Avoid duplicate computations of ExecState::vm().
https://bugs.webkit.org/show_bug.cgi?id=176647

Reviewed by Saam Barati.

Source/JavaScriptCore:

Because while computing ExecState::vm() is cheap, it is not free.

This patch also:
1. gets rids of some convenience methods in CallFrame that implicitly does a
   ExecState::vm() computation.  This minimizes the chance of us accidentally
   computing ExecState::vm() more than necessary.
2. passes vm (when available) to methodTable().
3. passes vm (when available) to JSLockHolder.

* API/JSBase.cpp:
(JSCheckScriptSyntax):
(JSGarbageCollect):
(JSReportExtraMemoryCost):
(JSSynchronousGarbageCollectForDebugging):
(JSSynchronousEdenCollectForDebugging):
* API/JSCallbackConstructor.h:
(JSC::JSCallbackConstructor::create):
* API/JSCallbackObject.h:
(JSC::JSCallbackObject::create):
* API/JSContext.mm:
(-[JSContext setException:]):
* API/JSContextRef.cpp:
(JSContextGetGlobalObject):
(JSContextCreateBacktrace):
* API/JSManagedValue.mm:
(-[JSManagedValue value]):
* API/JSObjectRef.cpp:
(JSObjectMake):
(JSObjectMakeFunctionWithCallback):
(JSObjectMakeConstructor):
(JSObjectMakeFunction):
(JSObjectSetPrototype):
(JSObjectHasProperty):
(JSObjectGetProperty):
(JSObjectSetProperty):
(JSObjectSetPropertyAtIndex):
(JSObjectDeleteProperty):
(JSObjectGetPrivateProperty):
(JSObjectSetPrivateProperty):
(JSObjectDeletePrivateProperty):
(JSObjectIsFunction):
(JSObjectCallAsFunction):
(JSObjectCallAsConstructor):
(JSObjectCopyPropertyNames):
(JSPropertyNameAccumulatorAddName):
* API/JSScriptRef.cpp:
* API/JSTypedArray.cpp:
(JSValueGetTypedArrayType):
(JSObjectMakeTypedArrayWithArrayBuffer):
(JSObjectMakeTypedArrayWithArrayBufferAndOffset):
(JSObjectGetTypedArrayBytesPtr):
(JSObjectGetTypedArrayBuffer):
(JSObjectMakeArrayBufferWithBytesNoCopy):
(JSObjectGetArrayBufferBytesPtr):
* API/JSWeakObjectMapRefPrivate.cpp:
* API/JSWrapperMap.mm:
(constructorHasInstance):
(makeWrapper):
* API/ObjCCallbackFunction.mm:
(objCCallbackFunctionForInvocation):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::jettison):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::addConstant):
(JSC::CodeBlock::replaceConstant):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFromLLInt):
(JSC::PutByIdStatus::computeFor):
* dfg/DFGDesiredWatchpoints.cpp:
(JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::globalThisObjectFor):
* dfg/DFGOperations.cpp:
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileFTLOSRExit):
* ftl/FTLOperations.cpp:
(JSC::FTL::operationPopulateObjectInOSR):
(JSC::FTL::operationMaterializeObjectInOSR):
* heap/GCAssertions.h:
* inspector/InjectedScriptHost.cpp:
(Inspector::InjectedScriptHost::wrapper):
* inspector/JSInjectedScriptHost.cpp:
(Inspector::JSInjectedScriptHost::subtype):
(Inspector::constructInternalProperty):
(Inspector::JSInjectedScriptHost::getInternalProperties):
(Inspector::JSInjectedScriptHost::weakMapEntries):
(Inspector::JSInjectedScriptHost::weakSetEntries):
(Inspector::JSInjectedScriptHost::iteratorEntries):
* inspector/JSJavaScriptCallFrame.cpp:
(Inspector::valueForScopeLocation):
(Inspector::JSJavaScriptCallFrame::scopeDescriptions):
(Inspector::toJS):
* inspector/ScriptCallStackFactory.cpp:
(Inspector::extractSourceInformationFromException):
(Inspector::createScriptArguments):
* interpreter/CachedCall.h:
(JSC::CachedCall::CachedCall):
* interpreter/CallFrame.h:
(JSC::ExecState::atomicStringTable const): Deleted.
(JSC::ExecState::propertyNames const): Deleted.
(JSC::ExecState::emptyList const): Deleted.
(JSC::ExecState::interpreter): Deleted.
(JSC::ExecState::heap): Deleted.
* interpreter/Interpreter.cpp:
(JSC::Interpreter::executeProgram):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeModuleProgram):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JITOperations.cpp:
* jit/JITWorklist.cpp:
(JSC::JITWorklist::compileNow):
* jsc.cpp:
(WTF::RuntimeArray::create):
(WTF::RuntimeArray::getOwnPropertySlot):
(WTF::DOMJITGetter::DOMJITAttribute::slowCall):
(WTF::DOMJITFunctionObject::unsafeFunction):
(WTF::DOMJITCheckSubClassObject::unsafeFunction):
(GlobalObject::moduleLoaderFetch):
(functionDumpCallFrame):
(functionCreateRoot):
(functionGetElement):
(functionSetElementRoot):
(functionCreateSimpleObject):
(functionSetHiddenValue):
(functionCreateProxy):
(functionCreateImpureGetter):
(functionCreateCustomGetterObject):
(functionCreateDOMJITNodeObject):
(functionCreateDOMJITGetterObject):
(functionCreateDOMJITGetterComplexObject):
(functionCreateDOMJITFunctionObject):
(functionCreateDOMJITCheckSubClassObject):
(functionGCAndSweep):
(functionFullGC):
(functionEdenGC):
(functionHeapSize):
(functionShadowChickenFunctionsOnStack):
(functionSetGlobalConstRedeclarationShouldNotThrow):
(functionJSCOptions):
(functionFailNextNewCodeBlock):
(functionMakeMasquerader):
(functionDumpTypesForAllVariables):
(functionFindTypeForExpression):
(functionReturnTypeFor):
(functionDumpBasicBlockExecutionRanges):
(functionBasicBlockExecutionCount):
(functionDrainMicrotasks):
(functionGenerateHeapSnapshot):
(functionEnsureArrayStorage):
(functionStartSamplingProfiler):
(runInteractive):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* parser/ModuleAnalyzer.cpp:
(JSC::ModuleAnalyzer::ModuleAnalyzer):
* profiler/ProfilerBytecode.cpp:
(JSC::Profiler::Bytecode::toJS const):
* profiler/ProfilerBytecodeSequence.cpp:
(JSC::Profiler::BytecodeSequence::addSequenceProperties const):
* profiler/ProfilerBytecodes.cpp:
(JSC::Profiler::Bytecodes::toJS const):
* profiler/ProfilerCompilation.cpp:
(JSC::Profiler::Compilation::toJS const):
* profiler/ProfilerCompiledBytecode.cpp:
(JSC::Profiler::CompiledBytecode::toJS const):
* profiler/ProfilerDatabase.cpp:
(JSC::Profiler::Database::toJS const):
* profiler/ProfilerEvent.cpp:
(JSC::Profiler::Event::toJS const):
* profiler/ProfilerOSRExit.cpp:
(JSC::Profiler::OSRExit::toJS const):
* profiler/ProfilerOrigin.cpp:
(JSC::Profiler::Origin::toJS const):
* profiler/ProfilerProfiledBytecodes.cpp:
(JSC::Profiler::ProfiledBytecodes::toJS const):
* runtime/AbstractModuleRecord.cpp:
(JSC::identifierToJSValue):
(JSC::AbstractModuleRecord::resolveExportImpl):
(JSC::getExportedNames):
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncToString):
(JSC::arrayProtoFuncToLocaleString):
* runtime/BooleanConstructor.cpp:
(JSC::constructBooleanFromImmediateBoolean):
* runtime/CallData.cpp:
(JSC::call):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
* runtime/Completion.cpp:
(JSC::checkSyntax):
(JSC::evaluate):
(JSC::loadAndEvaluateModule):
(JSC::loadModule):
(JSC::linkAndEvaluateModule):
(JSC::importModule):
* runtime/ConstructData.cpp:
(JSC::construct):
* runtime/DatePrototype.cpp:
(JSC::dateProtoFuncToJSON):
* runtime/DirectArguments.h:
(JSC::DirectArguments::length const):
* runtime/DirectEvalExecutable.cpp:
(JSC::DirectEvalExecutable::create):
* runtime/ErrorPrototype.cpp:
(JSC::errorProtoFuncToString):
* runtime/ExceptionHelpers.cpp:
(JSC::createUndefinedVariableError):
(JSC::errorDescriptionForValue):
* runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
* runtime/GenericArgumentsInlines.h:
(JSC::GenericArguments<Type>::getOwnPropertyNames):
* runtime/IdentifierInlines.h:
(JSC::Identifier::add):
* runtime/IndirectEvalExecutable.cpp:
(JSC::IndirectEvalExecutable::create):
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::finishCreation):
(JSC::InternalFunction::createSubclassStructureSlow):
* runtime/JSArray.cpp:
(JSC::JSArray::getOwnPropertySlot):
(JSC::JSArray::put):
(JSC::JSArray::deleteProperty):
(JSC::JSArray::getOwnNonIndexPropertyNames):
(JSC::JSArray::isIteratorProtocolFastAndNonObservable):
* runtime/JSArray.h:
(JSC::JSArray::shiftCountForShift):
* runtime/JSCJSValue.cpp:
(JSC::JSValue::dumpForBacktrace const):
* runtime/JSDataView.cpp:
(JSC::JSDataView::getOwnPropertySlot):
(JSC::JSDataView::deleteProperty):
(JSC::JSDataView::getOwnNonIndexPropertyNames):
* runtime/JSFunction.cpp:
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::deleteProperty):
(JSC::JSFunction::reifyName):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncEval):
* runtime/JSInternalPromise.cpp:
(JSC::JSInternalPromise::then):
* runtime/JSLexicalEnvironment.cpp:
(JSC::JSLexicalEnvironment::deleteProperty):
* runtime/JSMap.cpp:
(JSC::JSMap::isIteratorProtocolFastAndNonObservable):
* runtime/JSMapIterator.h:
(JSC::JSMapIterator::advanceIter):
* runtime/JSModuleEnvironment.cpp:
(JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
* runtime/JSModuleLoader.cpp:
(JSC::printableModuleKey):
(JSC::JSModuleLoader::provide):
(JSC::JSModuleLoader::loadAndEvaluateModule):
(JSC::JSModuleLoader::loadModule):
(JSC::JSModuleLoader::linkAndEvaluateModule):
(JSC::JSModuleLoader::requestImportModule):
* runtime/JSModuleNamespaceObject.h:
* runtime/JSModuleRecord.cpp:
(JSC::JSModuleRecord::evaluate):
* runtime/JSONObject.cpp:
(JSC::Stringifier::Stringifier):
(JSC::Stringifier::appendStringifiedValue):
(JSC::Stringifier::Holder::appendNextProperty):
* runtime/JSObject.cpp:
(JSC::JSObject::calculatedClassName):
(JSC::JSObject::putByIndex):
(JSC::JSObject::ordinaryToPrimitive const):
(JSC::JSObject::toPrimitive const):
(JSC::JSObject::hasInstance):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
(JSC::getCustomGetterSetterFunctionForGetterSetter):
(JSC::JSObject::getOwnPropertyDescriptor):
(JSC::JSObject::getMethod):
* runtime/JSObject.h:
(JSC::JSObject::createRawObject):
(JSC::JSFinalObject::create):
* runtime/JSObjectInlines.h:
(JSC::JSObject::canPerformFastPutInline):
(JSC::JSObject::putInlineForJSObject):
(JSC::JSObject::hasOwnProperty const):
* runtime/JSScope.cpp:
(JSC::isUnscopable):
(JSC::JSScope::resolveScopeForHoistingFuncDeclInEval):
* runtime/JSSet.cpp:
(JSC::JSSet::isIteratorProtocolFastAndNonObservable):
* runtime/JSSetIterator.h:
(JSC::JSSetIterator::advanceIter):
* runtime/JSString.cpp:
(JSC::JSString::getStringPropertyDescriptor):
* runtime/JSString.h:
(JSC::JSString::getStringPropertySlot):
* runtime/MapConstructor.cpp:
(JSC::constructMap):
* runtime/ModuleProgramExecutable.cpp:
(JSC::ModuleProgramExecutable::create):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncToLocaleString):
* runtime/ProgramExecutable.h:
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::getOwnPropertySlot):
(JSC::RegExpObject::deleteProperty):
(JSC::RegExpObject::getOwnNonIndexPropertyNames):
(JSC::RegExpObject::getPropertyNames):
(JSC::RegExpObject::getGenericPropertyNames):
(JSC::RegExpObject::put):
* runtime/ScopedArguments.h:
(JSC::ScopedArguments::length const):
* runtime/StrictEvalActivation.h:
(JSC::StrictEvalActivation::create):
* runtime/StringObject.cpp:
(JSC::isStringOwnProperty):
(JSC::StringObject::deleteProperty):
(JSC::StringObject::getOwnNonIndexPropertyNames):
* tools/JSDollarVMPrototype.cpp:
(JSC::JSDollarVMPrototype::gc):
(JSC::JSDollarVMPrototype::edenGC):
* wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::evaluate):

Source/WebCore:

No new tests because this is only a refactoring patch.  There is no
significant behavior change.

* Modules/mediastream/SDPProcessor.cpp:
(WebCore::SDPProcessor::callScript const):
* Modules/plugins/QuickTimePluginReplacement.mm:
(WebCore::QuickTimePluginReplacement::installReplacement):
* bindings/js/JSCallbackData.cpp:
(WebCore::JSCallbackData::invokeCallback):
* bindings/js/JSCustomElementInterface.cpp:
(WebCore::constructCustomElementSynchronously):
(WebCore::JSCustomElementInterface::upgradeElement):
(WebCore::JSCustomElementInterface::invokeCallback):
* bindings/js/JSDOMConvertRecord.h:
* bindings/js/JSDOMMapLike.h:
(WebCore::forwardSizeToMapLike):
(WebCore::forwardEntriesToMapLike):
(WebCore::forwardKeysToMapLike):
(WebCore::forwardValuesToMapLike):
(WebCore::forwardGetToMapLike):
(WebCore::forwardHasToMapLike):
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
(WebCore::addCrossOriginWindowOwnPropertyNames):
* bindings/js/JSDocumentCustom.cpp:
(WebCore::reportMemoryForDocumentIfFrameless):
* bindings/js/JSErrorHandler.cpp:
(WebCore::JSErrorHandler::handleEvent):
* bindings/js/JSImageDataCustom.cpp:
(WebCore::toJSNewlyCreated):
* bindings/js/JSLocationCustom.cpp:
(WebCore::getOwnPropertySlotCommon):
(WebCore::putCommon):
(WebCore::addCrossOriginLocationPropertyNames):
(WebCore::addCrossOriginLocationOwnPropertyNames):
(WebCore::JSLocation::defineOwnProperty):
(WebCore::JSLocationPrototype::put):
(WebCore::JSLocationPrototype::defineOwnProperty):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::serialize):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSInterfaceName.cpp:
(WebCore::setJSInterfaceNameConstructor):
* bindings/scripts/test/JS/JSMapLike.cpp:
(WebCore::setJSMapLikeConstructor):
* bindings/scripts/test/JS/JSReadOnlyMapLike.cpp:
(WebCore::setJSReadOnlyMapLikeConstructor):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::setJSTestActiveDOMObjectConstructor):
* bindings/scripts/test/JS/JSTestCEReactions.cpp:
(WebCore::setJSTestCEReactionsConstructor):
* bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
(WebCore::setJSTestCEReactionsStringifierConstructor):
* bindings/scripts/test/JS/JSTestCallTracer.cpp:
(WebCore::setJSTestCallTracerConstructor):
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
(WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
(WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
(WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
* bindings/scripts/test/JS/JSTestDOMJIT.cpp:
(WebCore::setJSTestDOMJITConstructor):
* bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:
(WebCore::setJSTestEnabledBySettingConstructor):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::setJSTestEventConstructorConstructor):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::setJSTestEventTargetConstructor):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::setJSTestExceptionConstructor):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::setJSTestGenerateIsReachableConstructor):
* bindings/scripts/test/JS/JSTestGlobalObject.cpp:
(WebCore::setJSTestGlobalObjectConstructor):
* bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:
(WebCore::setJSTestIndexedSetterNoIdentifierConstructor):
* bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:
(WebCore::setJSTestIndexedSetterThrowingExceptionConstructor):
* bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:
(WebCore::setJSTestIndexedSetterWithIdentifierConstructor):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::setJSTestInterfaceConstructor):
* bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:
(WebCore::setJSTestInterfaceLeadingUnderscoreConstructor):
* bindings/scripts/test/JS/JSTestIterable.cpp:
(WebCore::setJSTestIterableConstructor):
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
(WebCore::setJSTestJSBuiltinConstructorConstructor):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::setJSTestMediaQueryListListenerConstructor):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
(WebCore::setJSTestNamedAndIndexedSetterNoIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
(WebCore::setJSTestNamedAndIndexedSetterThrowingExceptionConstructor):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
(WebCore::setJSTestNamedAndIndexedSetterWithIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::setJSTestNamedConstructorConstructor):
* bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:
(WebCore::setJSTestNamedDeleterNoIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:
(WebCore::setJSTestNamedDeleterThrowingExceptionConstructor):
* bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:
(WebCore::setJSTestNamedDeleterWithIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:
(WebCore::setJSTestNamedDeleterWithIndexedGetterConstructor):
* bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:
(WebCore::setJSTestNamedGetterCallWithConstructor):
* bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:
(WebCore::setJSTestNamedGetterNoIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:
(WebCore::setJSTestNamedGetterWithIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
(WebCore::setJSTestNamedSetterNoIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
(WebCore::setJSTestNamedSetterThrowingExceptionConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
(WebCore::setJSTestNamedSetterWithIdentifierConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
(WebCore::setJSTestNamedSetterWithIndexedGetterConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
(WebCore::setJSTestNamedSetterWithIndexedGetterAndSetterConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp:
(WebCore::setJSTestNamedSetterWithOverrideBuiltinsConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp:
(WebCore::setJSTestNamedSetterWithUnforgablePropertiesConstructor):
* bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp:
(WebCore::setJSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltinsConstructor):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::setJSTestNodeConstructor):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::setJSTestObjConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::setJSTestOverloadedConstructorsConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
(WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):
* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
(WebCore::setJSTestOverrideBuiltinsConstructor):
* bindings/scripts/test/JS/JSTestPluginInterface.cpp:
(WebCore::setJSTestPluginInterfaceConstructor):
* bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:
(WebCore::setJSTestPromiseRejectionEventConstructor):
* bindings/scripts/test/JS/JSTestSerialization.cpp:
(WebCore::setJSTestSerializationConstructor):
* bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.cpp:
(WebCore::setJSTestSerializationIndirectInheritanceConstructor):
* bindings/scripts/test/JS/JSTestSerializationInherit.cpp:
(WebCore::setJSTestSerializationInheritConstructor):
* bindings/scripts/test/JS/JSTestSerializationInheritFinal.cpp:
(WebCore::setJSTestSerializationInheritFinalConstructor):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
* bindings/scripts/test/JS/JSTestStringifier.cpp:
(WebCore::setJSTestStringifierConstructor):
* bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp:
(WebCore::setJSTestStringifierAnonymousOperationConstructor):
* bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp:
(WebCore::setJSTestStringifierNamedOperationConstructor):
* bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp:
(WebCore::setJSTestStringifierOperationImplementedAsConstructor):
* bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp:
(WebCore::setJSTestStringifierOperationNamedToStringConstructor):
* bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp:
(WebCore::setJSTestStringifierReadOnlyAttributeConstructor):
* bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp:
(WebCore::setJSTestStringifierReadWriteAttributeConstructor):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::setJSTestTypedefsConstructor):
* bridge/NP_jsobject.cpp:
(_NPN_SetProperty):
(_NPN_RemoveProperty):
(_NPN_Enumerate):
* bridge/c/c_instance.cpp:
(JSC::Bindings::CRuntimeMethod::create):
* bridge/objc/WebScriptObject.mm:
(-[WebScriptObject setValue:forKey:]):
(-[WebScriptObject removeWebScriptKey:]):
(-[WebScriptObject setWebScriptValueAtIndex:value:]):
* bridge/objc/objc_instance.mm:
(ObjCRuntimeMethod::create):
* bridge/objc/objc_runtime.h:
(JSC::Bindings::ObjcFallbackObjectImp::create):
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::getOwnPropertyNames):
(JSC::RuntimeArray::getOwnPropertySlot):
(JSC::RuntimeArray::put):
* bridge/runtime_array.h:
(JSC::RuntimeArray::create):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::getOwnPropertySlot):
* bridge/runtime_method.h:
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::updateCaptionContainer):
(WebCore::HTMLMediaElement::setControllerJSProperty):
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
(WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
* testing/Internals.cpp:
(WebCore::Internals::cloneArrayBuffer):

Source/WebKit:

* WebProcess/Plugins/Netscape/JSNPMethod.h:
(WebKit::JSNPMethod::create):
* WebProcess/Plugins/Netscape/NPJSObject.cpp:
(WebKit::NPJSObject::setProperty):
(WebKit::NPJSObject::removeProperty):
(WebKit::NPJSObject::enumerate):

Source/WebKitLegacy/mac:

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::invokeDefault):
(WebKit::NetscapePluginInstanceProxy::construct):
(WebKit::NetscapePluginInstanceProxy::setProperty):
(WebKit::NetscapePluginInstanceProxy::removeProperty):
(WebKit::NetscapePluginInstanceProxy::enumerate):
* Plugins/Hosted/ProxyInstance.mm:
(WebKit::ProxyRuntimeMethod::create):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@221822 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/API/JSBase.cpp b/Source/JavaScriptCore/API/JSBase.cpp
index 291e5b1..4c0597d 100644
--- a/Source/JavaScriptCore/API/JSBase.cpp
+++ b/Source/JavaScriptCore/API/JSBase.cpp
@@ -96,7 +96,8 @@
         return false;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     startingLineNumber = std::max(1, startingLineNumber);
 
@@ -110,7 +111,7 @@
         if (exception)
             *exception = toRef(exec, syntaxException);
 #if ENABLE(REMOTE_INSPECTOR)
-        Exception* exception = Exception::create(exec->vm(), syntaxException);
+        Exception* exception = Exception::create(vm, syntaxException);
         exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
 #endif
         return false;
@@ -130,9 +131,10 @@
         return;
 
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
-    exec->vm().heap.reportAbandonedObjectGraph();
+    vm.heap.reportAbandonedObjectGraph();
 }
 
 void JSReportExtraMemoryCost(JSContextRef ctx, size_t size)
@@ -142,9 +144,10 @@
         return;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
-    exec->vm().heap.deprecatedReportExtraMemory(size);
+    vm.heap.deprecatedReportExtraMemory(size);
 }
 
 extern "C" JS_EXPORT void JSSynchronousGarbageCollectForDebugging(JSContextRef);
@@ -156,8 +159,9 @@
         return;
 
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
-    exec->vm().heap.collectNow(Sync, CollectionScope::Full);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
+    vm.heap.collectNow(Sync, CollectionScope::Full);
 }
 
 void JSSynchronousEdenCollectForDebugging(JSContextRef ctx)
@@ -166,8 +170,9 @@
         return;
 
