Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
https://bugs.webkit.org/show_bug.cgi?id=161171

Reviewed by Filip Pizlo and Geoffrey Garen.

Source/JavaScriptCore:

This is the first step towards having a mechanism (using the ThrowScope) to
verify that we're properly checking for exceptions in all the needed places.
See comments at the top of ThrowScope.cpp for details on how the ThrowScope works.

This patch only introduces the ThrowScope, and changes all throw sites to throw
using a ThrowScope instance.  VM::throwException() functions are now private, and
cannot be accessed directly.  All throws must now go through a ThrowScope.

Verification is disabled for the moment until we can fix all the verification
failures that will show up.

I also did a smoke test of the ThrowScope mechanisms by running verification on
the JSTests/stress/op-add-exceptions.js test with a local build with verification
turned on.

Performance is neutral on aggregate with this patch.

Misc other changes:
- deleted the unused CALL_THROW() macro from LLIntSlowPaths.cpp.
- moved createListFromArrayLike() from JSObject.h to JSObjectInlines.h.

* API/APICallbackFunction.h:
(JSC::APICallbackFunction::call):
(JSC::APICallbackFunction::construct):
* API/JSCallbackObjectFunctions.h:
(JSC::JSCallbackObject<Parent>::getOwnPropertySlot):
(JSC::JSCallbackObject<Parent>::defaultValue):
(JSC::JSCallbackObject<Parent>::put):
(JSC::JSCallbackObject<Parent>::putByIndex):
(JSC::JSCallbackObject<Parent>::deleteProperty):
(JSC::JSCallbackObject<Parent>::construct):
(JSC::JSCallbackObject<Parent>::customHasInstance):
(JSC::JSCallbackObject<Parent>::call):
(JSC::JSCallbackObject<Parent>::getStaticValue):
(JSC::JSCallbackObject<Parent>::staticFunctionGetter):
(JSC::JSCallbackObject<Parent>::callbackGetter):
* API/JSTypedArray.cpp:
(createTypedArray):
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGOperations.cpp:
(JSC::DFG::newTypedArrayWithSize):
* inspector/JSInjectedScriptHost.cpp:
(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
* inspector/JSInjectedScriptHostPrototype.cpp:
(Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):
(Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):
(Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):
(Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):
(Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):
(Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):
(Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):
(Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):
* inspector/JSJavaScriptCallFrame.cpp:
(Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
* inspector/JSJavaScriptCallFramePrototype.cpp:
(Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):
(Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):
(Inspector::jsJavaScriptCallFrameAttributeCaller):
(Inspector::jsJavaScriptCallFrameAttributeSourceID):
(Inspector::jsJavaScriptCallFrameAttributeLine):
(Inspector::jsJavaScriptCallFrameAttributeColumn):
(Inspector::jsJavaScriptCallFrameAttributeFunctionName):
(Inspector::jsJavaScriptCallFrameAttributeScopeChain):
(Inspector::jsJavaScriptCallFrameAttributeThisObject):
(Inspector::jsJavaScriptCallFrameAttributeType):
(Inspector::jsJavaScriptCallFrameIsTailDeleted):
* interpreter/CachedCall.h:
(JSC::CachedCall::CachedCall):
* interpreter/Interpreter.cpp:
(JSC::eval):
(JSC::sizeOfVarargs):
(JSC::sizeFrameForForwardArguments):
(JSC::sizeFrameForVarargs):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):
(JSC::Interpreter::prepareForRepeatCall):
* jit/JITOperations.cpp:
* jsc.cpp:
(WTF::CustomGetter::customGetter):
(WTF::RuntimeArray::lengthGetter):
(functionCreateElement):
(functionRun):
(functionRunString):
(functionLoad):
(functionLoadString):
(functionReadFile):
(functionCheckSyntax):
(functionTransferArrayBuffer):
(functionLoadModule):
(functionCheckModuleSyntax):
(functionSamplingProfilerStackTraces):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::getByVal):
(JSC::LLInt::handleHostCall):
(JSC::LLInt::setUpCall):
(JSC::LLInt::llint_throw_stack_overflow_error):
* runtime/ArrayConstructor.cpp:
(JSC::constructArrayWithSizeQuirk):
* runtime/ArrayConstructor.h:
(JSC::isArray):
* runtime/ArrayPrototype.cpp:
(JSC::shift):
(JSC::unshift):
(JSC::arrayProtoFuncToString):
(JSC::arrayProtoFuncPop):
(JSC::arrayProtoFuncReverse):
(JSC::arrayProtoFuncSplice):
(JSC::concatAppendOne):
(JSC::arrayProtoPrivateFuncConcatMemcpy):
* runtime/BooleanPrototype.cpp:
(JSC::booleanProtoFuncToString):
(JSC::booleanProtoFuncValueOf):
* runtime/CommonSlowPaths.cpp:
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::opIn):
* runtime/CommonSlowPathsExceptions.cpp:
(JSC::CommonSlowPaths::interpreterThrowInCaller):
* runtime/ConstructData.cpp:
(JSC::construct):
* runtime/DatePrototype.cpp:
(JSC::formateDateInstance):
(JSC::dateProtoFuncToISOString):
(JSC::dateProtoFuncToLocaleString):
(JSC::dateProtoFuncToLocaleDateString):
(JSC::dateProtoFuncToLocaleTimeString):
(JSC::dateProtoFuncToPrimitiveSymbol):
(JSC::dateProtoFuncGetTime):
(JSC::dateProtoFuncGetFullYear):
(JSC::dateProtoFuncGetUTCFullYear):
(JSC::dateProtoFuncGetMonth):
(JSC::dateProtoFuncGetUTCMonth):
(JSC::dateProtoFuncGetDate):
(JSC::dateProtoFuncGetUTCDate):
(JSC::dateProtoFuncGetDay):
(JSC::dateProtoFuncGetUTCDay):
(JSC::dateProtoFuncGetHours):
(JSC::dateProtoFuncGetUTCHours):
(JSC::dateProtoFuncGetMinutes):
(JSC::dateProtoFuncGetUTCMinutes):
(JSC::dateProtoFuncGetSeconds):
(JSC::dateProtoFuncGetUTCSeconds):
(JSC::dateProtoFuncGetMilliSeconds):
(JSC::dateProtoFuncGetUTCMilliseconds):
(JSC::dateProtoFuncGetTimezoneOffset):
(JSC::dateProtoFuncSetTime):
(JSC::setNewValueFromTimeArgs):
(JSC::setNewValueFromDateArgs):
(JSC::dateProtoFuncSetYear):
(JSC::dateProtoFuncGetYear):
(JSC::dateProtoFuncToJSON):
* runtime/Error.cpp:
(JSC::throwConstructorCannotBeCalledAsFunctionTypeError):
(JSC::throwTypeError):
(JSC::throwSyntaxError):
* runtime/Error.h:
(JSC::throwRangeError):
(JSC::throwVMError):
(JSC::throwVMTypeError):
(JSC::throwVMRangeError):
(JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
(JSC::StrictModeTypeErrorFunction::callThrowTypeError):
* runtime/ErrorPrototype.cpp:
(JSC::errorProtoFuncToString):
* runtime/ExceptionFuzz.cpp:
(JSC::doExceptionFuzzing):
* runtime/ExceptionHelpers.cpp:
(JSC::throwOutOfMemoryError):
(JSC::throwStackOverflowError):
(JSC::throwTerminatedExecutionException):
* runtime/ExceptionHelpers.h:
* runtime/Executable.cpp:
(JSC::ScriptExecutable::newCodeBlockFor):
(JSC::EvalExecutable::create):
* runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
(JSC::constructFunctionSkippingEvalEnabledCheck):
* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncToString):
(JSC::functionProtoFuncBind):
* runtime/GetterSetter.cpp:
(JSC::callSetter):
* runtime/IntlCollator.cpp:
(JSC::IntlCollator::compareStrings):
* runtime/IntlCollatorPrototype.cpp:
(JSC::IntlCollatorPrototypeGetterCompare):
(JSC::IntlCollatorPrototypeFuncResolvedOptions):
* runtime/IntlDateTimeFormat.cpp:
(JSC::IntlDateTimeFormat::initializeDateTimeFormat):
(JSC::IntlDateTimeFormat::format):
* runtime/IntlDateTimeFormatPrototype.cpp:
(JSC::IntlDateTimeFormatPrototypeGetterFormat):
(JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
* runtime/IntlNumberFormat.cpp:
(JSC::IntlNumberFormat::initializeNumberFormat):
(JSC::IntlNumberFormat::formatNumber):
* runtime/IntlNumberFormatPrototype.cpp:
(JSC::IntlNumberFormatPrototypeGetterFormat):
(JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
* runtime/IntlObject.cpp:
(JSC::intlStringOption):
(JSC::intlNumberOption):
(JSC::canonicalizeLocaleList):
(JSC::lookupSupportedLocales):
* runtime/IteratorOperations.cpp:
(JSC::iteratorNext):
(JSC::iteratorClose):
(JSC::createIteratorResultObject):
(JSC::iteratorForIterable):
* runtime/JSArray.cpp:
(JSC::JSArray::defineOwnProperty):
(JSC::JSArray::put):
(JSC::JSArray::appendMemcpy):
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::unshiftCountWithArrayStorage):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
* runtime/JSArrayBufferConstructor.cpp:
(JSC::constructArrayBuffer):
(JSC::callArrayBuffer):
* runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferProtoFuncSlice):
* runtime/JSCInlines.h:
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toObjectSlowCase):
(JSC::JSValue::synthesizePrototype):
(JSC::JSValue::putToPrimitive):
(JSC::JSValue::putToPrimitiveByIndex):
(JSC::JSValue::toStringSlowCase):
* runtime/JSCJSValueInlines.h:
(JSC::toPreferredPrimitiveType):
(JSC::JSValue::requireObjectCoercible):
* runtime/JSDataView.cpp:
(JSC::JSDataView::create):
* runtime/JSDataViewPrototype.cpp:
(JSC::getData):
(JSC::setData):
(JSC::dataViewProtoGetterBuffer):
(JSC::dataViewProtoGetterByteLength):
(JSC::dataViewProtoGetterByteOffset):
* runtime/JSFunction.cpp:
(JSC::callHostFunctionAsConstructor):
(JSC::JSFunction::callerGetter):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGenericTypedArrayView.h:
(JSC::JSGenericTypedArrayView::setIndex):
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewFromIterator):
(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::constructGenericTypedArrayView):
(JSC::callGenericTypedArrayView):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::create):
(JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):
(JSC::JSGenericTypedArrayView<Adaptor>::validateRange):
(JSC::JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::speciesConstruct):
(JSC::genericTypedArrayViewProtoFuncSet):
(JSC::genericTypedArrayViewProtoFuncCopyWithin):
(JSC::genericTypedArrayViewProtoFuncIncludes):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncJoin):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
(JSC::genericTypedArrayViewProtoGetterFuncBuffer):
(JSC::genericTypedArrayViewProtoGetterFuncLength):
(JSC::genericTypedArrayViewProtoGetterFuncByteLength):
(JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
(JSC::genericTypedArrayViewProtoFuncReverse):
(JSC::genericTypedArrayViewPrivateFuncSort):
(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::createEvalCodeBlock):
(JSC::JSGlobalObject::createModuleProgramCodeBlock):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::encode):
(JSC::decode):
(JSC::globalFuncEval):
(JSC::globalFuncThrowTypeError):
(JSC::globalFuncThrowTypeErrorArgumentsCalleeAndCaller):
(JSC::globalFuncProtoGetter):
(JSC::globalFuncProtoSetter):
* runtime/JSModuleEnvironment.cpp:
(JSC::JSModuleEnvironment::put):
* runtime/JSModuleNamespaceObject.cpp:
(JSC::JSModuleNamespaceObject::getOwnPropertySlot):
(JSC::JSModuleNamespaceObject::put):
(JSC::JSModuleNamespaceObject::putByIndex):
(JSC::JSModuleNamespaceObject::defineOwnProperty):
(JSC::moduleNamespaceObjectSymbolIterator):
* runtime/JSModuleRecord.cpp:
(JSC::JSModuleRecord::getModuleNamespace):
(JSC::JSModuleRecord::link):
(JSC::JSModuleRecord::instantiateDeclarations):
* runtime/JSONObject.cpp:
(JSC::Stringifier::appendStringifiedValue):
(JSC::Walker::walk):
(JSC::JSONProtoFuncParse):
(JSC::JSONProtoFuncStringify):
* runtime/JSObject.cpp:
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::callToPrimitiveFunction):
(JSC::JSObject::ordinaryToPrimitive):
(JSC::JSObject::hasInstance):
(JSC::JSObject::defaultHasInstance):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
(JSC::validateAndApplyPropertyDescriptor):
(JSC::JSObject::getMethod):
* runtime/JSObject.h:
(JSC::createListFromArrayLike): Deleted.
* runtime/JSObjectInlines.h:
(JSC::createListFromArrayLike):
(JSC::JSObject::putInline):
* runtime/JSPromiseConstructor.cpp:
(JSC::constructPromise):
(JSC::callPromise):
* runtime/JSPropertyNameIterator.cpp:
(JSC::propertyNameIteratorFuncNext):
* runtime/JSString.cpp:
(JSC::JSRopeString::outOfMemory):
* runtime/JSStringBuilder.h:
(JSC::JSStringBuilder::build):
(JSC::jsMakeNontrivialString):
* runtime/JSStringJoiner.cpp:
(JSC::JSStringJoiner::joinedLength):
(JSC::JSStringJoiner::join):
* runtime/JSStringJoiner.h:
(JSC::JSStringJoiner::JSStringJoiner):
* runtime/JSSymbolTableObject.h:
(JSC::symbolTablePut):
* runtime/JSTypedArrayViewConstructor.cpp:
(JSC::constructTypedArrayView):
* runtime/JSTypedArrayViewPrototype.cpp:
(JSC::typedArrayViewPrivateFuncLength):
(JSC::typedArrayViewPrivateFuncSort):
(JSC::typedArrayViewProtoFuncSet):
(JSC::typedArrayViewProtoFuncCopyWithin):
(JSC::typedArrayViewProtoFuncIncludes):
(JSC::typedArrayViewProtoFuncLastIndexOf):
(JSC::typedArrayViewProtoFuncIndexOf):
(JSC::typedArrayViewProtoFuncJoin):
(JSC::typedArrayViewProtoGetterFuncBuffer):
(JSC::typedArrayViewProtoGetterFuncLength):
(JSC::typedArrayViewProtoGetterFuncByteLength):
(JSC::typedArrayViewProtoGetterFuncByteOffset):
(JSC::typedArrayViewProtoFuncReverse):
(JSC::typedArrayViewPrivateFuncSubarrayCreate):
(JSC::typedArrayViewProtoFuncSlice):
* runtime/MapConstructor.cpp:
(JSC::callMap):
(JSC::constructMap):
* runtime/MapDataInlines.h:
(JSC::JSIterator>::ensureSpaceForAppend):
* runtime/MapIteratorPrototype.cpp:
(JSC::MapIteratorPrototypeFuncNext):
* runtime/MapPrototype.cpp:
(JSC::getMap):
(JSC::mapProtoFuncValues):
(JSC::mapProtoFuncEntries):
(JSC::mapProtoFuncKeys):
* runtime/ModuleLoaderPrototype.cpp:
(JSC::moduleLoaderPrototypeParseModule):
* runtime/NullSetterFunction.cpp:
(JSC::callReturnUndefined):
* runtime/NumberPrototype.cpp:
(JSC::numberProtoFuncToExponential):
(JSC::numberProtoFuncToFixed):
(JSC::numberProtoFuncToPrecision):
(JSC::numberProtoFuncToString):
(JSC::numberProtoFuncToLocaleString):
(JSC::numberProtoFuncValueOf):
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSetPrototypeOf):
(JSC::toPropertyDescriptor):
(JSC::objectConstructorDefineProperty):
(JSC::objectConstructorDefineProperties):
(JSC::objectConstructorCreate):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncDefineGetter):
(JSC::objectProtoFuncDefineSetter):
(JSC::objectProtoFuncToString):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/ProxyConstructor.cpp:
(JSC::makeRevocableProxy):
(JSC::proxyRevocableConstructorThrowError):
(JSC::constructProxyObject):
(JSC::callProxy):
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::finishCreation):
(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::getOwnPropertySlotCommon):
(JSC::ProxyObject::performPut):
(JSC::performProxyCall):
(JSC::performProxyConstruct):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::performIsExtensible):
(JSC::ProxyObject::performDefineOwnProperty):
(JSC::ProxyObject::performGetOwnPropertyNames):
(JSC::ProxyObject::performSetPrototype):
(JSC::ProxyObject::performGetPrototype):
* runtime/ReflectObject.cpp:
(JSC::reflectObjectConstruct):
(JSC::reflectObjectDefineProperty):
(JSC::reflectObjectEnumerate):
(JSC::reflectObjectGet):
(JSC::reflectObjectGetOwnPropertyDescriptor):
(JSC::reflectObjectGetPrototypeOf):
(JSC::reflectObjectIsExtensible):
(JSC::reflectObjectOwnKeys):
(JSC::reflectObjectPreventExtensions):
(JSC::reflectObjectSet):
(JSC::reflectObjectSetPrototypeOf):
* runtime/RegExpConstructor.cpp:
(JSC::toFlags):
(JSC::regExpCreate):
* runtime/RegExpObject.cpp:
(JSC::collectMatches):
* runtime/RegExpObject.h:
(JSC::RegExpObject::setLastIndex):
* runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncTestFast):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncMatchFast):
(JSC::regExpProtoFuncCompile):
(JSC::regExpProtoFuncToString):
(JSC::regExpProtoGetterGlobal):
(JSC::regExpProtoGetterIgnoreCase):
(JSC::regExpProtoGetterMultiline):
(JSC::regExpProtoGetterSticky):
(JSC::regExpProtoGetterUnicode):
(JSC::regExpProtoGetterFlags):
(JSC::regExpProtoGetterSource):
(JSC::regExpProtoFuncSplitFast):
* runtime/Reject.h:
(JSC::reject):
* runtime/SetConstructor.cpp:
(JSC::callSet):
(JSC::constructSet):
* runtime/SetIteratorPrototype.cpp:
(JSC::SetIteratorPrototypeFuncNext):
* runtime/SetPrototype.cpp:
(JSC::getSet):
(JSC::setProtoFuncValues):
(JSC::setProtoFuncEntries):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::putEntry):
(JSC::SparseArrayEntry::put):
* runtime/StringConstructor.cpp:
(JSC::stringFromCodePoint):
* runtime/StringObject.cpp:
(JSC::StringObject::put):
(JSC::StringObject::putByIndex):
* runtime/StringPrototype.cpp:
(JSC::jsSpliceSubstrings):
(JSC::jsSpliceSubstringsWithSeparators):
(JSC::repeatCharacter):
(JSC::replace):
(JSC::stringProtoFuncToString):
(JSC::stringProtoFuncCharAt):
(JSC::stringProtoFuncCharCodeAt):
(JSC::stringProtoFuncCodePointAt):
(JSC::stringProtoFuncConcat):
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncLastIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstr):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
(JSC::stringProtoFuncToUpperCase):
(JSC::stringProtoFuncLocaleCompare):
(JSC::toLocaleCase):
(JSC::stringProtoFuncBig):
(JSC::stringProtoFuncSmall):
(JSC::stringProtoFuncBlink):
(JSC::stringProtoFuncBold):
(JSC::stringProtoFuncFixed):
(JSC::stringProtoFuncItalics):
(JSC::stringProtoFuncStrike):
(JSC::stringProtoFuncSub):
(JSC::stringProtoFuncSup):
(JSC::stringProtoFuncFontcolor):
(JSC::stringProtoFuncFontsize):
(JSC::stringProtoFuncAnchor):
(JSC::stringProtoFuncLink):
(JSC::trimString):
(JSC::stringProtoFuncStartsWith):
(JSC::stringProtoFuncEndsWith):
(JSC::stringProtoFuncIncludes):
(JSC::stringProtoFuncIterator):
(JSC::normalize):
(JSC::stringProtoFuncNormalize):
* runtime/StringRecursionChecker.cpp:
(JSC::StringRecursionChecker::throwStackOverflowError):
* runtime/Symbol.cpp:
(JSC::Symbol::toNumber):
* runtime/SymbolConstructor.cpp:
(JSC::symbolConstructorKeyFor):
* runtime/SymbolPrototype.cpp:
(JSC::symbolProtoFuncToString):
(JSC::symbolProtoFuncValueOf):
* runtime/ThrowScope.cpp: Added.
(JSC::ThrowScope::ThrowScope):
(JSC::ThrowScope::~ThrowScope):
(JSC::ThrowScope::throwException):
(JSC::ThrowScope::printIfNeedCheck):
(JSC::ThrowScope::simulateThrow):
(JSC::ThrowScope::verifyExceptionCheckNeedIsSatisfied):
* runtime/ThrowScope.h: Added.
(JSC::ThrowScope::vm):
(JSC::ThrowScope::exception):
(JSC::ThrowScope::release):
(JSC::ThrowScope::ThrowScope):
(JSC::ThrowScope::throwException):
(JSC::throwException):
* runtime/ThrowScopeLocation.h: Added.
(JSC::ThrowScopeLocation::ThrowScopeLocation):
* runtime/VM.h:
* runtime/VMEntryScope.h:
(JSC::VMEntryScope::vm):
* runtime/WeakMapConstructor.cpp:
(JSC::callWeakMap):
(JSC::constructWeakMap):
* runtime/WeakMapPrototype.cpp:
(JSC::getWeakMapData):
(JSC::protoFuncWeakMapSet):
* runtime/WeakSetConstructor.cpp:
(JSC::callWeakSet):
(JSC::constructWeakSet):
* runtime/WeakSetPrototype.cpp:
(JSC::getWeakMapData):
(JSC::protoFuncWeakSetAdd):

