr, result.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, regExpGPR);
>                 m_jit.exceptionCheck();
>                 cellResult(result.gpr(), node);
>                 if (sample)
>@@ -13310,7 +13306,7 @@ void SpeculativeJIT::compileStringReplace(Node* node)
> 
>         flushRegisters();
>         GPRFlushedCallResult result(this);
>-        callOperation(operationStringProtoFuncReplaceRegExpString, result.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, regExpGPR, replaceGPR);
>+        callOperation(operationStringProtoFuncReplaceRegExpString, result.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, regExpGPR, replaceGPR);
>         m_jit.exceptionCheck();
>         cellResult(result.gpr(), node);
>         if (sample)
>@@ -13332,7 +13328,7 @@ void SpeculativeJIT::compileStringReplace(Node* node)
> 
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>-    callOperation(operationStringProtoFuncReplaceGeneric, result.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringRegs, searchRegs, replaceRegs);
>+    callOperation(operationStringProtoFuncReplaceGeneric, result.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringRegs, searchRegs, replaceRegs);
>     m_jit.exceptionCheck();
>     cellResult(result.gpr(), node);
>     if (sample)
>@@ -13353,7 +13349,7 @@ void SpeculativeJIT::compileRegExpExecNonGlobalOrSticky(Node* node)
>     JSValueRegs resultRegs = result.regs();
>     callOperation(
>         operationRegExpExecNonGlobalOrSticky, resultRegs,
>-        globalObjectGPR, TrustedImmPtr(node->cellOperand()), argumentGPR);
>+        globalObjectGPR, JITCompiler::UnlinkedConstant(m_graph, node->cellOperand()->cell()), argumentGPR);
>     m_jit.exceptionCheck();
> 
>     jsValueResult(resultRegs, node);
>@@ -13373,7 +13369,7 @@ void SpeculativeJIT::compileRegExpMatchFastGlobal(Node* node)
>     JSValueRegs resultRegs = result.regs();
>     callOperation(
>         operationRegExpMatchFastGlobalString, resultRegs,
>-        globalObjectGPR, TrustedImmPtr(node->cellOperand()), argumentGPR);
>+        globalObjectGPR, JITCompiler::UnlinkedConstant(m_graph, node->cellOperand()->cell()), argumentGPR);
>     m_jit.exceptionCheck();
> 
>     jsValueResult(resultRegs, node);
>@@ -13557,7 +13553,7 @@ void SpeculativeJIT::compileDefineDataProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineDataPropertyString, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, valueRegs, attributesGPR);
>+        callOperation(operationDefineDataPropertyString, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, valueRegs, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13574,7 +13570,7 @@ void SpeculativeJIT::compileDefineDataProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineDataPropertyStringIdent, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identGPR, valueRegs, attributesGPR);
>+        callOperation(operationDefineDataPropertyStringIdent, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identGPR, valueRegs, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13586,7 +13582,7 @@ void SpeculativeJIT::compileDefineDataProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineDataPropertySymbol, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, valueRegs, attributesGPR);
>+        callOperation(operationDefineDataPropertySymbol, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, valueRegs, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13597,7 +13593,7 @@ void SpeculativeJIT::compileDefineDataProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineDataProperty, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, valueRegs, attributesGPR);
>+        callOperation(operationDefineDataProperty, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, valueRegs, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13638,7 +13634,7 @@ void SpeculativeJIT::compileDefineAccessorProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineAccessorPropertyString, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, getterGPR, setterGPR, attributesGPR);
>+        callOperation(operationDefineAccessorPropertyString, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, getterGPR, setterGPR, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13655,7 +13651,7 @@ void SpeculativeJIT::compileDefineAccessorProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineAccessorPropertyStringIdent, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identGPR, getterGPR, setterGPR, attributesGPR);
>+        callOperation(operationDefineAccessorPropertyStringIdent, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identGPR, getterGPR, setterGPR, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13667,7 +13663,7 @@ void SpeculativeJIT::compileDefineAccessorProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineAccessorPropertySymbol, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, getterGPR, setterGPR, attributesGPR);
>+        callOperation(operationDefineAccessorPropertySymbol, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR, getterGPR, setterGPR, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13678,7 +13674,7 @@ void SpeculativeJIT::compileDefineAccessorProperty(Node* node)
>         useChildren(node);
> 
>         flushRegisters();
>-        callOperation(operationDefineAccessorProperty, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, getterGPR, setterGPR, attributesGPR);
>+        callOperation(operationDefineAccessorProperty, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyRegs, getterGPR, setterGPR, attributesGPR);
>         m_jit.exceptionCheck();
>         break;
>     }
>@@ -13810,7 +13806,7 @@ void SpeculativeJIT::compileGetMapBucketNext(Node* node)
>         ASSERT(node->bucketOwnerType() == BucketOwnerType::Set);
>         sentinel = vm().sentinelSetBucket();
>     }
>-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), sentinel), resultGPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), sentinel), resultGPR);
>     done.link(&m_jit);
> 
>     cellResult(resultGPR, node);
>@@ -13872,7 +13868,7 @@ void SpeculativeJIT::compileThrow(Node* node)
>     JSValueOperand value(this, node->child1());
>     JSValueRegs valueRegs = value.jsValueRegs();
>     flushRegisters();
>-    callOperation(operationThrowDFG, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs);
>+    callOperation(operationThrowDFG, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs);
>     m_jit.exceptionCheck();
>     m_jit.breakpoint();
>     noResult(node);
>@@ -13884,7 +13880,7 @@ void SpeculativeJIT::compileThrowStaticError(Node* node)
>     GPRReg messageGPR = message.gpr();
>     speculateString(node->child1(), messageGPR);
>     flushRegisters();
>-    callOperation(operationThrowStaticError, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), messageGPR, node->errorType());
>+    callOperation(operationThrowStaticError, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), messageGPR, node->errorType());
>     m_jit.exceptionCheck();
>     m_jit.breakpoint();
>     noResult(node);
>@@ -13974,7 +13970,7 @@ void SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode(Node* node)
>     flushRegisters();
>     JSValueRegsFlushedCallResult result(this);
>     JSValueRegs resultRegs = result.regs();
>-    callOperation(operationEnumeratorNextUpdateIndexAndMode, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, indexGPR, modeGPR, enumeratorGPR);
>+    callOperation(operationEnumeratorNextUpdateIndexAndMode, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, indexGPR, modeGPR, enumeratorGPR);
>     m_jit.exceptionCheck();
>     jsValueResult(resultRegs, node);
> }
>@@ -14047,12 +14043,12 @@ void SpeculativeJIT::compileEnumeratorNextUpdatePropertyName(Node* node)
>         doneCases.append(m_jit.jump());
> 
>         outOfBounds.link(&m_jit);
>-        m_jit.move(TrustedImmPtr::weakPointer(m_graph, vm().smallStrings.sentinelString()), resultGPR);
>+        m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, vm().smallStrings.sentinelString()), resultGPR);
>         doneCases.append(m_jit.jump());
>         operationCall.link(&m_jit);
>     }
> 
>-    callOperation(operationEnumeratorNextUpdatePropertyName, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), index, mode, enumerator);
>+    callOperation(operationEnumeratorNextUpdatePropertyName, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), index, mode, enumerator);
>     m_jit.exceptionCheck();
> 
>     doneCases.link(&m_jit);
>@@ -14096,9 +14092,9 @@ void SpeculativeJIT::compileEnumeratorHasProperty(Node* node, SlowPathFunctionTy
>         operationCases.link(&m_jit);
> 
>         if (baseRegs.tagGPR() == InvalidGPRReg)
>-            callOperation(slowPathFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseRegs.payloadGPR()), propertyNameRegs, indexGPR, modeGPR);
>+            callOperation(slowPathFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseRegs.payloadGPR()), propertyNameRegs, indexGPR, modeGPR);
>         else
>-            callOperation(slowPathFunction, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyNameRegs, indexGPR, modeGPR);
>+            callOperation(slowPathFunction, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, propertyNameRegs, indexGPR, modeGPR);
>         m_jit.exceptionCheck();
> 
>         done.link(&m_jit);
>@@ -14200,7 +14196,7 @@ void SpeculativeJIT::compilePutByIdWithThis(Node* node)
> 
>     flushRegisters();
>     callOperation(node->ecmaMode().isStrict() ? operationPutByIdWithThisStrict : operationPutByIdWithThis,
>-        TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, thisRegs, valueRegs, node->cacheableIdentifier().rawBits());
>+        JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, thisRegs, valueRegs, node->cacheableIdentifier().rawBits());
>     m_jit.exceptionCheck();
> 
>     noResult(node);
>@@ -14281,7 +14277,7 @@ void SpeculativeJIT::compileGetPropertyEnumerator(Node* node)
> 
>         if (node->child1().useKind() == CellOrOtherUse) {
>             auto notOther = m_jit.branchIfNotOther(baseRegs, scratch1GPR);
>-            m_jit.move(TrustedImmPtr::weakPointer(m_graph, vm().emptyPropertyNameEnumerator()), scratch1GPR);
>+            m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, vm().emptyPropertyNameEnumerator()), scratch1GPR);
>             doneCases.append(m_jit.jump());
>             notOther.link(&m_jit);
>         }
>@@ -14339,7 +14335,7 @@ void SpeculativeJIT::compileGetPropertyEnumerator(Node* node)
> 
>         slowCases.link(&m_jit);
>         silentSpillAllRegisters(scratch1GPR);
>-        callOperation(operationGetPropertyEnumeratorCell, scratch1GPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs.payloadGPR());
>+        callOperation(operationGetPropertyEnumeratorCell, scratch1GPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs.payloadGPR());
>         silentFillAllRegisters();
>         m_jit.exceptionCheck();
> 
>@@ -14354,7 +14350,7 @@ void SpeculativeJIT::compileGetPropertyEnumerator(Node* node)
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationGetPropertyEnumerator, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs);
>+    callOperation(operationGetPropertyEnumerator, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs);
>     m_jit.exceptionCheck();
>     cellResult(resultGPR, node);
> }
>@@ -14443,9 +14439,9 @@ void SpeculativeJIT::compileStrCat(Node* node)
> 
>     GPRFlushedCallResult result(this);
>     if (node->child3())
>-        callOperation(operationStrCat3, result.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs, op2Regs, op3Regs);
>+        callOperation(operationStrCat3, result.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs, op2Regs, op3Regs);
>     else
>-        callOperation(operationStrCat2, result.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs, op2Regs);
>+        callOperation(operationStrCat2, result.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), op1Regs, op2Regs);
>     m_jit.exceptionCheck();
> 
>     cellResult(result.gpr(), node);
>@@ -14515,7 +14511,7 @@ void SpeculativeJIT::compileNewArrayWithSize(Node* node)
>     bigLength.link(&m_jit);
>     m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
>     done.link(&m_jit);
>-    callOperation(operationNewArrayWithSize, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), structureGPR, sizeGPR, nullptr);
>+    callOperation(operationNewArrayWithSize, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), structureGPR, sizeGPR, nullptr);
>     m_jit.exceptionCheck();
>     cellResult(resultGPR, node);
> }
>@@ -14543,7 +14539,7 @@ void SpeculativeJIT::compileNewTypedArray(Node* node)
>         JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
>         callOperation(
>             operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
>-            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
>+            resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
>         m_jit.exceptionCheck();
> 
>         cellResult(resultGPR, node);
>@@ -14578,7 +14574,7 @@ void SpeculativeJIT::compileToThis(Node* node)
>         function = operationToThisStrict;
>     else
>         function = operationToThis;