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
-    exec->vm().heap.collectSync(CollectionScope::Eden);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
+    vm.heap.collectSync(CollectionScope::Eden);
 }
 
 void JSDisableGCTimer(void)
diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.h b/Source/JavaScriptCore/API/JSCallbackConstructor.h
index d730ad7..95b3501 100644
--- a/Source/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/Source/JavaScriptCore/API/JSCallbackConstructor.h
@@ -38,7 +38,8 @@
 
     static JSCallbackConstructor* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef classRef, JSObjectCallAsConstructorCallback callback) 
     {
-        JSCallbackConstructor* constructor = new (NotNull, allocateCell<JSCallbackConstructor>(*exec->heap())) JSCallbackConstructor(globalObject, structure, classRef, callback);
+        VM& vm = exec->vm();
+        JSCallbackConstructor* constructor = new (NotNull, allocateCell<JSCallbackConstructor>(vm.heap)) JSCallbackConstructor(globalObject, structure, classRef, callback);
         constructor->finishCreation(globalObject, classRef);
         return constructor;
     }
diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h
index 43749e2..29b2c72 100644
--- a/Source/JavaScriptCore/API/JSCallbackObject.h
+++ b/Source/JavaScriptCore/API/JSCallbackObject.h
@@ -138,8 +138,9 @@
 
     static JSCallbackObject* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef classRef, void* data)
     {
+        VM& vm = exec->vm();
         ASSERT_UNUSED(globalObject, !structure->globalObject() || structure->globalObject() == globalObject);
-        JSCallbackObject* callbackObject = new (NotNull, allocateCell<JSCallbackObject>(*exec->heap())) JSCallbackObject(exec, structure, classRef, data);
+        JSCallbackObject* callbackObject = new (NotNull, allocateCell<JSCallbackObject>(vm.heap)) JSCallbackObject(exec, structure, classRef, data);
         callbackObject->finishCreation(exec);
         return callbackObject;
     }
diff --git a/Source/JavaScriptCore/API/JSContext.mm b/Source/JavaScriptCore/API/JSContext.mm
index baeb178..c632f39 100644
--- a/Source/JavaScriptCore/API/JSContext.mm
+++ b/Source/JavaScriptCore/API/JSContext.mm
@@ -115,9 +115,11 @@
 
 - (void)setException:(JSValue *)value
 {
-    JSC::JSLockHolder locker(toJS(m_context));
+    JSC::ExecState* exec = toJS(m_context);
+    JSC::VM& vm = exec->vm();
+    JSC::JSLockHolder locker(vm);
     if (value)
-        m_exception.set(toJS(m_context)->vm(), toJS(JSValueToObject(m_context, valueInternalValue(value), 0)));
+        m_exception.set(vm, toJS(JSValueToObject(m_context, valueInternalValue(value), 0)));
     else
         m_exception.clear();
 }
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index 541cb70..a8065ca 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -189,9 +189,10 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
-    return toRef(jsCast<JSObject*>(exec->lexicalGlobalObject()->methodTable()->toThis(exec->lexicalGlobalObject(), exec, NotStrictMode)));
+    return toRef(jsCast<JSObject*>(exec->lexicalGlobalObject()->methodTable(vm)->toThis(exec->lexicalGlobalObject(), exec, NotStrictMode)));
 }
 
 JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
@@ -304,9 +305,10 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder lock(exec);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
     StringBuilder builder;
-    CallFrame* frame = exec->vm().topCallFrame;
+    CallFrame* frame = vm.topCallFrame;
 
     ASSERT(maxStackSize);
     BacktraceFunctor functor(builder, maxStackSize);
diff --git a/Source/JavaScriptCore/API/JSManagedValue.mm b/Source/JavaScriptCore/API/JSManagedValue.mm
index 038a682..932b9bf 100644
--- a/Source/JavaScriptCore/API/JSManagedValue.mm
+++ b/Source/JavaScriptCore/API/JSManagedValue.mm
@@ -264,10 +264,11 @@
 - (JSValue *)value
 {
     WTF::Locker<JSC::JSLock> locker(m_lock.get());
-    if (!m_lock->vm())
+    JSC::VM* vm = m_lock->vm();
+    if (!vm)
         return nil;
 
-    JSC::JSLockHolder apiLocker(m_lock->vm());
+    JSC::JSLockHolder apiLocker(vm);
     if (!m_globalObject)
         return nil;
     if (m_weakValue.isClear())
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index ce37cc6..702c823 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -89,14 +89,15 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     if (!jsClass)
         return toRef(constructEmptyObject(exec));
 
     JSCallbackObject<JSDestructibleObject>* object = JSCallbackObject<JSDestructibleObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data);
     if (JSObject* prototype = jsClass->prototype(exec))
-        object->setPrototypeDirect(exec->vm(), prototype);
+        object->setPrototypeDirect(vm, prototype);
 
     return toRef(object);
 }
@@ -108,8 +109,9 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
-    return toRef(JSCallbackFunction::create(exec->vm(), exec->lexicalGlobalObject(), callAsFunction, name ? name->string() : ASCIILiteral("anonymous")));
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
+    return toRef(JSCallbackFunction::create(vm, exec->lexicalGlobalObject(), callAsFunction, name ? name->string() : ASCIILiteral("anonymous")));
 }
 
 JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObjectCallAsConstructorCallback callAsConstructor)
@@ -119,14 +121,15 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
     if (!jsPrototype)
         jsPrototype = exec->lexicalGlobalObject()->objectPrototype();
 
     JSCallbackConstructor* constructor = JSCallbackConstructor::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackConstructorStructure(), jsClass, callAsConstructor);
-    constructor->putDirect(exec->vm(), exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
+    constructor->putDirect(vm, vm.propertyNames->prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
     return toRef(constructor);
 }
 
@@ -137,10 +140,11 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     startingLineNumber = std::max(1, startingLineNumber);
-    Identifier nameID = name ? name->identifier(&exec->vm()) : Identifier::fromString(exec, "anonymous");
+    Identifier nameID = name ? name->identifier(&vm) : Identifier::fromString(exec, "anonymous");
     
     MarkedArgumentBuffer args;
     for (unsigned i = 0; i < parameterCount; i++)
@@ -259,20 +263,20 @@
     }
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
 
     if (JSProxy* proxy = jsDynamicCast<JSProxy*>(vm, jsObject)) {
         if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(vm, proxy->target())) {
-            globalObject->resetPrototype(exec->vm(), jsValue.isObject() ? jsValue : jsNull());
+            globalObject->resetPrototype(vm, jsValue.isObject() ? jsValue : jsNull());
             return;
         }
         // Someday we might use proxies for something other than JSGlobalObjects, but today is not that day.
         RELEASE_ASSERT_NOT_REACHED();
     }
-    jsObject->setPrototype(exec->vm(), exec, jsValue.isObject() ? jsValue : jsNull());
+    jsObject->setPrototype(vm, exec, jsValue.isObject() ? jsValue : jsNull());
 }
 
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
@@ -282,11 +286,12 @@
         return false;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     JSObject* jsObject = toJS(object);
     
-    return jsObject->hasProperty(exec, propertyName->identifier(&exec->vm()));
+    return jsObject->hasProperty(exec, propertyName->identifier(&vm));
 }
 
 JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
@@ -296,11 +301,12 @@
         return 0;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     JSObject* jsObject = toJS(object);
 
-    JSValue jsValue = jsObject->get(exec, propertyName->identifier(&exec->vm()));
+    JSValue jsValue = jsObject->get(exec, propertyName->identifier(&vm));
     handleExceptionIfNeeded(exec, exception);
     return toRef(exec, jsValue);
 }
@@ -317,17 +323,17 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     JSObject* jsObject = toJS(object);
-    Identifier name(propertyName->identifier(&exec->vm()));
+    Identifier name(propertyName->identifier(&vm));
     JSValue jsValue = toJS(exec, value);
 
     bool doesNotHaveProperty = attributes && !jsObject->hasProperty(exec, name);
     if (LIKELY(!scope.exception())) {
         if (doesNotHaveProperty) {
             PropertyDescriptor desc(jsValue, attributes);
-            jsObject->methodTable()->defineOwnProperty(jsObject, exec, name, desc, false);
+            jsObject->methodTable(vm)->defineOwnProperty(jsObject, exec, name, desc, false);
         } else {
             PutPropertySlot slot(jsObject);
-            jsObject->methodTable()->put(jsObject, exec, name, jsValue, slot);
+            jsObject->methodTable(vm)->put(jsObject, exec, name, jsValue, slot);
         }
     }
     handleExceptionIfNeeded(exec, exception);
@@ -357,12 +363,13 @@
         return;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     JSObject* jsObject = toJS(object);
     JSValue jsValue = toJS(exec, value);
     
-    jsObject->methodTable()->putByIndex(jsObject, exec, propertyIndex, jsValue, false);
+    jsObject->methodTable(vm)->putByIndex(jsObject, exec, propertyIndex, jsValue, false);
     handleExceptionIfNeeded(exec, exception);
 }
 
@@ -373,11 +380,12 @@
         return false;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     JSObject* jsObject = toJS(object);
 
-    bool result = jsObject->methodTable()->deleteProperty(jsObject, exec, propertyName->identifier(&exec->vm()));
+    bool result = jsObject->methodTable(vm)->deleteProperty(jsObject, exec, propertyName->identifier(&vm));
     handleExceptionIfNeeded(exec, exception);
     return result;
 }
@@ -455,10 +463,10 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
     JSObject* jsObject = toJS(object);
     JSValue result;
-    Identifier name(propertyName->identifier(&exec->vm()));
+    Identifier name(propertyName->identifier(&vm));
 
 
     // Get wrapped object if proxied
@@ -480,26 +488,26 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
     JSObject* jsObject = toJS(object);
     JSValue jsValue = value ? toJS(exec, value) : JSValue();
-    Identifier name(propertyName->identifier(&exec->vm()));
+    Identifier name(propertyName->identifier(&vm));
 
     // Get wrapped object if proxied
     if (jsObject->inherits(vm, JSProxy::info()))
         jsObject = jsCast<JSProxy*>(jsObject)->target();
 
     if (jsObject->inherits(vm, JSCallbackObject<JSGlobalObject>::info())) {
-        jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
+        jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(vm, name, jsValue);
         return true;
     }
     if (jsObject->inherits(vm, JSCallbackObject<JSDestructibleObject>::info())) {
-        jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
+        jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivateProperty(vm, name, jsValue);
         return true;
     }
 #if JSC_OBJC_API_ENABLED
     if (jsObject->inherits(vm, JSCallbackObject<JSAPIWrapperObject>::info())) {
-        jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
+        jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivateProperty(vm, name, jsValue);
         return true;
     }
 #endif
@@ -510,9 +518,9 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
     JSObject* jsObject = toJS(object);
-    Identifier name(propertyName->identifier(&exec->vm()));
+    Identifier name(propertyName->identifier(&vm));
 
     // Get wrapped object if proxied
     if (jsObject->inherits(vm, JSProxy::info()))
@@ -539,16 +547,19 @@
 {
     if (!object)
         return false;
-    JSLockHolder locker(toJS(ctx));
+    ExecState* exec = toJS(ctx);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
     CallData callData;
     JSCell* cell = toJS(object);
-    return cell->methodTable()->getCallData(cell, callData) != CallType::None;
+    return cell->methodTable(vm)->getCallData(cell, callData) != CallType::None;
 }
 
 JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     if (!object)
         return 0;
@@ -564,7 +575,7 @@
         argList.append(toJS(exec, arguments[i]));
 
     CallData callData;
-    CallType callType = jsObject->methodTable()->getCallData(jsObject, callData);
+    CallType callType = jsObject->methodTable(vm)->getCallData(jsObject, callData);
     if (callType == CallType::None)
         return 0;
 
@@ -586,7 +597,8 @@
 JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     if (!object)
         return 0;
@@ -594,7 +606,7 @@
     JSObject* jsObject = toJS(object);
 
     ConstructData constructData;
-    ConstructType constructType = jsObject->methodTable()->getConstructData(jsObject, constructData);
+    ConstructType constructType = jsObject->methodTable(vm)->getConstructData(jsObject, constructData);
     if (constructType == ConstructType::None)
         return 0;
 
@@ -636,7 +648,7 @@
     JSObject* jsObject = toJS(object);
     JSPropertyNameArrayRef propertyNames = new OpaqueJSPropertyNameArray(vm);
     PropertyNameArray array(vm, PropertyNameMode::Strings);
-    jsObject->methodTable()->getPropertyNames(jsObject, exec, array, EnumerationMode());
+    jsObject->methodTable(*vm)->getPropertyNames(jsObject, exec, array, EnumerationMode());
 
     size_t size = array.size();
     propertyNames->array.reserveInitialCapacity(size);
@@ -673,8 +685,9 @@
 void JSPropertyNameAccumulatorAddName(JSPropertyNameAccumulatorRef array, JSStringRef propertyName)
 {
     PropertyNameArray* propertyNames = toJS(array);
-    JSLockHolder locker(propertyNames->vm());
-    propertyNames->add(propertyName->identifier(propertyNames->vm()));
+    VM* vm = propertyNames->vm();
+    JSLockHolder locker(vm);
+    propertyNames->add(propertyName->identifier(vm));
 }
 
 JSObjectRef JSObjectGetProxyTarget(JSObjectRef objectRef)
diff --git a/Source/JavaScriptCore/API/JSScriptRef.cpp b/Source/JavaScriptCore/API/JSScriptRef.cpp
index 791738b..33f59a3 100644
--- a/Source/JavaScriptCore/API/JSScriptRef.cpp
+++ b/Source/JavaScriptCore/API/JSScriptRef.cpp
@@ -145,8 +145,9 @@
 JSValueRef JSScriptEvaluate(JSContextRef context, JSScriptRef script, JSValueRef thisValueRef, JSValueRef* exception)
 {
     ExecState* exec = toJS(context);
-    JSLockHolder locker(exec);
-    if (&script->vm() != &exec->vm()) {
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
+    if (&script->vm() != &vm) {
         RELEASE_ASSERT_NOT_REACHED();
         return 0;
     }
diff --git a/Source/JavaScriptCore/API/JSTypedArray.cpp b/Source/JavaScriptCore/API/JSTypedArray.cpp
index 5fb29e7..db98289 100644
--- a/Source/JavaScriptCore/API/JSTypedArray.cpp
+++ b/Source/JavaScriptCore/API/JSTypedArray.cpp
@@ -141,7 +141,7 @@
 
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
 
     JSValue value = toJS(exec, valueRef);
     if (!value.isObject())
@@ -195,7 +195,7 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
 
     if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
         return nullptr;
@@ -219,7 +219,7 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
 
     if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)
         return nullptr;
@@ -240,7 +240,7 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
     JSObject* object = toJS(objectRef);
 
     if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object)) {
@@ -291,11 +291,11 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
     JSObject* object = toJS(objectRef);
 
     if (JSArrayBufferView* typedArray = jsDynamicCast<JSArrayBufferView*>(vm, object))
-        return toRef(exec->vm().m_typedArrayController->toJS(exec, typedArray->globalObject(), typedArray->possiblySharedBuffer()));
+        return toRef(vm.m_typedArrayController->toJS(exec, typedArray->globalObject(), typedArray->possiblySharedBuffer()));
 
     return nullptr;
 }
@@ -303,14 +303,15 @@
 JSObjectRef JSObjectMakeArrayBufferWithBytesNoCopy(JSContextRef ctx, void* bytes, size_t byteLength, JSTypedArrayBytesDeallocator bytesDeallocator, void* deallocatorContext, JSValueRef* exception)
 {
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
 
     auto buffer = ArrayBuffer::createFromBytes(bytes, byteLength, [=](void* p) {
         if (bytesDeallocator)
             bytesDeallocator(p, deallocatorContext);
     });
 
-    JSArrayBuffer* jsBuffer = JSArrayBuffer::create(exec->vm(), exec->lexicalGlobalObject()->arrayBufferStructure(ArrayBufferSharingMode::Default), WTFMove(buffer));
+    JSArrayBuffer* jsBuffer = JSArrayBuffer::create(vm, exec->lexicalGlobalObject()->arrayBufferStructure(ArrayBufferSharingMode::Default), WTFMove(buffer));
     if (handleExceptionIfNeeded(exec, exception) == ExceptionStatus::DidThrow)
         return nullptr;
 
@@ -321,7 +322,7 @@
 {
     ExecState* exec = toJS(ctx);
     VM& vm = exec->vm();
-    JSLockHolder locker(exec);
+    JSLockHolder locker(vm);
     JSObject* object = toJS(objectRef);
 
     if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(vm, object)) {
diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
index 28cf244..7f1cd52 100644
--- a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
+++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp
@@ -44,8 +44,9 @@
 JSWeakObjectMapRef JSWeakObjectMapCreate(JSContextRef context, void* privateData, JSWeakMapDestroyedCallback callback)
 {
     ExecState* exec = toJS(context);
-    JSLockHolder locker(exec);
-    RefPtr<OpaqueJSWeakObjectMap> map = OpaqueJSWeakObjectMap::create(exec->vm(), privateData, callback);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
+    RefPtr<OpaqueJSWeakObjectMap> map = OpaqueJSWeakObjectMap::create(vm, privateData, callback);
     exec->lexicalGlobalObject()->registerWeakMap(map.get());
     return map.get();
 }
@@ -57,13 +58,14 @@
         return;
     }
     ExecState* exec = toJS(ctx);
-    JSLockHolder locker(exec);
+    VM& vm = exec->vm();
+    JSLockHolder locker(vm);
     JSObject* obj = toJS(object);
     if (!obj)
         return;
-    ASSERT(obj->inherits(exec->vm(), JSProxy::info())
-        || obj->inherits(exec->vm(), JSCallbackObject<JSGlobalObject>::info())
-        || obj->inherits(exec->vm(), JSCallbackObject<JSDestructibleObject>::info()));
+    ASSERT(obj->inherits(vm, JSProxy::info())
+        || obj->inherits(vm, JSCallbackObject<JSGlobalObject>::info())
+        || obj->inherits(vm, JSCallbackObject<JSDestructibleObject>::info()));
     map->map().set(key, obj);
 }
 
diff --git a/Source/JavaScriptCore/API/JSWrapperMap.mm b/Source/JavaScriptCore/API/JSWrapperMap.mm
index 3465313..9425195 100644
--- a/Source/JavaScriptCore/API/JSWrapperMap.mm
+++ b/Source/JavaScriptCore/API/JSWrapperMap.mm
@@ -109,23 +109,25 @@
 static bool constructorHasInstance(JSContextRef ctx, JSObjectRef constructorRef, JSValueRef possibleInstance, JSValueRef*)
 {
     JSC::ExecState* exec = toJS(ctx);
-    JSC::JSLockHolder locker(exec);
+    JSC::VM& vm = exec->vm();
+    JSC::JSLockHolder locker(vm);
 
     JSC::JSObject* constructor = toJS(constructorRef);
     JSC::JSValue instance = toJS(exec, possibleInstance);
-    return JSC::JSObject::defaultHasInstance(exec, instance, constructor->get(exec, exec->propertyNames().prototype));
+    return JSC::JSObject::defaultHasInstance(exec, instance, constructor->get(exec, vm.propertyNames->prototype));
 }
 
 static JSC::JSObject* makeWrapper(JSContextRef ctx, JSClassRef jsClass, id wrappedObject)
 {
     JSC::ExecState* exec = toJS(ctx);
-    JSC::JSLockHolder locker(exec);
+    JSC::VM& vm = exec->vm();
+    JSC::JSLockHolder locker(vm);
 
     ASSERT(jsClass);
     JSC::JSCallbackObject<JSC::JSAPIWrapperObject>* object = JSC::JSCallbackObject<JSC::JSAPIWrapperObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->objcWrapperObjectStructure(), jsClass, 0);
     object->setWrappedObject(wrappedObject);
     if (JSC::JSObject* prototype = jsClass->prototype(exec))
-        object->setPrototypeDirect(exec->vm(), prototype);
+        object->setPrototypeDirect(vm, prototype);
 
     return object;
 }
diff --git a/Source/JavaScriptCore/API/ObjCCallbackFunction.mm b/Source/JavaScriptCore/API/ObjCCallbackFunction.mm
index e84e069..fb93a86 100644
--- a/Source/JavaScriptCore/API/ObjCCallbackFunction.mm
+++ b/Source/JavaScriptCore/API/ObjCCallbackFunction.mm
@@ -675,10 +675,11 @@
     }
 
     JSC::ExecState* exec = toJS([context JSGlobalContextRef]);
-    JSC::JSLockHolder locker(exec);
+    JSC::VM& vm = exec->vm();
+    JSC::JSLockHolder locker(vm);
     auto impl = std::make_unique<JSC::ObjCCallbackFunctionImpl>(invocation, type, instanceClass, WTFMove(arguments), WTFMove(result));
     const String& name = impl->name();
-    return toRef(JSC::ObjCCallbackFunction::create(exec->vm(), exec->lexicalGlobalObject(), name, WTFMove(impl)));
+    return toRef(JSC::ObjCCallbackFunction::create(vm, exec->lexicalGlobalObject(), name, WTFMove(impl)));
 }
 