Source/WebCore:

No new tests because this is only an internal API change. If it builds, it should be good.

* bindings/js/JSApplePaySessionCustom.cpp:
(WebCore::JSApplePaySession::completeShippingMethodSelection):
(WebCore::JSApplePaySession::completeShippingContactSelection):
(WebCore::JSApplePaySession::completePaymentMethodSelection):
* bindings/js/JSBlobCustom.cpp:
(WebCore::constructJSBlob):
* bindings/js/JSCSSStyleDeclarationCustom.cpp:
(WebCore::JSCSSStyleDeclaration::getPropertyCSSValue):
* bindings/js/JSCryptoAlgorithmDictionary.cpp:
(WebCore::JSCryptoAlgorithmDictionary::getAlgorithmIdentifier):
(WebCore::createAesCbcParams):
(WebCore::createAesKeyGenParams):
(WebCore::createHmacParams):
(WebCore::createHmacKeyParams):
(WebCore::createRsaKeyGenParams):
(WebCore::createRsaOaepParams):
(WebCore::createRsaSsaParams):
* bindings/js/JSCryptoCustom.cpp:
(WebCore::JSCrypto::getRandomValues):
* bindings/js/JSCryptoKeySerializationJWK.cpp:
(WebCore::getJSArrayFromJSON):
(WebCore::getStringFromJSON):
(WebCore::getBooleanFromJSON):
(WebCore::getBigIntegerVectorFromJSON):
(WebCore::JSCryptoKeySerializationJWK::JSCryptoKeySerializationJWK):
(WebCore::JSCryptoKeySerializationJWK::reconcileAlgorithm):
(WebCore::tryJWKKeyOpsValue):
(WebCore::JSCryptoKeySerializationJWK::reconcileUsages):
(WebCore::JSCryptoKeySerializationJWK::keyDataOctetSequence):
(WebCore::JSCryptoKeySerializationJWK::keyDataRSAComponents):
(WebCore::JSCryptoKeySerializationJWK::keyData):
(WebCore::addJWKAlgorithmToJSON):
(WebCore::JSCryptoKeySerializationJWK::serialize):
* bindings/js/JSCryptoOperationData.cpp:
(WebCore::cryptoOperationDataFromJSValue):
* bindings/js/JSCustomElementInterface.cpp:
(WebCore::JSCustomElementInterface::upgradeElement):
* bindings/js/JSCustomElementRegistryCustom.cpp:
(WebCore::getCustomElementCallback):
(WebCore::JSCustomElementRegistry::define):
* bindings/js/JSDOMBinding.cpp:
(WebCore::setDOMException):
(WebCore::enforceRange):
(WebCore::toSmallerInt):
(WebCore::toSmallerUInt):
(WebCore::canAccessDocument):
(WebCore::throwTypeError):
(WebCore::throwNotSupportedError):
(WebCore::throwInvalidStateError):
(WebCore::throwSecurityError):
(WebCore::throwArgumentMustBeEnumError):
(WebCore::throwArgumentMustBeFunctionError):
(WebCore::throwArgumentTypeError):
(WebCore::throwArrayElementTypeError):
(WebCore::throwAttributeTypeError):
(WebCore::throwConstructorScriptExecutionContextUnavailableError):
(WebCore::throwSequenceTypeError):
(WebCore::throwNonFiniteTypeError):
(WebCore::throwGetterTypeError):
(WebCore::throwSetterTypeError):
(WebCore::throwThisTypeError):
(WebCore::callThrowTypeError):
* bindings/js/JSDOMBinding.h:
(WebCore::toJSSequence):
(WebCore::toRefPtrNativeArray):
(WebCore::toNativeArray):
* bindings/js/JSDOMConstructor.h:
(WebCore::JSDOMConstructorNotConstructable::callThrowTypeError):
(WebCore::JSBuiltinConstructor<JSClass>::callConstructor):
* bindings/js/JSDOMConvert.h:
(WebCore::convertWrapperType):
* bindings/js/JSDOMIterator.h:
(WebCore::iteratorCreate):
(WebCore::iteratorForEach):
(WebCore::JSDOMIteratorPrototype<JSWrapper>::next):
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
(WebCore::JSDOMWindow::put):
(WebCore::JSDOMWindow::showModalDialog):
(WebCore::handlePostMessage):
(WebCore::JSDOMWindow::setTimeout):
(WebCore::JSDOMWindow::setInterval):
* bindings/js/JSDataCueCustom.cpp:
(WebCore::constructJSDataCue):
* bindings/js/JSDictionary.cpp:
(WebCore::JSDictionary::convertValue):
* bindings/js/JSDocumentCustom.cpp:
(WebCore::JSDocument::createTouchList):
(WebCore::JSDocument::getCSSCanvasContext):
* bindings/js/JSFileCustom.cpp:
(WebCore::constructJSFile):
* bindings/js/JSHTMLAllCollectionCustom.cpp:
(WebCore::JSHTMLAllCollection::item):
* bindings/js/JSHTMLCanvasElementCustom.cpp:
(WebCore::JSHTMLCanvasElement::getContext):
(WebCore::JSHTMLCanvasElement::probablySupportsContext):
* bindings/js/JSHTMLDocumentCustom.cpp:
(WebCore::JSHTMLDocument::open):
* bindings/js/JSHTMLElementCustom.cpp:
(WebCore::constructJSHTMLElement):
* bindings/js/JSHTMLFormControlsCollectionCustom.cpp:
(WebCore::JSHTMLFormControlsCollection::namedItem):
* bindings/js/JSHTMLInputElementCustom.cpp:
(WebCore::JSHTMLInputElement::selectionStart):
(WebCore::JSHTMLInputElement::setSelectionStart):
(WebCore::JSHTMLInputElement::selectionEnd):
(WebCore::JSHTMLInputElement::setSelectionEnd):
(WebCore::JSHTMLInputElement::selectionDirection):
(WebCore::JSHTMLInputElement::setSelectionDirection):
(WebCore::JSHTMLInputElement::setSelectionRange):
* bindings/js/JSHistoryCustom.cpp:
(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):
* bindings/js/JSIDBDatabaseCustom.cpp:
(WebCore::JSIDBDatabase::createObjectStore):
* bindings/js/JSImageConstructor.cpp:
(WebCore::JSImageConstructor::construct):
* bindings/js/JSLocationCustom.cpp:
(WebCore::JSLocation::getOwnPropertySlotDelegate):
* bindings/js/JSMediaDevicesCustom.cpp:
(WebCore::JSMediaDevices::getUserMedia):
* bindings/js/JSMediaStreamTrackCustom.cpp:
(WebCore::JSMediaStreamTrack::getSettings):
(WebCore::JSMediaStreamTrack::getCapabilities):
* bindings/js/JSMessagePortCustom.cpp:
(WebCore::fillMessagePortArray):
* bindings/js/JSMessagePortCustom.h:
(WebCore::handlePostMessage):
* bindings/js/JSMockContentFilterSettingsCustom.cpp:
(WebCore::JSMockContentFilterSettings::setDecisionPoint):
(WebCore::toDecision):
* bindings/js/JSModuleLoader.cpp:
(WebCore::JSModuleLoader::evaluate):
* bindings/js/JSMutationObserverCustom.cpp:
(WebCore::constructJSMutationObserver):
* bindings/js/JSNodeCustom.cpp:
(WebCore::JSNode::insertBefore):
(WebCore::JSNode::replaceChild):
(WebCore::JSNode::removeChild):
(WebCore::JSNode::appendChild):
* bindings/js/JSNodeFilterCustom.cpp:
(WebCore::JSNodeFilter::acceptNode):
* bindings/js/JSPluginElementFunctions.cpp:
(WebCore::pluginElementPropertyGetter):
* bindings/js/JSReadableStreamPrivateConstructors.cpp:
(WebCore::constructJSReadableStreamDefaultController):
(WebCore::constructJSReadableStreamDefaultReader):
* bindings/js/JSSVGLengthCustom.cpp:
(WebCore::JSSVGLength::setValue):
(WebCore::JSSVGLength::convertToSpecifiedUnits):
* bindings/js/JSWebGL2RenderingContextCustom.cpp:
(WebCore::JSWebGL2RenderingContext::getIndexedParameter):
* bindings/js/JSWebGLRenderingContextBaseCustom.cpp:
(WebCore::getObjectParameter):
(WebCore::JSWebGLRenderingContextBase::getAttachedShaders):
(WebCore::JSWebGLRenderingContextBase::getExtension):
(WebCore::JSWebGLRenderingContextBase::getFramebufferAttachmentParameter):
(WebCore::JSWebGLRenderingContextBase::getParameter):
(WebCore::JSWebGLRenderingContextBase::getProgramParameter):
(WebCore::JSWebGLRenderingContextBase::getShaderParameter):
(WebCore::JSWebGLRenderingContextBase::getUniform):
(WebCore::dataFunctionf):
(WebCore::dataFunctioni):
(WebCore::dataFunctionMatrix):
* bindings/js/JSWebKitSubtleCryptoCustom.cpp:
(WebCore::cryptoKeyFormatFromJSValue):
(WebCore::cryptoKeyUsagesFromJSValue):
(WebCore::JSWebKitSubtleCrypto::encrypt):
(WebCore::JSWebKitSubtleCrypto::decrypt):
(WebCore::JSWebKitSubtleCrypto::sign):
(WebCore::JSWebKitSubtleCrypto::verify):
(WebCore::JSWebKitSubtleCrypto::digest):
(WebCore::JSWebKitSubtleCrypto::generateKey):
(WebCore::importKey):
(WebCore::JSWebKitSubtleCrypto::importKey):
(WebCore::exportKey):
(WebCore::JSWebKitSubtleCrypto::exportKey):
(WebCore::JSWebKitSubtleCrypto::wrapKey):
(WebCore::JSWebKitSubtleCrypto::unwrapKey):
* bindings/js/JSWorkerCustom.cpp:
(WebCore::constructJSWorker):
* bindings/js/JSWorkerGlobalScopeCustom.cpp:
(WebCore::JSWorkerGlobalScope::setTimeout):
(WebCore::JSWorkerGlobalScope::setInterval):
* bindings/js/ReadableStreamDefaultController.cpp:
(WebCore::ReadableStreamDefaultController::invoke):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneBase::throwStackOverflow):
(WebCore::CloneDeserializer::throwValidationError):
(WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::evaluate):
(WebCore::WorkerScriptController::setException):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateEnumerationImplementationContent):
(GenerateDictionaryImplementationContent):
(GenerateOverloadedFunctionOrConstructor):
(GenerateImplementation):
(GenerateFunctionCastedThis):
(GenerateArgumentsCountCheck):
(GenerateParametersCheck):
(GenerateConstructorDefinition):
* bindings/scripts/test/JS/JSInterfaceName.cpp:
(WebCore::jsInterfaceNameConstructor):
(WebCore::setJSInterfaceNameConstructor):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::jsTestActiveDOMObjectExcitingAttr):
(WebCore::jsTestActiveDOMObjectConstructor):
(WebCore::setJSTestActiveDOMObjectConstructor):
(WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
(WebCore::jsTestActiveDOMObjectPrototypeFunctionPostMessage):
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
(WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
(WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
(WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
(WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::jsTestCustomNamedGetterConstructor):
(WebCore::setJSTestCustomNamedGetterConstructor):
(WebCore::jsTestCustomNamedGetterPrototypeFunctionAnotherFunction):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructorConstructor::construct):
(WebCore::jsTestEventConstructorAttr1):
(WebCore::jsTestEventConstructorAttr2):
(WebCore::jsTestEventConstructorAttr3):
(WebCore::jsTestEventConstructorConstructor):
(WebCore::setJSTestEventConstructorConstructor):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::jsTestEventTargetConstructor):
(WebCore::setJSTestEventTargetConstructor):
(WebCore::jsTestEventTargetPrototypeFunctionItem):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::jsTestExceptionName):
(WebCore::jsTestExceptionConstructor):
(WebCore::setJSTestExceptionConstructor):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::jsTestGenerateIsReachableConstructor):
(WebCore::setJSTestGenerateIsReachableConstructor):
* bindings/scripts/test/JS/JSTestGlobalObject.cpp:
(WebCore::jsTestGlobalObjectRegularAttribute):
(WebCore::jsTestGlobalObjectPublicAndPrivateAttribute):
(WebCore::jsTestGlobalObjectPublicAndPrivateConditionalAttribute):
(WebCore::jsTestGlobalObjectEnabledAtRuntimeAttribute):
(WebCore::jsTestGlobalObjectConstructor):
(WebCore::setJSTestGlobalObjectConstructor):
(WebCore::setJSTestGlobalObjectRegularAttribute):
(WebCore::setJSTestGlobalObjectPublicAndPrivateAttribute):
(WebCore::setJSTestGlobalObjectPublicAndPrivateConditionalAttribute):
(WebCore::setJSTestGlobalObjectEnabledAtRuntimeAttribute):
(WebCore::jsTestGlobalObjectInstanceFunctionRegularOperation):
(WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation1):
(WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation2):
(WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation):
(WebCore::jsTestGlobalObjectInstanceFunctionTestPrivateFunction):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceConstructor::construct):
(WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
(WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
(WebCore::jsTestInterfaceImplementsStr1):
(WebCore::jsTestInterfaceImplementsStr2):
(WebCore::jsTestInterfaceImplementsStr3):
(WebCore::jsTestInterfaceImplementsNode):
(WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
(WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
(WebCore::jsTestInterfaceSupplementalStr1):
(WebCore::jsTestInterfaceSupplementalStr2):
(WebCore::jsTestInterfaceSupplementalStr3):
(WebCore::jsTestInterfaceSupplementalNode):
(WebCore::jsTestInterfaceConstructor):
(WebCore::setJSTestInterfaceConstructor):
(WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
(WebCore::setJSTestInterfaceImplementsStr2):
(WebCore::setJSTestInterfaceImplementsStr3):
(WebCore::setJSTestInterfaceImplementsNode):
(WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
(WebCore::setJSTestInterfaceSupplementalStr2):
(WebCore::setJSTestInterfaceSupplementalStr3):
(WebCore::setJSTestInterfaceSupplementalNode):
(WebCore::jsTestInterfacePrototypeFunctionImplementsMethod1):
(WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
(WebCore::jsTestInterfacePrototypeFunctionImplementsMethod3):
(WebCore::jsTestInterfaceConstructorFunctionImplementsMethod4):
(WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod1):
(WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
(WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod3):
(WebCore::jsTestInterfaceConstructorFunctionSupplementalMethod4):
* bindings/scripts/test/JS/JSTestIterable.cpp:
(WebCore::jsTestIterableConstructor):
(WebCore::setJSTestIterableConstructor):
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
(WebCore::jsTestJSBuiltinConstructorTestAttributeCustom):
(WebCore::jsTestJSBuiltinConstructorTestAttributeRWCustom):
(WebCore::jsTestJSBuiltinConstructorConstructor):
(WebCore::setJSTestJSBuiltinConstructorConstructor):
(WebCore::setJSTestJSBuiltinConstructorTestAttributeRWCustom):
(WebCore::jsTestJSBuiltinConstructorPrototypeFunctionTestCustomFunction):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::jsTestMediaQueryListListenerConstructor):
(WebCore::setJSTestMediaQueryListListenerConstructor):
(WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructorNamedConstructor::construct):
(WebCore::jsTestNamedConstructorConstructor):
(WebCore::setJSTestNamedConstructorConstructor):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::JSTestNodeConstructor::construct):
(WebCore::jsTestNodeName):
(WebCore::jsTestNodeConstructor):
(WebCore::setJSTestNodeConstructor):
(WebCore::setJSTestNodeName):
* bindings/scripts/test/JS/JSTestNondeterministic.cpp:
(WebCore::jsTestNondeterministicNondeterministicReadonlyAttr):
(WebCore::jsTestNondeterministicNondeterministicWriteableAttr):
(WebCore::jsTestNondeterministicNondeterministicExceptionAttr):
(WebCore::jsTestNondeterministicNondeterministicGetterExceptionAttr):
(WebCore::jsTestNondeterministicNondeterministicSetterExceptionAttr):
(WebCore::jsTestNondeterministicConstructor):
(WebCore::setJSTestNondeterministicConstructor):
(WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
(WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
(WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
(WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
(WebCore::jsTestNondeterministicPrototypeFunctionNondeterministicZeroArgFunction):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::convert<TestObj::EnumType>):
(WebCore::convert<TestObj::Optional>):
(WebCore::convert<AlternateEnumName>):
(WebCore::convert<TestObj::EnumA>):
(WebCore::convert<TestObj::EnumB>):
(WebCore::convert<TestObj::EnumC>):
(WebCore::convert<TestObj::Kind>):
(WebCore::convert<TestObj::Size>):
(WebCore::convert<TestObj::Confidence>):
(WebCore::convertDictionary<TestObj::Dictionary>):
(WebCore::convertDictionary<TestObj::DictionaryThatShouldNotTolerateNull>):
(WebCore::convertDictionary<TestObj::DictionaryThatShouldTolerateNull>):
(WebCore::convertDictionary<AlternateDictionaryName>):
(WebCore::JSTestObjConstructor::construct):
(WebCore::jsTestObjReadOnlyLongAttr):
(WebCore::jsTestObjReadOnlyStringAttr):
(WebCore::jsTestObjReadOnlyTestObjAttr):
(WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
(WebCore::jsTestObjConstructorStaticStringAttr):
(WebCore::jsTestObjConstructorTestSubObj):
(WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::jsTestObjEnumAttr):
(WebCore::jsTestObjByteAttr):
(WebCore::jsTestObjOctetAttr):
(WebCore::jsTestObjShortAttr):
(WebCore::jsTestObjClampedShortAttr):
(WebCore::jsTestObjEnforceRangeShortAttr):
(WebCore::jsTestObjUnsignedShortAttr):
(WebCore::jsTestObjLongAttr):
(WebCore::jsTestObjLongLongAttr):
(WebCore::jsTestObjUnsignedLongLongAttr):
(WebCore::jsTestObjStringAttr):
(WebCore::jsTestObjUsvstringAttr):
(WebCore::jsTestObjTestObjAttr):
(WebCore::jsTestObjTestNullableObjAttr):
(WebCore::jsTestObjLenientTestObjAttr):
(WebCore::jsTestObjUnforgeableAttr):
(WebCore::jsTestObjStringAttrTreatingNullAsEmptyString):
(WebCore::jsTestObjUsvstringAttrTreatingNullAsEmptyString):
(WebCore::jsTestObjImplementationEnumAttr):
(WebCore::jsTestObjXMLObjAttr):
(WebCore::jsTestObjCreate):
(WebCore::jsTestObjReflectedStringAttr):
(WebCore::jsTestObjReflectedUSVStringAttr):
(WebCore::jsTestObjReflectedIntegralAttr):