>-    addSlowPathGenerator(slowPathCall(slowCases, this, function, tempRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), thisValueRegs));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, function, tempRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), thisValueRegs));
> 
>     jsValueResult(tempRegs, node);
> }
>@@ -14628,7 +14624,7 @@ void SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames(Node* node)
> 
>             addSlowPathGenerator(slowPathCall(slowButArrayBufferCases, this, operationNewArrayBuffer, resultGPR, &vm(), arrayStructure, scratch3GPR));
> 
>-            addSlowPathGenerator(slowPathCall(slowCases, this, node->op() == ObjectKeys ? operationObjectKeysObject : operationObjectGetOwnPropertyNamesObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));
>+            addSlowPathGenerator(slowPathCall(slowCases, this, node->op() == ObjectKeys ? operationObjectKeysObject : operationObjectGetOwnPropertyNamesObject, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));
> 
>             cellResult(resultGPR, node);
>             break;
>@@ -14643,7 +14639,7 @@ void SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames(Node* node)
>         flushRegisters();
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(node->op() == ObjectKeys ? operationObjectKeysObject : operationObjectGetOwnPropertyNamesObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR);
>+        callOperation(node->op() == ObjectKeys ? operationObjectKeysObject : operationObjectGetOwnPropertyNamesObject, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR);
>         m_jit.exceptionCheck();
> 
>         cellResult(resultGPR, node);
>@@ -14658,7 +14654,7 @@ void SpeculativeJIT::compileObjectKeysOrObjectGetOwnPropertyNames(Node* node)
>         flushRegisters();
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(node->op() == ObjectKeys ? operationObjectKeys : operationObjectGetOwnPropertyNames, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectRegs);
>+        callOperation(node->op() == ObjectKeys ? operationObjectKeys : operationObjectGetOwnPropertyNames, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectRegs);
>         m_jit.exceptionCheck();
> 
>         cellResult(resultGPR, node);
>@@ -14685,7 +14681,7 @@ void SpeculativeJIT::compileObjectAssign(Node* node)
>         speculateObject(node->child2(), sourceGPR);
> 
>         flushRegisters();
>-        callOperation(operationObjectAssignObject, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), targetGPR, sourceGPR);
>+        callOperation(operationObjectAssignObject, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), targetGPR, sourceGPR);
>         m_jit.exceptionCheck();
> 
>         noResult(node);
>@@ -14698,7 +14694,7 @@ void SpeculativeJIT::compileObjectAssign(Node* node)
>         JSValueRegs sourceRegs = source.jsValueRegs();
> 
>         flushRegisters();
>-        callOperation(operationObjectAssignUntyped, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), targetGPR, sourceRegs);
>+        callOperation(operationObjectAssignUntyped, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), targetGPR, sourceRegs);
>         m_jit.exceptionCheck();
> 
>         noResult(node);
>@@ -14723,7 +14719,7 @@ void SpeculativeJIT::compileObjectCreate(Node* node)
>         flushRegisters();
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(operationObjectCreateObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), prototypeGPR);
>+        callOperation(operationObjectCreateObject, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), prototypeGPR);
>         m_jit.exceptionCheck();
> 
>         cellResult(resultGPR, node);
>@@ -14738,7 +14734,7 @@ void SpeculativeJIT::compileObjectCreate(Node* node)
>         flushRegisters();
>         GPRFlushedCallResult result(this);
>         GPRReg resultGPR = result.gpr();
>-        callOperation(operationObjectCreate, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), prototypeRegs);
>+        callOperation(operationObjectCreate, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), prototypeRegs);
>         m_jit.exceptionCheck();
> 
>         cellResult(resultGPR, node);
>@@ -14790,7 +14786,7 @@ void SpeculativeJIT::compileCreateThis(Node* node)
>     m_jit.emitInitializeInlineStorage(resultGPR, inlineCapacityGPR);
>     m_jit.mutatorFence(vm());
> 
>-    addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), calleeGPR, node->inlineCapacity()));
>+    addSlowPathGenerator(slowPathCall(slowPath, this, operationCreateThis, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), calleeGPR, node->inlineCapacity()));
> 
>     cellResult(resultGPR, node);
> }
>@@ -14827,7 +14823,7 @@ void SpeculativeJIT::compileCreatePromise(Node* node)
>     m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
>     m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);
>     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
>-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), globalObject), scratch1GPR);
>     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::globalObjectOffset())));
> 
>     fastPromisePath.link(&m_jit);
>@@ -14840,7 +14836,7 @@ void SpeculativeJIT::compileCreatePromise(Node* node)
>     m_jit.storeTrustedValue(jsUndefined(), CCallHelpers::Address(resultGPR, JSInternalFieldObjectImpl<>::offsetOfInternalField(static_cast<unsigned>(JSPromise::Field::ReactionsOrResult))));
>     m_jit.mutatorFence(m_jit.vm());
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, node->isInternalPromise() ? operationCreateInternalPromise : operationCreatePromise, resultGPR, TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), calleeGPR));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, node->isInternalPromise() ? operationCreateInternalPromise : operationCreatePromise, resultGPR, JITCompiler::UnlinkedConstant(m_jit.graph(), globalObject), calleeGPR));
> 
>     cellResult(resultGPR, node);
> }
>@@ -14876,7 +14872,7 @@ void SpeculativeJIT::compileCreateInternalFieldObject(Node* node, Operation oper
>     m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
>     m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);
>     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
>-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), globalObject), scratch1GPR);
>     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::globalObjectOffset())));
> 
>     auto butterfly = TrustedImmPtr(nullptr);
>@@ -14887,7 +14883,7 @@ void SpeculativeJIT::compileCreateInternalFieldObject(Node* node, Operation oper
>         m_jit.storeTrustedValue(initialValues[index], CCallHelpers::Address(resultGPR, JSInternalFieldObjectImpl<>::offsetOfInternalField(index)));
>     m_jit.mutatorFence(m_jit.vm());
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operation, resultGPR, TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), calleeGPR));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operation, resultGPR, JITCompiler::UnlinkedConstant(m_jit.graph(), globalObject), calleeGPR));
> 
>     cellResult(resultGPR, node);
> }
>@@ -15011,7 +15007,7 @@ void SpeculativeJIT::compileToPrimitive(Node* node)
>     alreadyPrimitive.link(&m_jit);
>     m_jit.moveValueRegs(argumentRegs, resultRegs);
> 
>-    addSlowPathGenerator(slowPathCall(notPrimitive, this, operationToPrimitive, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
>+    addSlowPathGenerator(slowPathCall(notPrimitive, this, operationToPrimitive, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
> 
>     jsValueResult(resultRegs, node, DataFormatJS, UseChildrenCalledExplicitly);
> }
>@@ -15035,7 +15031,7 @@ void SpeculativeJIT::compileToPropertyKey(Node* node)
>     alreadyPropertyKey.link(&m_jit);
>     m_jit.moveValueRegs(argumentRegs, resultRegs);
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operationToPropertyKey, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operationToPropertyKey, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
> 
>     jsValueResult(resultRegs, node, DataFormatJSCell, UseChildrenCalledExplicitly);
> }
>@@ -15065,7 +15061,7 @@ void SpeculativeJIT::compileToNumeric(Node* node)
>     isHeapBigInt.link(&m_jit);
>     m_jit.moveValueRegs(argumentRegs, resultRegs);
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operationToNumeric, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operationToNumeric, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
> 
>     jsValueResult(resultRegs, node, DataFormatJS);
> }
>@@ -15100,7 +15096,7 @@ void SpeculativeJIT::compileCallNumberConstructor(Node* node)
>     CCallHelpers::JumpList slowCases;
>     slowCases.append(m_jit.branchIfNotNumber(argumentRegs, tempGPR));
>     m_jit.moveValueRegs(argumentRegs, resultRegs);
>-    addSlowPathGenerator(slowPathCall(slowCases, this, operationCallNumberConstructor, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, operationCallNumberConstructor, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentRegs));
> 
>     jsValueResult(resultRegs, node);
> }
>@@ -15147,7 +15143,8 @@ void SpeculativeJIT::compileLogShadowChickenTail(Node* node)
>     SpeculateCellOperand scope(this, node->child2());
>     GPRReg scopeReg = scope.gpr();
> 
>-    m_jit.logShadowChickenTailPacket(shadowPacketReg, thisRegs, scopeReg, CCallHelpers::TrustedImmPtr(m_jit.codeBlock()), callSiteIndex);
>+    m_jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, scratch1Reg);
>+    m_jit.logShadowChickenTailPacket(shadowPacketReg, thisRegs, scopeReg, scratch1Reg, callSiteIndex);
>     noResult(node);
> }
> 
>@@ -15166,7 +15163,7 @@ void SpeculativeJIT::compileSetAdd(Node* node)
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationSetAdd, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), setGPR, keyRegs, hashGPR);
>+    callOperation(operationSetAdd, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), setGPR, keyRegs, hashGPR);
>     m_jit.exceptionCheck();
>     cellResult(resultGPR, node);
> }
>@@ -15188,7 +15185,7 @@ void SpeculativeJIT::compileMapSet(Node* node)
>     flushRegisters();
>     GPRFlushedCallResult result(this);
>     GPRReg resultGPR = result.gpr();
>-    callOperation(operationMapSet, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), mapGPR, keyRegs, valueRegs, hashGPR);
>+    callOperation(operationMapSet, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), mapGPR, keyRegs, valueRegs, hashGPR);
>     m_jit.exceptionCheck();
>     cellResult(resultGPR, node);
> }
>@@ -15407,7 +15404,7 @@ void SpeculativeJIT::compileGetPrototypeOf(Node* node)
>         JITCompiler::JumpList slowCases;
>         m_jit.emitLoadPrototype(vm(), objectGPR, resultRegs, slowCases);
>         addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOfObject,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));
> 
>         jsValueResult(resultRegs, node);
>         return;
>@@ -15424,7 +15421,7 @@ void SpeculativeJIT::compileGetPrototypeOf(Node* node)
> 
>         m_jit.emitLoadPrototype(vm(), valueGPR, resultRegs, slowCases);
>         addSlowPathGenerator(slowPathCall(slowCases, this, operationGetPrototypeOf,
>-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs));
>+            resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs));
> 
>         jsValueResult(resultRegs, node);
>         return;
>@@ -15551,7 +15548,7 @@ void SpeculativeJIT::compileAllocateNewArrayWithSize(JSGlobalObject* globalObjec
> 
>     addSlowPathGenerator(makeUnique<CallArrayAllocatorWithVariableSizeSlowPathGenerator>(
>         slowCases, this, operationNewArrayWithSize, resultGPR,
>-        TrustedImmPtr::weakPointer(m_graph, globalObject),
>+        JITCompiler::UnlinkedConstant(m_graph, globalObject),
>         structure,
>         shouldConvertLargeSizeToArrayStorage ? m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)) : structure,
>         sizeGPR, storageGPR));
>@@ -15684,7 +15681,7 @@ void SpeculativeJIT::compileHasIndexedProperty(Node* node, S_JITOperation_GCZ sl
>     }
>     }
> 
>-    addSlowPathGenerator(slowPathCall(slowCases, this, slowPathOperation, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, indexGPR));
>+    addSlowPathGenerator(slowPathCall(slowCases, this, slowPathOperation, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, indexGPR));
> }
> 
> void SpeculativeJIT::compileExtractCatchLocal(Node* node)
>@@ -15804,11 +15801,11 @@ void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg baseGPR, JSValu
>     std::unique_ptr<SlowPathGenerator> slowPath;
>     if (JITCode::useDataIC(JITType::DFGJIT)) {
>         slowPath = slowPathICCall(
>-            slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), gen.slowPathFunction(), NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, valueRegs,
>+            slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), gen.slowPathFunction(), NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, valueRegs,
>             CCallHelpers::CellValue(baseGPR), identifier.rawBits());
>     } else {
>         slowPath = slowPathCall(
>-            slowCases, this, gen.slowPathFunction(), NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), valueRegs,
>+            slowCases, this, gen.slowPathFunction(), NoResult, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), valueRegs,