 JSObjectRef objCCallbackFunctionForInit(JSContext *context, Class cls, Protocol *protocol, SEL sel, const char* types)
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index c3f8019..cdfc866 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,335 @@
+2017-09-09  Mark Lam  <mark.lam@apple.com>
+
+        Avoid duplicate computations of ExecState::vm().
+        https://bugs.webkit.org/show_bug.cgi?id=176647
+
+        Reviewed by Saam Barati.
+
+        Because while computing ExecState::vm() is cheap, it is not free.
+
+        This patch also:
+        1. gets rids of some convenience methods in CallFrame that implicitly does a
+           ExecState::vm() computation.  This minimizes the chance of us accidentally
+           computing ExecState::vm() more than necessary.
+        2. passes vm (when available) to methodTable().
+        3. passes vm (when available) to JSLockHolder.
+
+        * API/JSBase.cpp:
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        (JSReportExtraMemoryCost):
+        (JSSynchronousGarbageCollectForDebugging):
+        (JSSynchronousEdenCollectForDebugging):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::create):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::create):
+        * API/JSContext.mm:
+        (-[JSContext setException:]):
+        * API/JSContextRef.cpp:
+        (JSContextGetGlobalObject):
+        (JSContextCreateBacktrace):
+        * API/JSManagedValue.mm:
+        (-[JSManagedValue value]):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectSetPrototype):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectGetPrivateProperty):
+        (JSObjectSetPrivateProperty):
+        (JSObjectDeletePrivateProperty):
+        (JSObjectIsFunction):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSScriptRef.cpp:
+        * API/JSTypedArray.cpp:
+        (JSValueGetTypedArrayType):
+        (JSObjectMakeTypedArrayWithArrayBuffer):
+        (JSObjectMakeTypedArrayWithArrayBufferAndOffset):
+        (JSObjectGetTypedArrayBytesPtr):
+        (JSObjectGetTypedArrayBuffer):
+        (JSObjectMakeArrayBufferWithBytesNoCopy):
+        (JSObjectGetArrayBufferBytesPtr):
+        * API/JSWeakObjectMapRefPrivate.cpp:
+        * API/JSWrapperMap.mm:
+        (constructorHasInstance):
+        (makeWrapper):
+        * API/ObjCCallbackFunction.mm:
+        (objCCallbackFunctionForInvocation):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addConstant):
+        (JSC::CodeBlock::replaceConstant):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * dfg/DFGDesiredWatchpoints.cpp:
+        (JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::globalThisObjectFor):
+        * dfg/DFGOperations.cpp:
+        * ftl/FTLOSRExitCompiler.cpp:
+        (JSC::FTL::compileFTLOSRExit):
+        * ftl/FTLOperations.cpp:
+        (JSC::FTL::operationPopulateObjectInOSR):
+        (JSC::FTL::operationMaterializeObjectInOSR):
+        * heap/GCAssertions.h:
+        * inspector/InjectedScriptHost.cpp:
+        (Inspector::InjectedScriptHost::wrapper):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::subtype):
+        (Inspector::constructInternalProperty):
+        (Inspector::JSInjectedScriptHost::getInternalProperties):
+        (Inspector::JSInjectedScriptHost::weakMapEntries):
+        (Inspector::JSInjectedScriptHost::weakSetEntries):
+        (Inspector::JSInjectedScriptHost::iteratorEntries):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::valueForScopeLocation):
+        (Inspector::JSJavaScriptCallFrame::scopeDescriptions):
+        (Inspector::toJS):
+        * inspector/ScriptCallStackFactory.cpp:
+        (Inspector::extractSourceInformationFromException):
+        (Inspector::createScriptArguments):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::atomicStringTable const): Deleted.
+        (JSC::ExecState::propertyNames const): Deleted.
+        (JSC::ExecState::emptyList const): Deleted.
+        (JSC::ExecState::interpreter): Deleted.
+        (JSC::ExecState::heap): Deleted.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::executeProgram):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeModuleProgram):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITOperations.cpp:
+        * jit/JITWorklist.cpp:
+        (JSC::JITWorklist::compileNow):
+        * jsc.cpp:
+        (WTF::RuntimeArray::create):
+        (WTF::RuntimeArray::getOwnPropertySlot):
+        (WTF::DOMJITGetter::DOMJITAttribute::slowCall):
+        (WTF::DOMJITFunctionObject::unsafeFunction):
+        (WTF::DOMJITCheckSubClassObject::unsafeFunction):
+        (GlobalObject::moduleLoaderFetch):
+        (functionDumpCallFrame):
+        (functionCreateRoot):
+        (functionGetElement):
+        (functionSetElementRoot):
+        (functionCreateSimpleObject):
+        (functionSetHiddenValue):
+        (functionCreateProxy):
+        (functionCreateImpureGetter):
+        (functionCreateCustomGetterObject):
+        (functionCreateDOMJITNodeObject):
+        (functionCreateDOMJITGetterObject):
+        (functionCreateDOMJITGetterComplexObject):
+        (functionCreateDOMJITFunctionObject):
+        (functionCreateDOMJITCheckSubClassObject):
+        (functionGCAndSweep):
+        (functionFullGC):
+        (functionEdenGC):
+        (functionHeapSize):
+        (functionShadowChickenFunctionsOnStack):
+        (functionSetGlobalConstRedeclarationShouldNotThrow):
+        (functionJSCOptions):
+        (functionFailNextNewCodeBlock):
+        (functionMakeMasquerader):
+        (functionDumpTypesForAllVariables):
+        (functionFindTypeForExpression):
+        (functionReturnTypeFor):
+        (functionDumpBasicBlockExecutionRanges):
+        (functionBasicBlockExecutionCount):
+        (functionDrainMicrotasks):
+        (functionGenerateHeapSnapshot):
+        (functionEnsureArrayStorage):
+        (functionStartSamplingProfiler):
+        (runInteractive):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * parser/ModuleAnalyzer.cpp:
+        (JSC::ModuleAnalyzer::ModuleAnalyzer):
+        * profiler/ProfilerBytecode.cpp:
+        (JSC::Profiler::Bytecode::toJS const):
+        * profiler/ProfilerBytecodeSequence.cpp:
+        (JSC::Profiler::BytecodeSequence::addSequenceProperties const):
+        * profiler/ProfilerBytecodes.cpp:
+        (JSC::Profiler::Bytecodes::toJS const):
+        * profiler/ProfilerCompilation.cpp:
+        (JSC::Profiler::Compilation::toJS const):
+        * profiler/ProfilerCompiledBytecode.cpp:
+        (JSC::Profiler::CompiledBytecode::toJS const):
+        * profiler/ProfilerDatabase.cpp:
+        (JSC::Profiler::Database::toJS const):
+        * profiler/ProfilerEvent.cpp:
+        (JSC::Profiler::Event::toJS const):
+        * profiler/ProfilerOSRExit.cpp:
+        (JSC::Profiler::OSRExit::toJS const):
+        * profiler/ProfilerOrigin.cpp:
+        (JSC::Profiler::Origin::toJS const):
+        * profiler/ProfilerProfiledBytecodes.cpp:
+        (JSC::Profiler::ProfiledBytecodes::toJS const):
+        * runtime/AbstractModuleRecord.cpp:
+        (JSC::identifierToJSValue):
+        (JSC::AbstractModuleRecord::resolveExportImpl):
+        (JSC::getExportedNames):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
+        (JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        (JSC::loadAndEvaluateModule):
+        (JSC::loadModule):
+        (JSC::linkAndEvaluateModule):
+        (JSC::importModule):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
+        * runtime/DirectArguments.h:
+        (JSC::DirectArguments::length const):
+        * runtime/DirectEvalExecutable.cpp:
+        (JSC::DirectEvalExecutable::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::errorDescriptionForValue):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::getOwnPropertyNames):
+        * runtime/IdentifierInlines.h:
+        (JSC::Identifier::add):
+        * runtime/IndirectEvalExecutable.cpp:
+        (JSC::IndirectEvalExecutable::create):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        (JSC::InternalFunction::createSubclassStructureSlow):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getOwnNonIndexPropertyNames):
+        (JSC::JSArray::isIteratorProtocolFastAndNonObservable):
+        * runtime/JSArray.h:
+        (JSC::JSArray::shiftCountForShift):
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::dumpForBacktrace const):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::getOwnPropertySlot):
+        (JSC::JSDataView::deleteProperty):
+        (JSC::JSDataView::getOwnNonIndexPropertyNames):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::reifyName):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSInternalPromise.cpp:
+        (JSC::JSInternalPromise::then):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::deleteProperty):
+        * runtime/JSMap.cpp:
+        (JSC::JSMap::isIteratorProtocolFastAndNonObservable):
+        * runtime/JSMapIterator.h:
+        (JSC::JSMapIterator::advanceIter):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::getOwnNonIndexPropertyNames):
+        * runtime/JSModuleLoader.cpp:
+        (JSC::printableModuleKey):
+        (JSC::JSModuleLoader::provide):
+        (JSC::JSModuleLoader::loadAndEvaluateModule):
+        (JSC::JSModuleLoader::loadModule):
+        (JSC::JSModuleLoader::linkAndEvaluateModule):
+        (JSC::JSModuleLoader::requestImportModule):
+        * runtime/JSModuleNamespaceObject.h:
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::evaluate):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Stringifier::Holder::appendNextProperty):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        (JSC::JSObject::putByIndex):
+        (JSC::JSObject::ordinaryToPrimitive const):
+        (JSC::JSObject::toPrimitive const):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
+        (JSC::getCustomGetterSetterFunctionForGetterSetter):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createRawObject):
+        (JSC::JSFinalObject::create):
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::canPerformFastPutInline):
+        (JSC::JSObject::putInlineForJSObject):
+        (JSC::JSObject::hasOwnProperty const):
+        * runtime/JSScope.cpp:
+        (JSC::isUnscopable):
+        (JSC::JSScope::resolveScopeForHoistingFuncDeclInEval):
+        * runtime/JSSet.cpp:
+        (JSC::JSSet::isIteratorProtocolFastAndNonObservable):
+        * runtime/JSSetIterator.h:
+        (JSC::JSSetIterator::advanceIter):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getStringPropertyDescriptor):
+        * runtime/JSString.h:
+        (JSC::JSString::getStringPropertySlot):
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/ModuleProgramExecutable.cpp:
+        (JSC::ModuleProgramExecutable::create):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncToLocaleString):
+        * runtime/ProgramExecutable.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::getOwnPropertySlot):
+        (JSC::RegExpObject::deleteProperty):
+        (JSC::RegExpObject::getOwnNonIndexPropertyNames):
+        (JSC::RegExpObject::getPropertyNames):
+        (JSC::RegExpObject::getGenericPropertyNames):
+        (JSC::RegExpObject::put):
+        * runtime/ScopedArguments.h:
+        (JSC::ScopedArguments::length const):
+        * runtime/StrictEvalActivation.h:
+        (JSC::StrictEvalActivation::create):
+        * runtime/StringObject.cpp:
+        (JSC::isStringOwnProperty):
+        (JSC::StringObject::deleteProperty):
+        (JSC::StringObject::getOwnNonIndexPropertyNames):
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::gc):
+        (JSC::JSDollarVMPrototype::edenGC):
+        * wasm/js/WebAssemblyModuleRecord.cpp:
+        (JSC::WebAssemblyModuleRecord::evaluate):
+
 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         [DFG] NewArrayWithSize(size)'s size does not care negative zero
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index c18765d..3702ab3 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -359,7 +359,7 @@
 CodeBlock::CodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
     JSScope* scope, RefPtr<SourceProvider>&& sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
     : JSCell(*vm, structure)
-    , m_globalObject(scope->globalObject()->vm(), this, scope->globalObject())
+    , m_globalObject(*vm, this, scope->globalObject())
     , m_numCalleeLocals(unlinkedCodeBlock->m_numCalleeLocals)
     , m_numVars(unlinkedCodeBlock->m_numVars)
     , m_shouldAlwaysBeInlined(true)
@@ -372,12 +372,12 @@
     , m_isConstructor(unlinkedCodeBlock->isConstructor())
     , m_isStrictMode(unlinkedCodeBlock->isStrictMode())
     , m_codeType(unlinkedCodeBlock->codeType())
-    , m_unlinkedCode(m_globalObject->vm(), this, unlinkedCodeBlock)
+    , m_unlinkedCode(*vm, this, unlinkedCodeBlock)
     , m_hasDebuggerStatement(false)
     , m_steppingMode(SteppingModeDisabled)
     , m_numBreakpoints(0)
-    , m_ownerExecutable(m_globalObject->vm(), this, ownerExecutable)
-    , m_vm(unlinkedCodeBlock->vm())
+    , m_ownerExecutable(*vm, this, ownerExecutable)
+    , m_vm(vm)
     , m_thisRegister(unlinkedCodeBlock->thisRegister())
     , m_scopeRegister(unlinkedCodeBlock->scopeRegister())
     , m_source(WTFMove(sourceProvider))
@@ -1993,7 +1993,7 @@
 
     // This accomplishes (2).
     ownerScriptExecutable()->installCode(
-        m_globalObject->vm(), alternative(), codeType(), specializationKind());
+        *m_vm, alternative(), codeType(), specializationKind());
 
 #if ENABLE(DFG_JIT)
     if (DFG::shouldDumpDisassembly())
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 83b4f1d..65a9613 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -538,7 +538,7 @@
     {
         unsigned result = m_constantRegisters.size();
         m_constantRegisters.append(WriteBarrier<Unknown>());
-        m_constantRegisters.last().set(m_globalObject->vm(), this, v);
+        m_constantRegisters.last().set(*m_vm, this, v);
         m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
         return result;
     }
@@ -952,7 +952,7 @@
     void replaceConstant(int index, JSValue value)
     {
         ASSERT(isConstantRegisterIndex(index) && static_cast<size_t>(index - FirstConstantRegisterIndex) < m_constantRegisters.size());
-        m_constantRegisters[index - FirstConstantRegisterIndex].set(m_globalObject->vm(), this, value);
+        m_constantRegisters[index - FirstConstantRegisterIndex].set(*m_vm, this, value);
     }
 
     bool shouldVisitStrongly(const ConcurrentJSLocker&);
diff --git a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
index fdadf70..85be528 100644
--- a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
@@ -100,7 +100,7 @@
     if (!(instruction[8].u.putByIdFlags & PutByIdIsDirect)) {
         conditionSet =
             generateConditionsForPropertySetterMissConcurrently(
-                *profiledBlock->vm(), profiledBlock->globalObject(), structure, uid);
+                vm, profiledBlock->globalObject(), structure, uid);
         if (!conditionSet.isValid())
             return PutByIdStatus(NoInformation);
     }
@@ -303,6 +303,7 @@
     if (set.isEmpty())
         return PutByIdStatus();
     
+    VM& vm = globalObject->vm();
     PutByIdStatus result;
     result.m_state = Simple;
     for (unsigned i = 0; i < set.size(); ++i) {
@@ -355,7 +356,7 @@
         ObjectPropertyConditionSet conditionSet;
         if (!isDirect) {
             conditionSet = generateConditionsForPropertySetterMissConcurrently(
-                globalObject->vm(), globalObject, structure, uid);
+                vm, globalObject, structure, uid);
             if (!conditionSet.isValid())
                 return PutByIdStatus(TakesSlowPath);
         }
diff --git a/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp b/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp
index 3cdc9bc..84ba2df 100644
--- a/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp
@@ -37,14 +37,15 @@
 void ArrayBufferViewWatchpointAdaptor::add(
     CodeBlock* codeBlock, JSArrayBufferView* view, CommonData& common)
 {
+    VM& vm = *codeBlock->vm();
     Watchpoint* watchpoint = common.watchpoints.add(codeBlock);
     ArrayBufferNeuteringWatchpoint* neuteringWatchpoint =
-        ArrayBufferNeuteringWatchpoint::create(*codeBlock->vm());
+        ArrayBufferNeuteringWatchpoint::create(vm);
     neuteringWatchpoint->set()->add(watchpoint);
     codeBlock->addConstant(neuteringWatchpoint);
     // FIXME: We don't need to set this watchpoint at all for shared buffers.
     // https://bugs.webkit.org/show_bug.cgi?id=164108
-    codeBlock->vm()->heap.addReference(neuteringWatchpoint, view->possiblySharedBuffer());
+    vm.heap.addReference(neuteringWatchpoint, view->possiblySharedBuffer());
 }
 
 void InferredValueAdaptor::add(
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index c6ec2e9..b1be68b 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -421,7 +421,7 @@
     JSObject* globalThisObjectFor(CodeOrigin codeOrigin)
     {
         JSGlobalObject* object = globalObjectFor(codeOrigin);
-        return jsCast<JSObject*>(object->methodTable()->toThis(object, object->globalExec(), NotStrictMode));
+        return jsCast<JSObject*>(object->methodTable(m_vm)->toThis(object, object->globalExec(), NotStrictMode));
     }
     
     ScriptExecutable* executableFor(InlineCallFrame* inlineCallFrame)
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 768fe87..4e6919e 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -246,7 +246,7 @@
         return constructEmptyObject(exec, rareData->objectAllocationProfile()->structure());
     }
 
-    JSValue proto = constructor->get(exec, exec->propertyNames().prototype);
+    JSValue proto = constructor->get(exec, vm.propertyNames->prototype);
     RETURN_IF_EXCEPTION(scope, nullptr);
     if (proto.isObject())
         return constructEmptyObject(exec, asObject(proto));
@@ -714,7 +714,7 @@
     }
     
     PutPropertySlot slot(array, true);
-    array->methodTable()->put(
+    array->methodTable(vm)->put(
         array, exec, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
 }
 
@@ -729,7 +729,7 @@
     }
     
     PutPropertySlot slot(array, false);
-    array->methodTable()->put(
+    array->methodTable(*vm)->put(
         array, exec, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
 }
 
@@ -746,7 +746,7 @@
     }
     
     PutPropertySlot slot(array, true);
-    array->methodTable()->put(
+    array->methodTable(*vm)->put(
         array, exec, Identifier::from(exec, index), jsValue, slot);
 }
 
@@ -763,7 +763,7 @@
     }
     
     PutPropertySlot slot(array, false);
-    array->methodTable()->put(
+    array->methodTable(*vm)->put(
         array, exec, Identifier::from(exec, index), jsValue, slot);
 }
 
@@ -833,21 +833,21 @@
 
 void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, EncodedJSValue encodedValue)
 {
-    VM* vm = &exec->vm();
-    NativeCallFrameTracer tracer(vm, exec);
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
     if (index >= 0) {
         array->putDirectIndex(exec, index, JSValue::decode(encodedValue), 0, PutDirectIndexShouldThrow);
         return;
     }
     
     PutPropertySlot slot(array, true);
-    array->putDirect(exec->vm(), Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
+    array->putDirect(vm, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
 }
 
 void JIT_OPERATION operationPutByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, EncodedJSValue encodedValue)
 {
-    VM* vm = &exec->vm();
-    NativeCallFrameTracer tracer(vm, exec);
+    VM& vm = exec->vm();
+    NativeCallFrameTracer tracer(&vm, exec);
     
     if (index >= 0) {
         array->putDirectIndex(exec, index, JSValue::decode(encodedValue));
@@ -855,7 +855,7 @@
     }
     
     PutPropertySlot slot(array, false);
-    array->putDirect(exec->vm(), Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
+    array->putDirect(vm, Identifier::from(exec, index), JSValue::decode(encodedValue), slot);
 }
 
 EncodedJSValue JIT_OPERATION operationArrayPush(ExecState* exec, EncodedJSValue encodedValue, JSArray* array)
@@ -2345,7 +2345,7 @@
         strictMode = exec->codeBlock()->isStrictMode();
     PutPropertySlot slot(scope, strictMode, PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
     throwScope.release();
-    scope->methodTable()->put(scope, exec, ident, JSValue::decode(value), slot);
+    scope->methodTable(vm)->put(scope, exec, ident, JSValue::decode(value), slot);
 }
 
 int32_t JIT_OPERATION operationMapHash(ExecState* exec, EncodedJSValue input)
diff --git a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
index 9b72774..8e081d7 100644
--- a/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
@@ -507,19 +507,18 @@
     if (shouldDumpDisassembly() || Options::verboseOSR() || Options::verboseFTLOSRExit())
         dataLog("Compiling OSR exit with exitID = ", exitID, "\n");
 
-    if (exec->vm().callFrameForCatch)
-        RELEASE_ASSERT(exec->vm().callFrameForCatch == exec);
+    VM& vm = exec->vm();
+    if (vm.callFrameForCatch)
+        RELEASE_ASSERT(vm.callFrameForCatch == exec);
     
     CodeBlock* codeBlock = exec->codeBlock();
     
     ASSERT(codeBlock);
     ASSERT(codeBlock->jitType() == JITCode::FTLJIT);
     
-    VM* vm = &exec->vm();
-    
     // It's sort of preferable that we don't GC while in here. Anyways, doing so wouldn't
     // really be profitable.
-    DeferGCForAWhile deferGC(vm->heap);
+    DeferGCForAWhile deferGC(vm.heap);
 
     JITCode* jitCode = codeBlock->jitCode()->ftl();
     OSRExit& exit = jitCode->osrExit[exitID];
@@ -543,7 +542,7 @@
 
     prepareCodeOriginForOSRExit(exec, exit.m_codeOrigin);
     
-    compileStub(exitID, jitCode, exit, vm, codeBlock);
+    compileStub(exitID, jitCode, exit, &vm, codeBlock);
 
     MacroAssembler::repatchJump(
         exit.codeLocationForRepatch(codeBlock), CodeLocationLabel(exit.m_code.code()));
diff --git a/Source/JavaScriptCore/ftl/FTLOperations.cpp b/Source/JavaScriptCore/ftl/FTLOperations.cpp
index 1a1b371..417178d 100644
--- a/Source/JavaScriptCore/ftl/FTLOperations.cpp
+++ b/Source/JavaScriptCore/ftl/FTLOperations.cpp
@@ -103,7 +103,7 @@
             if (property.location().kind() != ClosureVarPLoc)
                 continue;
 
-            activation->variableAt(ScopeOffset(property.location().info())).set(exec->vm(), activation, JSValue::decode(values[i]));
+            activation->variableAt(ScopeOffset(property.location().info())).set(vm, activation, JSValue::decode(values[i]));
         }
 
         break;
@@ -225,7 +225,7 @@
                 continue;
 
             result->variableAt(ScopeOffset(property.location().info())).set(
-                exec->vm(), result, jsNumber(29834));
+                vm, result, jsNumber(29834));
         }
 
         if (validationEnabled()) {
diff --git a/Source/JavaScriptCore/heap/GCAssertions.h b/Source/JavaScriptCore/heap/GCAssertions.h
index 145a30e..b275233 100644
--- a/Source/JavaScriptCore/heap/GCAssertions.h
+++ b/Source/JavaScriptCore/heap/GCAssertions.h
@@ -47,7 +47,7 @@
 
 #define ASSERT_THIS_GC_OBJECT_INHERITS(classInfo) do {\
     ASSERT_THIS_GC_OBJECT_LOOKS_VALID(); \
-    RELEASE_ASSERT(this->inherits(*this->vm(), classInfo)); \
+    RELEASE_ASSERT(this->inherits(vm, classInfo)); \
 } while (0)
 
 #else
diff --git a/Source/JavaScriptCore/inspector/InjectedScriptHost.cpp b/Source/JavaScriptCore/inspector/InjectedScriptHost.cpp
index 433174f..299f30e 100644
--- a/Source/JavaScriptCore/inspector/InjectedScriptHost.cpp
+++ b/Source/JavaScriptCore/inspector/InjectedScriptHost.cpp
@@ -43,9 +43,10 @@
     if (value)
         return value;
 
-    JSObject* prototype = JSInjectedScriptHost::createPrototype(exec->vm(), globalObject);
-    Structure* structure = JSInjectedScriptHost::createStructure(exec->vm(), globalObject, prototype);
-    JSInjectedScriptHost* injectedScriptHost = JSInjectedScriptHost::create(exec->vm(), structure, makeRef(*this));
+    VM& vm = exec->vm();
+    JSObject* prototype = JSInjectedScriptHost::createPrototype(vm, globalObject);
+    Structure* structure = JSInjectedScriptHost::createStructure(vm, globalObject, prototype);
+    JSInjectedScriptHost* injectedScriptHost = JSInjectedScriptHost::create(vm, structure, makeRef(*this));
     m_wrappers.addWrapper(globalObject, injectedScriptHost);
 
     return injectedScriptHost;
diff --git a/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp b/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
index a230dd1..11b384f 100644
--- a/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
+++ b/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
@@ -143,13 +143,13 @@
 
     JSValue value = exec->uncheckedArgument(0);
     if (value.isString())
-        return exec->vm().smallStrings.stringString();
+        return vm.smallStrings.stringString();
     if (value.isBoolean())
-        return exec->vm().smallStrings.booleanString();
+        return vm.smallStrings.booleanString();
     if (value.isNumber())
-        return exec->vm().smallStrings.numberString();
+        return vm.smallStrings.numberString();
     if (value.isSymbol())
-        return exec->vm().smallStrings.symbolString();
+        return vm.smallStrings.symbolString();
 
     JSObject* object = asObject(value);
     if (object) {
@@ -187,9 +187,9 @@
         return jsNontrivialString(exec, ASCIILiteral("iterator"));
 
     if (object) {
-        if (object->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().arrayIteratorNextIndexPrivateName())
-            || object->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().mapBucketPrivateName())
-            || object->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().setBucketPrivateName()))
+        if (object->getDirect(vm, vm.propertyNames->builtinNames().arrayIteratorNextIndexPrivateName())
+            || object->getDirect(vm, vm.propertyNames->builtinNames().mapBucketPrivateName())
+            || object->getDirect(vm, vm.propertyNames->builtinNames().setBucketPrivateName()))
             return jsNontrivialString(exec, ASCIILiteral("iterator"));
     }
 
@@ -256,9 +256,10 @@
 
 static JSObject* constructInternalProperty(ExecState* exec, const String& name, JSValue value)
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
-    result->putDirect(exec->vm(), Identifier::fromString(exec, "name"), jsString(exec, name));
-    result->putDirect(exec->vm(), Identifier::fromString(exec, "value"), value);
+    result->putDirect(vm, Identifier::fromString(exec, "name"), jsString(exec, name));
+    result->putDirect(vm, Identifier::fromString(exec, "value"), value);
     return result;
 }
 
@@ -275,7 +276,7 @@
         unsigned index = 0;
         JSArray* array = constructEmptyArray(exec, nullptr);
         RETURN_IF_EXCEPTION(scope, JSValue());
-        switch (promise->status(exec->vm())) {
+        switch (promise->status(vm)) {
         case JSPromise::Status::Pending:
             scope.release();
             array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("status"), jsNontrivialString(exec, ASCIILiteral("pending"))));
@@ -284,13 +285,13 @@
             array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("status"), jsNontrivialString(exec, ASCIILiteral("resolved"))));
             RETURN_IF_EXCEPTION(scope, JSValue());
             scope.release();
-            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("result"), promise->result(exec->vm())));
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("result"), promise->result(vm)));
             return array;
         case JSPromise::Status::Rejected:
             array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("status"), jsNontrivialString(exec, ASCIILiteral("rejected"))));
             RETURN_IF_EXCEPTION(scope, JSValue());
             scope.release();
-            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("result"), promise->result(exec->vm())));
+            array->putDirectIndex(exec, index++, constructInternalProperty(exec, ASCIILiteral("result"), promise->result(vm)));
             return array;
         }
         // FIXME: <https://webkit.org/b/141664> Web Inspector: ES6: Improved Support for Promises - Promise Reactions
@@ -325,9 +326,9 @@
     }
 
     if (JSObject* iteratorObject = jsDynamicCast<JSObject*>(vm, value)) {
-        if (iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().arrayIteratorNextIndexPrivateName())) {
-            JSValue iteratedValue = iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().iteratedObjectPrivateName());
-            JSValue kind = iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().arrayIteratorKindPrivateName());
+        if (iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().arrayIteratorNextIndexPrivateName())) {
+            JSValue iteratedValue = iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().iteratedObjectPrivateName());
+            JSValue kind = iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().arrayIteratorKindPrivateName());
 
             unsigned index = 0;
             JSArray* array = constructEmptyArray(exec, nullptr, 2);
@@ -339,10 +340,10 @@
             return array;
         }
 