(WebCore::jsTestObjReflectedUnsignedIntegralAttr):
(WebCore::jsTestObjReflectedBooleanAttr):
(WebCore::jsTestObjReflectedURLAttr):
(WebCore::jsTestObjReflectedUSVURLAttr):
(WebCore::jsTestObjReflectedCustomIntegralAttr):
(WebCore::jsTestObjReflectedCustomBooleanAttr):
(WebCore::jsTestObjReflectedCustomURLAttr):
(WebCore::jsTestObjEnabledAtRuntimeAttribute):
(WebCore::jsTestObjTypedArrayAttr):
(WebCore::jsTestObjAttrWithGetterException):
(WebCore::jsTestObjAttrWithGetterExceptionWithMessage):
(WebCore::jsTestObjAttrWithSetterException):
(WebCore::jsTestObjAttrWithSetterExceptionWithMessage):
(WebCore::jsTestObjStringAttrWithGetterException):
(WebCore::jsTestObjStringAttrWithSetterException):
(WebCore::jsTestObjCustomAttr):
(WebCore::jsTestObjOnfoo):
(WebCore::jsTestObjOnwebkitfoo):
(WebCore::jsTestObjWithScriptStateAttribute):
(WebCore::jsTestObjWithCallWithAndSetterCallWithAttribute):
(WebCore::jsTestObjWithScriptExecutionContextAttribute):
(WebCore::jsTestObjWithScriptStateAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
(WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
(WebCore::jsTestObjConditionalAttr1):
(WebCore::jsTestObjConditionalAttr2):
(WebCore::jsTestObjConditionalAttr3):
(WebCore::jsTestObjConditionalAttr4Constructor):
(WebCore::jsTestObjConditionalAttr5Constructor):
(WebCore::jsTestObjConditionalAttr6Constructor):
(WebCore::jsTestObjCachedAttribute1):
(WebCore::jsTestObjCachedAttribute2):
(WebCore::jsTestObjAnyAttribute):
(WebCore::jsTestObjContentDocument):
(WebCore::jsTestObjMutablePoint):
(WebCore::jsTestObjImmutablePoint):
(WebCore::jsTestObjStrawberry):
(WebCore::jsTestObjDescription):
(WebCore::jsTestObjId):
(WebCore::jsTestObjHash):
(WebCore::jsTestObjReplaceableAttribute):
(WebCore::jsTestObjNullableDoubleAttribute):
(WebCore::jsTestObjNullableLongAttribute):
(WebCore::jsTestObjNullableBooleanAttribute):
(WebCore::jsTestObjNullableStringAttribute):
(WebCore::jsTestObjNullableLongSettableAttribute):
(WebCore::jsTestObjNullableStringSettableAttribute):
(WebCore::jsTestObjNullableUSVStringSettableAttribute):
(WebCore::jsTestObjNullableStringValue):
(WebCore::jsTestObjAttribute):
(WebCore::jsTestObjAttributeWithReservedEnumType):
(WebCore::jsTestObjPutForwardsAttribute):
(WebCore::jsTestObjPutForwardsNullableAttribute):
(WebCore::jsTestObjStringifierAttribute):
(WebCore::jsTestObjConstructor):
(WebCore::setJSTestObjConstructor):
(WebCore::setJSTestObjConstructorStaticStringAttr):
(WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::setJSTestObjEnumAttr):
(WebCore::setJSTestObjByteAttr):
(WebCore::setJSTestObjOctetAttr):
(WebCore::setJSTestObjShortAttr):
(WebCore::setJSTestObjClampedShortAttr):
(WebCore::setJSTestObjEnforceRangeShortAttr):
(WebCore::setJSTestObjUnsignedShortAttr):
(WebCore::setJSTestObjLongAttr):
(WebCore::setJSTestObjLongLongAttr):
(WebCore::setJSTestObjUnsignedLongLongAttr):
(WebCore::setJSTestObjStringAttr):
(WebCore::setJSTestObjUsvstringAttr):
(WebCore::setJSTestObjTestObjAttr):
(WebCore::setJSTestObjTestNullableObjAttr):
(WebCore::setJSTestObjLenientTestObjAttr):
(WebCore::setJSTestObjStringAttrTreatingNullAsEmptyString):
(WebCore::setJSTestObjUsvstringAttrTreatingNullAsEmptyString):
(WebCore::setJSTestObjImplementationEnumAttr):
(WebCore::setJSTestObjXMLObjAttr):
(WebCore::setJSTestObjCreate):
(WebCore::setJSTestObjReflectedStringAttr):
(WebCore::setJSTestObjReflectedUSVStringAttr):
(WebCore::setJSTestObjReflectedIntegralAttr):
(WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
(WebCore::setJSTestObjReflectedBooleanAttr):
(WebCore::setJSTestObjReflectedURLAttr):
(WebCore::setJSTestObjReflectedUSVURLAttr):
(WebCore::setJSTestObjReflectedCustomIntegralAttr):
(WebCore::setJSTestObjReflectedCustomBooleanAttr):
(WebCore::setJSTestObjReflectedCustomURLAttr):
(WebCore::setJSTestObjEnabledAtRuntimeAttribute):
(WebCore::setJSTestObjTypedArrayAttr):
(WebCore::setJSTestObjAttrWithGetterException):
(WebCore::setJSTestObjAttrWithGetterExceptionWithMessage):
(WebCore::setJSTestObjAttrWithSetterException):
(WebCore::setJSTestObjAttrWithSetterExceptionWithMessage):
(WebCore::setJSTestObjStringAttrWithGetterException):
(WebCore::setJSTestObjStringAttrWithSetterException):
(WebCore::setJSTestObjCustomAttr):
(WebCore::setJSTestObjOnfoo):
(WebCore::setJSTestObjOnwebkitfoo):
(WebCore::setJSTestObjWithScriptStateAttribute):
(WebCore::setJSTestObjWithCallWithAndSetterCallWithAttribute):
(WebCore::setJSTestObjWithScriptExecutionContextAttribute):
(WebCore::setJSTestObjWithScriptStateAttributeRaises):
(WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
(WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
(WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
(WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
(WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
(WebCore::setJSTestObjConditionalAttr1):
(WebCore::setJSTestObjConditionalAttr2):
(WebCore::setJSTestObjConditionalAttr3):
(WebCore::setJSTestObjConditionalAttr4Constructor):
(WebCore::setJSTestObjConditionalAttr5Constructor):
(WebCore::setJSTestObjConditionalAttr6Constructor):
(WebCore::setJSTestObjAnyAttribute):
(WebCore::setJSTestObjMutablePoint):
(WebCore::setJSTestObjImmutablePoint):
(WebCore::setJSTestObjStrawberry):
(WebCore::setJSTestObjId):
(WebCore::setJSTestObjReplaceableAttribute):
(WebCore::setJSTestObjNullableLongSettableAttribute):
(WebCore::setJSTestObjNullableStringSettableAttribute):
(WebCore::setJSTestObjNullableUSVStringSettableAttribute):
(WebCore::setJSTestObjNullableStringValue):
(WebCore::setJSTestObjAttributeWithReservedEnumType):
(WebCore::setJSTestObjPutForwardsAttribute):
(WebCore::setJSTestObjPutForwardsNullableAttribute):
(WebCore::setJSTestObjStringifierAttribute):
(WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation1):
(WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation2):
(WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation):
(WebCore::jsTestObjPrototypeFunctionVoidMethod):
(WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionByteMethod):
(WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionOctetMethod):
(WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionLongMethod):
(WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionObjMethod):
(WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
(WebCore::jsTestObjInstanceFunctionUnforgeableMethod):
(WebCore::jsTestObjPrototypeFunctionMethodWithArgTreatingNullAsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithXPathNSResolverParameter):
(WebCore::jsTestObjPrototypeFunctionNullableStringMethod):
(WebCore::jsTestObjConstructorFunctionNullableStringStaticMethod):
(WebCore::jsTestObjPrototypeFunctionNullableStringSpecialMethod):
(WebCore::jsTestObjPrototypeFunctionMethodWithEnumArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArgAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
(WebCore::jsTestObjPrototypeFunctionMethodWithUSVStringArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNullableUSVStringArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithUSVStringArgTreatingNullAsEmptyString):
(WebCore::jsTestObjPrototypeFunctionSerializedValue):
(WebCore::jsTestObjPrototypeFunctionOptionsObject):
(WebCore::jsTestObjPrototypeFunctionMethodWithException):
(WebCore::jsTestObjPrototypeFunctionMethodWithExceptionWithMessage):
(WebCore::jsTestObjPrototypeFunctionCustomMethod):
(WebCore::jsTestObjPrototypeFunctionCustomMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionPrivateMethod):
(WebCore::jsTestObjPrototypeFunctionPublicAndPrivateMethod):
(WebCore::jsTestObjPrototypeFunctionAddEventListener):
(WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateVoid):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateVoidException):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
(WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
(WebCore::jsTestObjPrototypeFunctionWithDocumentArgument):
(WebCore::jsTestObjPrototypeFunctionWithCallerDocumentArgument):
(WebCore::jsTestObjPrototypeFunctionWithCallerWindowArgument):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUSVString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUSVStringIsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalDoubleIsNaN):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalFloatIsNaN):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalLongLong):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalLongLongIsZero):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLong):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLongIsZero):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequence):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequenceIsEmpty):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBoolean):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAny):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapper):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapperIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalXPathNSResolver):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackFunctionArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionAndOptionalArg):
(WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackAndOptionalArg):
(WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackArg):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod2):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod3):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod12):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):
(WebCore::jsTestObjConstructorFunctionClassMethod):
(WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
(WebCore::jsTestObjConstructorFunctionClassMethod2):
(WebCore::jsTestObjConstructorFunctionOverloadedMethod11):
(WebCore::jsTestObjConstructorFunctionOverloadedMethod12):
(WebCore::jsTestObjConstructorFunctionOverloadedMethod1):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithEnforceRange):
(WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
(WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
(WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
(WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence):
(WebCore::jsTestObjPrototypeFunctionGetElementById):
(WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
(WebCore::jsTestObjPrototypeFunctionConvert1):
(WebCore::jsTestObjPrototypeFunctionConvert2):
(WebCore::jsTestObjPrototypeFunctionConvert3):
(WebCore::jsTestObjPrototypeFunctionConvert4):
(WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
(WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
(WebCore::jsTestObjPrototypeFunctionOrange):
(WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
(WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
(WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
(WebCore::jsTestObjPrototypeFunctionAny):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithExceptionPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):
(WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionPromise):
(WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionWithExceptionPromise):
(WebCore::jsTestObjPrototypeFunctionMethodWithNeedsCustomElementReactionStack):
(WebCore::jsTestObjPrototypeFunctionConditionalOverload1):
(WebCore::jsTestObjPrototypeFunctionConditionalOverload2):
(WebCore::jsTestObjPrototypeFunctionConditionalOverload):
(WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload1):
(WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload2):
(WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload):
(WebCore::jsTestObjPrototypeFunctionAttachShadowRoot):
(WebCore::jsTestObjPrototypeFunctionToString):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::constructJSTestOverloadedConstructors1):
(WebCore::constructJSTestOverloadedConstructors2):
(WebCore::constructJSTestOverloadedConstructors3):
(WebCore::constructJSTestOverloadedConstructors4):
(WebCore::constructJSTestOverloadedConstructors5):
(WebCore::JSTestOverloadedConstructorsConstructor::construct):
(WebCore::jsTestOverloadedConstructorsConstructor):
(WebCore::setJSTestOverloadedConstructorsConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
(WebCore::constructJSTestOverloadedConstructorsWithSequence1):
(WebCore::constructJSTestOverloadedConstructorsWithSequence2):
(WebCore::JSTestOverloadedConstructorsWithSequenceConstructor::construct):
(WebCore::jsTestOverloadedConstructorsWithSequenceConstructor):
(WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):
* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
(WebCore::jsTestOverrideBuiltinsConstructor):
(WebCore::setJSTestOverrideBuiltinsConstructor):
(WebCore::jsTestOverrideBuiltinsPrototypeFunctionNamedItem):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::jsTestSerializedScriptValueInterfaceValue):
(WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
(WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
(WebCore::jsTestSerializedScriptValueInterfacePorts):
(WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
(WebCore::jsTestSerializedScriptValueInterfaceConstructor):
(WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
(WebCore::setJSTestSerializedScriptValueInterfaceValue):
(WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsConstructor::construct):
(WebCore::jsTestTypedefsUnsignedLongLongAttr):
(WebCore::jsTestTypedefsImmutableSerializedScriptValue):
(WebCore::jsTestTypedefsConstructorTestSubObj):
(WebCore::jsTestTypedefsAttrWithGetterException):
(WebCore::jsTestTypedefsAttrWithSetterException):
(WebCore::jsTestTypedefsStringAttrWithGetterException):
(WebCore::jsTestTypedefsStringAttrWithSetterException):
(WebCore::jsTestTypedefsConstructor):
(WebCore::setJSTestTypedefsConstructor):
(WebCore::setJSTestTypedefsUnsignedLongLongAttr):
(WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
(WebCore::setJSTestTypedefsAttrWithGetterException):
(WebCore::setJSTestTypedefsAttrWithSetterException):
(WebCore::setJSTestTypedefsStringAttrWithGetterException):
(WebCore::setJSTestTypedefsStringAttrWithSetterException):
(WebCore::jsTestTypedefsPrototypeFunctionFunc):
(WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
(WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
(WebCore::jsTestTypedefsPrototypeFunctionNullableSequenceArg):
(WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
(WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
(WebCore::jsTestTypedefsPrototypeFunctionStringSequenceFunction):
(WebCore::jsTestTypedefsPrototypeFunctionStringSequenceFunction2):
(WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
(WebCore::jsTestTypedefsPrototypeFunctionMethodWithException):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::jsattributeReadonly):
(WebCore::jsattributeConstructor):
(WebCore::setJSattributeConstructor):
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::jsreadonlyConstructor):
(WebCore::setJSreadonlyConstructor):
* bridge/c/c_instance.cpp:
(JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
(JSC::Bindings::CInstance::invokeMethod):
(JSC::Bindings::CInstance::invokeDefaultMethod):
(JSC::Bindings::CInstance::invokeConstruct):
(JSC::Bindings::CInstance::toJSPrimitive):
* bridge/objc/objc_instance.mm:
(ObjcInstance::moveGlobalExceptionToExecState):
(ObjcInstance::invokeMethod):
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcField::valueFromInstance):
(JSC::Bindings::ObjcField::setValueToInstance):
(JSC::Bindings::ObjcArray::setValueAt):
(JSC::Bindings::ObjcArray::valueAt):
(JSC::Bindings::callObjCFallbackObject):
* bridge/objc/objc_utility.h:
* bridge/objc/objc_utility.mm:
(JSC::Bindings::throwError):
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::lengthGetter):
(JSC::RuntimeArray::put):
(JSC::RuntimeArray::putByIndex):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::lengthGetter):
(JSC::callRuntimeMethod):
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::fallbackObjectGetter):
(JSC::Bindings::RuntimeObject::fieldGetter):
(JSC::Bindings::RuntimeObject::methodGetter):
(JSC::Bindings::RuntimeObject::getOwnPropertySlot):
(JSC::Bindings::RuntimeObject::put):
(JSC::Bindings::RuntimeObject::defaultValue):
(JSC::Bindings::RuntimeObject::getOwnPropertyNames):
(JSC::Bindings::RuntimeObject::throwInvalidAccessError):
* bridge/runtime_object.h:

Source/WebKit/mac:

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
* Plugins/Hosted/ProxyInstance.mm:
(WebKit::ProxyInstance::invokeMethod):

Source/WebKit2:

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
(WebKit::callMethod):
* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::callMethod):
(WebKit::JSNPObject::callObject):
(WebKit::JSNPObject::callConstructor):
(WebKit::JSNPObject::getOwnPropertySlot):
(WebKit::JSNPObject::put):
(WebKit::JSNPObject::deleteProperty):
(WebKit::JSNPObject::getOwnPropertyNames):
(WebKit::JSNPObject::propertyGetter):
(WebKit::JSNPObject::methodGetter):
(WebKit::JSNPObject::throwInvalidAccessError):
* WebProcess/Plugins/Netscape/JSNPObject.h:
* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
(WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):

Source/WTF:

* wtf/Platform.h:
- Introduced the ENABLE(THROW_SCOPE_VERIFICATION) flag.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@205198 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
index 5c122d3..f74793b 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008, 2011 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007-2008, 2011, 2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -73,18 +73,20 @@
 
 // ------------------------------ Functions ---------------------------
 
-JSObject* constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)
+JSValue constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (!length.isNumber())
         return constructArrayNegativeIndexed(exec, profile, globalObject, &length, 1, newTarget);
     
     uint32_t n = length.toUInt32(exec);
     if (n != length.toNumber(exec))
-        return exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer.")));
+        return throwException(exec, scope, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer.")));
     return constructEmptyArray(exec, profile, globalObject, n, newTarget);
 }
 
-static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args, JSValue newTarget)
+static inline JSValue constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args, JSValue newTarget)
 {
     JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
 
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.h b/Source/JavaScriptCore/runtime/ArrayConstructor.h
index 38de3a4..82d236b 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.h
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2007, 2008, 2011 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007-2008, 2011, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -23,6 +23,7 @@
 
 #include "InternalFunction.h"
 #include "ProxyObject.h"
+#include "ThrowScope.h"
 
 namespace JSC {
 
@@ -60,7 +61,7 @@
     static CallType getCallData(JSCell*, CallData&);
 };
 
-JSObject* constructArrayWithSizeQuirk(ExecState*, ArrayAllocationProfile*, JSGlobalObject*, JSValue length, JSValue prototype = JSValue());
+JSValue constructArrayWithSizeQuirk(ExecState*, ArrayAllocationProfile*, JSGlobalObject*, JSValue length, JSValue prototype = JSValue());
 
 EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArrayConstructor(ExecState*);
 
@@ -68,6 +69,9 @@
 // https://tc39.github.io/ecma262/#sec-isarray
 inline bool isArray(ExecState* exec, JSValue argumentValue)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!argumentValue.isObject())
         return false;
 