>             CCallHelpers::CellValue(baseGPR), identifier.rawBits());
>     }
> 
>@@ -15837,7 +15834,7 @@ void SpeculativeJIT::genericJSValueNonPeepholeCompare(Node* node, MacroAssembler
>         arg2.use();
> 
>         flushRegisters();
>-        callOperation(helperFunction, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>+        callOperation(helperFunction, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>         m_jit.exceptionCheck();
> 
>         unblessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
>@@ -15858,7 +15855,7 @@ void SpeculativeJIT::genericJSValueNonPeepholeCompare(Node* node, MacroAssembler
>     m_jit.compare32(cond, arg1Regs.payloadGPR(), arg2Regs.payloadGPR(), resultGPR);
> 
>     if (!isKnownInteger(node->child1().node()) || !isKnownInteger(node->child2().node()))
>-        addSlowPathGenerator(slowPathCall(slowPath, this, helperFunction, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs));
>+        addSlowPathGenerator(slowPathCall(slowPath, this, helperFunction, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs));
> 
>     unblessedBooleanResult(resultGPR, node, UseChildrenCalledExplicitly);
> }
>@@ -15898,7 +15895,7 @@ void SpeculativeJIT::genericJSValuePeepholeBranch(Node* node, Node* branchNode,
>         arg2.use();
> 
>         flushRegisters();
>-        callOperation(helperFunction, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>+        callOperation(helperFunction, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>         m_jit.exceptionCheck();
> 
>         branchTest32(callResultCondition, resultGPR, taken);
>@@ -15922,7 +15919,7 @@ void SpeculativeJIT::genericJSValuePeepholeBranch(Node* node, Node* branchNode,
>             slowPath.link(&m_jit);
> 
>             silentSpillAllRegisters(resultGPR);
>-            callOperation(helperFunction, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>+            callOperation(helperFunction, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>             silentFillAllRegisters();
>             m_jit.exceptionCheck();
> 
>@@ -15962,7 +15959,7 @@ void SpeculativeJIT::compileHeapBigIntEquality(Node* node)
>     notEqualCase.link(&m_jit);
> 
>     silentSpillAllRegisters(resultGPR);
>-    callOperation(operationCompareStrictEqCell, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>+    callOperation(operationCompareStrictEqCell, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), leftGPR, rightGPR);
>     silentFillAllRegisters();
> 
>     done.link(&m_jit);
>@@ -16115,7 +16112,7 @@ void SpeculativeJIT::compileMakeRope(Node* node)
> 
>     auto isNonEmptyString = m_jit.branchTest32(CCallHelpers::NonZero, allocatorGPR);
> 
>-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(m_jit.graph().m_vm)), resultGPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), jsEmptyString(m_jit.graph().m_vm)), resultGPR);
> 
>     isNonEmptyString.link(&m_jit);
>     m_jit.mutatorFence(vm());
>@@ -16123,11 +16120,11 @@ void SpeculativeJIT::compileMakeRope(Node* node)
>     switch (numOpGPRs) {
>     case 2:
>         addSlowPathGenerator(slowPathCall(
>-            slowPath, this, operationMakeRope2, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1]));
>+            slowPath, this, operationMakeRope2, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1]));
>         break;
>     case 3:
>         addSlowPathGenerator(slowPathCall(
>-            slowPath, this, operationMakeRope3, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1], opGPRs[2]));
>+            slowPath, this, operationMakeRope3, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1], opGPRs[2]));
>         break;
>     default:
>         RELEASE_ASSERT_NOT_REACHED();
>@@ -16141,11 +16138,11 @@ void SpeculativeJIT::compileMakeRope(Node* node)
>     GPRReg resultGPR = result.gpr();
>     switch (numOpGPRs) {
>     case 2:
>-        callOperation(operationMakeRope2, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1]);
>+        callOperation(operationMakeRope2, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1]);
>         m_jit.exceptionCheck();
>         break;
>     case 3:
>-        callOperation(operationMakeRope3, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1], opGPRs[2]);
>+        callOperation(operationMakeRope3, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), opGPRs[0], opGPRs[1], opGPRs[2]);
>         m_jit.exceptionCheck();
>         break;
>     default:
>@@ -16248,9 +16245,9 @@ void SpeculativeJIT::compileEnumeratorGetByVal(Node* node)
> 
>         if (!recoverGenericCase.empty()) {
>             if (baseRegs.tagGPR() == InvalidGPRReg)
>-                addSlowPathGenerator(slowPathCall(recoverGenericCase, this, operationEnumeratorRecoverNameAndGetByVal, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseRegs.payloadGPR()), indexGPR, enumeratorGPR));
>+                addSlowPathGenerator(slowPathCall(recoverGenericCase, this, operationEnumeratorRecoverNameAndGetByVal, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseRegs.payloadGPR()), indexGPR, enumeratorGPR));
>             else
>-                addSlowPathGenerator(slowPathCall(recoverGenericCase, this, operationEnumeratorRecoverNameAndGetByVal, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, indexGPR, enumeratorGPR));
>+                addSlowPathGenerator(slowPathCall(recoverGenericCase, this, operationEnumeratorRecoverNameAndGetByVal, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseRegs, indexGPR, enumeratorGPR));
>         }
> 
>         doneCases.link(&m_jit);
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>index 6953455799e58d62e9c9fe3e46663a9edbdb2a44..6f3bd931f932bb41f99eb9f1de4fa02a7c24e92f 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
>@@ -974,16 +974,15 @@ class SpeculativeJIT {
>         appendCall(CCallHelpers::Address(GPRInfo::nonArgGPR0, address.offset));
>     }
> 
>-    JITCompiler::Call callOperationWithCallFrameRollbackOnException(V_JITOperation_Cb operation, CodeBlock* codeBlock)
>+    JITCompiler::Call callOperationWithCallFrameRollbackOnException(V_JITOperation_Cb operation, GPRReg codeBlockGPR)
>     {
>-        // Do not register CodeBlock* as a weak-pointer.
>-        m_jit.setupArguments<V_JITOperation_Cb>(TrustedImmPtr(static_cast<void*>(codeBlock)));
>+        m_jit.setupArguments<V_JITOperation_Cb>(codeBlockGPR);
>         return appendCallWithCallFrameRollbackOnException(operation);
>     }
> 
>-    JITCompiler::Call callOperationWithCallFrameRollbackOnException(Z_JITOperation_G operation, GPRReg result, JSGlobalObject* globalObject)
>+    JITCompiler::Call callOperationWithCallFrameRollbackOnException(Z_JITOperation_G operation, GPRReg result, GPRReg globalObjectGPR)
>     {
>-        m_jit.setupArguments<Z_JITOperation_G>(TrustedImmPtr::weakPointer(m_graph, globalObject));
>+        m_jit.setupArguments<Z_JITOperation_G>(globalObjectGPR);
>         return appendCallWithCallFrameRollbackOnExceptionSetResult(operation, result);
>     }
>     
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>index a912eb598b9822a3596a1c18ce1e623e8aaa6811..c2729d9d005da4a76f9bf87d8b8b02ef0c7d2209 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
>@@ -178,12 +178,12 @@ void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), appropriateOptimizingGetByIdFunction(type),
>             spillMode, ExceptionCheckRequirement::CheckNeeded,
>-            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, baseGPR, identifier.rawBits());
>+            resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, baseGPR, identifier.rawBits());
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, appropriateOptimizingGetByIdFunction(type),
>             spillMode, ExceptionCheckRequirement::CheckNeeded,
>-            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseGPR, identifier.rawBits());
>+            resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseGPR, identifier.rawBits());
>     }
>     
>     m_jit.addGetById(gen, slowPath.get());
>@@ -215,12 +215,12 @@ void SpeculativeJIT::cachedGetByIdWithThis(CodeOrigin codeOrigin, GPRReg baseGPR
>         slowPath = slowPathICCall(
>             slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationGetByIdWithThisOptimize,
>             DontSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, baseGPR, thisGPR, identifier.rawBits());
>+            resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, baseGPR, thisGPR, identifier.rawBits());
>     } else {
>         slowPath = slowPathCall(
>             slowCases, this, operationGetByIdWithThisOptimize,
>             DontSpill, ExceptionCheckRequirement::CheckNeeded,
>-            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseGPR, thisGPR, identifier.rawBits());
>+            resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseGPR, thisGPR, identifier.rawBits());
>     }
>     
>     m_jit.addGetByIdWithThis(gen, slowPath.get());
>@@ -257,7 +257,7 @@ void SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(Edge operan
> 
>         GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
>         GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
>-        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
>+        m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
>         m_jit.emitLoadStructure(vm(), argGPR, resultGPR);
>         m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
>         m_jit.comparePtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, resultGPR);
>@@ -309,7 +309,7 @@ void SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined(Edge operand, N
> 
>         GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
>         GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
>-        m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
>+        m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), localGlobalObjectGPR);
>         m_jit.emitLoadStructure(vm(), argGPR, resultGPR);
>         m_jit.loadPtr(JITCompiler::Address(resultGPR, Structure::globalObjectOffset()), remoteGlobalObjectGPR);
>         branchPtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, taken);
>@@ -452,7 +452,7 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node* node, Node* branchNode
>         branch64(JITCompiler::Equal, arg1GPR, arg2GPR, invert ? notTaken : taken);
>         
>         silentSpillAllRegisters(resultGPR);
>-        callOperation(operationCompareStrictEqCell, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR);
>+        callOperation(operationCompareStrictEqCell, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR);
>         silentFillAllRegisters();
>         m_jit.exceptionCheck();
>         
>@@ -503,7 +503,7 @@ void SpeculativeJIT::nonSpeculativePeepholeStrictEq(Node* node, Node* branchNode
> 
>         jump(invert ? taken : notTaken, ForceJump);
> 
>-        addSlowPathGenerator(slowPathCall(slowPathCases, this, operationCompareStrictEq, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR));
>+        addSlowPathGenerator(slowPathCall(slowPathCases, this, operationCompareStrictEq, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1GPR, arg2GPR));
>         branchTest32(invert ? JITCompiler::Zero : JITCompiler::NonZero, resultGPR, taken);
>     }
> 
>@@ -541,7 +541,7 @@ void SpeculativeJIT::genericJSValueNonPeepholeStrictEq(Node* node, bool invert)
>         notEqualCase.link(&m_jit);
>         
>         silentSpillAllRegisters(resultGPR);
>-        callOperation(operationCompareStrictEqCell, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>+        callOperation(operationCompareStrictEqCell, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs);
>         silentFillAllRegisters();
>         m_jit.exceptionCheck();
>         
>@@ -597,7 +597,7 @@ void SpeculativeJIT::genericJSValueNonPeepholeStrictEq(Node* node, bool invert)
> 
>     m_jit.move(TrustedImm64(0), resultGPR);
> 
>-    addSlowPathGenerator(slowPathCall(slowPathCases, this, operationCompareStrictEq, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs));
>+    addSlowPathGenerator(slowPathCall(slowPathCases, this, operationCompareStrictEq, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), arg1Regs, arg2Regs));
> 
>     done.link(&m_jit);
> 
>@@ -734,7 +734,7 @@ void SpeculativeJIT::emitCall(Node* node)
>             emitSetupVarargsFrameFastCase(vm(), m_jit, scratchGPR2, scratchGPR1, scratchGPR2, scratchGPR3, inlineCallFrame, data->firstVarArgOffset, slowCase);
>             JITCompiler::Jump done = m_jit.jump();
>             slowCase.link(&m_jit);
>-            callOperation(operationThrowStackOverflowForVarargs, TrustedImmPtr::weakPointer(m_graph, globalObject));
>+            callOperation(operationThrowStackOverflowForVarargs, JITCompiler::UnlinkedConstant(m_graph, globalObject));
>             m_jit.exceptionCheck();
>             m_jit.abortWithReason(DFGVarargsThrowingPathDidNotThrow);
>             done.link(&m_jit);
>@@ -763,7 +763,7 @@ void SpeculativeJIT::emitCall(Node* node)
>             DFG_ASSERT(m_jit.graph(), node, isFlushed());
>             
>             // Right now, arguments is in argumentsGPR and the register file is flushed.