-        if (iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().mapBucketPrivateName())) {
-            JSValue iteratedValue = iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().iteratedObjectPrivateName());
+        if (iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().mapBucketPrivateName())) {
+            JSValue iteratedValue = iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().iteratedObjectPrivateName());
             String kind;
-            switch (static_cast<IterationKind>(iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().mapIteratorKindPrivateName()).asInt32())) {
+            switch (static_cast<IterationKind>(iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().mapIteratorKindPrivateName()).asInt32())) {
             case IterateKey:
                 kind = ASCIILiteral("key");
                 break;
@@ -363,10 +364,10 @@
             return array;
         }
 
-        if (iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().setBucketPrivateName())) {
-            JSValue iteratedValue = iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().iteratedObjectPrivateName());
+        if (iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().setBucketPrivateName())) {
+            JSValue iteratedValue = iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().iteratedObjectPrivateName());
             String kind;
-            switch (static_cast<IterationKind>(iteratorObject->getDirect(exec->vm(), exec->vm().propertyNames->builtinNames().setIteratorKindPrivateName()).asInt32())) {
+            switch (static_cast<IterationKind>(iteratorObject->getDirect(vm, vm.propertyNames->builtinNames().setIteratorKindPrivateName()).asInt32())) {
             case IterateKey:
                 kind = ASCIILiteral("key");
                 break;
@@ -456,8 +457,8 @@
     RETURN_IF_EXCEPTION(scope, JSValue());
     for (auto it = weakMap->begin(); it != weakMap->end(); ++it) {
         JSObject* entry = constructEmptyObject(exec);
-        entry->putDirect(exec->vm(), Identifier::fromString(exec, "key"), it->key);
-        entry->putDirect(exec->vm(), Identifier::fromString(exec, "value"), it->value.get());
+        entry->putDirect(vm, Identifier::fromString(exec, "key"), it->key);
+        entry->putDirect(vm, Identifier::fromString(exec, "value"), it->value.get());
         array->putDirectIndex(exec, fetched++, entry);
         RETURN_IF_EXCEPTION(scope, JSValue());
         if (numberToFetch && fetched >= numberToFetch)
@@ -505,7 +506,7 @@
     RETURN_IF_EXCEPTION(scope, JSValue());
     for (auto it = weakSet->begin(); it != weakSet->end(); ++it) {
         JSObject* entry = constructEmptyObject(exec);
-        entry->putDirect(exec->vm(), Identifier::fromString(exec, "value"), it->key);
+        entry->putDirect(vm, Identifier::fromString(exec, "value"), it->key);
         array->putDirectIndex(exec, fetched++, entry);
         RETURN_IF_EXCEPTION(scope, JSValue());
         if (numberToFetch && fetched >= numberToFetch)
@@ -604,7 +605,7 @@
         RETURN_IF_EXCEPTION(scope, { });
 
         JSObject* entry = constructEmptyObject(exec);
-        entry->putDirect(exec->vm(), Identifier::fromString(exec, "value"), nextValue);
+        entry->putDirect(vm, Identifier::fromString(exec, "value"), nextValue);
         array->putDirectIndex(exec, i, entry);
         if (UNLIKELY(scope.exception())) {
             scope.release();
diff --git a/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp b/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp
index b312087..c0d30d9 100644
--- a/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp
+++ b/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp
@@ -119,10 +119,11 @@
         return jsNull();
 
     // Debugger.Location protocol object.
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
-    result->putDirect(exec->vm(), Identifier::fromString(exec, "scriptId"), jsString(exec, String::number(location.sourceID)));
-    result->putDirect(exec->vm(), Identifier::fromString(exec, "lineNumber"), jsNumber(location.line));
-    result->putDirect(exec->vm(), Identifier::fromString(exec, "columnNumber"), jsNumber(location.column));
+    result->putDirect(vm, Identifier::fromString(exec, "scriptId"), jsString(exec, String::number(location.sourceID)));
+    result->putDirect(vm, Identifier::fromString(exec, "lineNumber"), jsNumber(location.line));
+    result->putDirect(vm, Identifier::fromString(exec, "columnNumber"), jsNumber(location.column));
     return result;
 }
 
@@ -142,9 +143,9 @@
     for (DebuggerScope::iterator iter = scopeChain->begin(); iter != end; ++iter) {
         DebuggerScope* scope = iter.get();
         JSObject* description = constructEmptyObject(exec);
-        description->putDirect(exec->vm(), Identifier::fromString(exec, "type"), valueForScopeType(scope));
-        description->putDirect(exec->vm(), Identifier::fromString(exec, "name"), jsString(exec, scope->name()));
-        description->putDirect(exec->vm(), Identifier::fromString(exec, "location"), valueForScopeLocation(exec, scope->location()));
+        description->putDirect(vm, Identifier::fromString(exec, "type"), valueForScopeType(scope));
+        description->putDirect(vm, Identifier::fromString(exec, "name"), jsString(exec, scope->name()));
+        description->putDirect(vm, Identifier::fromString(exec, "location"), valueForScopeLocation(exec, scope->location()));
         array->putDirectIndex(exec, index++, description);
         RETURN_IF_EXCEPTION(throwScope, JSValue());
     }
@@ -226,9 +227,10 @@
     if (!impl)
         return jsNull();
 
-    JSObject* prototype = JSJavaScriptCallFrame::createPrototype(exec->vm(), globalObject);
-    Structure* structure = JSJavaScriptCallFrame::createStructure(exec->vm(), globalObject, prototype);
-    JSJavaScriptCallFrame* javaScriptCallFrame = JSJavaScriptCallFrame::create(exec->vm(), structure, *impl);
+    VM& vm = exec->vm();
+    JSObject* prototype = JSJavaScriptCallFrame::createPrototype(vm, globalObject);
+    Structure* structure = JSJavaScriptCallFrame::createStructure(vm, globalObject, prototype);
+    JSJavaScriptCallFrame* javaScriptCallFrame = JSJavaScriptCallFrame::create(vm, structure, *impl);
 
     return javaScriptCallFrame;
 }
diff --git a/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp b/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
index 7c1ea90..2a21a3b 100644
--- a/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
+++ b/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp
@@ -124,11 +124,11 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     // FIXME: <http://webkit.org/b/115087> Web Inspector: Should not need to evaluate JavaScript handling exceptions
-    JSValue lineValue = exceptionObject->getDirect(exec->vm(), Identifier::fromString(exec, "line"));
+    JSValue lineValue = exceptionObject->getDirect(vm, Identifier::fromString(exec, "line"));
     *lineNumber = lineValue && lineValue.isNumber() ? int(lineValue.toNumber(exec)) : 0;
-    JSValue columnValue = exceptionObject->getDirect(exec->vm(), Identifier::fromString(exec, "column"));
+    JSValue columnValue = exceptionObject->getDirect(vm, Identifier::fromString(exec, "column"));
     *columnNumber = columnValue && columnValue.isNumber() ? int(columnValue.toNumber(exec)) : 0;
-    JSValue sourceURLValue = exceptionObject->getDirect(exec->vm(), Identifier::fromString(exec, "sourceURL"));
+    JSValue sourceURLValue = exceptionObject->getDirect(vm, Identifier::fromString(exec, "sourceURL"));
     *sourceURL = sourceURLValue && sourceURLValue.isString() ? sourceURLValue.toWTFString(exec) : ASCIILiteral("undefined");
     scope.clearException();
 }
@@ -170,10 +170,11 @@
 
 Ref<ScriptArguments> createScriptArguments(JSC::ExecState* exec, unsigned skipArgumentCount)
 {
+    VM& vm = exec->vm();
     Vector<Deprecated::ScriptValue> arguments;
     size_t argumentCount = exec->argumentCount();
     for (size_t i = skipArgumentCount; i < argumentCount; ++i)
-        arguments.append(Deprecated::ScriptValue(exec->vm(), exec->uncheckedArgument(i)));
+        arguments.append(Deprecated::ScriptValue(vm, exec->uncheckedArgument(i)));
     return ScriptArguments::create(exec, arguments);
 }
 
diff --git a/Source/JavaScriptCore/interpreter/CachedCall.h b/Source/JavaScriptCore/interpreter/CachedCall.h
index 5adc95d..5ba85d9 100644
--- a/Source/JavaScriptCore/interpreter/CachedCall.h
+++ b/Source/JavaScriptCore/interpreter/CachedCall.h
@@ -41,8 +41,8 @@
     public:
         CachedCall(CallFrame* callFrame, JSFunction* function, int argumentCount)
             : m_valid(false)
-            , m_interpreter(callFrame->interpreter())
             , m_vm(callFrame->vm())
+            , m_interpreter(m_vm.interpreter)
             , m_entryScope(m_vm, function->scope()->globalObject(m_vm))
         {
             VM& vm = m_entryScope.vm();
@@ -70,8 +70,8 @@
 
     private:
         bool m_valid;
-        Interpreter* m_interpreter;
         VM& m_vm;
+        Interpreter* m_interpreter;
         VMEntryScope m_entryScope;
         ProtoCallFrame m_protoCallFrame;
         MarkedArgumentBuffer m_arguments;
diff --git a/Source/JavaScriptCore/interpreter/CallFrame.h b/Source/JavaScriptCore/interpreter/CallFrame.h
index 130c987..62309a0 100644
--- a/Source/JavaScriptCore/interpreter/CallFrame.h
+++ b/Source/JavaScriptCore/interpreter/CallFrame.h
@@ -135,18 +135,6 @@
 
         VM& vm() const;
 
-        // Convenience functions for access to global data.
-        // It takes a few memory references to get from a call frame to the global data
-        // pointer, so these are inefficient, and should be used sparingly in new code.
-        // But they're used in many places in legacy code, so they're not going away any time soon.
-
-        AtomicStringTable* atomicStringTable() const { return vm().atomicStringTable(); }
-        const CommonIdentifiers& propertyNames() const { return *vm().propertyNames; }
-        const ArgList& emptyList() const { return *vm().emptyList; }
-        Interpreter* interpreter() { return vm().interpreter; }
-        Heap* heap() { return &vm().heap; }
-
-
         static CallFrame* create(Register* callFrameBase) { return static_cast<CallFrame*>(callFrameBase); }
         Register* registers() { return this; }
         const Register* registers() const { return this; }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index e0eac38..348a876 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -804,7 +804,7 @@
             if (JSONPPath.size() == 1 && JSONPPath[0].m_type == JSONPPathEntryTypeDeclare) {
                 globalObject->addVar(callFrame, JSONPPath[0].m_pathEntryName);
                 PutPropertySlot slot(globalObject);
-                globalObject->methodTable()->put(globalObject, callFrame, JSONPPath[0].m_pathEntryName, JSONPValue, slot);
+                globalObject->methodTable(vm)->put(globalObject, callFrame, JSONPPath[0].m_pathEntryName, JSONPValue, slot);
                 result = jsUndefined();
                 continue;
             }
@@ -1103,7 +1103,7 @@
     VM& vm = *scope->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    ASSERT(scope->vm() == &callFrame->vm());
+    ASSERT(&vm == &callFrame->vm());
     throwScope.assertNoException();
     ASSERT(!vm.isCollectorBusyOnCurrentThread());
     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
@@ -1185,7 +1185,7 @@
                 PutPropertySlot slot(variableObject);
                 if (!variableObject->isExtensible(callFrame))
                     return checkedReturn(throwTypeError(callFrame, throwScope, ASCIILiteral(NonExtensibleObjectPropertyDefineError)));
-                variableObject->methodTable()->put(variableObject, callFrame, ident, jsUndefined(), slot);
+                variableObject->methodTable(vm)->put(variableObject, callFrame, ident, jsUndefined(), slot);
                 RETURN_IF_EXCEPTION(throwScope, checkedReturn(throwScope.exception()));
             }
         }
@@ -1195,7 +1195,7 @@
                 FunctionExecutable* function = codeBlock->functionDecl(i);
                 PutPropertySlot slot(variableObject);
                 // We need create this variables because it will be used to emits code by bytecode generator
-                variableObject->methodTable()->put(variableObject, callFrame, function->name(), jsUndefined(), slot);
+                variableObject->methodTable(vm)->put(variableObject, callFrame, function->name(), jsUndefined(), slot);
             }
         } else {
             for (unsigned i = 0; i < numTopLevelFunctionDecls; ++i) {
@@ -1205,7 +1205,7 @@
                     return checkedReturn(throwSyntaxError(callFrame, throwScope, makeString("Can't create duplicate variable in eval: '", String(function->name().impl()), "'")));
                 PutPropertySlot slot(variableObject);
                 // We need create this variables because it will be used to emits code by bytecode generator
-                variableObject->methodTable()->put(variableObject, callFrame, function->name(), jsUndefined(), slot);
+                variableObject->methodTable(vm)->put(variableObject, callFrame, function->name(), jsUndefined(), slot);
                 RETURN_IF_EXCEPTION(throwScope, checkedReturn(throwScope.exception()));
             }
 
@@ -1215,7 +1215,7 @@
                 if (!resolvedScope.isUndefined()) {
                     if (!variableObject->hasProperty(callFrame, ident)) {
                         PutPropertySlot slot(variableObject);
-                        variableObject->methodTable()->put(variableObject, callFrame, ident, jsUndefined(), slot);
+                        variableObject->methodTable(vm)->put(variableObject, callFrame, ident, jsUndefined(), slot);
                         RETURN_IF_EXCEPTION(throwScope, checkedReturn(throwScope.exception()));
                     }
                 }
@@ -1246,7 +1246,7 @@
     VM& vm = *scope->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    ASSERT(scope->vm() == &callFrame->vm());
+    ASSERT(&vm == &callFrame->vm());
     throwScope.assertNoException();
     ASSERT(!vm.isCollectorBusyOnCurrentThread());
     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index e4fc35e..5ecf3a6 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -187,8 +187,9 @@
 
     m_callLinkInfoIndex = 0;
 
+    VM& vm = *m_codeBlock->vm();
     unsigned startBytecodeOffset = 0;
-    if (m_loopOSREntryBytecodeOffset && (m_codeBlock->inherits(*m_codeBlock->vm(), ProgramCodeBlock::info()) || m_codeBlock->inherits(*m_codeBlock->vm(), ModuleProgramCodeBlock::info()))) {
+    if (m_loopOSREntryBytecodeOffset && (m_codeBlock->inherits(vm, ProgramCodeBlock::info()) || m_codeBlock->inherits(vm, ModuleProgramCodeBlock::info()))) {
         // We can only do this optimization because we execute ProgramCodeBlock's exactly once.
         // This optimization would be invalid otherwise. When the LLInt determines it wants to
         // do OSR entry into the baseline JIT in a loop, it will pass in the bytecode offset it
diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
index 11f2dd1..a043a5d 100644
--- a/Source/JavaScriptCore/jit/JITOperations.cpp
+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -412,7 +412,7 @@
     Identifier ident = Identifier::fromUid(vm, uid);
     LOG_IC((ICEvent::OperationPutByIdDirectStrict, baseValue.classInfoOrNull(*vm), ident));
     PutPropertySlot slot(baseValue, true, exec->codeBlock()->putByIdContext());
-    asObject(baseValue)->putDirect(exec->vm(), ident, JSValue::decode(encodedValue), slot);
+    asObject(baseValue)->putDirect(*vm, ident, JSValue::decode(encodedValue), slot);
 }
 
 void JIT_OPERATION operationPutByIdDirectNonStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
@@ -428,7 +428,7 @@
     Identifier ident = Identifier::fromUid(vm, uid);
     LOG_IC((ICEvent::OperationPutByIdDirectNonStrict, baseValue.classInfoOrNull(*vm), ident));
     PutPropertySlot slot(baseValue, false, exec->codeBlock()->putByIdContext());
-    asObject(baseValue)->putDirect(exec->vm(), ident, JSValue::decode(encodedValue), slot);
+    asObject(baseValue)->putDirect(*vm, ident, JSValue::decode(encodedValue), slot);
 }
 
 void JIT_OPERATION operationPutByIdStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
@@ -504,7 +504,7 @@
     PutPropertySlot slot(baseObject, true, codeBlock->putByIdContext());
     
     Structure* structure = baseObject->structure(*vm);
-    baseObject->putDirect(exec->vm(), ident, value, slot);
+    baseObject->putDirect(*vm, ident, value, slot);
     
     if (accessType != static_cast<AccessType>(stubInfo->accessType))
         return;
@@ -530,7 +530,7 @@
     PutPropertySlot slot(baseObject, false, codeBlock->putByIdContext());
     
     Structure* structure = baseObject->structure(*vm);
-    baseObject->putDirect(exec->vm(), ident, value, slot);
+    baseObject->putDirect(*vm, ident, value, slot);
     
     if (accessType != static_cast<AccessType>(stubInfo->accessType))
         return;
@@ -554,7 +554,7 @@
         if (baseValue.isObject()) {
             JSObject* object = asObject(baseValue);
             if (object->canSetIndexQuickly(i))
-                object->setIndexQuickly(callFrame->vm(), i, value);
+                object->setIndexQuickly(vm, i, value);
             else {
                 // FIXME: This will make us think that in-bounds typed array accesses are actually
                 // out-of-bounds.
@@ -631,7 +631,7 @@
         byValInfo->tookSlowPath = true;
 
     PutPropertySlot slot(baseObject, isStrictMode);
-    baseObject->putDirect(callFrame->vm(), property, value, slot);
+    baseObject->putDirect(vm, property, value, slot);
 }
 
 enum class OptimizationResult {
@@ -2266,7 +2266,7 @@
     }
 
     PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
-    scope->methodTable()->put(scope, exec, ident, value, slot);
+    scope->methodTable(vm)->put(scope, exec, ident, value, slot);
     
     RETURN_IF_EXCEPTION(throwScope, void());
 
diff --git a/Source/JavaScriptCore/jit/JITWorklist.cpp b/Source/JavaScriptCore/jit/JITWorklist.cpp
index f645965..f534910 100644
--- a/Source/JavaScriptCore/jit/JITWorklist.cpp
+++ b/Source/JavaScriptCore/jit/JITWorklist.cpp
@@ -273,7 +273,8 @@
 
 void JITWorklist::compileNow(CodeBlock* codeBlock, unsigned loopOSREntryBytecodeOffset)
 {
-    DeferGC deferGC(codeBlock->vm()->heap);
+    VM* vm = codeBlock->vm();
+    DeferGC deferGC(vm->heap);
     if (codeBlock->jitType() != JITCode::InterpreterThunk)
         return;
     
@@ -286,7 +287,7 @@
     if (isPlanned) {
         RELEASE_ASSERT(Options::useConcurrentJIT());
         // This is expensive, but probably good enough.
-        completeAllForVM(*codeBlock->vm());
+        completeAllForVM(*vm);
     }
     
     // Now it might be compiled!
@@ -298,7 +299,7 @@
     codeBlock->resetJITData();
     
     // OK, just compile it.
-    JIT::compile(codeBlock->vm(), codeBlock, JITCompilationMustSucceed, loopOSREntryBytecodeOffset);
+    JIT::compile(vm, codeBlock, JITCompilationMustSucceed, loopOSREntryBytecodeOffset);
     codeBlock->ownerScriptExecutable()->installCode(codeBlock);
 }
 
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index 56fda57..fb76552 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -429,7 +429,7 @@
         VM& vm = exec->vm();
         JSGlobalObject* globalObject = exec->lexicalGlobalObject();
         Structure* structure = createStructure(vm, globalObject, createPrototype(vm, globalObject));
-        RuntimeArray* runtimeArray = new (NotNull, allocateCell<RuntimeArray>(*exec->heap())) RuntimeArray(exec, structure);
+        RuntimeArray* runtimeArray = new (NotNull, allocateCell<RuntimeArray>(vm.heap)) RuntimeArray(exec, structure);
         runtimeArray->finishCreation(exec);
         vm.heap.addFinalizer(runtimeArray, destroy);
         return runtimeArray;
@@ -446,8 +446,9 @@
 
     static bool getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
     {
+        VM& vm = exec->vm();
         RuntimeArray* thisObject = jsCast<RuntimeArray*>(object);
-        if (propertyName == exec->propertyNames().length) {
+        if (propertyName == vm.propertyNames->length) {
             slot.setCacheableCustom(thisObject, DontDelete | ReadOnly | DontEnum, thisObject->lengthGetter);
             return true;
         }
@@ -665,7 +666,8 @@
 #if ENABLE(JIT)
         static EncodedJSValue JIT_OPERATION slowCall(ExecState* exec, void* pointer)
         {
-            NativeCallFrameTracer tracer(&exec->vm(), exec);
+            VM& vm = exec->vm();
+            NativeCallFrameTracer tracer(&vm, exec);
             return JSValue::encode(jsNumber(static_cast<DOMJITGetter*>(pointer)->value()));
         }
 
@@ -855,7 +857,8 @@
 
     static EncodedJSValue JIT_OPERATION unsafeFunction(ExecState* exec, DOMJITNode* node)
     {
-        NativeCallFrameTracer tracer(&exec->vm(), exec);
+        VM& vm = exec->vm();
+        NativeCallFrameTracer tracer(&vm, exec);
         return JSValue::encode(jsNumber(node->value()));
     }
 
@@ -928,7 +931,8 @@
 
     static EncodedJSValue JIT_OPERATION unsafeFunction(ExecState* exec, DOMJITNode* node)
     {
-        NativeCallFrameTracer tracer(&exec->vm(), exec);
+        VM& vm = exec->vm();
+        NativeCallFrameTracer tracer(&vm, exec);
         return JSValue::encode(jsNumber(node->value()));
     }
 
@@ -1811,7 +1815,7 @@
     if (!fetchModuleFromLocalFileSystem(moduleKey, utf8))
         return deferred->reject(exec, createError(exec, makeString("Could not open file '", moduleKey, "'.")));
 
-    auto result = deferred->resolve(exec, JSSourceCode::create(exec->vm(), makeSource(stringFromUTF(utf8), SourceOrigin { moduleKey }, moduleKey, TextPosition(), SourceProviderSourceType::Module)));
+    auto result = deferred->resolve(exec, JSSourceCode::create(vm, makeSource(stringFromUTF(utf8), SourceOrigin { moduleKey }, moduleKey, TextPosition(), SourceProviderSourceType::Module)));
     scope.releaseAssertNoException();
     return result;
 }
@@ -1853,10 +1857,11 @@
 #ifndef NDEBUG
 EncodedJSValue JSC_HOST_CALL functionDumpCallFrame(ExecState* exec)
 {
-    VMEntryFrame* topVMEntryFrame = exec->vm().topVMEntryFrame;
+    VM& vm = exec->vm();
+    VMEntryFrame* topVMEntryFrame = vm.topVMEntryFrame;
     ExecState* callerFrame = exec->callerFrame(topVMEntryFrame);
     if (callerFrame)
-        exec->vm().interpreter->dumpCallFrame(callerFrame);
+        vm.interpreter->dumpCallFrame(callerFrame);
     return JSValue::encode(jsUndefined());
 }
 #endif
@@ -1933,8 +1938,9 @@
 
 EncodedJSValue JSC_HOST_CALL functionCreateRoot(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    return JSValue::encode(Root::create(exec->vm(), exec->lexicalGlobalObject()));
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    return JSValue::encode(Root::create(vm, exec->lexicalGlobalObject()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateElement(ExecState* exec)
@@ -1951,8 +1957,8 @@
 