@@ -81,7 +85,7 @@
 
         ProxyObject* proxy = jsCast<ProxyObject*>(argument);
         if (proxy->isRevoked()) {
-            throwTypeError(exec, ASCIILiteral("Array.isArray cannot be called on a Proxy that has been revoked"));
+            throwTypeError(exec, scope, ASCIILiteral("Array.isArray cannot be called on a Proxy that has been revoked"));
             return false;
         }
         argument = proxy->target();
diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index a216b2e..00de361 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -265,6 +265,9 @@
 template<JSArray::ShiftCountMode shiftCountMode>
 void shift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     RELEASE_ASSERT(currentCount > resultCount);
     unsigned count = currentCount - resultCount;
 
@@ -286,14 +289,14 @@
             thisObj->putByIndexInline(exec, to, value, true);
             if (exec->hadException())
                 return;
-        } else if (!thisObj->methodTable(exec->vm())->deletePropertyByIndex(thisObj, exec, to)) {
-            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+        } else if (!thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, to)) {
+            throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
             return;
         }
     }
     for (unsigned k = length; k > length - count; --k) {
-        if (!thisObj->methodTable(exec->vm())->deletePropertyByIndex(thisObj, exec, k - 1)) {
-            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+        if (!thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, k - 1)) {
+            throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
             return;
         }
     }
@@ -302,6 +305,9 @@
 template<JSArray::ShiftCountMode shiftCountMode>
 void unshift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     RELEASE_ASSERT(resultCount > currentCount);
     unsigned count = resultCount - currentCount;
 
@@ -310,7 +316,7 @@
 
     // Guard against overflow.
     if (count > (UINT_MAX - length)) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return;
     }
 
@@ -327,8 +333,8 @@
             if (exec->hadException())
                 return;
             thisObj->putByIndexInline(exec, to, value, true);
-        } else if (!thisObj->methodTable(exec->vm())->deletePropertyByIndex(thisObj, exec, to)) {
-            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+        } else if (!thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, to)) {
+            throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
             return;
         }
         if (exec->hadException())
@@ -361,7 +367,7 @@
         customJoinCase = true;
 
     if (UNLIKELY(customJoinCase))
-        return JSValue::encode(jsMakeNontrivialString(exec, "[object ", thisObject->methodTable(exec->vm())->className(thisObject), "]"));
+        return JSValue::encode(jsMakeNontrivialString(exec, "[object ", thisObject->methodTable(vm)->className(thisObject), "]"));
 
     // 4. Return the result of calling the [[Call]] internal method of func providing array as the this value and an empty arguments list.
     if (!isJSArray(thisObject) || callType != CallType::Host || callData.native.function != arrayProtoFuncJoin)
@@ -674,6 +680,9 @@
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
 
     if (isJSArray(thisValue))
@@ -694,8 +703,8 @@
         result = thisObj->get(exec, length - 1);
         if (exec->hadException())
             return JSValue::encode(jsUndefined());
-        if (!thisObj->methodTable(exec->vm())->deletePropertyByIndex(thisObj, exec, length - 1)) {
-            throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+        if (!thisObj->methodTable(vm)->deletePropertyByIndex(thisObj, exec, length - 1)) {
+            throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
             return JSValue::encode(jsUndefined());
         }
         putLength(exec, thisObj, jsNumber(length - 1));
@@ -740,11 +749,13 @@
 
 EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     if (!thisObject)
         return JSValue::encode(JSValue());
 
-    VM& vm = exec->vm();
     unsigned length = getLength(exec, thisObject);
     if (vm.exception())
         return JSValue::encode(jsUndefined());
@@ -812,7 +823,7 @@
                 return JSValue::encode(JSValue());
         } else if (!thisObject->methodTable(vm)->deletePropertyByIndex(thisObject, exec, lower)) {
             if (!vm.exception())
-                throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+                throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
             return JSValue::encode(JSValue());
         }
 
@@ -822,7 +833,7 @@
                 return JSValue::encode(JSValue());
         } else if (!thisObject->methodTable(vm)->deletePropertyByIndex(thisObject, exec, upper)) {
             if (!vm.exception())
-                throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+                throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
             return JSValue::encode(JSValue());
         }
     }
@@ -902,6 +913,7 @@
     // 15.4.4.12
 
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     if (!thisObj)
@@ -966,7 +978,7 @@
         } else {
             result = JSArray::tryCreateUninitialized(vm, exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), deleteCount);
             if (!result)
-                return JSValue::encode(throwOutOfMemoryError(exec));
+                return JSValue::encode(throwOutOfMemoryError(exec, scope));
             
             for (unsigned k = 0; k < deleteCount; ++k) {
                 JSValue v = getProperty(exec, thisObj, k + begin);
@@ -1123,6 +1135,8 @@
 
 static EncodedJSValue concatAppendOne(ExecState* exec, VM& vm, JSArray* first, JSValue second)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ASSERT(!isJSArray(second));
     ASSERT(!shouldUseSlowPut(first->indexingType()));
     Butterfly* firstButterfly = first->butterfly();
@@ -1135,7 +1149,7 @@
     Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
     JSArray* result = JSArray::create(vm, resultStructure, firstArraySize + 1);
     if (!result)
-        return JSValue::encode(throwOutOfMemoryError(exec));
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
 
     if (!result->appendMemcpy(exec, vm, 0, first)) {
         if (!moveElements(exec, vm, result, 0, first, firstArraySize)) {
@@ -1154,6 +1168,7 @@
 {
     ASSERT(exec->argumentCount() == 2);
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     JSArray* firstArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
 
@@ -1197,7 +1212,7 @@
     Structure* resultStructure = exec->lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(type);
     JSArray* result = JSArray::tryCreateUninitialized(vm, resultStructure, firstArraySize + secondArraySize);
     if (!result)
-        return JSValue::encode(throwOutOfMemoryError(exec));
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
 
     if (type == ArrayWithDouble) {
         double* buffer = result->butterfly()->contiguousDouble().data();
diff --git a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
index 92abcc9..aee96ca 100644
--- a/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2008, 2011 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2008, 2011, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -68,6 +68,7 @@
 EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)
 {
     VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
     JSValue thisValue = exec->thisValue();
     if (thisValue == jsBoolean(false))
         return JSValue::encode(vm->smallStrings.falseString());
@@ -76,7 +77,7 @@
         return JSValue::encode(vm->smallStrings.trueString());
 
     if (!thisValue.inherits(BooleanObject::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
         return JSValue::encode(vm->smallStrings.falseString());
@@ -87,12 +88,13 @@
 
 EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (thisValue.isBoolean())
         return JSValue::encode(thisValue);
 
     if (!thisValue.inherits(BooleanObject::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     return JSValue::encode(asBooleanObject(thisValue)->internalValue());
 }
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
index 2e868dc..c7cb6ca 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
@@ -91,7 +91,8 @@
 #define END_IMPL() RETURN_TWO(pc, exec)
 
 #define THROW(exceptionToThrow) do {                        \
-        vm.throwException(exec, exceptionToThrow);          \
+        auto scope = DECLARE_THROW_SCOPE(vm);               \
+        throwException(exec, scope, exceptionToThrow);      \
         RETURN_TO_THROW(exec, pc);                          \
         END_IMPL();                                         \
     } while (false)
@@ -140,13 +141,6 @@
 
 #define CALL_END_IMPL(exec, callTarget) RETURN_TWO((callTarget), (exec))
 
-#define CALL_THROW(exec, pc, exceptionToThrow) do {                     \
-        ExecState* ctExec = (exec);                                     \
-        Instruction* ctPC = (pc);                                       \
-        vm.throwException(exec, exceptionToThrow);                      \
-        CALL_END_IMPL(ctExec, LLInt::callToThrow(ctExec));              \
-    } while (false)
-
 #define CALL_CHECK_EXCEPTION(exec, pc) do {                          \
         ExecState* cceExec = (exec);                                 \
         Instruction* ccePC = (pc);                                   \
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.h b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
index 3d9c15f..358c37a 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
@@ -73,8 +73,10 @@
 
 inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (!baseVal.isObject()) {
-        exec->vm().throwException(exec, createInvalidInParameterError(exec, baseVal));
+        throwException(exec, scope, createInvalidInParameterError(exec, baseVal));
         return false;
     }
 
@@ -85,7 +87,7 @@
         return baseObj->hasProperty(exec, i);
 
     auto property = propName.toPropertyKey(exec);
-    if (exec->vm().exception())
+    if (vm.exception())
         return false;
     return baseObj->hasProperty(exec, property);
 }
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp b/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp
index f586ed0..b0c8fd7 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp
+++ b/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,7 +38,9 @@
 {
     VM* vm = &exec->vm();
     NativeCallFrameTracer tracer(vm, exec);
-    vm->throwException(exec, error);
+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    throwException(exec, scope, error);
 #if LLINT_SLOW_PATH_TRACING
     dataLog("Throwing exception ", vm->exception(), ".\n");
 #endif
diff --git a/Source/JavaScriptCore/runtime/ConstructData.cpp b/Source/JavaScriptCore/runtime/ConstructData.cpp
index e4085cb..e26bedc 100644
--- a/Source/JavaScriptCore/runtime/ConstructData.cpp
+++ b/Source/JavaScriptCore/runtime/ConstructData.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,10 +37,13 @@
 
 JSObject* construct(ExecState* exec, JSValue constructorObject, const ArgList& args, const char* errorMessage)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ConstructData constructData;
     ConstructType constructType = getConstructData(constructorObject, constructData);
     if (constructType == ConstructType::None)
-        return throwTypeError(exec, errorMessage);
+        return throwTypeError(exec, scope, errorMessage);
 
     return construct(exec, constructorObject, constructType, constructData, args, constructorObject);
 }
diff --git a/Source/JavaScriptCore/runtime/DatePrototype.cpp b/Source/JavaScriptCore/runtime/DatePrototype.cpp
index f621891..768dd46 100644
--- a/Source/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/Source/JavaScriptCore/runtime/DatePrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2008, 2009 Torch Mobile, Inc. All rights reserved.
  *  Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
@@ -320,9 +320,10 @@
 
 static EncodedJSValue formateDateInstance(ExecState* exec, DateTimeFormat format, bool asUTCVariant)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
 
@@ -522,13 +523,14 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     if (!std::isfinite(thisDateObj->internalNumber()))
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("Invalid Date")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Invalid Date")));
 
     const GregorianDateTime* gregorianDateTime = thisDateObj->gregorianDateTimeUTC(exec);
     if (!gregorianDateTime)
@@ -568,9 +570,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDateAndTime));
@@ -578,9 +581,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDate));
@@ -588,9 +592,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleTime));
@@ -598,13 +603,14 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToPrimitiveSymbol(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, "Date.prototype[Symbol.toPrimitive] expected |this| to be an object.");
+        return throwVMTypeError(exec, scope, "Date.prototype[Symbol.toPrimitive] expected |this| to be an object.");
     JSObject* thisObject = jsCast<JSObject*>(thisValue);
 
     if (!exec->argumentCount())
-        return throwVMTypeError(exec, "Date.prototype[Symbol.toPrimitive] expected a first argument.");
+        return throwVMTypeError(exec, scope, "Date.prototype[Symbol.toPrimitive] expected a first argument.");
 
     JSValue hintValue = exec->uncheckedArgument(0);
     PreferredPrimitiveType type = toPreferredPrimitiveType(exec, hintValue);
@@ -619,18 +625,20 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     return JSValue::encode(asDateInstance(thisValue)->internalValue());
 }
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -642,9 +650,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -656,9 +665,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -670,9 +680,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -684,9 +695,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -698,9 +710,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -712,9 +725,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -726,9 +740,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -740,9 +755,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -754,9 +770,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -768,9 +785,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -782,9 +800,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -796,9 +815,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -810,9 +830,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -824,9 +845,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
@@ -840,9 +862,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
@@ -856,9 +879,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -870,9 +894,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -884,9 +909,10 @@
 
 static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     double milli = thisDateObj->internalNumber();
@@ -923,9 +949,10 @@
 
 static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     if (!exec->argumentCount()) {
@@ -1035,9 +1062,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     VM& vm = exec->vm();
     DateInstance* thisDateObj = asDateInstance(thisValue);
@@ -1078,9 +1106,10 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(DateInstance::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
@@ -1094,6 +1123,7 @@
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     JSValue thisValue = exec->thisValue();
     JSObject* object = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
     if (exec->hadException())
@@ -1112,13 +1142,13 @@
     CallData callData;
     CallType callType = getCallData(toISOValue, callData);
     if (callType == CallType::None)
-        return throwVMTypeError(exec, ASCIILiteral("toISOString is not a function"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("toISOString is not a function"));
 
     JSValue result = call(exec, asObject(toISOValue), callType, callData, object, exec->emptyList());
     if (exec->hadException())
         return JSValue::encode(jsNull());
     if (result.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("toISOString did not return a primitive value"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("toISOString did not return a primitive value"));
     return JSValue::encode(result);
 }
 
diff --git a/Source/JavaScriptCore/runtime/Error.cpp b/Source/JavaScriptCore/runtime/Error.cpp
index 21152b5..529e20c 100644
--- a/Source/JavaScriptCore/runtime/Error.cpp
+++ b/Source/JavaScriptCore/runtime/Error.cpp
@@ -198,34 +198,34 @@
         || error->hasProperty(exec, Identifier::fromString(exec, sourceURLPropertyName));
 }
 
-JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState* exec, const char* constructorName)
+JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState* exec, ThrowScope& scope, const char* constructorName)
 {
-    return throwTypeError(exec, makeString("calling ", constructorName, " constructor without new is invalid"));
+    return throwTypeError(exec, scope, makeString("calling ", constructorName, " constructor without new is invalid"));
 }
 
-JSObject* throwTypeError(ExecState* exec)
+JSObject* throwTypeError(ExecState* exec, ThrowScope& scope)
 {
-    return exec->vm().throwException(exec, createTypeError(exec));
+    return throwException(exec, scope, createTypeError(exec));
 }
 
-JSObject* throwTypeError(ExecState* exec, ASCIILiteral errorMessage)
+JSObject* throwTypeError(ExecState* exec, ThrowScope& scope, ASCIILiteral errorMessage)
 {
-    return throwTypeError(exec, String(errorMessage));
+    return throwTypeError(exec, scope, String(errorMessage));
 }
 
-JSObject* throwTypeError(ExecState* exec, const String& message)
+JSObject* throwTypeError(ExecState* exec, ThrowScope& scope, const String& message)
 {
-    return exec->vm().throwException(exec, createTypeError(exec, message));
+    return throwException(exec, scope, createTypeError(exec, message));
 }
 
-JSObject* throwSyntaxError(ExecState* exec)
+JSObject* throwSyntaxError(ExecState* exec, ThrowScope& scope)
 {
-    return exec->vm().throwException(exec, createSyntaxError(exec, ASCIILiteral("Syntax error")));
+    return throwException(exec, scope, createSyntaxError(exec, ASCIILiteral("Syntax error")));
 }
 
-JSObject* throwSyntaxError(ExecState* exec, const String& message)
+JSObject* throwSyntaxError(ExecState* exec, ThrowScope& scope, const String& message)
 {
-    return exec->vm().throwException(exec, createSyntaxError(exec, message));
+    return throwException(exec, scope, createSyntaxError(exec, message));
 }
 
 JSObject* createError(ExecState* exec, const String& message)
diff --git a/Source/JavaScriptCore/runtime/Error.h b/Source/JavaScriptCore/runtime/Error.h
index bdf1c5d..a5a0e7b 100644
--- a/Source/JavaScriptCore/runtime/Error.h
+++ b/Source/JavaScriptCore/runtime/Error.h
@@ -27,6 +27,7 @@
 #include "InternalFunction.h"
 #include "Interpreter.h"
 #include "JSObject.h"
+#include "ThrowScope.h"
 #include <stdint.h>
 
 
@@ -71,21 +72,21 @@
 // Methods to throw Errors.
 