>-            callOperation(operationSizeFrameForVarargs, GPRInfo::returnValueGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentsGPR, numUsedStackSlots, data->firstVarArgOffset);
>+            callOperation(operationSizeFrameForVarargs, GPRInfo::returnValueGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentsGPR, numUsedStackSlots, data->firstVarArgOffset);
>             m_jit.exceptionCheck();
>             
>             // Now we have the argument count of the callee frame, but we've lost the arguments operand.
>@@ -773,7 +773,7 @@ void SpeculativeJIT::emitCall(Node* node)
>             emitSetVarargsFrame(m_jit, GPRInfo::returnValueGPR, false, scratchGPR1, scratchGPR1);
>             m_jit.addPtr(TrustedImm32(-(sizeof(CallerFrameAndPC) + WTF::roundUpToMultipleOf(stackAlignmentBytes(), 5 * sizeof(void*)))), scratchGPR1, JITCompiler::stackPointerRegister);
>             
>-            callOperation(operationSetupVarargsFrame, GPRInfo::returnValueGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scratchGPR1, argumentsGPR, data->firstVarArgOffset, GPRInfo::returnValueGPR);
>+            callOperation(operationSetupVarargsFrame, GPRInfo::returnValueGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scratchGPR1, argumentsGPR, data->firstVarArgOffset, GPRInfo::returnValueGPR);
>             m_jit.exceptionCheck();
>             m_jit.addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), GPRInfo::returnValueGPR, JITCompiler::stackPointerRegister);
>         }
>@@ -910,7 +910,7 @@ void SpeculativeJIT::emitCall(Node* node)
>         requiredBytes = WTF::roundUpToMultipleOf(stackAlignmentBytes(), requiredBytes);
>         m_jit.subPtr(TrustedImm32(requiredBytes), JITCompiler::stackPointerRegister);
>         m_jit.move(TrustedImm32(node->ecmaMode().value()), GPRInfo::regT1);
>-        m_jit.setupArguments<decltype(operationCallEval)>(TrustedImmPtr::weakPointer(m_graph, globalObject), GPRInfo::regT0, GPRInfo::regT1);
>+        m_jit.setupArguments<decltype(operationCallEval)>(JITCompiler::UnlinkedConstant(m_graph, globalObject), GPRInfo::regT0, GPRInfo::regT1);
>         prepareForExternalCall();
>         m_jit.appendCall(operationCallEval);
>         m_jit.exceptionCheck();
>@@ -1005,7 +1005,9 @@ void SpeculativeJIT::emitCall(Node* node)
>             m_jit.emitRestoreCalleeSaves(); // This needs to happen after we moved calleeGPR to regT0
>     }
> 
>+    // FIXME
>     m_jit.move(TrustedImmPtr::weakPointer(m_graph, globalObject), GPRInfo::regT3); // JSGlobalObject needs to be in regT3
>+    // m_jit.loadUnlinkedConstant(TrustedImmPtr::weakPointer(m_graph, globalObject), GPRInfo::regT3); // JSGlobalObject needs to be in regT3
>     callLinkInfo->emitSlowPath(vm(), m_jit);
> 
>     done.link(&m_jit);
>@@ -1890,7 +1892,7 @@ void SpeculativeJIT::compileCompareEqPtr(Node* node)
>     GPRReg valueGPR = value.gpr();
>     GPRReg resultGPR = result.gpr();
> 
>-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), node->cellOperand()->cell()), resultGPR);
>+    m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), node->cellOperand()->cell()), resultGPR);
>     m_jit.compare64(MacroAssembler::Equal, valueGPR, resultGPR, resultGPR);
>     unblessedBooleanResult(resultGPR, node);
> }
>@@ -2179,8 +2181,7 @@ void SpeculativeJIT::emitUntypedBranch(Edge nodeUse, BasicBlock* taken, BasicBlo
>         if (shouldCheckMasqueradesAsUndefined) {
>             branchTest8(MacroAssembler::Zero, MacroAssembler::Address(valueGPR, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined), taken);
>             m_jit.emitLoadStructure(vm(), valueGPR, temp1GPR);
>-            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(m_currentNode->origin.semantic);
>-            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), temp2GPR);
>+            m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.graph().globalObjectFor(m_currentNode->origin.semantic)), temp2GPR);
>             branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(temp1GPR, Structure::globalObjectOffset()), temp2GPR, taken);
>             jump(notTaken, ForceJump);
>         } else
>@@ -2378,7 +2379,7 @@ void SpeculativeJIT::compileGetByVal(Node* node, const ScopedLambda<std::tuple<J
>                 silentSpillAllRegisters(resultRegs);
>             else
>                 flushRegisters();
>-            callOperation(operationGetByVal, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR);
>+            callOperation(operationGetByVal, resultRegs, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, propertyGPR);
>             if (canUseFlush == CanUseFlush::No)
>                 silentFillAllRegisters();
>             m_jit.exceptionCheck();
>@@ -2434,11 +2435,11 @@ void SpeculativeJIT::compileGetByVal(Node* node, const ScopedLambda<std::tuple<J
>         if (JITCode::useDataIC(JITType::DFGJIT)) {
>             slowPath = slowPathICCall(
>                 slowCases, this, gen.stubInfo(), stubInfoGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfSlowOperation()), operationGetByValOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, nullptr, baseGPR, propertyGPR);
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), stubInfoGPR, nullptr, baseGPR, propertyGPR);
>         } else {
>             slowPath = slowPathCall(
>                 slowCases, this, operationGetByValOptimize,
>-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), nullptr, baseGPR, propertyGPR);
>+                resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), nullptr, baseGPR, propertyGPR);
>         }
> 
>         m_jit.addGetByVal(gen, slowPath.get());
>@@ -2513,7 +2514,7 @@ void SpeculativeJIT::compileGetByVal(Node* node, const ScopedLambda<std::tuple<J
>             addSlowPathGenerator(
>                 slowPathCall(
>                     slowCases, this, operationGetByValObjectInt,
>-                    resultReg, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>+                    resultReg, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>         }
> 
> 
>@@ -2605,7 +2606,7 @@ void SpeculativeJIT::compileGetByVal(Node* node, const ScopedLambda<std::tuple<J
>             addSlowPathGenerator(
>                 slowPathCall(
>                     slowCases, this, operationGetByValObjectInt,
>-                    resultRegs.gpr(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>+                    resultRegs.gpr(), JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>             jsValueResult(resultRegs.gpr(), node);
>         }
> 
>@@ -2663,7 +2664,7 @@ void SpeculativeJIT::compileGetByVal(Node* node, const ScopedLambda<std::tuple<J
>         addSlowPathGenerator(
>             slowPathCall(
>                 slowCases, this, operationGetByValObjectInt,
>-                resultReg, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
>+                resultReg, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseReg, propertyReg));
> 
>         jsValueResult(resultReg, node);
>         break;
>@@ -2792,8 +2793,7 @@ void SpeculativeJIT::compileRegExpTestInline(Node* node)
> #if CPU(X86_64)
>         if (inlineCodeStats8Bit.needsTemp2()) {
>             // Since we reused globalObjectGPR for temp2, let's restore the global object.
>-            JSGlobalObject* globalObjectConst = jsCast<JSGlobalObject*>(node->cellOperand()->value());
>-            m_jit.move(CCallHelpers::TrustedImmPtr(globalObjectConst), globalObjectGPR);
>+            m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_graph, jsCast<JSGlobalObject*>(node->cellOperand()->value())), globalObjectGPR);
>         }
> #endif
> 
>@@ -3548,7 +3548,7 @@ void SpeculativeJIT::compile(Node* node)
> 
>         if (!storageEdge) {
>             auto callSlowPath = [&] () {
>-                auto globalObjectImmPtr = TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic));
>+                auto globalObjectImmPtr = JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic));
>                 switch (node->op()) {
>                 case AtomicsAdd:
>                     callOperation(operationAtomicsAdd, resultGPR, globalObjectImmPtr, baseGPR, indexGPR, argGPRs[0]);
>@@ -3757,7 +3757,7 @@ void SpeculativeJIT::compile(Node* node)
>             flushRegisters();
>             GPRFlushedCallResult result(this);
>             GPRReg resultGPR = result.gpr();
>-            callOperation(operationAtomicsIsLockFree, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), operandGPR);
>+            callOperation(operationAtomicsIsLockFree, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), operandGPR);
>             m_jit.exceptionCheck();
>             jsValueResult(resultGPR, node);
>             break;
>@@ -3899,7 +3899,7 @@ void SpeculativeJIT::compile(Node* node)
>                     MacroAssembler::TrustedImm64(JSValue::encode(jsUndefined())), valueGPR));
>             addSlowPathGenerator(
>                 slowPathCall(
>-                    slowCase, this, operationArrayPopAndRecoverLength, valueGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR));
>+                    slowCase, this, operationArrayPopAndRecoverLength, valueGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR));
>             
>             // We can't know for sure that the result is an int because of the slow paths. :-/
>             jsValueResult(valueGPR, node);
>@@ -3932,7 +3932,7 @@ void SpeculativeJIT::compile(Node* node)
>         
>             addSlowPathGenerator(
>                 slowPathCall(
>-                    slowCases, this, operationArrayPop, valueGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR));
>+                    slowCases, this, operationArrayPop, valueGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR));
> 
>             jsValueResult(valueGPR, node);
>             break;
>@@ -4058,7 +4058,7 @@ void SpeculativeJIT::compile(Node* node)
>         // Instead of the slow path generator, we emit callOperation here.