 EncodedJSValue JSC_HOST_CALL functionGetElement(ExecState* exec)
 {
-    JSLockHolder lock(exec);
     VM& vm = exec->vm();
+    JSLockHolder lock(vm);
     Root* root = jsDynamicCast<Root*>(vm, exec->argument(0));
     if (!root)
         return JSValue::encode(jsUndefined());
@@ -1962,19 +1968,20 @@
 
 EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState* exec)
 {
-    JSLockHolder lock(exec);
     VM& vm = exec->vm();
+    JSLockHolder lock(vm);
     Element* element = jsDynamicCast<Element*>(vm, exec->argument(0));
     Root* root = jsDynamicCast<Root*>(vm, exec->argument(1));
     if (element && root)
-        element->setRoot(exec->vm(), root);
+        element->setRoot(vm, root);
     return JSValue::encode(jsUndefined());
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateSimpleObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    return JSValue::encode(SimpleObject::create(exec->vm(), exec->lexicalGlobalObject()));
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    return JSValue::encode(SimpleObject::create(vm, exec->lexicalGlobalObject()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionGetHiddenValue(ExecState* exec)
@@ -2003,19 +2010,20 @@
         return encodedJSValue();
     }
     JSValue value = exec->argument(1);
-    simpleObject->setHiddenValue(exec->vm(), value);
+    simpleObject->setHiddenValue(vm, value);
     return JSValue::encode(jsUndefined());
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateProxy(ExecState* exec)
 {
-    JSLockHolder lock(exec);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
     JSValue target = exec->argument(0);
     if (!target.isObject())
         return JSValue::encode(jsUndefined());
     JSObject* jsTarget = asObject(target.asCell());
-    Structure* structure = JSProxy::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsTarget->getPrototypeDirect(), ImpureProxyType);
-    JSProxy* proxy = JSProxy::create(exec->vm(), structure, jsTarget);
+    Structure* structure = JSProxy::createStructure(vm, exec->lexicalGlobalObject(), jsTarget->getPrototypeDirect(), ImpureProxyType);
+    JSProxy* proxy = JSProxy::create(vm, structure, jsTarget);
     return JSValue::encode(proxy);
 }
 
@@ -2028,61 +2036,68 @@
 
 EncodedJSValue JSC_HOST_CALL functionCreateImpureGetter(ExecState* exec)
 {
-    JSLockHolder lock(exec);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
     JSValue target = exec->argument(0);
     JSObject* delegate = nullptr;
     if (target.isObject())
         delegate = asObject(target.asCell());
-    Structure* structure = ImpureGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
-    ImpureGetter* result = ImpureGetter::create(exec->vm(), structure, delegate);
+    Structure* structure = ImpureGetter::createStructure(vm, exec->lexicalGlobalObject(), jsNull());
+    ImpureGetter* result = ImpureGetter::create(vm, structure, delegate);
     return JSValue::encode(result);
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateCustomGetterObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    Structure* structure = CustomGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
-    CustomGetter* result = CustomGetter::create(exec->vm(), structure);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    Structure* structure = CustomGetter::createStructure(vm, exec->lexicalGlobalObject(), jsNull());
+    CustomGetter* result = CustomGetter::create(vm, structure);
     return JSValue::encode(result);
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateDOMJITNodeObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    Structure* structure = DOMJITNode::createStructure(exec->vm(), exec->lexicalGlobalObject(), DOMJITGetter::create(exec->vm(), DOMJITGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull())));
-    DOMJITNode* result = DOMJITNode::create(exec->vm(), structure);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    Structure* structure = DOMJITNode::createStructure(vm, exec->lexicalGlobalObject(), DOMJITGetter::create(vm, DOMJITGetter::createStructure(vm, exec->lexicalGlobalObject(), jsNull())));
+    DOMJITNode* result = DOMJITNode::create(vm, structure);
     return JSValue::encode(result);
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    Structure* structure = DOMJITGetter::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
-    DOMJITGetter* result = DOMJITGetter::create(exec->vm(), structure);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    Structure* structure = DOMJITGetter::createStructure(vm, exec->lexicalGlobalObject(), jsNull());
+    DOMJITGetter* result = DOMJITGetter::create(vm, structure);
     return JSValue::encode(result);
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateDOMJITGetterComplexObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    Structure* structure = DOMJITGetterComplex::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
-    DOMJITGetterComplex* result = DOMJITGetterComplex::create(exec->vm(), exec->lexicalGlobalObject(), structure);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    Structure* structure = DOMJITGetterComplex::createStructure(vm, exec->lexicalGlobalObject(), jsNull());
+    DOMJITGetterComplex* result = DOMJITGetterComplex::create(vm, exec->lexicalGlobalObject(), structure);
     return JSValue::encode(result);
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateDOMJITFunctionObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    Structure* structure = DOMJITFunctionObject::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
-    DOMJITFunctionObject* result = DOMJITFunctionObject::create(exec->vm(), exec->lexicalGlobalObject(), structure);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    Structure* structure = DOMJITFunctionObject::createStructure(vm, exec->lexicalGlobalObject(), jsNull());
+    DOMJITFunctionObject* result = DOMJITFunctionObject::create(vm, exec->lexicalGlobalObject(), structure);
     return JSValue::encode(result);
 }
 
 EncodedJSValue JSC_HOST_CALL functionCreateDOMJITCheckSubClassObject(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    Structure* structure = DOMJITCheckSubClassObject::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsNull());
-    DOMJITCheckSubClassObject* result = DOMJITCheckSubClassObject::create(exec->vm(), exec->lexicalGlobalObject(), structure);
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    Structure* structure = DOMJITCheckSubClassObject::createStructure(vm, exec->lexicalGlobalObject(), jsNull());
+    DOMJITCheckSubClassObject* result = DOMJITCheckSubClassObject::create(vm, exec->lexicalGlobalObject(), structure);
     return JSValue::encode(result);
 }
 
@@ -2109,23 +2124,26 @@
 
 EncodedJSValue JSC_HOST_CALL functionGCAndSweep(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    exec->heap()->collectNow(Sync, CollectionScope::Full);
-    return JSValue::encode(jsNumber(exec->heap()->sizeAfterLastFullCollection()));
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    vm.heap.collectNow(Sync, CollectionScope::Full);
+    return JSValue::encode(jsNumber(vm.heap.sizeAfterLastFullCollection()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionFullGC(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    exec->heap()->collectSync(CollectionScope::Full);
-    return JSValue::encode(jsNumber(exec->heap()->sizeAfterLastFullCollection()));
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    vm.heap.collectSync(CollectionScope::Full);
+    return JSValue::encode(jsNumber(vm.heap.sizeAfterLastFullCollection()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionEdenGC(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    exec->heap()->collectSync(CollectionScope::Eden);
-    return JSValue::encode(jsNumber(exec->heap()->sizeAfterLastEdenCollection()));
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    vm.heap.collectSync(CollectionScope::Eden);
+    return JSValue::encode(jsNumber(vm.heap.sizeAfterLastEdenCollection()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionForceGCSlowPaths(ExecState*)
@@ -2138,8 +2156,9 @@
 
 EncodedJSValue JSC_HOST_CALL functionHeapSize(ExecState* exec)
 {
-    JSLockHolder lock(exec);
-    return JSValue::encode(jsNumber(exec->heap()->size()));
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    return JSValue::encode(jsNumber(vm.heap.size()));
 }
 
 // This function is not generally very helpful in 64-bit code as the tag and payload
@@ -2367,12 +2386,14 @@
 
 EncodedJSValue JSC_HOST_CALL functionShadowChickenFunctionsOnStack(ExecState* exec)
 {
-    return JSValue::encode(exec->vm().shadowChicken().functionsOnStack(exec));
+    VM& vm = exec->vm();
+    return JSValue::encode(vm.shadowChicken().functionsOnStack(exec));
 }
 
 EncodedJSValue JSC_HOST_CALL functionSetGlobalConstRedeclarationShouldNotThrow(ExecState* exec)
 {
-    exec->vm().setGlobalConstRedeclarationShouldThrow(false);
+    VM& vm = exec->vm();
+    vm.setGlobalConstRedeclarationShouldThrow(false);
     return JSValue::encode(jsUndefined());
 }
 
@@ -2807,9 +2828,10 @@
 
 EncodedJSValue JSC_HOST_CALL functionJSCOptions(ExecState* exec)
 {
+    VM& vm = exec->vm();
     JSObject* optionsObject = constructEmptyObject(exec);
 #define FOR_EACH_OPTION(type_, name_, defaultValue_, availability_, description_) \
-    addOption(exec->vm(), optionsObject, Identifier::fromString(exec, #name_), Options::name_());
+    addOption(vm, optionsObject, Identifier::fromString(exec, #name_), Options::name_());
     JSC_OPTIONS(FOR_EACH_OPTION)
 #undef FOR_EACH_OPTION
     return JSValue::encode(optionsObject);
@@ -2847,7 +2869,8 @@
 
 EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState* exec)
 {
-    exec->vm().setFailNextNewCodeBlock();
+    VM& vm = exec->vm();
+    vm.setFailNextNewCodeBlock();
     return JSValue::encode(jsUndefined());
 }
 
@@ -2889,7 +2912,8 @@
 
 EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState* exec)
 {
-    return JSValue::encode(Masquerader::create(exec->vm(), exec->lexicalGlobalObject()));
+    VM& vm = exec->vm();
+    return JSValue::encode(Masquerader::create(vm, exec->lexicalGlobalObject()));
 }
 
 EncodedJSValue JSC_HOST_CALL functionHasCustomProperties(ExecState* exec)
@@ -2902,14 +2926,15 @@
 
 EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState* exec)
 {
-    exec->vm().dumpTypeProfilerData();
+    VM& vm = exec->vm();
+    vm.dumpTypeProfilerData();
     return JSValue::encode(jsUndefined());
 }
 
 EncodedJSValue JSC_HOST_CALL functionFindTypeForExpression(ExecState* exec)
 {
     VM& vm = exec->vm();
-    RELEASE_ASSERT(exec->vm().typeProfiler());
+    RELEASE_ASSERT(vm.typeProfiler());
     vm.typeProfilerLog()->processLogEntries(ASCIILiteral("jsc Testing API: functionFindTypeForExpression"));
 
     JSValue functionValue = exec->argument(0);
@@ -2921,14 +2946,14 @@
     String sourceCodeText = executable->source().view().toString();
     unsigned offset = static_cast<unsigned>(sourceCodeText.find(substring) + executable->source().startOffset());
     
-    String jsonString = exec->vm().typeProfiler()->typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorNormal, offset, executable->sourceID(), exec->vm());
+    String jsonString = vm.typeProfiler()->typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorNormal, offset, executable->sourceID(), vm);
     return JSValue::encode(JSONParse(exec, jsonString));
 }
 
 EncodedJSValue JSC_HOST_CALL functionReturnTypeFor(ExecState* exec)
 {
     VM& vm = exec->vm();
-    RELEASE_ASSERT(exec->vm().typeProfiler());
+    RELEASE_ASSERT(vm.typeProfiler());
     vm.typeProfilerLog()->processLogEntries(ASCIILiteral("jsc Testing API: functionReturnTypeFor"));
 
     JSValue functionValue = exec->argument(0);
@@ -2936,14 +2961,15 @@
     FunctionExecutable* executable = (jsDynamicCast<JSFunction*>(vm, functionValue.asCell()->getObject()))->jsExecutable();
 
     unsigned offset = executable->typeProfilingStartOffset();
-    String jsonString = exec->vm().typeProfiler()->typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorFunctionReturn, offset, executable->sourceID(), exec->vm());
+    String jsonString = vm.typeProfiler()->typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorFunctionReturn, offset, executable->sourceID(), vm);
     return JSValue::encode(JSONParse(exec, jsonString));
 }
 
 EncodedJSValue JSC_HOST_CALL functionDumpBasicBlockExecutionRanges(ExecState* exec)
 {
-    RELEASE_ASSERT(exec->vm().controlFlowProfiler());
-    exec->vm().controlFlowProfiler()->dumpData();
+    VM& vm = exec->vm();
+    RELEASE_ASSERT(vm.controlFlowProfiler());
+    vm.controlFlowProfiler()->dumpData();
     return JSValue::encode(jsUndefined());
 }
 
@@ -2981,7 +3007,7 @@
     RELEASE_ASSERT(sourceCodeText.contains(substring));
     int offset = sourceCodeText.find(substring) + executable->source().startOffset();
     
-    size_t executionCount = vm.controlFlowProfiler()->basicBlockExecutionCountAtTextOffset(offset, executable->sourceID(), exec->vm());
+    size_t executionCount = vm.controlFlowProfiler()->basicBlockExecutionCountAtTextOffset(offset, executable->sourceID(), vm);
     return JSValue::encode(JSValue(executionCount));
 }
 
@@ -2993,7 +3019,8 @@
 
 EncodedJSValue JSC_HOST_CALL functionDrainMicrotasks(ExecState* exec)
 {
-    exec->vm().drainMicrotasks();
+    VM& vm = exec->vm();
+    vm.drainMicrotasks();
     return JSValue::encode(jsUndefined());
 }
 
@@ -3093,7 +3120,7 @@
     JSLockHolder lock(vm);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    HeapSnapshotBuilder snapshotBuilder(exec->vm().ensureHeapProfiler());
+    HeapSnapshotBuilder snapshotBuilder(vm.ensureHeapProfiler());
     snapshotBuilder.buildSnapshot();
 
     String jsonString = snapshotBuilder.json();
@@ -3113,7 +3140,7 @@
     VM& vm = exec->vm();
     for (unsigned i = 0; i < exec->argumentCount(); ++i) {
         if (JSObject* object = jsDynamicCast<JSObject*>(vm, exec->argument(0)))
-            object->ensureArrayStorage(exec->vm());
+            object->ensureArrayStorage(vm);
     }
     return JSValue::encode(jsUndefined());
 }
@@ -3121,7 +3148,8 @@
 #if ENABLE(SAMPLING_PROFILER)
 EncodedJSValue JSC_HOST_CALL functionStartSamplingProfiler(ExecState* exec)
 {
-    SamplingProfiler& samplingProfiler = exec->vm().ensureSamplingProfiler(WTF::Stopwatch::create());
+    VM& vm = exec->vm();
+    SamplingProfiler& samplingProfiler = vm.ensureSamplingProfiler(WTF::Stopwatch::create());
     samplingProfiler.noticeCurrentThreadAsJSCExecutionThread();
     samplingProfiler.start();
     return JSValue::encode(jsUndefined());
@@ -3479,7 +3507,7 @@
                 break;
             source = source + line;
             source = source + '\n';
-            checkSyntax(globalObject->vm(), makeSource(source, sourceOrigin), error);
+            checkSyntax(vm, makeSource(source, sourceOrigin), error);
             if (!line[0]) {
                 free(line);
                 break;
@@ -3518,7 +3546,7 @@
             printf("%s\n", returnValue.toWTFString(globalObject->globalExec()).utf8().data());
 
         scope.clearException();
-        globalObject->vm().drainMicrotasks();
+        vm.drainMicrotasks();
     }
     printf("\n");
 }
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index ea6899a..225106b 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -695,7 +695,7 @@
         }
     } else if (!LLINT_ALWAYS_ACCESS_SLOW
         && isJSArray(baseValue)
-        && ident == exec->propertyNames().length) {
+        && ident == vm.propertyNames->length) {
         pc[0].u.opcode = LLInt::getOpcode(op_get_array_length);
         ArrayProfile* arrayProfile = codeBlock->getOrAddArrayProfile(pc - codeBlock->instructions().begin());
         arrayProfile->observeStructure(baseValue.asCell()->structure());
@@ -796,7 +796,7 @@
     CodeBlock* codeBlock = exec->codeBlock();
     JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
     LLINT_CHECK_EXCEPTION();
-    bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
+    bool couldDelete = baseObject->methodTable(vm)->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
     LLINT_CHECK_EXCEPTION();
     if (!couldDelete && codeBlock->isStrictMode())
         LLINT_THROW(createTypeError(exec, UnableToDeletePropertyError));
@@ -855,7 +855,7 @@
             if (object->canSetIndexQuickly(i))
                 object->setIndexQuickly(vm, i, value);
             else
-                object->methodTable()->putByIndex(object, exec, i, value, isStrictMode);
+                object->methodTable(vm)->putByIndex(object, exec, i, value, isStrictMode);
             LLINT_END();
         }
         baseValue.putByIndex(exec, i, value, isStrictMode);
@@ -904,7 +904,7 @@
         baseObject->putDirectIndex(exec, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
     else {
         PutPropertySlot slot(baseObject, isStrictMode);
-        baseObject->putDirect(exec->vm(), property, value, slot);
+        baseObject->putDirect(vm, property, value, slot);
     }
     LLINT_END();
 }
@@ -922,12 +922,12 @@
     
     uint32_t i;
     if (subscript.getUInt32(i))
-        couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
+        couldDelete = baseObject->methodTable(vm)->deletePropertyByIndex(baseObject, exec, i);
     else {
         LLINT_CHECK_EXCEPTION();
         auto property = subscript.toPropertyKey(exec);
         LLINT_CHECK_EXCEPTION();
-        couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
+        couldDelete = baseObject->methodTable(vm)->deleteProperty(baseObject, exec, property);
     }
     
     if (!couldDelete && exec->codeBlock()->isStrictMode())
@@ -1617,7 +1617,7 @@
         LLINT_THROW(createUndefinedVariableError(exec, ident));
 
     PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
-    scope->methodTable()->put(scope, exec, ident, value, slot);
+    scope->methodTable(vm)->put(scope, exec, ident, value, slot);
     
     CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
 
diff --git a/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp b/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
index a7b180b..4522b0d 100644
--- a/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
+++ b/Source/JavaScriptCore/parser/ModuleAnalyzer.cpp
@@ -37,7 +37,7 @@
 
 ModuleAnalyzer::ModuleAnalyzer(ExecState* exec, const Identifier& moduleKey, const SourceCode& sourceCode, const VariableEnvironment& declaredVariables, const VariableEnvironment& lexicalVariables)
     : m_vm(&exec->vm())
-    , m_moduleRecord(exec->vm(), JSModuleRecord::create(exec, exec->vm(), exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables))
+    , m_moduleRecord(*m_vm, JSModuleRecord::create(exec, *m_vm, exec->lexicalGlobalObject()->moduleRecordStructure(), moduleKey, sourceCode, declaredVariables, lexicalVariables))
 {
 }
 
diff --git a/Source/JavaScriptCore/profiler/ProfilerBytecode.cpp b/Source/JavaScriptCore/profiler/ProfilerBytecode.cpp
index b76e78f..fd88a22 100644
--- a/Source/JavaScriptCore/profiler/ProfilerBytecode.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerBytecode.cpp
@@ -35,10 +35,11 @@
 
 JSValue Bytecode::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
-    result->putDirect(exec->vm(), exec->propertyNames().bytecodeIndex, jsNumber(m_bytecodeIndex));
-    result->putDirect(exec->vm(), exec->propertyNames().opcode, jsString(exec, String::fromUTF8(opcodeNames[m_opcodeID])));
-    result->putDirect(exec->vm(), exec->propertyNames().description, jsString(exec, String::fromUTF8(m_description)));
+    result->putDirect(vm, vm.propertyNames->bytecodeIndex, jsNumber(m_bytecodeIndex));
+    result->putDirect(vm, vm.propertyNames->opcode, jsString(exec, String::fromUTF8(opcodeNames[m_opcodeID])));
+    result->putDirect(vm, vm.propertyNames->description, jsString(exec, String::fromUTF8(m_description)));
     return result;
 }
 
diff --git a/Source/JavaScriptCore/profiler/ProfilerBytecodeSequence.cpp b/Source/JavaScriptCore/profiler/ProfilerBytecodeSequence.cpp
index 433a37d..23e238c 100644
--- a/Source/JavaScriptCore/profiler/ProfilerBytecodeSequence.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerBytecodeSequence.cpp
@@ -85,7 +85,7 @@
         header->putDirectIndex(exec, i, jsString(exec, String::fromUTF8(m_header[i])));
         RETURN_IF_EXCEPTION(scope, void());
     }
-    result->putDirect(vm, exec->propertyNames().header, header);
+    result->putDirect(vm, vm.propertyNames->header, header);
     
     JSArray* sequence = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, void());
@@ -93,7 +93,7 @@
         sequence->putDirectIndex(exec, i, m_sequence[i].toJS(exec));
         RETURN_IF_EXCEPTION(scope, void());
     }
-    result->putDirect(vm, exec->propertyNames().bytecode, sequence);
+    result->putDirect(vm, vm.propertyNames->bytecode, sequence);
 }
 
 } } // namespace JSC::Profiler
diff --git a/Source/JavaScriptCore/profiler/ProfilerBytecodes.cpp b/Source/JavaScriptCore/profiler/ProfilerBytecodes.cpp
index 74c55ab..bd0f695 100644
--- a/Source/JavaScriptCore/profiler/ProfilerBytecodes.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerBytecodes.cpp
@@ -53,13 +53,14 @@
 
 JSValue Bytecodes::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
     
-    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_id));
-    result->putDirect(exec->vm(), exec->propertyNames().inferredName, jsString(exec, String::fromUTF8(m_inferredName)));
-    result->putDirect(exec->vm(), exec->propertyNames().sourceCode, jsString(exec, String::fromUTF8(m_sourceCode)));
-    result->putDirect(exec->vm(), exec->propertyNames().hash, jsString(exec, String::fromUTF8(toCString(m_hash))));
-    result->putDirect(exec->vm(), exec->propertyNames().instructionCount, jsNumber(m_instructionCount));
+    result->putDirect(vm, vm.propertyNames->bytecodesID, jsNumber(m_id));
+    result->putDirect(vm, vm.propertyNames->inferredName, jsString(exec, String::fromUTF8(m_inferredName)));
+    result->putDirect(vm, vm.propertyNames->sourceCode, jsString(exec, String::fromUTF8(m_sourceCode)));
+    result->putDirect(vm, vm.propertyNames->hash, jsString(exec, String::fromUTF8(toCString(m_hash))));
+    result->putDirect(vm, vm.propertyNames->instructionCount, jsNumber(m_instructionCount));
     addSequenceProperties(exec, result);
     
     return result;
diff --git a/Source/JavaScriptCore/profiler/ProfilerCompilation.cpp b/Source/JavaScriptCore/profiler/ProfilerCompilation.cpp
index 255f831..ebe92c3 100644
--- a/Source/JavaScriptCore/profiler/ProfilerCompilation.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerCompilation.cpp
@@ -118,8 +118,8 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
     JSObject* result = constructEmptyObject(exec);
     RETURN_IF_EXCEPTION(scope, { });
-    result->putDirect(vm, exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
-    result->putDirect(vm, exec->propertyNames().compilationKind, jsString(exec, String::fromUTF8(toCString(m_kind))));
+    result->putDirect(vm, vm.propertyNames->bytecodesID, jsNumber(m_bytecodes->id()));
+    result->putDirect(vm, vm.propertyNames->compilationKind, jsString(exec, String::fromUTF8(toCString(m_kind))));
     
     JSArray* profiledBytecodes = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -129,7 +129,7 @@
         profiledBytecodes->putDirectIndex(exec, i, value);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().profiledBytecodes, profiledBytecodes);
+    result->putDirect(vm, vm.propertyNames->profiledBytecodes, profiledBytecodes);
     
     JSArray* descriptions = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -139,7 +139,7 @@
         descriptions->putDirectIndex(exec, i, value);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().descriptions, descriptions);
+    result->putDirect(vm, vm.propertyNames->descriptions, descriptions);
     
     JSArray* counters = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -148,12 +148,12 @@
         RETURN_IF_EXCEPTION(scope, { });
         auto value = it->key.toJS(exec);
         RETURN_IF_EXCEPTION(scope, { });
-        counterEntry->putDirect(vm, exec->propertyNames().origin, value);
-        counterEntry->putDirect(vm, exec->propertyNames().executionCount, jsNumber(it->value->count()));
+        counterEntry->putDirect(vm, vm.propertyNames->origin, value);
+        counterEntry->putDirect(vm, vm.propertyNames->executionCount, jsNumber(it->value->count()));
         counters->push(exec, counterEntry);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().counters, counters);
+    result->putDirect(vm, vm.propertyNames->counters, counters);
     