 // Convenience wrappers, create an throw an exception with a default message.
-JS_EXPORT_PRIVATE JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState*, const char* constructorName);
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ASCIILiteral errorMessage);
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String& errorMessage);
-JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, const String& errorMessage);
-inline JSObject* throwRangeError(ExecState* state, const String& errorMessage) { return state->vm().throwException(state, createRangeError(state, errorMessage)); }
+JS_EXPORT_PRIVATE JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState*, ThrowScope&, const char* constructorName);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&, ASCIILiteral errorMessage);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&, const String& errorMessage);
+JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, ThrowScope&, const String& errorMessage);
+inline JSObject* throwRangeError(ExecState* state, ThrowScope& scope, const String& errorMessage) { return throwException(state, scope, createRangeError(state, errorMessage)); }
 
 // Convenience wrappers, wrap result as an EncodedJSValue.
-inline void throwVMError(ExecState* exec, Exception* exception) { exec->vm().throwException(exec, exception); }
-inline EncodedJSValue throwVMError(ExecState* exec, JSValue error) { return JSValue::encode(exec->vm().throwException(exec, error)); }
-inline EncodedJSValue throwVMTypeError(ExecState* exec) { return JSValue::encode(throwTypeError(exec)); }
-inline EncodedJSValue throwVMTypeError(ExecState* exec, ASCIILiteral errorMessage) { return JSValue::encode(throwTypeError(exec, errorMessage)); }
-inline EncodedJSValue throwVMTypeError(ExecState* exec, const String& errorMessage) { return JSValue::encode(throwTypeError(exec, errorMessage)); }
-inline EncodedJSValue throwVMRangeError(ExecState* state, const String& errorMessage) { return JSValue::encode(throwRangeError(state, errorMessage)); }
+inline void throwVMError(ExecState* exec, ThrowScope& scope, Exception* exception) { throwException(exec, scope, exception); }
+inline EncodedJSValue throwVMError(ExecState* exec, ThrowScope& scope, JSValue error) { return JSValue::encode(throwException(exec, scope, error)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope& scope) { return JSValue::encode(throwTypeError(exec, scope)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope& scope, ASCIILiteral errorMessage) { return JSValue::encode(throwTypeError(exec, scope, errorMessage)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope& scope, const String& errorMessage) { return JSValue::encode(throwTypeError(exec, scope, errorMessage)); }
+inline EncodedJSValue throwVMRangeError(ExecState* state, ThrowScope& scope, const String& errorMessage) { return JSValue::encode(throwRangeError(state, scope, errorMessage)); }
 
 class StrictModeTypeErrorFunction : public InternalFunction {
 private:
@@ -109,7 +110,9 @@
 
     static EncodedJSValue JSC_HOST_CALL constructThrowTypeError(ExecState* exec)
     {
-        throwTypeError(exec, static_cast<StrictModeTypeErrorFunction*>(exec->callee())->m_message);
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(exec, scope, static_cast<StrictModeTypeErrorFunction*>(exec->callee())->m_message);
         return JSValue::encode(jsNull());
     }
 
@@ -121,7 +124,9 @@
 
     static EncodedJSValue JSC_HOST_CALL callThrowTypeError(ExecState* exec)
     {
-        throwTypeError(exec, static_cast<StrictModeTypeErrorFunction*>(exec->callee())->m_message);
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(exec, scope, static_cast<StrictModeTypeErrorFunction*>(exec->callee())->m_message);
         return JSValue::encode(jsNull());
     }
 
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index 69f8a02..6403dd2 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -67,12 +67,15 @@
 // ECMA-262 5.1, 15.11.4.4
 EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 1. Let O be the this value.
     JSValue thisValue = exec->thisValue();
 
     // 2. If Type(O) is not Object, throw a TypeError exception.
     if (!thisValue.isObject())
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSObject* thisObj = asObject(thisValue);
 
     // Guard against recursion!
diff --git a/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp b/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp
index 3fb2787..618354b 100644
--- a/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,17 +38,18 @@
 // Call this only if you know that exception fuzzing is enabled.
 void doExceptionFuzzing(ExecState* exec, const char* where, void* returnPC)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ASSERT(Options::useExceptionFuzz());
 
-    DeferGCForAWhile deferGC(exec->vm().heap);
+    DeferGCForAWhile deferGC(vm.heap);
     
     s_numberOfExceptionFuzzChecks++;
     
     unsigned fireTarget = Options::fireExceptionFuzzAt();
     if (fireTarget == s_numberOfExceptionFuzzChecks) {
         printf("JSC EXCEPTION FUZZ: Throwing fuzz exception with call frame %p, seen in %s and return address %p.\n", exec, where, returnPC);
-        exec->vm().throwException(
-            exec, createError(exec, ASCIILiteral("Exception Fuzz")));
+        throwException(exec, scope, createError(exec, ASCIILiteral("Exception Fuzz")));
     }
 }
 
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 8d4b956..d612909 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2009, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -289,23 +289,23 @@
     return createReferenceError(exec, "Cannot access uninitialized variable.");
 }
 
-JSObject* throwOutOfMemoryError(ExecState* exec)
+JSObject* throwOutOfMemoryError(ExecState* exec, ThrowScope& scope)
 {
-    return exec->vm().throwException(exec, createOutOfMemoryError(exec));
+    return throwException(exec, scope, createOutOfMemoryError(exec));
 }
 
-JSObject* throwStackOverflowError(ExecState* exec)
+JSObject* throwStackOverflowError(ExecState* exec, ThrowScope& scope)
 {
     VM& vm = exec->vm();
     ErrorHandlingScope errorScope(vm);
-    return vm.throwException(exec, createStackOverflowError(exec));
+    return throwException(exec, scope, createStackOverflowError(exec));
 }
 
-JSObject* throwTerminatedExecutionException(ExecState* exec)
+JSObject* throwTerminatedExecutionException(ExecState* exec, ThrowScope& scope)
 {
     VM& vm = exec->vm();
     ErrorHandlingScope errorScope(vm);
-    return vm.throwException(exec, createTerminatedExecutionException(&vm));
+    return throwException(exec, scope, createTerminatedExecutionException(&vm));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.h b/Source/JavaScriptCore/runtime/ExceptionHelpers.h
index 54c5d70..3a3edb8 100644
--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -31,6 +31,7 @@
 
 #include "ErrorInstance.h"
 #include "JSObject.h"
+#include "ThrowScope.h"
 
 namespace JSC {
 
@@ -52,9 +53,9 @@
 JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const String&);
 JSString* errorDescriptionForValue(ExecState*, JSValue);
 
-JS_EXPORT_PRIVATE JSObject* throwOutOfMemoryError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwStackOverflowError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwTerminatedExecutionException(ExecState*);
+JS_EXPORT_PRIVATE JSObject* throwOutOfMemoryError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwStackOverflowError(ExecState*, ThrowScope&);
+JS_EXPORT_PRIVATE JSObject* throwTerminatedExecutionException(ExecState*, ThrowScope&);
 
 
 class TerminatedExecutionError final : public JSNonFinalObject {
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 190b579..6b7828a 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -268,6 +268,7 @@
     CodeSpecializationKind kind, JSFunction* function, JSScope* scope, JSObject*& exception)
 {
     VM* vm = scope->vm();
+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
 
     ASSERT(vm->heap.isDeferred());
     ASSERT(startColumn() != UINT_MAX);
@@ -319,8 +320,8 @@
         executable->m_unlinkedExecutable->hasCapturedVariables(), firstLine(), 
         lastLine(), startColumn(), endColumn()); 
     if (!unlinkedCodeBlock) {
-        exception = vm->throwException(
-            globalObject->globalExec(),
+        exception = throwException(
+            globalObject->globalExec(), throwScope,
             error.toErrorObject(globalObject, executable->m_source));
         return nullptr;
     }
@@ -429,20 +430,23 @@
 
 EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode& source, bool isInStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     if (!globalObject->evalEnabled()) {
-        exec->vm().throwException(exec, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+        throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
         return 0;
     }
 
     EvalExecutable* executable = new (NotNull, allocateCell<EvalExecutable>(*exec->heap())) EvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
-    executable->finishCreation(exec->vm());
+    executable->finishCreation(vm);
 
     UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject->createEvalCodeBlock(exec, executable, variablesUnderTDZ);
     if (!unlinkedEvalCode)
         return 0;
 
-    executable->m_unlinkedEvalCodeBlock.set(exec->vm(), executable, unlinkedEvalCode);
+    executable->m_unlinkedEvalCodeBlock.set(vm, executable, unlinkedEvalCode);
 
     return executable;
 }
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
index 591f2c8..a74b8b3 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2013 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2008, 2013, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -76,8 +76,11 @@
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const String& sourceURL, const TextPosition& position, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!globalObject->evalEnabled())
-        return exec->vm().throwException(exec, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+        return throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
     return constructFunctionSkippingEvalEnabledCheck(exec, globalObject, args, functionName, sourceURL, position, -1, functionConstructionMode, newTarget);
 }
 
@@ -86,6 +89,9 @@
     const Identifier& functionName, const String& sourceURL, 
     const TextPosition& position, int overrideLineNumber, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // How we stringify functions is sometimes important for web compatibility.
     // See https://bugs.webkit.org/show_bug.cgi?id=24350.
     String program;
@@ -116,14 +122,14 @@
     FunctionExecutable* function = FunctionExecutable::fromGlobalCode(functionName, *exec, source, exception, overrideLineNumber);
     if (!function) {
         ASSERT(exception);
-        return exec->vm().throwException(exec, exception);
+        return throwException(exec, scope, exception);
     }
 
     Structure* subclassStructure = InternalFunction::createSubclassStructure(exec, newTarget, globalObject->functionStructure());
     if (exec->hadException())
         return nullptr;
 
-    return JSFunction::create(exec->vm(), function, globalObject->globalScope(), subclassStructure);
+    return JSFunction::create(vm, function, globalObject->globalScope(), subclassStructure);
 }
 
 // ECMA 15.3.2 The Function Constructor
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
index 4f4214c..7e2a5c9 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -83,6 +83,8 @@
 EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (thisValue.inherits(JSFunction::info())) {
         JSFunction* function = jsCast<JSFunction*>(thisValue);
@@ -112,19 +114,21 @@
         JSObject* object = asObject(thisValue);
         if (object->inlineTypeFlags() & TypeOfShouldCallGetCallData) {
             CallData callData;
-            if (object->methodTable(exec->vm())->getCallData(object, callData) != CallType::None) {
+            if (object->methodTable(vm)->getCallData(object, callData) != CallType::None) {
                 if (auto* classInfo = object->classInfo())
                     return JSValue::encode(jsMakeNontrivialString(exec, "function ", classInfo->className, "() {\n    [native code]\n}"));
             }
         }
     }
 
-    return throwVMTypeError(exec);
+    return throwVMTypeError(exec, scope);
 }
 
 // 15.3.4.5 Function.prototype.bind (thisArg [, arg1 [, arg2, ...]])
 EncodedJSValue JSC_HOST_CALL functionProtoFuncBind(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSGlobalObject* globalObject = exec->callee()->globalObject();
 
     // Let Target be the this value.
@@ -134,11 +138,10 @@
     CallData callData;
     CallType callType = getCallData(target, callData);
     if (callType == CallType::None)
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     // Primitive values are not callable.
     ASSERT(target.isObject());
     JSObject* targetObject = asObject(target);
-    VM& vm = exec->vm();
 
     // Let A be a new (possibly empty) internal list of all of the argument values provided after thisArg (arg1, arg2 etc), in order.
     size_t numBoundArgs = exec->argumentCount() > 1 ? exec->argumentCount() - 1 : 0;
@@ -146,7 +149,7 @@
     if (numBoundArgs) {
         boundArgs = JSArray::tryCreateUninitialized(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous), numBoundArgs);
         if (!boundArgs)
-            return JSValue::encode(throwOutOfMemoryError(exec));
+            return JSValue::encode(throwOutOfMemoryError(exec, scope));
         
         for (size_t i = 0; i < numBoundArgs; ++i)
             boundArgs->initializeIndex(vm, i, exec->argument(i + 1));
diff --git a/Source/JavaScriptCore/runtime/GetterSetter.cpp b/Source/JavaScriptCore/runtime/GetterSetter.cpp
index a8fda49..a51c217 100644
--- a/Source/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/Source/JavaScriptCore/runtime/GetterSetter.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2004, 2007, 2008, 2009, 2014 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2007-2009, 2014, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -87,11 +87,14 @@
 
 bool callSetter(ExecState* exec, JSValue base, JSValue getterSetter, JSValue value, ECMAMode ecmaMode)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     GetterSetter* getterSetterObj = jsCast<GetterSetter*>(getterSetter);
 
     if (getterSetterObj->isSetterNull()) {
         if (ecmaMode == StrictMode)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
 
@@ -101,7 +104,7 @@
     args.append(value);
 
     CallData callData;
-    CallType callType = setter->methodTable(exec->vm())->getCallData(setter, callData);
+    CallType callType = setter->methodTable(vm)->getCallData(setter, callData);
     call(exec, setter, callType, callData, base, args);
     return true;
 }
diff --git a/Source/JavaScriptCore/runtime/IntlCollator.cpp b/Source/JavaScriptCore/runtime/IntlCollator.cpp
index f7ca4d4..a468951 100644
--- a/Source/JavaScriptCore/runtime/IntlCollator.cpp
+++ b/Source/JavaScriptCore/runtime/IntlCollator.cpp
@@ -367,11 +367,14 @@
 
 JSValue IntlCollator::compareStrings(ExecState& state, StringView x, StringView y)
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 10.3.4 CompareStrings abstract operation (ECMA-402 2.0)
     if (!m_collator) {
         createCollator(state);
         if (!m_collator)
-            return state.vm().throwException(&state, createError(&state, ASCIILiteral("Failed to compare strings.")));
+            return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to compare strings.")));
     }
 