>         if (!(m_state.forNode(node->child1()).m_type & SpecBytecodeNumber)) {
>             flushRegisters();
>-            callOperation(operationToNumber, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentGPR);
>+            callOperation(operationToNumber, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentGPR);
>             m_jit.exceptionCheck();
>         } else {
>             MacroAssembler::Jump notNumber = m_jit.branchIfNotNumber(argumentGPR);
>@@ -4067,7 +4067,7 @@ void SpeculativeJIT::compile(Node* node)
> 
>             notNumber.link(&m_jit);
>             silentSpillAllRegisters(resultGPR);
>-            callOperation(operationToNumber, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentGPR);
>+            callOperation(operationToNumber, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), argumentGPR);
>             silentFillAllRegisters();
>             m_jit.exceptionCheck();
> 
>@@ -4543,7 +4543,7 @@ void SpeculativeJIT::compile(Node* node)
>         GPRReg valueGPR = value.gpr();
> 
>         flushRegisters();
>-        callOperation(node->ecmaMode().isStrict() ? operationPutByValWithThisStrict : operationPutByValWithThis, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, thisValueGPR, propertyGPR, valueGPR);
>+        callOperation(node->ecmaMode().isStrict() ? operationPutByValWithThisStrict : operationPutByValWithThis, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, thisValueGPR, propertyGPR, valueGPR);
>         m_jit.exceptionCheck();
> 
>         noResult(node);
>@@ -4681,7 +4681,7 @@ void SpeculativeJIT::compile(Node* node)
>             isMasqueradesAsUndefined.link(&m_jit);
>             GPRReg localGlobalObjectGPR = localGlobalObject.gpr();
>             GPRReg remoteGlobalObjectGPR = remoteGlobalObject.gpr();
>-            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)), localGlobalObjectGPR);
>+            m_jit.loadUnlinkedConstant(JITCompiler::UnlinkedConstant(m_jit.graph(), m_jit.globalObjectFor(node->origin.semantic)), localGlobalObjectGPR);
>             m_jit.emitLoadStructure(vm(), value.gpr(), result.gpr());
>             m_jit.loadPtr(JITCompiler::Address(result.gpr(), Structure::globalObjectOffset()), remoteGlobalObjectGPR); 
>             m_jit.comparePtr(JITCompiler::Equal, localGlobalObjectGPR, remoteGlobalObjectGPR, result.gpr());
>@@ -4886,7 +4886,7 @@ void SpeculativeJIT::compile(Node* node)
> 
>             slowPath.link(&m_jit);
>             silentSpillAllRegisters(resultGPR);
>-            callOperation(operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), JSValueRegs(inputGPR));
>+            callOperation(operationMapHash, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), JSValueRegs(inputGPR));
>             silentFillAllRegisters();
>             m_jit.exceptionCheck();
> 
>@@ -4931,7 +4931,7 @@ void SpeculativeJIT::compile(Node* node)
> 
>         slowPath.link(&m_jit);
>         silentSpillAllRegisters(resultGPR);
>-        callOperation(operationMapHash, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), JSValueRegs(inputGPR));
>+        callOperation(operationMapHash, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), JSValueRegs(inputGPR));
>         silentFillAllRegisters();
>         m_jit.exceptionCheck();
> 
>@@ -5079,9 +5079,9 @@ void SpeculativeJIT::compile(Node* node)
>             slowPathCases.link(&m_jit);
>             silentSpillAllRegisters(indexGPR);
>             if (node->child1().useKind() == MapObjectUse)
>-                callOperation(operationJSMapFindBucket, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), mapGPR, keyGPR, hashGPR);
>+                callOperation(operationJSMapFindBucket, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), mapGPR, keyGPR, hashGPR);
>             else
>-                callOperation(operationJSSetFindBucket, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), mapGPR, keyGPR, hashGPR);
>+                callOperation(operationJSSetFindBucket, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), mapGPR, keyGPR, hashGPR);
>             silentFillAllRegisters();
>             m_jit.exceptionCheck();
>             done.append(m_jit.jump());
>@@ -5394,7 +5394,7 @@ void SpeculativeJIT::compile(Node* node)
> 
>         slowPath.link(&m_jit);
>         silentSpillAllRegisters(resultGPR);
>-        callOperation(operationHasOwnProperty, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR, keyGPR);
>+        callOperation(operationHasOwnProperty, resultGPR, JITCompiler::UnlinkedConstant(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR, keyGPR);
>         silentFillAllRegisters();
>         m_jit.exceptionCheck();
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGThunks.cpp b/Source/JavaScriptCore/dfg/DFGThunks.cpp
>index 0c4d195d914857229384e9848d17994da394126d..b01999a5eaea9921609212575555268a77a81aab 100644
>--- a/Source/JavaScriptCore/dfg/DFGThunks.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGThunks.cpp
>@@ -37,6 +37,7 @@
> #include "GPRInfo.h"
> #include "LinkBuffer.h"
> #include "MacroAssembler.h"
>+#include "ProbeContext.h"
> 
> namespace JSC { namespace DFG {
> 
>@@ -141,6 +142,7 @@ MacroAssemblerCodeRef<JITThunkPtrTag> osrEntryThunkGenerator(VM& vm)
>     ptrdiff_t offsetOfFrameSize = 0; // This is the DFG frame count.
>     ptrdiff_t offsetOfTargetPC = offsetOfFrameSize + sizeof(EncodedJSValue);
>     ptrdiff_t offsetOfPayload = offsetOfTargetPC + sizeof(EncodedJSValue);
>+    ptrdiff_t offsetOfCodeBlock = offsetOfPayload + sizeof(Register) * CallFrameSlot::codeBlock;
>     ptrdiff_t offsetOfLocals = offsetOfPayload + sizeof(Register) * CallFrame::headerSizeInRegisters;
>     
>     jit.move(GPRInfo::returnValueGPR2, GPRInfo::regT0);
>@@ -162,8 +164,21 @@ MacroAssemblerCodeRef<JITThunkPtrTag> osrEntryThunkGenerator(VM& vm)
>     jit.abortWithReason(DFGUnreasonableOSREntryJumpDestination);
> 
>     ok.link(&jit);
>+
>+    jit.loadPtr(MacroAssembler::Address(GPRInfo::regT0, offsetOfCodeBlock), GPRInfo::regT2);
>+    jit.emitPutToCallFrameHeader(GPRInfo::regT2, CallFrameSlot::codeBlock);
>+#if ASSERT_ENABLED
>+    jit.probeDebug([=](Probe::Context& ctx) {
>+        CodeBlock* codeBlock = ctx.fp<CallFrame*>()->codeBlock();
>+        RELEASE_ASSERT(JITCode::isOptimizingJIT(codeBlock->jitType()));
>+    });
>+#endif
>+
>     jit.restoreCalleeSavesFromEntryFrameCalleeSavesBuffer(vm.topEntryFrame);
>     jit.emitMaterializeTagCheckRegisters();
>+#if USE(JSVALUE64)
>+    jit.loadPtr(CCallHelpers::Address(GPRInfo::regT2, CodeBlock::offsetOfJITData()), GPRInfo::constantsRegister);
>+#endif
> 
>     jit.farJump(GPRInfo::regT1, GPRInfo::callFrameRegister);
> 
>diff --git a/Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.cpp b/Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.cpp
>index 8fd02f3bd39419e833e27aa9a1976578449e7a75..3159cda5c42635cf36bee7531b0a2dbb25371e31 100644
>--- a/Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.cpp
>@@ -61,7 +61,7 @@ class TierUpCheckInjectionPhase : public Phase {
>     
>     bool run()
>     {
>-        RELEASE_ASSERT(m_graph.m_plan.mode() == JITCompilationMode::DFG);
>+        RELEASE_ASSERT(isDFG(m_graph.m_plan.mode()));
> 
>         if (!Options::useFTLJIT())
>             return false;
>diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>index 024ddf0af6772b85cf4649e9bab24fc48640e596..1b64334a17ede2206e11a5df12c5369246af324b 100644
>--- a/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
>@@ -1374,6 +1374,22 @@ void AssemblyHelpers::emitSaveOrCopyLLIntBaselineCalleeSavesFor(CodeBlock* codeB
>     spooler.finalizeGPR();
> }
> 
>+void AssemblyHelpers::emitPutCodeBlockToFrameInPrologue(GPRReg result, bool isConstructor)
>+{
>+    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, result);
>+    loadPtr(Address(result, JSFunction::offsetOfExecutableOrRareData()), result);
>+    auto hasExecutable = branchTestPtr(Zero, result, TrustedImm32(JSFunction::rareDataTag));
>+    loadPtr(Address(result, FunctionRareData::offsetOfExecutable() - JSFunction::rareDataTag), result);
>+    hasExecutable.link(this);
>+    if (isConstructor)
>+        loadPtr(Address(result, FunctionExecutable::offsetOfCodeBlockForConstruct()), result);
>+    else
>+        loadPtr(Address(result, FunctionExecutable::offsetOfCodeBlockForCall()), result);
>+
>+    loadPtr(Address(result, ExecutableToCodeBlockEdge::offsetOfCodeBlock()), result);
>+    emitPutToCallFrameHeader(result, CallFrameSlot::codeBlock);
>+}
>+
> } // namespace JSC
> 
> #endif // ENABLE(JIT)
>diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>index c117e0b5cf9ce2ac7598e52dad339cea6b0afed6..ec3e5d4902907dd13eedb027d66a61ae601c1503 100644
>--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
>+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>@@ -406,6 +406,8 @@ class AssemblyHelpers : public MacroAssembler {
> #endif
>     }
> 
>+    void emitPutCodeBlockToFrameInPrologue(GPRReg result, bool isConstructor);
>+
> #if CPU(X86_64)
>     static constexpr size_t prologueStackPointerDelta()
>     {
>diff --git a/Source/JavaScriptCore/jit/CCallHelpers.h b/Source/JavaScriptCore/jit/CCallHelpers.h
>index 687efdb00eac7d1859e6971539df0aa5ed398a75..a6525f60b3085c26745fb2ce751374fe257b92d6 100644
>--- a/Source/JavaScriptCore/jit/CCallHelpers.h
>+++ b/Source/JavaScriptCore/jit/CCallHelpers.h
>@@ -69,6 +69,10 @@ class CCallHelpers : public AssemblyHelpers {
>         GPRReg m_gpr;
>     };
> 
>+    // Base class for constant materializers.
>+    // It offers DerivedClass::materialize and poke functions.
>+    class ConstantMaterializer { };
>+
>     // The most general helper for setting arguments that fit in a GPR, if you can compute each
>     // argument without using any argument registers. You usually want one of the setupArguments*()
>     // methods below instead of this. This thing is most useful if you have *a lot* of arguments.
>@@ -365,7 +369,10 @@ class CCallHelpers : public AssemblyHelpers {
>     ALWAYS_INLINE void pokeForArgument(ArgType arg, unsigned currentGPRArgument, unsigned currentFPRArgument, unsigned numCrossSources, unsigned extraGPRArgs, unsigned nonArgGPRs, unsigned extraPoke)
>     {
>         unsigned pokeOffset = calculatePokeOffset(currentGPRArgument, currentFPRArgument, numCrossSources, extraGPRArgs, nonArgGPRs, extraPoke);
>-        poke(arg, pokeOffset);
>+        if constexpr (std::is_base_of_v<ConstantMaterializer, ArgType>)
>+            arg.poke(*this, addressForPoke(pokeOffset));
>+        else
>+            poke(arg, pokeOffset);
>     }
> 
>     ALWAYS_INLINE bool stackAligned(unsigned currentGPRArgument, unsigned currentFPRArgument, unsigned numCrossSources, unsigned extraGPRArgs, unsigned nonArgGPRs, unsigned extraPoke)
>@@ -647,6 +654,27 @@ class CCallHelpers : public AssemblyHelpers {
>         setupArgumentsImpl<OperationType>(argSourceRegs, TrustedImmPtr(arg.get()), args...);
>     }
> 
>+    template<typename OperationType, unsigned numGPRArgs, unsigned numGPRSources, unsigned numFPRArgs, unsigned numFPRSources, unsigned numCrossSources, unsigned extraGPRArgs, unsigned nonArgGPRs, unsigned extraPoke, typename Arg, typename... Args>
>+    ALWAYS_INLINE std::enable_if_t<std::is_base_of_v<ConstantMaterializer, Arg>>
>+    setupArgumentsImpl(ArgCollection<numGPRArgs, numGPRSources, numFPRArgs, numFPRSources, numCrossSources, extraGPRArgs, nonArgGPRs, extraPoke> argSourceRegs, Arg arg, Args... args)
>+    {
>+        static_assert(!std::is_floating_point<CURRENT_ARGUMENT_TYPE>::value, "We don't support immediate floats/doubles in setupArguments");
>+        auto numArgRegisters = GPRInfo::numberOfArgumentRegisters;
>+#if OS(WINDOWS) && CPU(X86_64)
>+        auto currentArgCount = numGPRArgs + numFPRArgs + (std::is_same<RESULT_TYPE, SlowPathReturnType>::value ? 1 : 0);
>+#else
>+        auto currentArgCount = numGPRArgs + extraGPRArgs;
>+#endif
>+        if (currentArgCount < numArgRegisters) {
>+            setupArgumentsImpl<OperationType>(argSourceRegs.addGPRArg(), args...);
>+            arg.materialize(*this, GPRInfo::toArgumentRegister(currentArgCount));
>+            return;
>+        }
>+
>+        pokeForArgument(arg, numGPRArgs, numFPRArgs, numCrossSources, extraGPRArgs, nonArgGPRs, extraPoke);
>+        setupArgumentsImpl<OperationType>(argSourceRegs.addGPRArg(), args...);
>+    }
>+
> #undef CURRENT_ARGUMENT_TYPE
> #undef RESULT_TYPE
> 
>diff --git a/Source/JavaScriptCore/jit/GPRInfo.h b/Source/JavaScriptCore/jit/GPRInfo.h
>index 0022bd9b98595a830c1ee0956f81083ed4781e86..67e47b3c6c6f60fb0158fac8f19e702eda7e153c 100644
>--- a/Source/JavaScriptCore/jit/GPRInfo.h
>+++ b/Source/JavaScriptCore/jit/GPRInfo.h
>@@ -420,13 +420,14 @@ class GPRInfo {
> class GPRInfo {
> public:
>     typedef GPRReg RegisterType;
>-    static constexpr unsigned numberOfRegisters = 11;
>+    static constexpr unsigned numberOfRegisters = 10;
>     static constexpr unsigned numberOfArgumentRegisters = NUMBER_OF_ARGUMENT_REGISTERS;
> 
>     // These registers match the baseline JIT.