     JSArray* exitSites = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -163,7 +163,7 @@
         exitSites->putDirectIndex(exec, i, value);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().osrExitSites, exitSites);
+    result->putDirect(vm, vm.propertyNames->osrExitSites, exitSites);
     
     JSArray* exits = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -171,16 +171,16 @@
         exits->putDirectIndex(exec, i, m_osrExits[i].toJS(exec));
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().osrExits, exits);
+    result->putDirect(vm, vm.propertyNames->osrExits, exits);
     
-    result->putDirect(vm, exec->propertyNames().numInlinedGetByIds, jsNumber(m_numInlinedGetByIds));
-    result->putDirect(vm, exec->propertyNames().numInlinedPutByIds, jsNumber(m_numInlinedPutByIds));
-    result->putDirect(vm, exec->propertyNames().numInlinedCalls, jsNumber(m_numInlinedCalls));
-    result->putDirect(vm, exec->propertyNames().jettisonReason, jsString(exec, String::fromUTF8(toCString(m_jettisonReason))));
+    result->putDirect(vm, vm.propertyNames->numInlinedGetByIds, jsNumber(m_numInlinedGetByIds));
+    result->putDirect(vm, vm.propertyNames->numInlinedPutByIds, jsNumber(m_numInlinedPutByIds));
+    result->putDirect(vm, vm.propertyNames->numInlinedCalls, jsNumber(m_numInlinedCalls));
+    result->putDirect(vm, vm.propertyNames->jettisonReason, jsString(exec, String::fromUTF8(toCString(m_jettisonReason))));
     if (!m_additionalJettisonReason.isNull())
-        result->putDirect(vm, exec->propertyNames().additionalJettisonReason, jsString(exec, String::fromUTF8(m_additionalJettisonReason)));
+        result->putDirect(vm, vm.propertyNames->additionalJettisonReason, jsString(exec, String::fromUTF8(m_additionalJettisonReason)));
     
-    result->putDirect(vm, exec->propertyNames().uid, m_uid.toJS(exec));
+    result->putDirect(vm, vm.propertyNames->uid, m_uid.toJS(exec));
     
     return result;
 }
diff --git a/Source/JavaScriptCore/profiler/ProfilerCompiledBytecode.cpp b/Source/JavaScriptCore/profiler/ProfilerCompiledBytecode.cpp
index 4891c31..624d0ce 100644
--- a/Source/JavaScriptCore/profiler/ProfilerCompiledBytecode.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerCompiledBytecode.cpp
@@ -44,10 +44,11 @@
 
 JSValue CompiledBytecode::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
     
-    result->putDirect(exec->vm(), exec->propertyNames().origin, m_origin.toJS(exec));
-    result->putDirect(exec->vm(), exec->propertyNames().description, jsString(exec, String::fromUTF8(m_description)));
+    result->putDirect(vm, vm.propertyNames->origin, m_origin.toJS(exec));
+    result->putDirect(vm, vm.propertyNames->description, jsString(exec, String::fromUTF8(m_description)));
     
     return result;
 }
diff --git a/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp b/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
index ca72832..8c8a53a 100644
--- a/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
@@ -111,7 +111,7 @@
         bytecodes->putDirectIndex(exec, i, value);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().bytecodes, bytecodes);
+    result->putDirect(vm, vm.propertyNames->bytecodes, bytecodes);
     
     JSArray* compilations = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -121,7 +121,7 @@
         compilations->putDirectIndex(exec, i, value);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().compilations, compilations);
+    result->putDirect(vm, vm.propertyNames->compilations, compilations);
     
     JSArray* events = constructEmptyArray(exec, 0);
     RETURN_IF_EXCEPTION(scope, { });
@@ -131,7 +131,7 @@
         events->putDirectIndex(exec, i, value);
         RETURN_IF_EXCEPTION(scope, { });
     }
-    result->putDirect(vm, exec->propertyNames().events, events);
+    result->putDirect(vm, vm.propertyNames->events, events);
     
     return result;
 }
diff --git a/Source/JavaScriptCore/profiler/ProfilerEvent.cpp b/Source/JavaScriptCore/profiler/ProfilerEvent.cpp
index e84ef6f..1a719d7 100644
--- a/Source/JavaScriptCore/profiler/ProfilerEvent.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerEvent.cpp
@@ -46,15 +46,16 @@
 
 JSValue Event::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
     
-    result->putDirect(exec->vm(), exec->propertyNames().time, jsNumber(m_time));
-    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
+    result->putDirect(vm, vm.propertyNames->time, jsNumber(m_time));
+    result->putDirect(vm, vm.propertyNames->bytecodesID, jsNumber(m_bytecodes->id()));
     if (m_compilation)
-        result->putDirect(exec->vm(), exec->propertyNames().compilationUID, m_compilation->uid().toJS(exec));
-    result->putDirect(exec->vm(), exec->propertyNames().summary, jsString(exec, String::fromUTF8(m_summary)));
+        result->putDirect(vm, vm.propertyNames->compilationUID, m_compilation->uid().toJS(exec));
+    result->putDirect(vm, vm.propertyNames->summary, jsString(exec, String::fromUTF8(m_summary)));
     if (m_detail.length())
-        result->putDirect(exec->vm(), exec->propertyNames().detail, jsString(exec, String::fromUTF8(m_detail)));
+        result->putDirect(vm, vm.propertyNames->detail, jsString(exec, String::fromUTF8(m_detail)));
     
     return result;
 }
diff --git a/Source/JavaScriptCore/profiler/ProfilerOSRExit.cpp b/Source/JavaScriptCore/profiler/ProfilerOSRExit.cpp
index 2a5d5be..fb43c30 100644
--- a/Source/JavaScriptCore/profiler/ProfilerOSRExit.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerOSRExit.cpp
@@ -47,12 +47,13 @@
 
 JSValue OSRExit::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
-    result->putDirect(exec->vm(), exec->propertyNames().id, jsNumber(m_id));
-    result->putDirect(exec->vm(), exec->propertyNames().origin, m_origin.toJS(exec));
-    result->putDirect(exec->vm(), exec->propertyNames().exitKind, jsString(exec, exitKindToString(m_exitKind)));
-    result->putDirect(exec->vm(), exec->propertyNames().isWatchpoint, jsBoolean(m_isWatchpoint));
-    result->putDirect(exec->vm(), exec->propertyNames().count, jsNumber(m_counter));
+    result->putDirect(vm, vm.propertyNames->id, jsNumber(m_id));
+    result->putDirect(vm, vm.propertyNames->origin, m_origin.toJS(exec));
+    result->putDirect(vm, vm.propertyNames->exitKind, jsString(exec, exitKindToString(m_exitKind)));
+    result->putDirect(vm, vm.propertyNames->isWatchpoint, jsBoolean(m_isWatchpoint));
+    result->putDirect(vm, vm.propertyNames->count, jsNumber(m_counter));
     return result;
 }
 
diff --git a/Source/JavaScriptCore/profiler/ProfilerOrigin.cpp b/Source/JavaScriptCore/profiler/ProfilerOrigin.cpp
index 7c28f7b..8d7c5bd 100644
--- a/Source/JavaScriptCore/profiler/ProfilerOrigin.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerOrigin.cpp
@@ -47,9 +47,10 @@
 
 JSValue Origin::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
-    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
-    result->putDirect(exec->vm(), exec->propertyNames().bytecodeIndex, jsNumber(m_bytecodeIndex));
+    result->putDirect(vm, vm.propertyNames->bytecodesID, jsNumber(m_bytecodes->id()));
+    result->putDirect(vm, vm.propertyNames->bytecodeIndex, jsNumber(m_bytecodeIndex));
     return result;
 }
 
diff --git a/Source/JavaScriptCore/profiler/ProfilerProfiledBytecodes.cpp b/Source/JavaScriptCore/profiler/ProfilerProfiledBytecodes.cpp
index fe590ff..94ad45b 100644
--- a/Source/JavaScriptCore/profiler/ProfilerProfiledBytecodes.cpp
+++ b/Source/JavaScriptCore/profiler/ProfilerProfiledBytecodes.cpp
@@ -44,9 +44,10 @@
 
 JSValue ProfiledBytecodes::toJS(ExecState* exec) const
 {
+    VM& vm = exec->vm();
     JSObject* result = constructEmptyObject(exec);
     
-    result->putDirect(exec->vm(), exec->propertyNames().bytecodesID, jsNumber(m_bytecodes->id()));
+    result->putDirect(vm, vm.propertyNames->bytecodesID, jsNumber(m_bytecodes->id()));
     addSequenceProperties(exec, result);
     
     return result;
diff --git a/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp b/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
index 12bc246..c39a167 100644
--- a/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
+++ b/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
@@ -138,9 +138,10 @@
 
 static JSValue identifierToJSValue(ExecState* exec, const Identifier& identifier)
 {
+    VM& vm = exec->vm();
     if (identifier.isSymbol())
-        return Symbol::create(exec->vm(), static_cast<SymbolImpl&>(*identifier.impl()));
-    return jsString(&exec->vm(), identifier.impl());
+        return Symbol::create(vm, static_cast<SymbolImpl&>(*identifier.impl()));
+    return jsString(&vm, identifier.impl());
 }
 
 AbstractModuleRecord* AbstractModuleRecord::hostResolveImportedModule(ExecState* exec, const Identifier& moduleName)
@@ -494,7 +495,8 @@
         // section 15.2.1.16.3, step 6
         // If the "default" name is not resolved in the current module, we need to throw an error and stop resolution immediately,
         // Rationale to this error: A default export cannot be provided by an export *.
-        if (query.exportName == exec->propertyNames().defaultKeyword.impl())
+        VM& vm = exec->vm();
+        if (query.exportName == vm.propertyNames->defaultKeyword.impl())
             return false;
 
         // step 7, If exportStarSet contains module, then return null.
@@ -660,6 +662,7 @@
 
 static void getExportedNames(ExecState* exec, AbstractModuleRecord* root, IdentifierSet& exportedNames)
 {
+    VM& vm = exec->vm();
     HashSet<AbstractModuleRecord*> exportStarSet;
     Vector<AbstractModuleRecord*, 8> pendingModules;
 
@@ -673,7 +676,7 @@
 
         for (const auto& pair : moduleRecord->exportEntries()) {
             const AbstractModuleRecord::ExportEntry& exportEntry = pair.value;
-            if (moduleRecord == root || exec->propertyNames().defaultKeyword != exportEntry.exportName)
+            if (moduleRecord == root || vm.propertyNames->defaultKeyword != exportEntry.exportName)
                 exportedNames.add(exportEntry.exportName.impl());
         }
 
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index de02b7d..2e2d563 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -410,7 +410,7 @@
     // 4. Return the result of calling the [[Call]] internal method of func providing array as the this value and an empty arguments list.
     if (!isJSArray(thisObject) || callType != CallType::Host || callData.native.function != arrayProtoFuncJoin) {
         scope.release();
-        return JSValue::encode(call(exec, function, callType, callData, thisObject, exec->emptyList()));
+        return JSValue::encode(call(exec, function, callType, callData, thisObject, *vm.emptyList));
     }
 
     ASSERT(isJSArray(thisValue));
@@ -490,7 +490,7 @@
         CallData callData;
         CallType callType = getCallData(conversionFunction, callData);
         if (callType != CallType::None) {
-            element = call(exec, conversionFunction, callType, callData, element, exec->emptyList());
+            element = call(exec, conversionFunction, callType, callData, element, *vm.emptyList);
             RETURN_IF_EXCEPTION(scope, encodedJSValue());
         }
         stringJoiner.append(*exec, element);
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
index 2a5b716..97b61ba 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -76,8 +76,9 @@
 
 JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSGlobalObject* globalObject, JSValue immediateBooleanValue)
 {
-    BooleanObject* obj = BooleanObject::create(exec->vm(), globalObject->booleanObjectStructure());
-    obj->setInternalValue(exec->vm(), immediateBooleanValue);
+    VM& vm = exec->vm();
+    BooleanObject* obj = BooleanObject::create(vm, globalObject->booleanObjectStructure());
+    obj->setInternalValue(vm, immediateBooleanValue);
     return obj;
 }
 
diff --git a/Source/JavaScriptCore/runtime/CallData.cpp b/Source/JavaScriptCore/runtime/CallData.cpp
index be85971..226249e 100644
--- a/Source/JavaScriptCore/runtime/CallData.cpp
+++ b/Source/JavaScriptCore/runtime/CallData.cpp
@@ -36,8 +36,9 @@
 
 JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
+    VM& vm = exec->vm();
     ASSERT(callType == CallType::JS || callType == CallType::Host);
-    return exec->interpreter()->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args);
+    return vm.interpreter->executeCall(exec, asObject(functionObject), callType, callData, thisValue, args);
 }
 
 JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, NakedPtr<Exception>& returnedException)
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
index ffcae0c..fe753ea 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
@@ -235,7 +235,7 @@
         JSFunction* constructor = jsCast<JSFunction*>(constructorAsObject);
         auto& cacheWriteBarrier = pc[4].u.jsCell;
         if (!cacheWriteBarrier)
-            cacheWriteBarrier.set(exec->vm(), exec->codeBlock(), constructor);
+            cacheWriteBarrier.set(vm, exec->codeBlock(), constructor);
         else if (cacheWriteBarrier.unvalidatedGet() != JSCell::seenMultipleCalleeObjects() && cacheWriteBarrier.get() != constructor)
             cacheWriteBarrier.setWithoutWriteBarrier(JSCell::seenMultipleCalleeObjects());
 
@@ -244,7 +244,7 @@
         result = constructEmptyObject(exec, structure);
     } else {
         // http://ecma-international.org/ecma-262/6.0/#sec-ordinarycreatefromconstructor
-        JSValue proto = constructorAsObject->get(exec, exec->propertyNames().prototype);
+        JSValue proto = constructorAsObject->get(exec, vm.propertyNames->prototype);
         CHECK_EXCEPTION();
         if (proto.isObject())
             result = constructEmptyObject(exec, asObject(proto));
@@ -907,7 +907,6 @@
     JSValue subscript = OP_C(4).jsValue();
 
     if (LIKELY(baseValue.isCell() && subscript.isString())) {
-        VM& vm = exec->vm();
         Structure& structure = *baseValue.asCell()->structure(vm);
         if (JSCell::canUseFastGetOwnProperty(structure)) {
             if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.h b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
index fa2824f..f4d6ebe 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
@@ -154,10 +154,11 @@
             return;
         }
         
-        scope->structure()->didCachePropertyReplacement(exec->vm(), slot.cachedOffset());
+        VM& vm = exec->vm();
+        scope->structure()->didCachePropertyReplacement(vm, slot.cachedOffset());
 
         ConcurrentJSLocker locker(codeBlock->m_lock);
-        pc[5].u.structure.set(exec->vm(), codeBlock, scope->structure());
+        pc[5].u.structure.set(vm, codeBlock, scope->structure());
         pc[6].u.operand = slot.cachedOffset();
     }
 }
@@ -193,7 +194,7 @@
             Structure* structure = scope->structure(vm);
             {
                 ConcurrentJSLocker locker(codeBlock->m_lock);
-                pc[5].u.structure.set(exec->vm(), codeBlock, structure);
+                pc[5].u.structure.set(vm, codeBlock, structure);
                 pc[6].u.operand = slot.cachedOffset();
             }
             structure->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
diff --git a/Source/JavaScriptCore/runtime/Completion.cpp b/Source/JavaScriptCore/runtime/Completion.cpp
index 7dc8935..3512e53 100644
--- a/Source/JavaScriptCore/runtime/Completion.cpp
+++ b/Source/JavaScriptCore/runtime/Completion.cpp
@@ -46,8 +46,9 @@
 
 bool checkSyntax(ExecState* exec, const SourceCode& source, JSValue* returnedException)
 {
-    JSLockHolder lock(exec);
-    RELEASE_ASSERT(exec->vm().atomicStringTable() == Thread::current().atomicStringTable());
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
 
     ProgramExecutable* program = ProgramExecutable::create(exec, source);
     JSObject* error = program->checkSyntax(exec);
@@ -99,7 +100,7 @@
     if (!thisValue || thisValue.isUndefinedOrNull())
         thisValue = exec->vmEntryGlobalObject();
     JSObject* thisObj = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
-    JSValue result = exec->interpreter()->executeProgram(source, exec, thisObj);
+    JSValue result = vm.interpreter->executeProgram(source, exec, thisObj);
 
     if (scope.exception()) {
         returnedException = scope.exception();
@@ -165,9 +166,10 @@
 
 JSInternalPromise* loadAndEvaluateModule(ExecState* exec, const String& moduleName, JSValue scriptFetcher)
 {
-    JSLockHolder lock(exec);
-    RELEASE_ASSERT(exec->vm().atomicStringTable() == Thread::current().atomicStringTable());
-    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
 
     return loadAndEvaluateModule(lock, exec, exec->vmEntryGlobalObject(), Identifier::fromString(exec, moduleName), scriptFetcher);
 }
@@ -203,9 +205,10 @@
 
 JSInternalPromise* loadModule(ExecState* exec, const String& moduleName, JSValue scriptFetcher)
 {
-    JSLockHolder lock(exec);
-    RELEASE_ASSERT(exec->vm().atomicStringTable() == Thread::current().atomicStringTable());
-    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
 
     return loadModule(lock, exec, exec->vmEntryGlobalObject(), Identifier::fromString(exec, moduleName), scriptFetcher);
 }
@@ -232,19 +235,21 @@
 
 JSValue linkAndEvaluateModule(ExecState* exec, const Identifier& moduleKey, JSValue scriptFetcher)
 {
-    JSLockHolder lock(exec);
-    RELEASE_ASSERT(exec->vm().atomicStringTable() == Thread::current().atomicStringTable());
-    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
 
     JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
-    return globalObject->moduleLoader()->linkAndEvaluateModule(exec, identifierToJSValue(exec->vm(), moduleKey), scriptFetcher);
+    return globalObject->moduleLoader()->linkAndEvaluateModule(exec, identifierToJSValue(vm, moduleKey), scriptFetcher);
 }
 
 JSInternalPromise* importModule(ExecState* exec, const Identifier& moduleKey, JSValue scriptFetcher)
 {
-    JSLockHolder lock(exec);
-    RELEASE_ASSERT(exec->vm().atomicStringTable() == Thread::current().atomicStringTable());
-    RELEASE_ASSERT(!exec->vm().isCollectorBusyOnCurrentThread());
+    VM& vm = exec->vm();
+    JSLockHolder lock(vm);
+    RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
+    RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
 
     return exec->vmEntryGlobalObject()->moduleLoader()->requestImportModule(exec, moduleKey, scriptFetcher);
 }
diff --git a/Source/JavaScriptCore/runtime/ConstructData.cpp b/Source/JavaScriptCore/runtime/ConstructData.cpp
index 94e672f..062e11c 100644
--- a/Source/JavaScriptCore/runtime/ConstructData.cpp
+++ b/Source/JavaScriptCore/runtime/ConstructData.cpp
@@ -51,8 +51,9 @@
 
 JSObject* construct(ExecState* exec, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue newTarget)
 {
+    VM& vm = exec->vm();
     ASSERT(constructType == ConstructType::JS || constructType == ConstructType::Host);
-    return exec->interpreter()->executeConstruct(exec, asObject(constructorObject), constructType, constructData, args, newTarget);
+    return vm.interpreter->executeConstruct(exec, asObject(constructorObject), constructType, constructData, args, newTarget);
 }
 
 JSObject* profiledConstruct(ExecState* exec, ProfilingReason reason, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue newTarget)
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index 0cd78a6..247a899 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -1168,7 +1168,7 @@
     if (callType == CallType::None)
         return throwVMTypeError(exec, scope, ASCIILiteral("toISOString is not a function"));
 
-    JSValue result = call(exec, asObject(toISOValue), callType, callData, object, exec->emptyList());
+    JSValue result = call(exec, asObject(toISOValue), callType, callData, object, *vm.emptyList);
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     if (result.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("toISOString did not return a primitive value"));
diff --git a/Source/JavaScriptCore/runtime/DirectArguments.h b/Source/JavaScriptCore/runtime/DirectArguments.h
index 97cc2ac..81773a5 100644
--- a/Source/JavaScriptCore/runtime/DirectArguments.h
+++ b/Source/JavaScriptCore/runtime/DirectArguments.h
@@ -74,8 +74,10 @@
     
     uint32_t length(ExecState* exec) const
     {
-        if (UNLIKELY(m_mappedArguments))
-            return get(exec, exec->propertyNames().length).toUInt32(exec);
+        if (UNLIKELY(m_mappedArguments)) {
+            VM& vm = exec->vm();
+            return get(exec, vm.propertyNames->length).toUInt32(exec);
+        }
         return m_length;
     }
     
diff --git a/Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp b/Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp
index 277ff4d..96016c0 100644
--- a/Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp
+++ b/Source/JavaScriptCore/runtime/DirectEvalExecutable.cpp
@@ -46,7 +46,7 @@
         return 0;
     }
 
-    auto* executable = new (NotNull, allocateCell<DirectEvalExecutable>(*exec->heap())) DirectEvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
+    auto* executable = new (NotNull, allocateCell<DirectEvalExecutable>(vm.heap)) DirectEvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
     executable->finishCreation(vm);
 
     ParserError error;
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index b685666..38777c6 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -85,7 +85,7 @@
         return JSValue::encode(earlyReturnValue);
 
     // 3. Let name be the result of calling the [[Get]] internal method of O with argument "name".
-    JSValue name = thisObj->get(exec, exec->propertyNames().name);
+    JSValue name = thisObj->get(exec, vm.propertyNames->name);
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
     // 4. If name is undefined, then let name be "Error"; else let name be ToString(name).
@@ -98,7 +98,7 @@
     }
 
     // 5. Let msg be the result of calling the [[Get]] internal method of O with argument "message".
-    JSValue message = thisObj->get(exec, exec->propertyNames().message);
+    JSValue message = thisObj->get(exec, vm.propertyNames->message);
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
     // (sic)
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
index e76d5cb..a3b4a3e 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -83,7 +83,8 @@
 JSObject* createUndefinedVariableError(ExecState* exec, const Identifier& ident)
 {
     if (ident.isPrivateName()) {
-        String message(makeString("Can't find private variable: @", exec->propertyNames().lookUpPublicName(ident).string()));
+        VM& vm = exec->vm();
+        String message(makeString("Can't find private variable: @", vm.propertyNames->lookUpPublicName(ident).string()));
         return createReferenceError(exec, message);
     }
     String message(makeString("Can't find variable: ", ident.string()));
@@ -97,10 +98,11 @@
     if (v.isSymbol())
         return jsNontrivialString(exec, asSymbol(v)->descriptiveString());
     if (v.isObject()) {
+        VM& vm = exec->vm();
         CallData callData;
         JSObject* object = asObject(v);
-        if (object->methodTable()->getCallData(object, callData) != CallType::None)
-            return exec->vm().smallStrings.functionString();
+        if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
+            return vm.smallStrings.functionString();
         return jsString(exec, JSObject::calculatedClassName(object));
     }
     return v.toString(exec);
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index 7711d5e1..9496ce6 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -210,7 +210,8 @@
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
 {
-    return constructFunction(exec, globalObject, args, exec->propertyNames().anonymous, exec->callerSourceOrigin(), String(), TextPosition(), functionConstructionMode, newTarget);
+    VM& vm = exec->vm();
+    return constructFunction(exec, globalObject, args, vm.propertyNames->anonymous, exec->callerSourceOrigin(), String(), TextPosition(), functionConstructionMode, newTarget);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/GenericArgumentsInlines.h b/Source/JavaScriptCore/runtime/GenericArgumentsInlines.h
index 0b262f6..ed4e96c 100644
--- a/Source/JavaScriptCore/runtime/GenericArgumentsInlines.h
+++ b/Source/JavaScriptCore/runtime/GenericArgumentsInlines.h
@@ -102,10 +102,11 @@
     }
 
     if (mode.includeDontEnumProperties() && !thisObject->overrodeThings()) {
-        array.add(exec->propertyNames().length);
-        array.add(exec->propertyNames().callee);
+        VM& vm = exec->vm();
+        array.add(vm.propertyNames->length);
+        array.add(vm.propertyNames->callee);
         if (array.includeSymbolProperties())
-            array.add(exec->propertyNames().iteratorSymbol);
+            array.add(vm.propertyNames->iteratorSymbol);
     }
     Base::getOwnPropertyNames(thisObject, exec, array, mode);
 }
diff --git a/Source/JavaScriptCore/runtime/IdentifierInlines.h b/Source/JavaScriptCore/runtime/IdentifierInlines.h
index 8d9ffa6..9b226a2 100644
--- a/Source/JavaScriptCore/runtime/IdentifierInlines.h
+++ b/Source/JavaScriptCore/runtime/IdentifierInlines.h
@@ -60,7 +60,8 @@
 #ifndef NDEBUG
     checkCurrentAtomicStringTable(exec);
 #endif
-    return *AtomicStringImpl::addWithStringTableProvider(*exec, r);
+    VM& vm = exec->vm();
+    return *AtomicStringImpl::addWithStringTableProvider(vm, r);
 }
 inline Ref<StringImpl> Identifier::add(VM* vm, StringImpl* r)
 {
diff --git a/Source/JavaScriptCore/runtime/IndirectEvalExecutable.cpp b/Source/JavaScriptCore/runtime/IndirectEvalExecutable.cpp
index db9269e..50ab3739 100644
--- a/Source/JavaScriptCore/runtime/IndirectEvalExecutable.cpp
+++ b/Source/JavaScriptCore/runtime/IndirectEvalExecutable.cpp
@@ -46,7 +46,7 @@
         return 0;
     }
 