     UErrorCode status = U_ZERO_ERROR;
@@ -379,7 +382,7 @@
     UCharIterator iteratorY = createIterator(y);
     auto result = ucol_strcollIter(m_collator.get(), &iteratorX, &iteratorY, &status);
     if (U_FAILURE(status))
-        return state.vm().throwException(&state, createError(&state, ASCIILiteral("Failed to compare strings.")));
+        return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to compare strings.")));
     return jsNumber(result);
 }
 
diff --git a/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp b/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp
index 2c84844..7c16f5c 100644
--- a/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp
@@ -106,16 +106,18 @@
 
 EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeGetterCompare(ExecState* state)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 10.3.3 Intl.Collator.prototype.compare (ECMA-402 2.0)
     // 1. Let collator be this Collator object.
     IntlCollator* collator = jsDynamicCast<IntlCollator*>(state->thisValue());
     if (!collator)
-        return JSValue::encode(throwTypeError(state, ASCIILiteral("Intl.Collator.prototype.compare called on value that's not an object initialized as a Collator")));
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.Collator.prototype.compare called on value that's not an object initialized as a Collator")));
 
     JSBoundFunction* boundCompare = collator->boundCompare();
     // 2. If collator.[[boundCompare]] is undefined,
     if (!boundCompare) {
-        VM& vm = state->vm();
         JSGlobalObject* globalObject = collator->globalObject();
         // a. Let F be a new built-in function object as defined in 11.3.4.
         // b. The value of F’s length property is 2.
@@ -134,10 +136,13 @@
 
 EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeFuncResolvedOptions(ExecState* state)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 10.3.5 Intl.Collator.prototype.resolvedOptions() (ECMA-402 2.0)
     IntlCollator* collator = jsDynamicCast<IntlCollator*>(state->thisValue());
     if (!collator)
-        return JSValue::encode(throwTypeError(state, ASCIILiteral("Intl.Collator.prototype.resolvedOptions called on value that's not an object initialized as a Collator")));
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.Collator.prototype.resolvedOptions called on value that's not an object initialized as a Collator")));
 
     return JSValue::encode(collator->resolvedOptions(*state));
 }
diff --git a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
index 3a80500..234035e 100644
--- a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
+++ b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
@@ -420,6 +420,9 @@
 
 void IntlDateTimeFormat::initializeDateTimeFormat(ExecState& exec, JSValue locales, JSValue originalOptions)
 {
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 12.1.1 InitializeDateTimeFormat (dateTimeFormat, locales, options) (ECMA-402 2.0)
     // 1. If dateTimeFormat.[[initializedIntlObject]] is true, throw a TypeError exception.
     // 2. Set dateTimeFormat.[[initializedIntlObject]] to true.
@@ -440,7 +443,6 @@
     HashMap<String, String> localeOpt;
 
     // 8. Let matcher be GetOption(options, "localeMatcher", "string", «"lookup", "best fit"», "best fit").
-    VM& vm = exec.vm();
     String localeMatcher = intlStringOption(exec, options, vm.propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
     // 9. ReturnIfAbrupt(matcher).
     if (exec.hadException())
@@ -487,7 +489,7 @@
         // d. Let tz be CanonicalizeTimeZoneName(tz).
         tz = canonicalizeTimeZoneName(originalTz);
         if (tz.isNull()) {
-            throwRangeError(&exec, String::format("invalid time zone: %s", originalTz.utf8().data()));
+            throwRangeError(&exec, scope, String::format("invalid time zone: %s", originalTz.utf8().data()));
             return;
         }
     } else {
@@ -647,7 +649,7 @@
     UErrorCode status = U_ZERO_ERROR;
     UDateTimePatternGenerator* generator = udatpg_open(dataLocale.utf8().data(), &status);
     if (U_FAILURE(status)) {
-        throwTypeError(&exec, ASCIILiteral("failed to initialize DateTimeFormat"));
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat"));
         return;
     }
 
@@ -663,7 +665,7 @@
     }
     udatpg_close(generator);
     if (U_FAILURE(status)) {
-        throwTypeError(&exec, ASCIILiteral("failed to initialize DateTimeFormat"));
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat"));
         return;
     }
 
@@ -674,7 +676,7 @@
     StringView timeZoneView(m_timeZone);
     m_dateFormat = std::unique_ptr<UDateFormat, UDateFormatDeleter>(udat_open(UDAT_PATTERN, UDAT_PATTERN, m_locale.utf8().data(), timeZoneView.upconvertedCharacters(), timeZoneView.length(), pattern.upconvertedCharacters(), pattern.length(), &status));
     if (U_FAILURE(status)) {
-        throwTypeError(&exec, ASCIILiteral("failed to initialize DateTimeFormat"));
+        throwTypeError(&exec, scope, ASCIILiteral("failed to initialize DateTimeFormat"));
         return;
     }
 
@@ -883,6 +885,9 @@
 
 JSValue IntlDateTimeFormat::format(ExecState& exec, double value)
 {
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 12.3.4 FormatDateTime abstract operation (ECMA-402 2.0)
     if (!m_initializedDateTimeFormat) {
         initializeDateTimeFormat(exec, jsUndefined(), jsUndefined());
@@ -891,7 +896,7 @@
 
     // 1. If x is not a finite Number, then throw a RangeError exception.
     if (!std::isfinite(value))
-        return throwRangeError(&exec, ASCIILiteral("date value is not finite in DateTimeFormat format()"));
+        return throwRangeError(&exec, scope, ASCIILiteral("date value is not finite in DateTimeFormat format()"));
 
     // Delegate remaining steps to ICU.
     UErrorCode status = U_ZERO_ERROR;
@@ -903,7 +908,7 @@
         udat_format(m_dateFormat.get(), value, result.data(), resultLength, nullptr, &status);
     }
     if (U_FAILURE(status))
-        return throwTypeError(&exec, ASCIILiteral("failed to format date value"));
+        return throwTypeError(&exec, scope, ASCIILiteral("failed to format date value"));
 
     return jsString(&exec, String(result.data(), resultLength));
 }
diff --git a/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp b/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp
index de509f5..ae3eab9 100644
--- a/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -110,6 +111,9 @@
 
 EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeGetterFormat(ExecState* state)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 12.3.3 Intl.DateTimeFormat.prototype.format (ECMA-402 2.0)
     // 1. Let dtf be this DateTimeFormat object.
     IntlDateTimeFormat* dtf = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue());
@@ -117,23 +121,22 @@
     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
     // https://bugs.webkit.org/show_bug.cgi?id=153679
     if (!dtf)
-        dtf = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue().get(state, state->vm().propertyNames->builtinNames().intlSubstituteValuePrivateName()));
+        dtf = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName()));
 
     // 2. ReturnIfAbrupt(dtf).
     if (!dtf)
-        return JSValue::encode(throwTypeError(state, ASCIILiteral("Intl.DateTimeFormat.prototype.format called on value that's not an object initialized as a DateTimeFormat")));
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.DateTimeFormat.prototype.format called on value that's not an object initialized as a DateTimeFormat")));
 
     JSBoundFunction* boundFormat = dtf->boundFormat();
     // 3. If the [[boundFormat]] internal slot of this DateTimeFormat object is undefined,
     if (!boundFormat) {
-        VM& vm = state->vm();
         JSGlobalObject* globalObject = dtf->globalObject();
         // a. Let F be a new built-in function object as defined in 12.3.4.
         // b. The value of F’s length property is 1. (Note: F’s length property was 0 in ECMA-402 1.0)
         JSFunction* targetObject = JSFunction::create(vm, globalObject, 1, ASCIILiteral("format"), IntlDateTimeFormatFuncFormatDateTime, NoIntrinsic);
         JSArray* boundArgs = JSArray::tryCreateUninitialized(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
         if (!boundArgs)
-            return JSValue::encode(throwOutOfMemoryError(state));
+            return JSValue::encode(throwOutOfMemoryError(state, scope));
 
         // c. Let bf be BoundFunctionCreate(F, «this value»).
         boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, dtf, boundArgs, 1, ASCIILiteral("format"));
@@ -148,16 +151,19 @@
 
 EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeFuncResolvedOptions(ExecState* state)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 12.3.5 Intl.DateTimeFormat.prototype.resolvedOptions() (ECMA-402 2.0)
     IntlDateTimeFormat* dateTimeFormat = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue());
 
     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
     // https://bugs.webkit.org/show_bug.cgi?id=153679
     if (!dateTimeFormat)
-        dateTimeFormat = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue().get(state, state->vm().propertyNames->builtinNames().intlSubstituteValuePrivateName()));
+        dateTimeFormat = jsDynamicCast<IntlDateTimeFormat*>(state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName()));
 
     if (!dateTimeFormat)
-        return JSValue::encode(throwTypeError(state, ASCIILiteral("Intl.DateTimeFormat.prototype.resolvedOptions called on value that's not an object initialized as a DateTimeFormat")));
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.DateTimeFormat.prototype.resolvedOptions called on value that's not an object initialized as a DateTimeFormat")));
 
     return JSValue::encode(dateTimeFormat->resolvedOptions(*state));
 }
diff --git a/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp b/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp
index ece5fa5..baf0511 100644
--- a/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp
+++ b/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
  * Copyright (C) 2016 Sukolsak Sakshuwong (sukolsak@gmail.com)
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -159,6 +160,7 @@
 {
     // 11.1.1 InitializeNumberFormat (numberFormat, locales, options) (ECMA-402 2.0)
     VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     // 1. If numberFormat has an [[initializedIntlObject]] internal slot with value true, throw a TypeError exception.
     // 2. Set numberFormat.[[initializedIntlObject]] to true.
@@ -186,7 +188,7 @@
     HashMap<String, String> opt;
 
     // 8. Let matcher be GetOption(options, "localeMatcher", "string", «"lookup", "best fit"», "best fit").
-    String matcher = intlStringOption(state, options, state.vm().propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
+    String matcher = intlStringOption(state, options, vm.propertyNames->localeMatcher, { "lookup", "best fit" }, "localeMatcher must be either \"lookup\" or \"best fit\"", "best fit");
     // 9. ReturnIfAbrupt(matcher).
     if (state.hadException())
         return;
@@ -230,7 +232,7 @@
     if (!currency.isNull()) {
         // a. If the result of IsWellFormedCurrencyCode(c), is false, then throw a RangeError exception.
         if (currency.length() != 3 || !currency.isAllSpecialCharacters<isASCIIAlpha>()) {
-            state.vm().throwException(&state, createRangeError(&state, ASCIILiteral("currency is not a well-formed currency code")));
+            throwException(&state, scope, createRangeError(&state, ASCIILiteral("currency is not a well-formed currency code")));
             return;
         }
     }
@@ -239,7 +241,7 @@
     if (m_style == Style::Currency) {
         // 22. If s is "currency" and c is undefined, throw a TypeError exception.
         if (currency.isNull()) {
-            throwTypeError(&state, ASCIILiteral("currency must be a string"));
+            throwTypeError(&state, scope, ASCIILiteral("currency must be a string"));
             return;
         }
 
@@ -423,11 +425,14 @@
 
 JSValue IntlNumberFormat::formatNumber(ExecState& state, double number)
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 11.3.4 FormatNumber abstract operation (ECMA-402 2.0)
     if (!m_numberFormat) {
         createNumberFormat(state);
         if (!m_numberFormat)
-            return state.vm().throwException(&state, createError(&state, ASCIILiteral("Failed to format a number.")));
+            return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to format a number.")));
     }
 
     // Map negative zero to positive zero.
@@ -443,7 +448,7 @@
         unum_formatDouble(m_numberFormat.get(), number, buffer.data(), length, nullptr, &status);
     }
     if (U_FAILURE(status))
-        return state.vm().throwException(&state, createError(&state, ASCIILiteral("Failed to format a number.")));
+        return throwException(&state, scope, createError(&state, ASCIILiteral("Failed to format a number.")));
 
     return jsString(&state, String(buffer.data(), length));
 }
diff --git a/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp b/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp
index fe2c9db..729def1 100644
--- a/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp
@@ -100,6 +100,9 @@
 
 EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeGetterFormat(ExecState* state)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 11.3.3 Intl.NumberFormat.prototype.format (ECMA-402 2.0)
     // 1. Let nf be this NumberFormat object.
     IntlNumberFormat* nf = jsDynamicCast<IntlNumberFormat*>(state->thisValue());
@@ -107,22 +110,21 @@
     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
     // https://bugs.webkit.org/show_bug.cgi?id=153679
     if (!nf)
-        nf = jsDynamicCast<IntlNumberFormat*>(state->thisValue().get(state, state->vm().propertyNames->builtinNames().intlSubstituteValuePrivateName()));
+        nf = jsDynamicCast<IntlNumberFormat*>(state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName()));
 
     if (!nf)
-        return JSValue::encode(throwTypeError(state, ASCIILiteral("Intl.NumberFormat.prototype.format called on value that's not an object initialized as a NumberFormat")));
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.NumberFormat.prototype.format called on value that's not an object initialized as a NumberFormat")));
     
     JSBoundFunction* boundFormat = nf->boundFormat();
     // 2. If nf.[[boundFormat]] is undefined,
     if (!boundFormat) {
-        VM& vm = state->vm();
         JSGlobalObject* globalObject = nf->globalObject();
         // a. Let F be a new built-in function object as defined in 11.3.4.
         // b. The value of F’s length property is 1.
         JSFunction* targetObject = JSFunction::create(vm, globalObject, 1, ASCIILiteral("format"), IntlNumberFormatFuncFormatNumber, NoIntrinsic);
         JSArray* boundArgs = JSArray::tryCreateUninitialized(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
         if (!boundArgs)
-            return JSValue::encode(throwOutOfMemoryError(state));
+            return JSValue::encode(throwOutOfMemoryError(state, scope));
 
         // c. Let bf be BoundFunctionCreate(F, «this value»).
         boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, nf, boundArgs, 1, ASCIILiteral("format"));
@@ -137,16 +139,19 @@
 
 EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeFuncResolvedOptions(ExecState* state)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 11.3.5 Intl.NumberFormat.prototype.resolvedOptions() (ECMA-402 2.0)
     IntlNumberFormat* numberFormat = jsDynamicCast<IntlNumberFormat*>(state->thisValue());
 
     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
     // https://bugs.webkit.org/show_bug.cgi?id=153679
     if (!numberFormat)
-        numberFormat = jsDynamicCast<IntlNumberFormat*>(state->thisValue().get(state, state->vm().propertyNames->builtinNames().intlSubstituteValuePrivateName()));
+        numberFormat = jsDynamicCast<IntlNumberFormat*>(state->thisValue().get(state, vm.propertyNames->builtinNames().intlSubstituteValuePrivateName()));
 
     if (!numberFormat)
-        return JSValue::encode(throwTypeError(state, ASCIILiteral("Intl.NumberFormat.prototype.resolvedOptions called on value that's not an object initialized as a NumberFormat")));
+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral("Intl.NumberFormat.prototype.resolvedOptions called on value that's not an object initialized as a NumberFormat")));
 
     return JSValue::encode(numberFormat->resolvedOptions(*state));
 }
diff --git a/Source/JavaScriptCore/runtime/IntlObject.cpp b/Source/JavaScriptCore/runtime/IntlObject.cpp
index 185beb5..fede118 100644
--- a/Source/JavaScriptCore/runtime/IntlObject.cpp
+++ b/Source/JavaScriptCore/runtime/IntlObject.cpp
@@ -162,6 +162,9 @@
 
 String intlStringOption(ExecState& state, JSValue options, PropertyName property, std::initializer_list<const char*> values, const char* notFound, const char* fallback)
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 9.2.9 GetOption (options, property, type, values, fallback)
     // For type="string".
 