>     static constexpr GPRReg callFrameRegister = X86Registers::ebp;
>     static constexpr GPRReg numberTagRegister = X86Registers::r14;
>     static constexpr GPRReg notCellMaskRegister = X86Registers::r15;
>+    static constexpr GPRReg constantsRegister = X86Registers::r13;
> 
>     // Temporary registers.
>     static constexpr GPRReg regT0 = X86Registers::eax;
>@@ -450,16 +451,16 @@ class GPRInfo {
> 
> #if !OS(WINDOWS)
>     static constexpr GPRReg regCS1 = X86Registers::r12;
>-    static constexpr GPRReg regCS2 = X86Registers::r13;
>-    static constexpr GPRReg regCS3 = X86Registers::r14;
>-    static constexpr GPRReg regCS4 = X86Registers::r15;
>+    static constexpr GPRReg regCS2 = X86Registers::r13; // constantsRegister
>+    static constexpr GPRReg regCS3 = X86Registers::r14; // numberTagRegister
>+    static constexpr GPRReg regCS4 = X86Registers::r15; // notCellMaskRegister
> #else
>     static constexpr GPRReg regCS1 = X86Registers::esi;
>     static constexpr GPRReg regCS2 = X86Registers::edi;
>     static constexpr GPRReg regCS3 = X86Registers::r12;
>-    static constexpr GPRReg regCS4 = X86Registers::r13;
>-    static constexpr GPRReg regCS5 = X86Registers::r14;
>-    static constexpr GPRReg regCS6 = X86Registers::r15;
>+    static constexpr GPRReg regCS4 = X86Registers::r13; // constantsRegister
>+    static constexpr GPRReg regCS5 = X86Registers::r14; // numberTagRegister
>+    static constexpr GPRReg regCS6 = X86Registers::r15; // notCellMaskRegister
> #endif
> 
>     // These constants provide the names for the general purpose argument & return value registers.
>@@ -497,9 +498,9 @@ class GPRInfo {
>     {
>         ASSERT(index < numberOfRegisters);
> #if !OS(WINDOWS)
>-        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regT6, regT7, regCS0, regCS1, regCS2 };
>+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regT6, regT7, regCS0, regCS1 };
> #else
>-        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regCS0, regCS1, regCS2, regCS3, regCS4 };
>+        static const GPRReg registerForIndex[numberOfRegisters] = { regT0, regT1, regT2, regT3, regT4, regT5, regCS0, regCS1, regCS2, regCS3 };
> #endif
>         return registerForIndex[index];
>     }
>@@ -634,6 +635,7 @@ class GPRInfo {
>     static constexpr GPRReg callFrameRegister = ARM64Registers::fp;
>     static constexpr GPRReg numberTagRegister = ARM64Registers::x27;
>     static constexpr GPRReg notCellMaskRegister = ARM64Registers::x28;
>+    static constexpr GPRReg constantsRegister = ARM64Registers::x26;
>     static constexpr GPRReg dataTempRegister = MacroAssembler::dataTempRegister;
>     static constexpr GPRReg memoryTempRegister = MacroAssembler::memoryTempRegister;
>     // Temporary registers.
>@@ -660,7 +662,7 @@ class GPRInfo {
>     static constexpr GPRReg regCS4 = ARM64Registers::x23; // Used by FTL only
>     static constexpr GPRReg regCS5 = ARM64Registers::x24; // Used by FTL only
>     static constexpr GPRReg regCS6 = ARM64Registers::x25;
>-    static constexpr GPRReg regCS7 = ARM64Registers::x26;
>+    static constexpr GPRReg regCS7 = ARM64Registers::x26; // constants
>     static constexpr GPRReg regCS8 = ARM64Registers::x27; // numberTag
>     static constexpr GPRReg regCS9 = ARM64Registers::x28; // notCellMask
>     // These constants provide the names for the general purpose argument & return value registers.
>@@ -777,7 +779,7 @@ class GPRInfo {
>     static constexpr GPRReg returnValueGPR2 = regT1;
>     static constexpr GPRReg nonPreservedNonReturnGPR = regT2;
>     static constexpr GPRReg regCS0 = MIPSRegisters::s0;
>-    static constexpr GPRReg regCS1 = MIPSRegisters::s1;
>+    static constexpr GPRReg regCS1 = MIPSRegisters::s1; // constants
> 
>     static GPRReg toRegister(unsigned index)
>     {
>@@ -832,6 +834,7 @@ class GPRInfo {
>     static constexpr GPRReg callFrameRegister = RISCV64Registers::fp;
>     static constexpr GPRReg numberTagRegister = RISCV64Registers::x25;
>     static constexpr GPRReg notCellMaskRegister = RISCV64Registers::x26;
>+    static constexpr GPRReg constantsRegister = RISCV64Registers::x24;
> 
>     static constexpr GPRReg regT0 = RISCV64Registers::x10;
>     static constexpr GPRReg regT1 = RISCV64Registers::x11;
>@@ -854,7 +857,7 @@ class GPRInfo {
>     static constexpr GPRReg regCS4 = RISCV64Registers::x21;
>     static constexpr GPRReg regCS5 = RISCV64Registers::x22;
>     static constexpr GPRReg regCS6 = RISCV64Registers::x23;
>-    static constexpr GPRReg regCS7 = RISCV64Registers::x24;
>+    static constexpr GPRReg regCS7 = RISCV64Registers::x24; // constants
>     static constexpr GPRReg regCS8 = RISCV64Registers::x25; // numberTag
>     static constexpr GPRReg regCS9 = RISCV64Registers::x26; // notCellMask
>     static constexpr GPRReg regCS10 = RISCV64Registers::x27;
>diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
>index e9c0ecc30eacc68c559f8ac463e1062231ddeb6a..fe6e26790cd75949dd47f435b4b3895af3947551 100644
>--- a/Source/JavaScriptCore/jit/JIT.cpp
>+++ b/Source/JavaScriptCore/jit/JIT.cpp
>@@ -205,19 +205,7 @@ void JIT::emitSlowCaseCall(Vector<SlowCaseEntry>::iterator& iter, SlowPathFuncti
> void JIT::emitPutCodeBlockToFrameInPrologue(GPRReg result)
> {
>     RELEASE_ASSERT(m_unlinkedCodeBlock->codeType() == FunctionCode);
>-    emitGetFromCallFrameHeaderPtr(CallFrameSlot::callee, result);
>-    loadPtr(Address(result, JSFunction::offsetOfExecutableOrRareData()), result);
>-    auto hasExecutable = branchTestPtr(Zero, result, CCallHelpers::TrustedImm32(JSFunction::rareDataTag));
>-    loadPtr(Address(result, FunctionRareData::offsetOfExecutable() - JSFunction::rareDataTag), result);
>-    hasExecutable.link(this);
>-    if (m_unlinkedCodeBlock->isConstructor())
>-        loadPtr(Address(result, FunctionExecutable::offsetOfCodeBlockForConstruct()), result);
>-    else
>-        loadPtr(Address(result, FunctionExecutable::offsetOfCodeBlockForCall()), result);
>-
>-    loadPtr(Address(result, ExecutableToCodeBlockEdge::offsetOfCodeBlock()), result);
>-    emitPutToCallFrameHeader(result, CallFrameSlot::codeBlock);
>-
>+    AssemblyHelpers::emitPutCodeBlockToFrameInPrologue(result, m_unlinkedCodeBlock->isConstructor());
> #if ASSERT_ENABLED
>     probeDebug([=] (Probe::Context& ctx) {
>         CodeBlock* codeBlock = ctx.fp<CallFrame*>()->codeBlock();
>@@ -274,7 +262,7 @@ void JIT::privateCompileMainPass()
>         if (opcodeID != op_catch) {
>             loadPtr(addressFor(CallFrameSlot::codeBlock), regT0);
>             loadPtr(Address(regT0, CodeBlock::offsetOfMetadataTable()), regT1);
>-            loadPtr(Address(regT0, CodeBlock::offsetOfBaselineJITData()), regT2);
>+            loadPtr(Address(regT0, CodeBlock::offsetOfJITData()), regT2);
> 
>             auto metadataOK = branchPtr(Equal, regT1, s_metadataGPR);
>             breakpoint();
>@@ -698,7 +686,7 @@ void JIT::emitMaterializeMetadataAndConstantPoolRegisters()
> {
>     loadPtr(addressFor(CallFrameSlot::codeBlock), regT0);
>     loadPtr(Address(regT0, CodeBlock::offsetOfMetadataTable()), s_metadataGPR);
>-    loadPtr(Address(regT0, CodeBlock::offsetOfBaselineJITData()), s_constantsGPR);
>+    loadPtr(Address(regT0, CodeBlock::offsetOfJITData()), s_constantsGPR);
> }
> 
> void JIT::emitSaveCalleeSaves()
>@@ -767,7 +755,7 @@ void JIT::compileAndLinkWithoutFinalizing(JITCompilationEffort effort)
> 
>     emitFunctionPrologue();
>     if (m_unlinkedCodeBlock->codeType() == FunctionCode)
>-        emitPutCodeBlockToFrameInPrologue();
>+        emitPutCodeBlockToFrameInPrologue(regT0);
> 
>     Label beginLabel(this);
> 
>diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
>index b8fda5d1b4315e9f7d704c46aaa5a5b1bb0344fb..b130e3ec96ff8bee31314a1b0dc8941e0131056d 100644
>--- a/Source/JavaScriptCore/jit/JIT.h
>+++ b/Source/JavaScriptCore/jit/JIT.h
>@@ -262,7 +262,7 @@ namespace JSC {
>         void loadCodeBlockConstantTag(VirtualRegister, RegisterID);
> #endif
> 
>-        void emitPutCodeBlockToFrameInPrologue(GPRReg result = regT0);
>+        void emitPutCodeBlockToFrameInPrologue(GPRReg result);
> 
>         void exceptionCheck(Jump jumpToHandler)
>         {
>diff --git a/Source/JavaScriptCore/jit/JITCompilationMode.cpp b/Source/JavaScriptCore/jit/JITCompilationMode.cpp
>index c59d394a467c5fdd68ffe2f9c2fb5256a742206c..cdf6c1024f81e3ef94b1e83627672fba5431c82d 100644
>--- a/Source/JavaScriptCore/jit/JITCompilationMode.cpp
>+++ b/Source/JavaScriptCore/jit/JITCompilationMode.cpp
>@@ -44,6 +44,9 @@ void printInternal(PrintStream& out, JITCompilationMode mode)
>     case JITCompilationMode::DFG:
>         out.print("DFGMode");
>         return;
>+    case JITCompilationMode::UnlinkedDFG:
>+        out.print("UnlinkedDFG");
>+        return;
>     case JITCompilationMode::FTL:
>         out.print("FTLMode");
>         return;
>diff --git a/Source/JavaScriptCore/jit/JITCompilationMode.h b/Source/JavaScriptCore/jit/JITCompilationMode.h
>index 7bc0e07ff53ca31599b568efa21591a632cb954f..068a572bf26f6dee18748986df19c851cd63e1b2 100644
>--- a/Source/JavaScriptCore/jit/JITCompilationMode.h
>+++ b/Source/JavaScriptCore/jit/JITCompilationMode.h
>@@ -33,10 +33,22 @@ enum class JITCompilationMode {
>     InvalidCompilation,
>     Baseline,
>     DFG,
>+    UnlinkedDFG,
>     FTL,
>-    FTLForOSREntry
>+    FTLForOSREntry,
> };
> 
>+inline bool isDFG(JITCompilationMode mode)
>+{
>+    switch (mode) {
>+    case JITCompilationMode::DFG:
>+    case JITCompilationMode::UnlinkedDFG:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
> inline bool isFTL(JITCompilationMode mode)
> {
>     switch (mode) {
>@@ -48,6 +60,17 @@ inline bool isFTL(JITCompilationMode mode)
>     }
> }
> 
>+inline bool isUnlinked(JITCompilationMode mode)
>+{
>+    switch (mode) {
>+    case JITCompilationMode::Baseline:
>+    case JITCompilationMode::UnlinkedDFG:
>+        return true;
>+    default:
>+        return false;
>+    }
>+}
>+
> } // namespace JSC
> 
> namespace WTF {
>diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
>index 5b85c7ac517a702dcfd7a62edf09211a3d5d333e..44c12d8d6924294a0588fc462ef5829252b81d4a 100644
>--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
>+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
>@@ -1025,7 +1025,7 @@ void JIT::emit_op_catch(const JSInstruction* currentInstruction)
>     // So we replenish it here.