-    auto* executable = new (NotNull, allocateCell<IndirectEvalExecutable>(*exec->heap())) IndirectEvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
+    auto* executable = new (NotNull, allocateCell<IndirectEvalExecutable>(vm.heap)) IndirectEvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
     executable->finishCreation(vm);
 
     ParserError error;
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.cpp b/Source/JavaScriptCore/runtime/InternalFunction.cpp
index 58f168e..71587a3 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/InternalFunction.cpp
@@ -45,7 +45,7 @@
 {
     Base::finishCreation(vm);
     ASSERT(inherits(vm, info()));
-    ASSERT(methodTable()->getCallData != InternalFunction::info()->methodTable.getCallData);
+    ASSERT(methodTable(vm)->getCallData != InternalFunction::info()->methodTable.getCallData);
     JSString* nameString = jsString(&vm, name);
     m_originalName.set(vm, this, nameString);
     if (nameVisibility == NameVisibility::Visible)
@@ -112,12 +112,12 @@
             return structure;
 
         // Note, Reflect.construct might cause the profile to churn but we don't care.
-        JSValue prototypeValue = newTarget.get(exec, exec->propertyNames().prototype);
+        JSValue prototypeValue = newTarget.get(exec, vm.propertyNames->prototype);
         RETURN_IF_EXCEPTION(scope, nullptr);
         if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue))
             return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, lexicalGlobalObject, prototype, baseClass);
     } else {
-        JSValue prototypeValue = newTarget.get(exec, exec->propertyNames().prototype);
+        JSValue prototypeValue = newTarget.get(exec, vm.propertyNames->prototype);
         RETURN_IF_EXCEPTION(scope, nullptr);
         if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue)) {
             // This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 8d8a6f3..9c16b28 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -243,8 +243,9 @@
 
 bool JSArray::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
+    VM& vm = exec->vm();
     JSArray* thisObject = jsCast<JSArray*>(object);
-    if (propertyName == exec->propertyNames().length) {
+    if (propertyName == vm.propertyNames->length) {
         unsigned attributes = thisObject->isLengthWritable() ? DontDelete | DontEnum : DontDelete | DontEnum | ReadOnly;
         slot.setValue(thisObject, attributes, jsNumber(thisObject->length()));
         return true;
@@ -266,7 +267,7 @@
         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
     }
 
-    if (propertyName == exec->propertyNames().length) {
+    if (propertyName == vm.propertyNames->length) {
         if (!thisObject->isLengthWritable())
             return false;
         unsigned newLength = value.toUInt32(exec);
@@ -285,9 +286,10 @@
 
 bool JSArray::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
+    VM& vm = exec->vm();
     JSArray* thisObject = jsCast<JSArray*>(cell);
 
-    if (propertyName == exec->propertyNames().length)
+    if (propertyName == vm.propertyNames->length)
         return false;
 
     return JSObject::deleteProperty(thisObject, exec, propertyName);
@@ -302,10 +304,11 @@
 
 void JSArray::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     JSArray* thisObject = jsCast<JSArray*>(object);
 
     if (mode.includeDontEnumProperties())
-        propertyNames.add(exec->propertyNames().length);
+        propertyNames.add(vm.propertyNames->length);
 
     JSObject::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
 }
@@ -1431,7 +1434,8 @@
     if (structure->storedPrototype() != globalObject->arrayPrototype())
         return false;
 
-    if (getDirectOffset(globalObject->vm(), globalObject->vm().propertyNames->iteratorSymbol) != invalidOffset)
+    VM& vm = globalObject->vm();
+    if (getDirectOffset(vm, vm.propertyNames->iteratorSymbol) != invalidOffset)
         return false;
 
     return true;
diff --git a/Source/JavaScriptCore/runtime/JSArray.h b/Source/JavaScriptCore/runtime/JSArray.h
index e180cd0..5eaab13 100644
--- a/Source/JavaScriptCore/runtime/JSArray.h
+++ b/Source/JavaScriptCore/runtime/JSArray.h
@@ -112,7 +112,8 @@
 
     bool shiftCountForShift(ExecState* exec, unsigned startIndex, unsigned count)
     {
-        return shiftCountWithArrayStorage(exec->vm(), startIndex, count, ensureArrayStorage(exec->vm()));
+        VM& vm = exec->vm();
+        return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
     }
     bool shiftCountForSplice(ExecState* exec, unsigned& startIndex, unsigned count)
     {
diff --git a/Source/JavaScriptCore/runtime/JSCJSValue.cpp b/Source/JavaScriptCore/runtime/JSCJSValue.cpp
index acab267..2deb8dd 100644
--- a/Source/JavaScriptCore/runtime/JSCJSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSCJSValue.cpp
@@ -299,14 +299,15 @@
     else if (isDouble())
         out.printf("%lf", asDouble());
     else if (isCell()) {
-        if (asCell()->inherits(*asCell()->vm(), JSString::info())) {
+        VM& vm = *asCell()->vm();
+        if (asCell()->inherits(vm, JSString::info())) {
             JSString* string = asString(asCell());
             const StringImpl* impl = string->tryGetValueImpl();
             if (impl)
                 out.print("\"", impl, "\"");
             else
                 out.print("(unresolved string)");
-        } else if (asCell()->inherits(*asCell()->vm(), Structure::info())) {
+        } else if (asCell()->inherits(vm, Structure::info())) {
             out.print("Structure[ ", asCell()->structure()->classInfo()->className);
 #if USE(JSVALUE64)
             out.print(" ID: ", asCell()->structureID());
diff --git a/Source/JavaScriptCore/runtime/JSDataView.cpp b/Source/JavaScriptCore/runtime/JSDataView.cpp
index f3708ba..f33257e 100644
--- a/Source/JavaScriptCore/runtime/JSDataView.cpp
+++ b/Source/JavaScriptCore/runtime/JSDataView.cpp
@@ -105,12 +105,13 @@
 bool JSDataView::getOwnPropertySlot(
     JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
+    VM& vm = exec->vm();
     JSDataView* thisObject = jsCast<JSDataView*>(object);
-    if (propertyName == exec->propertyNames().byteLength) {
+    if (propertyName == vm.propertyNames->byteLength) {
         slot.setValue(thisObject, DontEnum | ReadOnly, jsNumber(thisObject->m_length));
         return true;
     }
-    if (propertyName == exec->propertyNames().byteOffset) {
+    if (propertyName == vm.propertyNames->byteOffset) {
         slot.setValue(thisObject, DontEnum | ReadOnly, jsNumber(thisObject->byteOffset()));
         return true;
     }
@@ -156,9 +157,10 @@
 bool JSDataView::deleteProperty(
     JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
+    VM& vm = exec->vm();
     JSDataView* thisObject = jsCast<JSDataView*>(cell);
-    if (propertyName == exec->propertyNames().byteLength
-        || propertyName == exec->propertyNames().byteOffset)
+    if (propertyName == vm.propertyNames->byteLength
+        || propertyName == vm.propertyNames->byteOffset)
         return false;
 
     return Base::deleteProperty(thisObject, exec, propertyName);
@@ -167,11 +169,12 @@
 void JSDataView::getOwnNonIndexPropertyNames(
     JSObject* object, ExecState* exec, PropertyNameArray& array, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     JSDataView* thisObject = jsCast<JSDataView*>(object);
     
     if (mode.includeDontEnumProperties()) {
-        array.add(exec->propertyNames().byteOffset);
-        array.add(exec->propertyNames().byteLength);
+        array.add(vm.propertyNames->byteOffset);
+        array.add(vm.propertyNames->byteLength);
     }
     
     Base::getOwnNonIndexPropertyNames(thisObject, exec, array, mode);
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index f79c2c0..5163e8e 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -375,7 +375,7 @@
         slot.setValue(thisObject, attributes, thisObject->getDirect(offset), offset);
     }
 
-    if (propertyName == exec->propertyNames().arguments) {
+    if (propertyName == vm.propertyNames->arguments) {
         if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties())
             return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
         
@@ -383,7 +383,7 @@
         return true;
     }
 
-    if (propertyName == exec->propertyNames().caller) {
+    if (propertyName == vm.propertyNames->caller) {
         if (!thisObject->jsExecutable()->hasCallerAndArgumentsProperties())
             return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
 
@@ -487,10 +487,10 @@
         // For non-host functions, don't let these properties by deleted - except by DefineOwnProperty.
         FunctionExecutable* executable = thisObject->jsExecutable();
         
-        if (propertyName == exec->propertyNames().caller || propertyName == exec->propertyNames().arguments)
+        if (propertyName == vm.propertyNames->caller || propertyName == vm.propertyNames->arguments)
             return !executable->hasCallerAndArgumentsProperties();
 
-        if (propertyName == exec->propertyNames().prototype && !executable->isArrowFunction())
+        if (propertyName == vm.propertyNames->prototype && !executable->isArrowFunction())
             return false;
 
         thisObject->reifyLazyPropertyIfNeeded(vm, exec, propertyName);
@@ -649,8 +649,8 @@
     // https://tc39.github.io/ecma262/#sec-exports-runtime-semantics-evaluation
     // When the ident is "*default*", we need to set "default" for the ecma name.
     // This "*default*" name is never shown to users.
-    if (ecmaName == exec->propertyNames().builtinNames().starDefaultPrivateName())
-        name = exec->propertyNames().defaultKeyword.string();
+    if (ecmaName == vm.propertyNames->builtinNames().starDefaultPrivateName())
+        name = vm.propertyNames->defaultKeyword.string();
     else
         name = ecmaName.string();
     reifyName(vm, exec, name);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index ce57b1a..b46819b 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -502,7 +502,7 @@
     if (!eval)
         return JSValue::encode(jsUndefined());
 
-    return JSValue::encode(exec->interpreter()->execute(eval, exec, calleeGlobalObject->globalThis(), calleeGlobalObject->globalScope()));
+    return JSValue::encode(vm.interpreter->execute(eval, exec, calleeGlobalObject->globalThis(), calleeGlobalObject->globalScope()));
 }
 
 EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/JSInternalPromise.cpp b/Source/JavaScriptCore/runtime/JSInternalPromise.cpp
index 5d72ce3..2f60c6e 100644
--- a/Source/JavaScriptCore/runtime/JSInternalPromise.cpp
+++ b/Source/JavaScriptCore/runtime/JSInternalPromise.cpp
@@ -52,7 +52,8 @@
 
 JSInternalPromise* JSInternalPromise::then(ExecState* exec, JSFunction* onFulfilled, JSFunction* onRejected)
 {
-    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().thenPublicName()));
+    VM& vm = exec->vm();
+    JSObject* function = jsCast<JSObject*>(get(exec, vm.propertyNames->builtinNames().thenPublicName()));
     CallData callData;
     CallType callType = JSC::getCallData(function, callData);
     ASSERT(callType != CallType::None);
diff --git a/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp b/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
index 96754f0..0548a64 100644
--- a/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
+++ b/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp
@@ -100,7 +100,8 @@
 
 bool JSLexicalEnvironment::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
-    if (propertyName == exec->propertyNames().arguments)
+    VM& vm = exec->vm();
+    if (propertyName == vm.propertyNames->arguments)
         return false;
 
     return Base::deleteProperty(cell, exec, propertyName);
diff --git a/Source/JavaScriptCore/runtime/JSMap.cpp b/Source/JavaScriptCore/runtime/JSMap.cpp
index 8aca572..12b7b70 100644
--- a/Source/JavaScriptCore/runtime/JSMap.cpp
+++ b/Source/JavaScriptCore/runtime/JSMap.cpp
@@ -59,7 +59,8 @@
     if (structure->storedPrototype() != globalObject->mapPrototype())
         return false;
 
-    if (getDirectOffset(globalObject->vm(), globalObject->vm().propertyNames->iteratorSymbol) != invalidOffset)
+    VM& vm = globalObject->vm();
+    if (getDirectOffset(vm, vm.propertyNames->iteratorSymbol) != invalidOffset)
         return false;
 
     return true;
diff --git a/Source/JavaScriptCore/runtime/JSMapIterator.h b/Source/JavaScriptCore/runtime/JSMapIterator.h
index 576309b..66a8e3a 100644
--- a/Source/JavaScriptCore/runtime/JSMapIterator.h
+++ b/Source/JavaScriptCore/runtime/JSMapIterator.h
@@ -56,14 +56,15 @@
         HashMapBucketType* prev = m_iter.get();
         if (!prev)
             return nullptr;
+        VM& vm = exec->vm();
         HashMapBucketType* bucket = m_iter->next();
         while (bucket && bucket->deleted())
             bucket = bucket->next();
         if (!bucket) {
-            setIterator(exec->vm(), nullptr);
+            setIterator(vm, nullptr);
             return nullptr;
         }
-        setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
+        setIterator(vm, bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
         return bucket;
     }
     bool next(ExecState* exec, JSValue& value)
diff --git a/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp b/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp
index f996209..119d699 100644
--- a/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp
@@ -102,9 +102,10 @@
 {
     JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
     if (propertyNamesArray.includeStringProperties()) {
+        VM& vm = exec->vm();
         for (const auto& pair : thisObject->moduleRecord()->importEntries()) {
             const AbstractModuleRecord::ImportEntry& importEntry = pair.value;
-            if (!importEntry.isNamespace(exec->vm()))
+            if (!importEntry.isNamespace(vm))
                 propertyNamesArray.add(importEntry.localName);
         }
     }
diff --git a/Source/JavaScriptCore/runtime/JSModuleLoader.cpp b/Source/JavaScriptCore/runtime/JSModuleLoader.cpp
index 950728e..7d2a4f0 100644
--- a/Source/JavaScriptCore/runtime/JSModuleLoader.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleLoader.cpp
@@ -72,15 +72,16 @@
 
 static String printableModuleKey(ExecState* exec, JSValue key)
 {
+    VM& vm = exec->vm();
     if (key.isString() || key.isSymbol())
         return key.toPropertyKey(exec).impl();
-    return exec->propertyNames().emptyIdentifier.impl();
+    return vm.propertyNames->emptyIdentifier.impl();
 }
 
 JSValue JSModuleLoader::provide(ExecState* exec, JSValue key, Status status, const SourceCode& sourceCode)
 {
     VM& vm = exec->vm();
-    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().providePublicName()));
+    JSObject* function = jsCast<JSObject*>(get(exec, vm.propertyNames->builtinNames().providePublicName()));
     CallData callData;
     CallType callType = JSC::getCallData(function, callData);
     ASSERT(callType != CallType::None);
@@ -96,7 +97,8 @@
 
 JSInternalPromise* JSModuleLoader::loadAndEvaluateModule(ExecState* exec, JSValue moduleName, JSValue referrer, JSValue scriptFetcher)
 {
-    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().loadAndEvaluateModulePublicName()));
+    VM& vm = exec->vm();
+    JSObject* function = jsCast<JSObject*>(get(exec, vm.propertyNames->builtinNames().loadAndEvaluateModulePublicName()));
     CallData callData;
     CallType callType = JSC::getCallData(function, callData);
     ASSERT(callType != CallType::None);
@@ -111,7 +113,8 @@
 
 JSInternalPromise* JSModuleLoader::loadModule(ExecState* exec, JSValue moduleName, JSValue referrer, JSValue scriptFetcher)
 {
-    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().loadModulePublicName()));
+    VM& vm = exec->vm();
+    JSObject* function = jsCast<JSObject*>(get(exec, vm.propertyNames->builtinNames().loadModulePublicName()));
     CallData callData;
     CallType callType = JSC::getCallData(function, callData);
     ASSERT(callType != CallType::None);
@@ -126,7 +129,8 @@
 
 JSValue JSModuleLoader::linkAndEvaluateModule(ExecState* exec, JSValue moduleKey, JSValue scriptFetcher)
 {
-    JSObject* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().linkAndEvaluateModulePublicName()));
+    VM& vm = exec->vm();
+    JSObject* function = jsCast<JSObject*>(get(exec, vm.propertyNames->builtinNames().linkAndEvaluateModulePublicName()));
     CallData callData;
     CallType callType = JSC::getCallData(function, callData);
     ASSERT(callType != CallType::None);
@@ -140,7 +144,8 @@
 
 JSInternalPromise* JSModuleLoader::requestImportModule(ExecState* exec, const Identifier& moduleKey, JSValue scriptFetcher)
 {
-    auto* function = jsCast<JSObject*>(get(exec, exec->propertyNames().builtinNames().requestImportModulePublicName()));
+    VM& vm = exec->vm();
+    auto* function = jsCast<JSObject*>(get(exec, vm.propertyNames->builtinNames().requestImportModulePublicName()));
     CallData callData;
     auto callType = JSC::getCallData(function, callData);
     ASSERT(callType != CallType::None);
diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h
index 17e4846..6c28b66 100644
--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h
+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.h
@@ -37,11 +37,12 @@
 
     static JSModuleNamespaceObject* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, AbstractModuleRecord* moduleRecord, Vector<std::pair<Identifier, AbstractModuleRecord::Resolution>>&& resolutions)
     {
+        VM& vm = exec->vm();
         JSModuleNamespaceObject* object =
             new (
                 NotNull,
-                allocateCell<JSModuleNamespaceObject>(exec->vm().heap, JSModuleNamespaceObject::allocationSize(resolutions.size())))
-            JSModuleNamespaceObject(exec->vm(), structure);
+                allocateCell<JSModuleNamespaceObject>(vm.heap, JSModuleNamespaceObject::allocationSize(resolutions.size())))
+            JSModuleNamespaceObject(vm, structure);
         object->finishCreation(exec, globalObject, moduleRecord, WTFMove(resolutions));
         return object;
     }
diff --git a/Source/JavaScriptCore/runtime/JSModuleRecord.cpp b/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
index abe9958..990ae82 100644
--- a/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
@@ -205,9 +205,10 @@
 {
     if (!m_moduleProgramExecutable)
         return jsUndefined();
+    VM& vm = exec->vm();
     ModuleProgramExecutable* executable = m_moduleProgramExecutable.get();
     m_moduleProgramExecutable.clear();
-    return exec->interpreter()->executeModuleProgram(executable, exec, m_moduleEnvironment.get());
+    return vm.interpreter->executeModuleProgram(executable, exec, m_moduleEnvironment.get());
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 02f3d67..0cf361f 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -259,7 +259,7 @@
         return;
     }
 
-    m_replacerCallType = m_replacer.asObject()->methodTable()->getCallData(m_replacer.asObject().get(), m_replacerCallData);
+    m_replacerCallType = m_replacer.asObject()->methodTable(vm)->getCallData(m_replacer.asObject().get(), m_replacerCallData);
 }
 
 Local<Unknown> Stringifier::stringify(Handle<Unknown> value)
@@ -378,7 +378,7 @@
     JSObject* object = asObject(value);
 
     CallData callData;
-    if (object->methodTable()->getCallData(object, callData) != CallType::None) {
+    if (object->methodTable(vm)->getCallData(object, callData) != CallType::None) {
         if (holder.isArray()) {
             builder.appendLiteral("null");
             return StringifySucceeded;
@@ -485,7 +485,7 @@
                 m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
             else {
                 PropertyNameArray objectPropertyNames(exec, PropertyNameMode::Strings);
-                m_object->methodTable()->getOwnPropertyNames(m_object.get(), exec, objectPropertyNames, EnumerationMode());
+                m_object->methodTable(vm)->getOwnPropertyNames(m_object.get(), exec, objectPropertyNames, EnumerationMode());
                 RETURN_IF_EXCEPTION(scope, false);
                 m_propertyNames = objectPropertyNames.releaseData();
             }
@@ -515,7 +515,7 @@
             value = asArray(m_object.get())->getIndexQuickly(index);
         else {
             PropertySlot slot(m_object.get(), PropertySlot::InternalMethodType::Get);
-            if (m_object->methodTable()->getOwnPropertySlotByIndex(m_object.get(), exec, index, slot))
+            if (m_object->methodTable(vm)->getOwnPropertySlotByIndex(m_object.get(), exec, index, slot))
                 value = slot.getValue(exec, index);
             else
                 value = jsUndefined();
@@ -534,7 +534,7 @@
         // Get the value.
         PropertySlot slot(m_object.get(), PropertySlot::InternalMethodType::Get);
         Identifier& propertyName = m_propertyNames->propertyNameVector()[index];
-        if (!m_object->methodTable()->getOwnPropertySlot(m_object.get(), exec, propertyName, slot))
+        if (!m_object->methodTable(vm)->getOwnPropertySlot(m_object.get(), exec, propertyName, slot))
             return true;
         JSValue value = slot.getValue(exec, propertyName);
         RETURN_IF_EXCEPTION(scope, false);
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 031c0c62..95c15cf 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -533,7 +533,7 @@
 
     ExecState* exec = globalObject->globalExec();
     PropertySlot slot(object->getPrototypeDirect(), PropertySlot::InternalMethodType::VMInquiry);
-    PropertyName constructor(exec->propertyNames().constructor);
+    PropertyName constructor(vm.propertyNames->constructor);
     if (object->getPropertySlot(exec, constructor, slot)) {
         if (slot.isValue()) {
             JSValue constructorValue = slot.getValue(exec, constructor);
@@ -554,7 +554,7 @@
         scope.clearException();
 
     if (prototypeFunctionName.isNull() || prototypeFunctionName == "Object") {
-        String tableClassName = object->methodTable()->className(object);
+        String tableClassName = object->methodTable(vm)->className(object);
         if (!tableClassName.isNull() && tableClassName != "Object")
             return tableClassName;
 