>     {
>         loadPtr(addressFor(CallFrameSlot::codeBlock), regT0);
>-        loadPtr(Address(regT0, CodeBlock::offsetOfBaselineJITData()), s_constantsGPR);
>+        loadPtr(Address(regT0, CodeBlock::offsetOfJITData()), s_constantsGPR);
>     }
> 
>     callOperationNoExceptionCheck(operationRetrieveAndClearExceptionIfCatchable, &vm());
>@@ -1046,6 +1046,7 @@ void JIT::emit_op_catch(const JSInstruction* currentInstruction)
> 
>     callOperationNoExceptionCheck(operationTryOSREnterAtCatchAndValueProfile, &vm(), m_bytecodeIndex.asBits());
>     auto skipOSREntry = branchTestPtr(Zero, returnValueGPR);
>+    emitPutToCallFrameHeader(returnValueGPR2, CallFrameSlot::codeBlock);
>     emitRestoreCalleeSaves();
>     farJump(returnValueGPR, ExceptionHandlerPtrTag);
>     skipOSREntry.link(this);
>diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
>index efc9a0e8bb02e22581184623d1060a8935cdf2a1..5b5da78dba71562312e97067f467b45739084a21 100644
>--- a/Source/JavaScriptCore/jit/JITOperations.cpp
>+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
>@@ -2056,7 +2056,7 @@ JSC_DEFINE_JIT_OPERATION(operationOptimize, SlowPathReturnType, (VM* vmPointer,
>     return encodeResult(nullptr, nullptr);
> }
> 
>-JSC_DEFINE_JIT_OPERATION(operationTryOSREnterAtCatch, char*, (VM* vmPointer, uint32_t bytecodeIndexBits))
>+JSC_DEFINE_JIT_OPERATION(operationTryOSREnterAtCatchAndValueProfile, SlowPathReturnType, (VM* vmPointer, uint32_t bytecodeIndexBits))
> {
>     VM& vm = *vmPointer;
>     CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
>@@ -2066,37 +2066,13 @@ JSC_DEFINE_JIT_OPERATION(operationTryOSREnterAtCatch, char*, (VM* vmPointer, uin
>     CodeBlock* codeBlock = callFrame->codeBlock();
>     CodeBlock* optimizedReplacement = codeBlock->replacement();
>     if (UNLIKELY(!optimizedReplacement))
>-        return nullptr;
>-
>-    switch (optimizedReplacement->jitType()) {
>-    case JITType::DFGJIT:
>-    case JITType::FTLJIT: {
>-        MacroAssemblerCodePtr<ExceptionHandlerPtrTag> entry = DFG::prepareCatchOSREntry(vm, callFrame, codeBlock, optimizedReplacement, bytecodeIndex);
>-        return entry.executableAddress<char*>();
>-    }
>-    default:
>-        break;
>-    }
>-    return nullptr;
>-}
>-
>-JSC_DEFINE_JIT_OPERATION(operationTryOSREnterAtCatchAndValueProfile, char*, (VM* vmPointer, uint32_t bytecodeIndexBits))
>-{
>-    VM& vm = *vmPointer;
>-    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
>-    JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
>-    BytecodeIndex bytecodeIndex = BytecodeIndex::fromBits(bytecodeIndexBits);
>-
>-    CodeBlock* codeBlock = callFrame->codeBlock();
>-    CodeBlock* optimizedReplacement = codeBlock->replacement();
>-    if (UNLIKELY(!optimizedReplacement))
>-        return nullptr;
>+        return encodeResult(nullptr, nullptr);
> 
>     switch (optimizedReplacement->jitType()) {
>     case JITType::DFGJIT:
>     case JITType::FTLJIT: {
>         MacroAssemblerCodePtr<ExceptionHandlerPtrTag> entry = DFG::prepareCatchOSREntry(vm, callFrame, codeBlock, optimizedReplacement, bytecodeIndex);
>-        return entry.executableAddress<char*>();
>+        return encodeResult(entry.executableAddress<char*>(), optimizedReplacement);
>     }
>     default:
>         break;
>@@ -2109,7 +2085,7 @@ JSC_DEFINE_JIT_OPERATION(operationTryOSREnterAtCatchAndValueProfile, char*, (VM*
>         profile.m_buckets[0] = JSValue::encode(callFrame->uncheckedR(profile.m_operand).jsValue());
>     });
> 
>-    return nullptr;
>+    return encodeResult(nullptr, nullptr);
> }
> 
> #endif
>diff --git a/Source/JavaScriptCore/jit/JITOperations.h b/Source/JavaScriptCore/jit/JITOperations.h
>index 2a59f64e885ad5a25e18672f96c3dd5bb865bd0f..c5ce58deff98eeb6afacc46cdb1e83681764ee38 100644
>--- a/Source/JavaScriptCore/jit/JITOperations.h
>+++ b/Source/JavaScriptCore/jit/JITOperations.h
>@@ -259,8 +259,7 @@ JSC_DECLARE_JIT_OPERATION(operationThrow, void, (JSGlobalObject*, EncodedJSValue
> JSC_DECLARE_JIT_OPERATION(operationDebug, void, (VM*, int32_t));
> #if ENABLE(DFG_JIT)
> JSC_DECLARE_JIT_OPERATION(operationOptimize, SlowPathReturnType, (VM*, uint32_t));
>-JSC_DECLARE_JIT_OPERATION(operationTryOSREnterAtCatch, char*, (VM*, uint32_t));
>-JSC_DECLARE_JIT_OPERATION(operationTryOSREnterAtCatchAndValueProfile, char*, (VM*, uint32_t));
>+JSC_DECLARE_JIT_OPERATION(operationTryOSREnterAtCatchAndValueProfile, SlowPathReturnType, (VM*, uint32_t));
> #endif
> JSC_DECLARE_JIT_OPERATION(operationPutGetterById, void, (JSGlobalObject*, JSCell*, UniquedStringImpl*, int32_t options, JSCell*));
> JSC_DECLARE_JIT_OPERATION(operationPutSetterById, void, (JSGlobalObject*, JSCell*, UniquedStringImpl*, int32_t options, JSCell*));
>diff --git a/Source/JavaScriptCore/jit/JITPlan.cpp b/Source/JavaScriptCore/jit/JITPlan.cpp
>index 96fcb2310bbd9fddfa88142dc44499899d1cfae4..f0488339787a470f9878d2e4a05b72d2057f61d3 100644
>--- a/Source/JavaScriptCore/jit/JITPlan.cpp
>+++ b/Source/JavaScriptCore/jit/JITPlan.cpp
>@@ -77,6 +77,7 @@ auto JITPlan::tier() const -> Tier
>     case JITCompilationMode::Baseline:
>         return Tier::Baseline;
>     case JITCompilationMode::DFG:
>+    case JITCompilationMode::UnlinkedDFG:
>         return Tier::DFG;
>     case JITCompilationMode::FTL:
>     case JITCompilationMode::FTLForOSREntry:
>@@ -145,7 +146,7 @@ bool JITPlan::reportCompileTimes() const
> {
>     return Options::reportCompileTimes()
>         || (Options::reportBaselineCompileTimes() && m_mode == JITCompilationMode::Baseline)
>-        || (Options::reportDFGCompileTimes() && m_mode == JITCompilationMode::DFG)
>+        || (Options::reportDFGCompileTimes() && isDFG())
>         || (Options::reportFTLCompileTimes() && isFTL());
> }
> 
>diff --git a/Source/JavaScriptCore/jit/JITPlan.h b/Source/JavaScriptCore/jit/JITPlan.h
>index 9a8df4a74960b9dd087bf37b531b024fa1a13b45..e2b04f7a2ef9e76ef593e8bd194cfcb7041c6128 100644
>--- a/Source/JavaScriptCore/jit/JITPlan.h
>+++ b/Source/JavaScriptCore/jit/JITPlan.h
>@@ -56,7 +56,9 @@ class JITPlan : public ThreadSafeRefCounted<JITPlan> {
>     JITCompilationMode mode() const { return m_mode; }
> 
>     JITPlanStage stage() const { return m_stage; }
>+    bool isDFG() const { return ::JSC::isDFG(m_mode); }
>     bool isFTL() const { return ::JSC::isFTL(m_mode); }
>+    bool isUnlinked() const { return ::JSC::isUnlinked(m_mode); }
> 
>     enum class Tier { Baseline = 0, DFG = 1, FTL = 2, Count = 3 };
>     Tier tier() const;
>diff --git a/Source/JavaScriptCore/jit/RegisterSet.cpp b/Source/JavaScriptCore/jit/RegisterSet.cpp
>index 38c67949fddf073a88fa5582972c925c161cded4..1c312754d0c39a21ab600d76ea5c95d59ecdc6a9 100644
>--- a/Source/JavaScriptCore/jit/RegisterSet.cpp
>+++ b/Source/JavaScriptCore/jit/RegisterSet.cpp
>@@ -200,16 +200,18 @@ RegisterSet RegisterSet::llintBaselineCalleeSaveRegisters()
> #elif CPU(X86_64)
> #if !OS(WINDOWS)
>     result.set(GPRInfo::regCS1);
>+    static_assert(GPRInfo::regCS2 == GPRInfo::constantsRegister);
>+    static_assert(GPRInfo::regCS3 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS4 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS2);
>-    static_assert(GPRInfo::regCS3 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS4 == GPRInfo::notCellMaskRegister, "");
>     result.set(GPRInfo::regCS3);
>     result.set(GPRInfo::regCS4);
> #else
>     result.set(GPRInfo::regCS3);
>+    static_assert(GPRInfo::regCS4 == GPRInfo::constantsRegister);
>+    static_assert(GPRInfo::regCS5 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS6 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS4);
>-    static_assert(GPRInfo::regCS5 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS6 == GPRInfo::notCellMaskRegister, "");
>     result.set(GPRInfo::regCS5);
>     result.set(GPRInfo::regCS6);
> #endif
>@@ -218,9 +220,10 @@ RegisterSet RegisterSet::llintBaselineCalleeSaveRegisters()
>     result.set(GPRInfo::regCS1);
> #elif CPU(ARM64) || CPU(RISCV64)
>     result.set(GPRInfo::regCS6);
>+    static_assert(GPRInfo::regCS7 == GPRInfo::constantsRegister);
>+    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS7);
>-    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister, "");
>     result.set(GPRInfo::regCS8);
>     result.set(GPRInfo::regCS9);
> #else
>@@ -236,17 +239,20 @@ RegisterSet RegisterSet::dfgCalleeSaveRegisters()
> #elif CPU(X86_64)
>     result.set(GPRInfo::regCS0);
>     result.set(GPRInfo::regCS1);
>-    result.set(GPRInfo::regCS2);
> #if !OS(WINDOWS)
>-    static_assert(GPRInfo::regCS3 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS4 == GPRInfo::notCellMaskRegister, "");
>+    static_assert(GPRInfo::regCS2 == GPRInfo::constantsRegister);
>+    static_assert(GPRInfo::regCS3 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS4 == GPRInfo::notCellMaskRegister);