@@ -817,6 +817,7 @@
 
 bool JSObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
 {
+    VM& vm = exec->vm();
     JSObject* thisObject = jsCast<JSObject*>(cell);
     
     if (propertyName > MAX_ARRAY_INDEX) {
@@ -829,14 +830,14 @@
         break;
         
     case ALL_UNDECIDED_INDEXING_TYPES: {
-        thisObject->convertUndecidedForValue(exec->vm(), value);
+        thisObject->convertUndecidedForValue(vm, value);
         // Reloop.
         return putByIndex(cell, exec, propertyName, value, shouldThrow);
     }
         
     case ALL_INT32_INDEXING_TYPES: {
         if (!value.isInt32()) {
-            thisObject->convertInt32ForValue(exec->vm(), value);
+            thisObject->convertInt32ForValue(vm, value);
             return putByIndex(cell, exec, propertyName, value, shouldThrow);
         }
         FALLTHROUGH;
@@ -846,7 +847,7 @@
         Butterfly* butterfly = thisObject->butterfly();
         if (propertyName >= butterfly->vectorLength())
             break;
-        butterfly->contiguous()[propertyName].set(exec->vm(), thisObject, value);
+        butterfly->contiguous()[propertyName].set(vm, thisObject, value);
         if (propertyName >= butterfly->publicLength())
             butterfly->setPublicLength(propertyName + 1);
         return true;
@@ -854,13 +855,13 @@
         
     case ALL_DOUBLE_INDEXING_TYPES: {
         if (!value.isNumber()) {
-            thisObject->convertDoubleToContiguous(exec->vm());
+            thisObject->convertDoubleToContiguous(vm);
             // Reloop.
             return putByIndex(cell, exec, propertyName, value, shouldThrow);
         }
         double valueAsDouble = value.asNumber();
         if (valueAsDouble != valueAsDouble) {
-            thisObject->convertDoubleToContiguous(exec->vm());
+            thisObject->convertDoubleToContiguous(vm);
             // Reloop.
             return putByIndex(cell, exec, propertyName, value, shouldThrow);
         }
@@ -891,7 +892,7 @@
         } else if (!valueSlot)
             ++storage->m_numValuesInVector;
         
-        valueSlot.set(exec->vm(), thisObject, value);
+        valueSlot.set(vm, thisObject, value);
         return true;
     }
         
@@ -920,7 +921,7 @@
             ++storage->m_numValuesInVector;
         }
         
-        valueSlot.set(exec->vm(), thisObject, value);
+        valueSlot.set(vm, thisObject, value);
         return true;
     }
         
@@ -1945,20 +1946,20 @@
 
     JSValue value;
     if (hint == PreferString) {
-        value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
+        value = callToPrimitiveFunction(exec, this, vm.propertyNames->toString, hint);
         ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
-        value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
+        value = callToPrimitiveFunction(exec, this, vm.propertyNames->valueOf, hint);
         ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
     } else {
-        value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
+        value = callToPrimitiveFunction(exec, this, vm.propertyNames->valueOf, hint);
         ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
-        value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
+        value = callToPrimitiveFunction(exec, this, vm.propertyNames->toString, hint);
         ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
@@ -1979,12 +1980,12 @@
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    JSValue value = callToPrimitiveFunction<TypeHintMode::TakesHint>(exec, this, exec->propertyNames().toPrimitiveSymbol, preferredType);
+    JSValue value = callToPrimitiveFunction<TypeHintMode::TakesHint>(exec, this, vm.propertyNames->toPrimitiveSymbol, preferredType);
     RETURN_IF_EXCEPTION(scope, { });
     if (value)
         return value;
 
-    return this->methodTable(exec->vm())->defaultValue(this, exec, preferredType);
+    return this->methodTable(vm)->defaultValue(this, exec, preferredType);
 }
 
 bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result) const
@@ -2043,7 +2044,7 @@
 
     TypeInfo info = structure(vm)->typeInfo();
     if (info.implementsDefaultHasInstance()) {
-        JSValue prototype = get(exec, exec->propertyNames().prototype);
+        JSValue prototype = get(exec, vm.propertyNames->prototype);
         RETURN_IF_EXCEPTION(scope, false);
         return defaultHasInstance(exec, value, prototype);
     }
@@ -2057,7 +2058,7 @@
 {
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
-    JSValue hasInstanceValue = get(exec, exec->propertyNames().hasInstanceSymbol);
+    JSValue hasInstanceValue = get(exec, vm.propertyNames->hasInstanceSymbol);
     RETURN_IF_EXCEPTION(scope, false);
 
     return hasInstance(exec, value, hasInstanceValue);
@@ -2127,9 +2128,10 @@
 
 void JSObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     if (!mode.includeJSObjectProperties()) {
         // We still have to get non-indexed properties from any subclasses of JSObject that have them.
-        object->methodTable(exec->vm())->getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
+        object->methodTable(vm)->getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
         return;
     }
 
@@ -2198,7 +2200,7 @@
         }
     }
 
-    object->methodTable(exec->vm())->getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
+    object->methodTable(vm)->getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
 }
 
 void JSObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
@@ -2862,7 +2864,7 @@
     }
         
     case ALL_UNDECIDED_INDEXING_TYPES: {
-        convertUndecidedForValue(exec->vm(), value);
+        convertUndecidedForValue(vm, value);
         // Reloop.
         return putDirectIndex(exec, i, value, attributes, mode);
     }
@@ -3211,11 +3213,12 @@
 
 static JSCustomGetterSetterFunction* getCustomGetterSetterFunctionForGetterSetter(ExecState* exec, PropertyName propertyName, CustomGetterSetter* getterSetter, JSCustomGetterSetterFunction::Type type)
 {
+    VM& vm = exec->vm();
     auto key = std::make_pair(getterSetter, (int)type);
-    JSCustomGetterSetterFunction* customGetterSetterFunction = exec->vm().customGetterSetterFunctionMap.get(key);
+    JSCustomGetterSetterFunction* customGetterSetterFunction = vm.customGetterSetterFunctionMap.get(key);
     if (!customGetterSetterFunction) {
-        customGetterSetterFunction = JSCustomGetterSetterFunction::create(exec->vm(), exec->lexicalGlobalObject(), getterSetter, type, propertyName.publicName());
-        exec->vm().customGetterSetterFunctionMap.set(key, customGetterSetterFunction);
+        customGetterSetterFunction = JSCustomGetterSetterFunction::create(vm, exec->lexicalGlobalObject(), getterSetter, type, propertyName.publicName());
+        vm.customGetterSetterFunctionMap.set(key, customGetterSetterFunction);
     }
     return customGetterSetterFunction;
 }
@@ -3253,10 +3256,10 @@
         if (slot.isCustomAccessor())
             getterSetter = slot.customGetterSetter();
         else {
-            JSValue maybeGetterSetter = thisObject->getDirect(exec->vm(), propertyName);
+            JSValue maybeGetterSetter = thisObject->getDirect(vm, propertyName);
             if (!maybeGetterSetter) {
                 thisObject->reifyAllStaticProperties(exec);
-                maybeGetterSetter = thisObject->getDirect(exec->vm(), propertyName);
+                maybeGetterSetter = thisObject->getDirect(vm, propertyName);
             }
 
             ASSERT(maybeGetterSetter);
@@ -3622,7 +3625,7 @@
         return jsUndefined();
     }
 
-    callType = method.asCell()->methodTable()->getCallData(method.asCell(), callData);
+    callType = method.asCell()->methodTable(vm)->getCallData(method.asCell(), callData);
     if (callType == CallType::None) {
         throwVMTypeError(exec, scope, errorMessage);
         return jsUndefined();
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 968c54a..4be8636 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -1004,7 +1004,7 @@
         
     template<PutMode>
     bool putDirectInternal(VM&, PropertyName, JSValue, unsigned attr, PutPropertySlot&);
-    bool canPerformFastPutInline(ExecState* exec, VM&, PropertyName);
+    bool canPerformFastPutInline(VM&, PropertyName);
 
     JS_EXPORT_PRIVATE NEVER_INLINE bool putInlineSlow(ExecState*, PropertyName, JSValue, PutPropertySlot&);
 
@@ -1147,28 +1147,30 @@
 inline JSObject* JSObject::createRawObject(
     ExecState* exec, Structure* structure, Butterfly* butterfly)
 {
+    VM& vm = exec->vm();
     JSObject* finalObject = new (
         NotNull, 
         allocateCell<JSFinalObject>(
-            *exec->heap(),
+            vm.heap,
             JSFinalObject::allocationSize(structure->inlineCapacity())
         )
-    ) JSObject(exec->vm(), structure, butterfly);
-    finalObject->finishCreation(exec->vm());
+    ) JSObject(vm, structure, butterfly);
+    finalObject->finishCreation(vm);
     return finalObject;
 }
 
 inline JSFinalObject* JSFinalObject::create(
     ExecState* exec, Structure* structure, Butterfly* butterfly)
 {
+    VM& vm = exec->vm();
     JSFinalObject* finalObject = new (
         NotNull, 
         allocateCell<JSFinalObject>(
-            *exec->heap(),
+            vm.heap,
             allocationSize(structure->inlineCapacity())
         )
-    ) JSFinalObject(exec->vm(), structure, butterfly);
-    finalObject->finishCreation(exec->vm());
+    ) JSFinalObject(vm, structure, butterfly);
+    finalObject->finishCreation(vm);
     return finalObject;
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSObjectInlines.h b/Source/JavaScriptCore/runtime/JSObjectInlines.h
index f49a302..e48e9b9 100644
--- a/Source/JavaScriptCore/runtime/JSObjectInlines.h
+++ b/Source/JavaScriptCore/runtime/JSObjectInlines.h
@@ -60,9 +60,9 @@
     }
 }
 
-ALWAYS_INLINE bool JSObject::canPerformFastPutInline(ExecState* exec, VM& vm, PropertyName propertyName)
+ALWAYS_INLINE bool JSObject::canPerformFastPutInline(VM& vm, PropertyName propertyName)
 {
-    if (UNLIKELY(propertyName == exec->propertyNames().underscoreProto))
+    if (UNLIKELY(propertyName == vm.propertyNames->underscoreProto))
         return false;
 
     // Check if there are any setters or getters in the prototype chain
@@ -211,7 +211,7 @@
     if (std::optional<uint32_t> index = parseIndex(propertyName))
         return putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
 
-    if (thisObject->canPerformFastPutInline(exec, vm, propertyName)) {
+    if (thisObject->canPerformFastPutInline(vm, propertyName)) {
         ASSERT(!thisObject->structure(vm)->prototypeChainMayInterceptStoreTo(vm, propertyName));
         if (!thisObject->putDirectInternal<PutModePut>(vm, propertyName, value, 0, slot))
             return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral(ReadonlyPropertyWriteError));
@@ -226,10 +226,11 @@
 // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-hasownproperty
 ALWAYS_INLINE bool JSObject::hasOwnProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot) const
 {
+    VM& vm = exec->vm();
     ASSERT(slot.internalMethodType() == PropertySlot::InternalMethodType::GetOwnProperty);
-    if (LIKELY(const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlot == JSObject::getOwnPropertySlot))
+    if (LIKELY(const_cast<JSObject*>(this)->methodTable(vm)->getOwnPropertySlot == JSObject::getOwnPropertySlot))
         return JSObject::getOwnPropertySlot(const_cast<JSObject*>(this), exec, propertyName, slot);
-    return const_cast<JSObject*>(this)->methodTable(exec->vm())->getOwnPropertySlot(const_cast<JSObject*>(this), exec, propertyName, slot);
+    return const_cast<JSObject*>(this)->methodTable(vm)->getOwnPropertySlot(const_cast<JSObject*>(this), exec, propertyName, slot);
 }
 
 ALWAYS_INLINE bool JSObject::hasOwnProperty(ExecState* exec, PropertyName propertyName) const
diff --git a/Source/JavaScriptCore/runtime/JSScope.cpp b/Source/JavaScriptCore/runtime/JSScope.cpp
index 6bd82cf..36dead5 100644
--- a/Source/JavaScriptCore/runtime/JSScope.cpp
+++ b/Source/JavaScriptCore/runtime/JSScope.cpp
@@ -201,7 +201,7 @@
     if (scope->type() != WithScopeType)
         return false;
 
-    JSValue unscopables = object->get(exec, exec->propertyNames().unscopablesSymbol);
+    JSValue unscopables = object->get(exec, vm.propertyNames->unscopablesSymbol);
     RETURN_IF_EXCEPTION(throwScope, false);
     if (!unscopables.isObject())
         return false;
@@ -258,6 +258,7 @@
 
 JSValue JSScope::resolveScopeForHoistingFuncDeclInEval(ExecState* exec, JSScope* scope, const Identifier& ident)
 {
+    VM& vm = exec->vm();
     auto returnPredicate = [&] (JSScope* scope) -> bool {
         return scope->isVarScope();
     };
@@ -267,8 +268,8 @@
     JSObject* object = resolve(exec, scope, ident, returnPredicate, skipPredicate);
     
     bool result = false;
-    if (JSScope* scope = jsDynamicCast<JSScope*>(exec->vm(), object)) {
-        if (SymbolTable* scopeSymbolTable = scope->symbolTable(exec->vm())) {
+    if (JSScope* scope = jsDynamicCast<JSScope*>(vm, object)) {
+        if (SymbolTable* scopeSymbolTable = scope->symbolTable(vm)) {
             result = scope->isGlobalObject()
                 ? JSObject::isExtensible(object, exec)
                 : scopeSymbolTable->scopeType() == SymbolTable::ScopeType::VarScope;
diff --git a/Source/JavaScriptCore/runtime/JSSet.cpp b/Source/JavaScriptCore/runtime/JSSet.cpp
index e4f4a16..abee613 100644
--- a/Source/JavaScriptCore/runtime/JSSet.cpp
+++ b/Source/JavaScriptCore/runtime/JSSet.cpp
@@ -59,7 +59,8 @@
     if (structure->storedPrototype() != globalObject->jsSetPrototype())
         return false;
 
-    if (getDirectOffset(globalObject->vm(), globalObject->vm().propertyNames->iteratorSymbol) != invalidOffset)
+    VM& vm = globalObject->vm();
+    if (getDirectOffset(vm, vm.propertyNames->iteratorSymbol) != invalidOffset)
         return false;
 
     return true;
diff --git a/Source/JavaScriptCore/runtime/JSSetIterator.h b/Source/JavaScriptCore/runtime/JSSetIterator.h
index 051a989..bd33705 100644
--- a/Source/JavaScriptCore/runtime/JSSetIterator.h
+++ b/Source/JavaScriptCore/runtime/JSSetIterator.h
@@ -56,14 +56,15 @@
         HashMapBucketType* prev = m_iter.get();
         if (!prev)
             return nullptr;
+        VM& vm = exec->vm();
         HashMapBucketType* bucket = m_iter->next();
         while (bucket && bucket->deleted())
             bucket = bucket->next();
         if (!bucket) {
-            setIterator(exec->vm(), nullptr);
+            setIterator(vm, nullptr);
             return nullptr;
         }
-        setIterator(exec->vm(), bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
+        setIterator(vm, bucket); // We keep m_iter on the last value since the first thing we do in this function is call next().
         return bucket;
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 04969f3..d87c6ed 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -442,7 +442,8 @@
 
 bool JSString::getStringPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
 {
-    if (propertyName == exec->propertyNames().length) {
+    VM& vm = exec->vm();
+    if (propertyName == vm.propertyNames->length) {
         descriptor.setDescriptor(jsNumber(length()), DontEnum | DontDelete | ReadOnly);
         return true;
     }
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index e604184..cf52d07 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -669,7 +669,8 @@
 
 ALWAYS_INLINE bool JSString::getStringPropertySlot(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
-    if (propertyName == exec->propertyNames().length) {
+    VM& vm = exec->vm();
+    if (propertyName == vm.propertyNames->length) {
         slot.setValue(this, DontEnum | DontDelete | ReadOnly, jsNumber(length()));
         return true;
     }
diff --git a/Source/JavaScriptCore/runtime/MapConstructor.cpp b/Source/JavaScriptCore/runtime/MapConstructor.cpp
index 7985083..0a50770 100644
--- a/Source/JavaScriptCore/runtime/MapConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/MapConstructor.cpp
@@ -76,7 +76,7 @@
     JSMap* map = JSMap::create(exec, vm, mapStructure);
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
-    JSValue adderFunction = map->JSObject::get(exec, exec->propertyNames().set);
+    JSValue adderFunction = map->JSObject::get(exec, vm.propertyNames->set);
     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
     CallData adderFunctionCallData;
diff --git a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.cpp b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.cpp
index b55e83f..d4e8306 100644
--- a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.cpp
+++ b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.cpp
@@ -58,7 +58,7 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-    ModuleProgramExecutable* executable = new (NotNull, allocateCell<ModuleProgramExecutable>(*exec->heap())) ModuleProgramExecutable(exec, source);
+    ModuleProgramExecutable* executable = new (NotNull, allocateCell<ModuleProgramExecutable>(vm.heap)) ModuleProgramExecutable(exec, source);
     executable->finishCreation(exec->vm());
 
     ParserError error;
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 66c488e..aa350fb 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -306,7 +306,7 @@
 
     // Return the result of calling the [[Call]] internal method of toString passing the this value and no arguments.
     scope.release();
-    return JSValue::encode(call(exec, toString, callType, callData, thisValue, exec->emptyList()));
+    return JSValue::encode(call(exec, toString, callType, callData, thisValue, *vm.emptyList));
 }
 
 EncodedJSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ProgramExecutable.h b/Source/JavaScriptCore/runtime/ProgramExecutable.h
index b67fe82..d17482a 100644
--- a/Source/JavaScriptCore/runtime/ProgramExecutable.h
+++ b/Source/JavaScriptCore/runtime/ProgramExecutable.h
@@ -37,8 +37,9 @@
 
     static ProgramExecutable* create(ExecState* exec, const SourceCode& source)
     {
-        ProgramExecutable* executable = new (NotNull, allocateCell<ProgramExecutable>(*exec->heap())) ProgramExecutable(exec, source);
-        executable->finishCreation(exec->vm());
+        VM& vm = exec->vm();
+        ProgramExecutable* executable = new (NotNull, allocateCell<ProgramExecutable>(vm.heap)) ProgramExecutable(exec, source);
+        executable->finishCreation(vm);
         return executable;
     }
 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 8de93b0..af69849 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -62,7 +62,8 @@
 
 bool RegExpObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
-    if (propertyName == exec->propertyNames().lastIndex) {
+    VM& vm = exec->vm();
+    if (propertyName == vm.propertyNames->lastIndex) {
         RegExpObject* regExp = asRegExpObject(object);
         unsigned attributes = regExp->m_lastIndexIsWritable ? DontDelete | DontEnum : DontDelete | DontEnum | ReadOnly;
         slot.setValue(regExp, attributes, regExp->getLastIndex());
@@ -73,29 +74,33 @@
 
 bool RegExpObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
-    if (propertyName == exec->propertyNames().lastIndex)
+    VM& vm = exec->vm();
+    if (propertyName == vm.propertyNames->lastIndex)
         return false;
     return Base::deleteProperty(cell, exec, propertyName);
 }
 
 void RegExpObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     if (mode.includeDontEnumProperties())
-        propertyNames.add(exec->propertyNames().lastIndex);
+        propertyNames.add(vm.propertyNames->lastIndex);
     Base::getOwnNonIndexPropertyNames(object, exec, propertyNames, mode);
 }
 
 void RegExpObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     if (mode.includeDontEnumProperties())
-        propertyNames.add(exec->propertyNames().lastIndex);
+        propertyNames.add(vm.propertyNames->lastIndex);
     Base::getPropertyNames(object, exec, propertyNames, mode);
 }
 
 void RegExpObject::getGenericPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     if (mode.includeDontEnumProperties())
-        propertyNames.add(exec->propertyNames().lastIndex);
+        propertyNames.add(vm.propertyNames->lastIndex);
     Base::getGenericPropertyNames(object, exec, propertyNames, mode);
 }
 
@@ -144,12 +149,13 @@
 
 bool RegExpObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
     RegExpObject* thisObject = jsCast<RegExpObject*>(cell);
 
     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
 
-    if (propertyName == exec->propertyNames().lastIndex) {
+    if (propertyName == vm.propertyNames->lastIndex) {
         bool result = asRegExpObject(cell)->setLastIndex(exec, value, slot.isStrictMode());
         slot.setCustomValue(asRegExpObject(cell), slot.isStrictMode()
             ? regExpObjectSetLastIndexStrict
diff --git a/Source/JavaScriptCore/runtime/ScopedArguments.h b/Source/JavaScriptCore/runtime/ScopedArguments.h
index 53e2738..3900847 100644
--- a/Source/JavaScriptCore/runtime/ScopedArguments.h
+++ b/Source/JavaScriptCore/runtime/ScopedArguments.h
@@ -72,8 +72,9 @@
     
     uint32_t length(ExecState* exec) const
     {
+        VM& vm = exec->vm();
         if (UNLIKELY(m_overrodeThings))
-            return get(exec, exec->propertyNames().length).toUInt32(exec);
+            return get(exec, vm.propertyNames->length).toUInt32(exec);
         return internalLength();
     }
     
diff --git a/Source/JavaScriptCore/runtime/StrictEvalActivation.h b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
index d800e96..b1a5f9e 100644
--- a/Source/JavaScriptCore/runtime/StrictEvalActivation.h
+++ b/Source/JavaScriptCore/runtime/StrictEvalActivation.h
@@ -36,8 +36,9 @@
 
     static StrictEvalActivation* create(ExecState* exec, JSScope* currentScope)
     {
-        StrictEvalActivation* lexicalEnvironment = new (NotNull, allocateCell<StrictEvalActivation>(*exec->heap())) StrictEvalActivation(exec, currentScope);
-        lexicalEnvironment->finishCreation(exec->vm());
+        VM& vm = exec->vm();
+        StrictEvalActivation* lexicalEnvironment = new (NotNull, allocateCell<StrictEvalActivation>(vm.heap)) StrictEvalActivation(exec, currentScope);
+        lexicalEnvironment->finishCreation(vm);
         return lexicalEnvironment;
     }
 
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index 7ef3745..6332c11 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -96,7 +96,8 @@
 
 static bool isStringOwnProperty(ExecState* exec, StringObject* object, PropertyName propertyName)
 {
-    if (propertyName == exec->propertyNames().length)
+    VM& vm = exec->vm();
+    if (propertyName == vm.propertyNames->length)
         return true;
     if (std::optional<uint32_t> index = parseIndex(propertyName)) {
         if (object->internalValue()->canGetIndex(index.value()))
@@ -132,8 +133,9 @@
 
 bool StringObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
 {
+    VM& vm = exec->vm();
     StringObject* thisObject = jsCast<StringObject*>(cell);
-    if (propertyName == exec->propertyNames().length)
+    if (propertyName == vm.propertyNames->length)
         return false;
     std::optional<uint32_t> index = parseIndex(propertyName);
     if (index && thisObject->internalValue()->canGetIndex(index.value()))
@@ -162,9 +164,10 @@
 
 void StringObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
+    VM& vm = exec->vm();
     StringObject* thisObject = jsCast<StringObject*>(object);
     if (mode.includeDontEnumProperties())
-        propertyNames.add(exec->propertyNames().length);
+        propertyNames.add(vm.propertyNames->length);
     return JSObject::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
 }
 
diff --git a/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp b/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp
index 5009d5e..f706969 100644
--- a/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp
+++ b/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp
@@ -117,9 +117,10 @@
 
 void JSDollarVMPrototype::gc(ExecState* exec)
 {
+    VM& vm = exec->vm();
     if (!ensureCurrentThreadOwnsJSLock(exec))
         return;
-    exec->heap()->collectNow(Sync, CollectionScope::Full);
+    vm.heap.collectNow(Sync, CollectionScope::Full);
 }
     
 static EncodedJSValue JSC_HOST_CALL functionGC(ExecState* exec)
@@ -130,9 +131,10 @@
 
 void JSDollarVMPrototype::edenGC(ExecState* exec)
 {
+    VM& vm = exec->vm();
     if (!ensureCurrentThreadOwnsJSLock(exec))
         return;
-    exec->heap()->collectSync(CollectionScope::Eden);
+    vm.heap.collectSync(CollectionScope::Eden);
 }
 
 static EncodedJSValue JSC_HOST_CALL functionEdenGC(ExecState* exec)
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
index 598681e..5c5bfc6 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
@@ -342,7 +342,7 @@
     if (JSObject* startFunction = m_startFunction.get()) {
         CallData callData;
         CallType callType = JSC::getCallData(startFunction, callData);
-        call(exec, startFunction, callType, callData, jsUndefined(), exec->emptyList());
+        call(exec, startFunction, callType, callData, jsUndefined(), *vm.emptyList);
         RETURN_IF_EXCEPTION(scope, { });
     }