>+    result.set(GPRInfo::regCS2);
>     result.set(GPRInfo::regCS3);
>     result.set(GPRInfo::regCS4);
> #else
>+    result.set(GPRInfo::regCS2);
>     result.set(GPRInfo::regCS3);
>+    static_assert(GPRInfo::regCS4 == GPRInfo::constantsRegister);
>+    static_assert(GPRInfo::regCS5 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS6 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS4);
>-    static_assert(GPRInfo::regCS5 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS6 == GPRInfo::notCellMaskRegister, "");
>     result.set(GPRInfo::regCS5);
>     result.set(GPRInfo::regCS6);
> #endif
>@@ -254,8 +260,10 @@ RegisterSet RegisterSet::dfgCalleeSaveRegisters()
>     result.set(GPRInfo::regCS0);
>     result.set(GPRInfo::regCS1);
> #elif CPU(ARM64) || CPU(RISCV64)
>-    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister, "");
>+    static_assert(GPRInfo::regCS7 == GPRInfo::constantsRegister);
>+    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister);
>+    result.set(GPRInfo::regCS7);
>     result.set(GPRInfo::regCS8);
>     result.set(GPRInfo::regCS9);
> #else
>@@ -272,8 +280,8 @@ RegisterSet RegisterSet::ftlCalleeSaveRegisters()
>     result.set(GPRInfo::regCS0);
>     result.set(GPRInfo::regCS1);
>     result.set(GPRInfo::regCS2);
>-    static_assert(GPRInfo::regCS3 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS4 == GPRInfo::notCellMaskRegister, "");
>+    static_assert(GPRInfo::regCS3 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS4 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS3);
>     result.set(GPRInfo::regCS4);
> #elif CPU(ARM64)
>@@ -286,8 +294,8 @@ RegisterSet RegisterSet::ftlCalleeSaveRegisters()
>     result.set(GPRInfo::regCS5);
>     result.set(GPRInfo::regCS6);
>     result.set(GPRInfo::regCS7);
>-    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister, "");
>+    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS8);
>     result.set(GPRInfo::regCS9);
>     result.set(FPRInfo::fpRegCS0);
>@@ -307,8 +315,8 @@ RegisterSet RegisterSet::ftlCalleeSaveRegisters()
>     result.set(GPRInfo::regCS5);
>     result.set(GPRInfo::regCS6);
>     result.set(GPRInfo::regCS7);
>-    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister, "");
>-    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister, "");
>+    static_assert(GPRInfo::regCS8 == GPRInfo::numberTagRegister);
>+    static_assert(GPRInfo::regCS9 == GPRInfo::notCellMaskRegister);
>     result.set(GPRInfo::regCS8);
>     result.set(GPRInfo::regCS9);
>     result.set(GPRInfo::regCS10);
>diff --git a/Source/JavaScriptCore/llint/LLIntData.h b/Source/JavaScriptCore/llint/LLIntData.h
>index c0333d342b09b0304010f4462843fc0894829ee4..15115ee07d24f14bee6dbafe62262c680245028e 100644
>--- a/Source/JavaScriptCore/llint/LLIntData.h
>+++ b/Source/JavaScriptCore/llint/LLIntData.h
>@@ -395,13 +395,13 @@ struct Registers {
> 
> #if CPU(X86_64) && !OS(WINDOWS)
>     static constexpr GPRReg metadataTableGPR = GPRInfo::regCS1;
>-    static constexpr GPRReg pbGPR = GPRInfo::regCS2;
>+    static constexpr GPRReg pbGPR = GPRInfo::constantsRegister;
> #elif CPU(X86_64) && OS(WINDOWS)
>     static constexpr GPRReg metadataTableGPR = GPRInfo::regCS3;
>-    static constexpr GPRReg pbGPR = GPRInfo::regCS4;
>+    static constexpr GPRReg pbGPR = GPRInfo::constantsRegister;
> #elif CPU(ARM64) || CPU(RISCV64)
>     static constexpr GPRReg metadataTableGPR = GPRInfo::regCS6;
>-    static constexpr GPRReg pbGPR = GPRInfo::regCS7;
>+    static constexpr GPRReg pbGPR = GPRInfo::constantsRegister;
> #elif CPU(MIPS) || CPU(ARM_THUMB2)
>     static constexpr GPRReg metadataTableGPR = GPRInfo::regCS0;
>     static constexpr GPRReg pbGPR = GPRInfo::regCS1;
>diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>index a8e7c7399d581a5960d0aa7aa724335db0354c75..13b178cfcd736b08f64c91824d02a027a0390cbc 100644
>--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>@@ -2625,7 +2625,7 @@ if JIT
>     macro loadBaselineJITConstantPool()
>         # Baseline uses LLInt's PB register for its JIT constant pool.
>         loadp CodeBlock[cfr], PB
>-        loadp CodeBlock::m_baselineJITData[PB], PB
>+        loadp CodeBlock::m_jitData[PB], PB
>     end
> 
>     macro setupReturnToBaselineAfterCheckpointExitIfNeeded()
>diff --git a/Source/JavaScriptCore/profiler/ProfilerCompilationKind.cpp b/Source/JavaScriptCore/profiler/ProfilerCompilationKind.cpp
>index 3fbe251925adb383b78be5a1ed1e2ce45bb88339..1f267c9263cc68bb4d23a02a7fbb711fc1e4ab80 100644
>--- a/Source/JavaScriptCore/profiler/ProfilerCompilationKind.cpp
>+++ b/Source/JavaScriptCore/profiler/ProfilerCompilationKind.cpp
>@@ -42,6 +42,9 @@ void printInternal(PrintStream& out, JSC::Profiler::CompilationKind kind)
>     case JSC::Profiler::DFG:
>         out.print("DFG");
>         return;
>+    case JSC::Profiler::UnlinkedDFG:
>+        out.print("UnlinkedDFG");
>+        return;
>     case JSC::Profiler::FTL:
>         out.print("FTL");
>         return;
>diff --git a/Source/JavaScriptCore/profiler/ProfilerCompilationKind.h b/Source/JavaScriptCore/profiler/ProfilerCompilationKind.h
>index aaefd4b46fa836846776a76f2cb2c234d78c43df..2104ab05cf263f12ed9c7cf9e1269bcdd986943d 100644
>--- a/Source/JavaScriptCore/profiler/ProfilerCompilationKind.h
>+++ b/Source/JavaScriptCore/profiler/ProfilerCompilationKind.h
>@@ -31,8 +31,9 @@ enum CompilationKind {
>     LLInt,
>     Baseline,
>     DFG,
>+    UnlinkedDFG,
>     FTL,
>-    FTLForOSREntry
>+    FTLForOSREntry,
> };
> 
> } } // namespace JSC::Profiler
>diff --git a/Source/JavaScriptCore/runtime/ArrayBuffer.h b/Source/JavaScriptCore/runtime/ArrayBuffer.h
>index b4693f91c607d8d074594646e8dc4372e9bc99e6..7b9ca2812108b10cc78563a55b817a0a294ef83c 100644
>--- a/Source/JavaScriptCore/runtime/ArrayBuffer.h
>+++ b/Source/JavaScriptCore/runtime/ArrayBuffer.h
>@@ -88,6 +88,7 @@ class ArrayBufferContents {
>     explicit operator bool() { return !!m_data; }
>     
>     void* data() const { return m_data.getMayBeNull(sizeInBytes()); }
>+    void* dataWithoutPACValidation() const { return m_data.getUnsafe(); }
>     size_t sizeInBytes() const { return m_sizeInBytes; }
>     
>     bool isShared() const { return m_shared; }
>@@ -136,6 +137,9 @@ class ArrayBuffer : public GCIncomingRefCounted<ArrayBuffer> {
>     inline void* data();
>     inline const void* data() const;
>     inline size_t byteLength() const;
>+
>+    inline void* dataWithoutPACValidation();
>+    inline const void* dataWithoutPACValidation() const;
>     
>     void makeShared();
>     void setSharingMode(ArrayBufferSharingMode);
>@@ -201,6 +205,16 @@ const void* ArrayBuffer::data() const
>     return m_contents.data();
> }
> 
>+void* ArrayBuffer::dataWithoutPACValidation()
>+{
>+    return m_contents.dataWithoutPACValidation();
>+}
>+
>+const void* ArrayBuffer::dataWithoutPACValidation() const
>+{
>+    return m_contents.dataWithoutPACValidation();
>+}
>+
> size_t ArrayBuffer::byteLength() const
> {
>     return m_contents.sizeInBytes();
>diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h b/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
>index d85b32830762a908201cb9c45c929169a1c15565..fe3f5cc3a5cd13e15897c7a9b2ef51b6a238787c 100644
>--- a/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h
>@@ -97,7 +97,7 @@ inline ResultType JSArrayBufferView::byteOffsetImpl()
>     }
> 
>     ptrdiff_t delta =
>-        bitwise_cast<uint8_t*>(vectorWithoutPACValidation()) - static_cast<uint8_t*>(buffer->data());
>+        bitwise_cast<uint8_t*>(vectorWithoutPACValidation()) - static_cast<uint8_t*>(buffer->dataWithoutPACValidation());
> 
>     size_t result = static_cast<size_t>(delta);
>     if (requester == Mutator)
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
>index d9da1e466b9c987d76310a2a673983756714d311..f4700d66ea08d76e460da34f5e7ef55559baa0b2 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
>@@ -921,6 +921,7 @@ class JSGlobalObject : public JSSegmentedVariableObject {
>     RegExpGlobalData& regExpGlobalData() { return m_regExpGlobalData; }
>     static ptrdiff_t regExpGlobalDataOffset() { return OBJECT_OFFSETOF(JSGlobalObject, m_regExpGlobalData); }
> 
>+    static ptrdiff_t offsetOfGlobalThis() { return OBJECT_OFFSETOF(JSGlobalObject, m_globalThis); }
>     static ptrdiff_t offsetOfVM() { return OBJECT_OFFSETOF(JSGlobalObject, m_vm); }
>     static ptrdiff_t offsetOfGlobalLexicalEnvironment() { return OBJECT_OFFSETOF(JSGlobalObject, m_globalLexicalEnvironment); }
>     static ptrdiff_t offsetOfGlobalLexicalBindingEpoch() { return OBJECT_OFFSETOF(JSGlobalObject, m_globalLexicalBindingEpoch); }

Actions: View | Formatted Diff | Diff

Attachments on bug 237863: 454645 | 454648 | 454649 | 454802 | 455044 | 455072 | 455076 | 456680 | 457299