@@ -195,7 +198,7 @@
         // d. If values is not undefined, then
         // i. If values does not contain an element equal to value, throw a RangeError exception.
         if (values.size() && std::find(values.begin(), values.end(), stringValue) == values.end()) {
-            state.vm().throwException(&state, createRangeError(&state, notFound));
+            throwException(&state, scope, createRangeError(&state, notFound));
             return { };
         }
 
@@ -209,6 +212,9 @@
 
 unsigned intlNumberOption(ExecState& state, JSValue options, PropertyName property, unsigned minimum, unsigned maximum, unsigned fallback)
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 9.2.9 GetNumberOption (options, property, minimum, maximum, fallback) (ECMA-402 2.0)
     // 1. Let opts be ToObject(options).
     JSObject* opts = options.toObject(&state);
@@ -233,7 +239,7 @@
             return 0;
         // 1. If value is NaN or less than minimum or greater than maximum, throw a RangeError exception.
         if (!(doubleValue >= minimum && doubleValue <= maximum)) {
-            state.vm().throwException(&state, createRangeError(&state, *property.publicName() + " is out of range"));
+            throwException(&state, scope, createRangeError(&state, *property.publicName() + " is out of range"));
             return 0;
         }
 
@@ -524,6 +530,8 @@
 {
     // 9.2.1 CanonicalizeLocaleList (locales)
     VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = state.callee()->globalObject();
     Vector<String> seen;
 
@@ -587,7 +595,7 @@
 
             // iii. If Type(kValue) is not String or Object, throw a TypeError exception.
             if (!kValue.isString() && !kValue.isObject()) {
-                throwTypeError(&state, ASCIILiteral("locale value must be a string or object"));
+                throwTypeError(&state, scope, ASCIILiteral("locale value must be a string or object"));
                 return Vector<String>();
             }
 
@@ -602,7 +610,7 @@
             // vii. Let canonicalizedTag be CanonicalizeLanguageTag(tag).
             String canonicalizedTag = canonicalizeLanguageTag(tag->value(&state));
             if (canonicalizedTag.isNull()) {
-                state.vm().throwException(&state, createRangeError(&state, String::format("invalid language tag: %s", tag->value(&state).utf8().data())));
+                throwException(&state, scope, createRangeError(&state, String::format("invalid language tag: %s", tag->value(&state).utf8().data())));
                 return Vector<String>();
             }
 
@@ -870,6 +878,9 @@
 
 static JSArray* lookupSupportedLocales(ExecState& state, const HashSet<String>& availableLocales, const Vector<String>& requestedLocales)
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 9.2.6 LookupSupportedLocales (availableLocales, requestedLocales)
 
     // 1. Let rLocales be CreateArrayFromList(requestedLocales).
@@ -879,11 +890,10 @@
     size_t len = requestedLocales.size();
 
     // 3. Let subset be an empty List.
-    VM& vm = state.vm();
     JSGlobalObject* globalObject = state.callee()->globalObject();
     JSArray* subset = JSArray::tryCreateUninitialized(vm, globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
     if (!subset) {
-        throwOutOfMemoryError(&state);
+        throwOutOfMemoryError(&state, scope);
         return nullptr;
     }
 
diff --git a/Source/JavaScriptCore/runtime/IteratorOperations.cpp b/Source/JavaScriptCore/runtime/IteratorOperations.cpp
index 7ac7082..0828adc 100644
--- a/Source/JavaScriptCore/runtime/IteratorOperations.cpp
+++ b/Source/JavaScriptCore/runtime/IteratorOperations.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,14 +37,17 @@
 
 JSValue iteratorNext(ExecState* exec, JSValue iterator, JSValue value)
 {
-    JSValue nextFunction = iterator.get(exec, exec->vm().propertyNames->next);
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue nextFunction = iterator.get(exec, vm.propertyNames->next);
     if (exec->hadException())
         return jsUndefined();
 
     CallData nextFunctionCallData;
     CallType nextFunctionCallType = getCallData(nextFunction, nextFunctionCallData);
     if (nextFunctionCallType == CallType::None)
-        return throwTypeError(exec);
+        return throwTypeError(exec, scope);
 
     MarkedArgumentBuffer nextFunctionArguments;
     if (!value.isEmpty())
@@ -53,7 +57,7 @@
         return jsUndefined();
 
     if (!result.isObject())
-        return throwTypeError(exec, ASCIILiteral("Iterator result interface is not an object."));
+        return throwTypeError(exec, scope, ASCIILiteral("Iterator result interface is not an object."));
 
     return result;
 }
@@ -89,18 +93,21 @@
 
 void iteratorClose(ExecState* exec, JSValue iterator)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Exception* exception = nullptr;
     if (exec->hadException()) {
         exception = exec->exception();
         exec->clearException();
     }
-    JSValue returnFunction = iterator.get(exec, exec->vm().propertyNames->returnKeyword);
+    JSValue returnFunction = iterator.get(exec, vm.propertyNames->returnKeyword);
     if (exec->hadException())
         return;
 
     if (returnFunction.isUndefined()) {
         if (exception)
-            exec->vm().throwException(exec, exception);
+            throwException(exec, scope, exception);
         return;
     }
 
@@ -108,9 +115,9 @@
     CallType returnFunctionCallType = getCallData(returnFunction, returnFunctionCallData);
     if (returnFunctionCallType == CallType::None) {
         if (exception)
-            exec->vm().throwException(exec, exception);
+            throwException(exec, scope, exception);
         else
-            throwTypeError(exec);
+            throwTypeError(exec, scope);
         return;
     }
 
@@ -118,7 +125,7 @@
     JSValue innerResult = call(exec, returnFunction, returnFunctionCallType, returnFunctionCallData, iterator, returnFunctionArguments);
 
     if (exception) {
-        exec->vm().throwException(exec, exception);
+        throwException(exec, scope, exception);
         return;
     }
 
@@ -126,7 +133,7 @@
         return;
 
     if (!innerResult.isObject()) {
-        throwTypeError(exec, ASCIILiteral("Iterator result interface is not an object."));
+        throwTypeError(exec, scope, ASCIILiteral("Iterator result interface is not an object."));
         return;
     }
 }
@@ -147,14 +154,18 @@
 
 JSObject* createIteratorResultObject(ExecState* exec, JSValue value, bool done)
 {
+    VM& vm = exec->vm();
     JSObject* resultObject = constructEmptyObject(exec, exec->lexicalGlobalObject()->iteratorResultObjectStructure());
-    resultObject->putDirect(exec->vm(), donePropertyOffset, jsBoolean(done));
-    resultObject->putDirect(exec->vm(), valuePropertyOffset, value);
+    resultObject->putDirect(vm, donePropertyOffset, jsBoolean(done));
+    resultObject->putDirect(vm, valuePropertyOffset, value);
     return resultObject;
 }
 
 JSValue iteratorForIterable(ExecState* state, JSValue iterable)
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
     JSValue iteratorFunction = iterable.get(state, state->propertyNames().iteratorSymbol);
     if (state->hadException())
         return JSValue();
@@ -162,7 +173,7 @@
     CallData iteratorFunctionCallData;
     CallType iteratorFunctionCallType = getCallData(iteratorFunction, iteratorFunctionCallData);
     if (iteratorFunctionCallType == CallType::None) {
-        throwTypeError(state);
+        throwTypeError(state, scope);
         return JSValue();
     }
 
@@ -172,7 +183,7 @@
         return JSValue();
 
     if (!iterator.isObject()) {
-        throwTypeError(state);
+        throwTypeError(state, scope);
         return JSValue();
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index cdc6a69..48f848a 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008, 2009, 2012, 2013, 2015-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007-2009, 2012-2013, 2015-2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -75,6 +75,9 @@
 // Defined in ES5.1 15.4.5.1
 bool JSArray::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSArray* array = jsCast<JSArray*>(object);
 
     // 3. If P is "length", then
@@ -106,7 +109,7 @@
         unsigned newLen = descriptor.value().toUInt32(exec);
         // d. If newLen is not equal to ToNumber( Desc.[[Value]]), throw a RangeError exception.
         if (newLen != descriptor.value().toNumber(exec)) {
-            exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
+            JSC::throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return false;
         }
 
@@ -191,6 +194,9 @@
 // ECMA 15.4.5.1
 bool JSArray::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSArray* thisObject = jsCast<JSArray*>(cell);
 
     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
@@ -199,7 +205,7 @@
     if (propertyName == exec->propertyNames().length) {
         unsigned newLength = value.toUInt32(exec);
         if (value.toNumber(exec) != static_cast<double>(newLength)) {
-            exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
+            throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return false;
         }
         return thisObject->setLength(exec, newLength, slot.isStrictMode());
@@ -393,6 +399,8 @@
 
 bool JSArray::appendMemcpy(ExecState* exec, VM& vm, unsigned startIndex, JSC::JSArray* otherArray)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!canFastCopy(vm, otherArray))
         return false;
 
@@ -418,7 +426,7 @@
         return false;
 
     if (!ensureLength(vm, newLength)) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return false;
     }
     ASSERT(copyType == indexingType());
@@ -433,6 +441,9 @@
 
 bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Butterfly* butterfly = m_butterfly.get();
     switch (indexingType()) {
     case ArrayClass:
@@ -441,9 +452,9 @@
         if (newLength >= MIN_SPARSE_ARRAY_INDEX) {
             return setLengthWithArrayStorage(
                 exec, newLength, throwException,
-                ensureArrayStorage(exec->vm()));
+                ensureArrayStorage(vm));
         }
-        createInitialUndecided(exec->vm(), newLength);
+        createInitialUndecided(vm, newLength);
         return true;
         
     case ArrayWithUndecided:
@@ -457,11 +468,11 @@
                 && !isDenseEnoughForVector(newLength, countElements()))) {
             return setLengthWithArrayStorage(
                 exec, newLength, throwException,
-                ensureArrayStorage(exec->vm()));
+                ensureArrayStorage(vm));
         }
         if (newLength > butterfly->publicLength()) {
-            if (!ensureLength(exec->vm(), newLength)) {
-                throwOutOfMemoryError(exec);
+            if (!ensureLength(vm, newLength)) {
+                throwOutOfMemoryError(exec, scope);
                 return false;
             }
             return true;
@@ -470,7 +481,7 @@
         unsigned lengthToClear = butterfly->publicLength() - newLength;
         unsigned costToAllocateNewButterfly = 64; // a heuristic.
         if (lengthToClear > newLength && lengthToClear > costToAllocateNewButterfly) {
-            reallocateAndShrinkButterfly(exec->vm(), newLength);
+            reallocateAndShrinkButterfly(vm, newLength);
             return true;
         }
 
@@ -497,6 +508,9 @@
 
 JSValue JSArray::pop(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Butterfly* butterfly = m_butterfly.get();
     
     switch (indexingType()) {
@@ -548,7 +562,7 @@
         unsigned length = storage->length();
         if (!length) {
             if (!isLengthWritable())
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
             return jsUndefined();
         }
 
@@ -580,7 +594,7 @@
         return jsUndefined();
     // Call the [[Delete]] internal method of O with arguments indx and true.
     if (!deletePropertyByIndex(this, exec, index)) {
-        throwTypeError(exec, ASCIILiteral("Unable to delete property."));
+        throwTypeError(exec, scope, ASCIILiteral("Unable to delete property."));
         return jsUndefined();
     }
     // Call the [[Put]] internal method of O with arguments "length", indx, and true.
@@ -594,23 +608,26 @@
 //  - pushing to an array of length 2^32-1 stores the property, but throws a range error.
 void JSArray::push(ExecState* exec, JSValue value)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Butterfly* butterfly = m_butterfly.get();
     
     switch (indexingType()) {
     case ArrayClass: {
-        createInitialUndecided(exec->vm(), 0);
+        createInitialUndecided(vm, 0);
         FALLTHROUGH;
     }
         
     case ArrayWithUndecided: {
-        convertUndecidedForValue(exec->vm(), value);
+        convertUndecidedForValue(vm, value);
         push(exec, value);
         return;
     }
         
     case ArrayWithInt32: {
         if (!value.isInt32()) {
-            convertInt32ForValue(exec->vm(), value);
+            convertInt32ForValue(vm, value);
             push(exec, value);
             return;
         }
@@ -624,9 +641,9 @@
         }
         
         if (length > MAX_ARRAY_INDEX) {
-            methodTable(exec->vm())->putByIndex(this, exec, length, value, true);
+            methodTable(vm)->putByIndex(this, exec, length, value, true);
             if (!exec->hadException())
-                exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return;
         }
         
@@ -638,15 +655,15 @@
         unsigned length = butterfly->publicLength();
         ASSERT(length <= butterfly->vectorLength());
         if (length < butterfly->vectorLength()) {
-            butterfly->contiguous()[length].set(exec->vm(), this, value);
+            butterfly->contiguous()[length].set(vm, this, value);
             butterfly->setPublicLength(length + 1);
             return;
         }
         
         if (length > MAX_ARRAY_INDEX) {
-            methodTable(exec->vm())->putByIndex(this, exec, length, value, true);
+            methodTable(vm)->putByIndex(this, exec, length, value, true);
             if (!exec->hadException())
-                exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return;
         }
         
@@ -656,13 +673,13 @@
         
     case ArrayWithDouble: {
         if (!value.isNumber()) {
-            convertDoubleToContiguous(exec->vm());
+            convertDoubleToContiguous(vm);
             push(exec, value);
             return;
         }
         double valueAsDouble = value.asNumber();
         if (valueAsDouble != valueAsDouble) {
-            convertDoubleToContiguous(exec->vm());
+            convertDoubleToContiguous(vm);
             push(exec, value);
             return;
         }
@@ -676,9 +693,9 @@
         }
         
         if (length > MAX_ARRAY_INDEX) {
-            methodTable(exec->vm())->putByIndex(this, exec, length, value, true);
+            methodTable(vm)->putByIndex(this, exec, length, value, true);
             if (!exec->hadException())
-                exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return;
         }
         
@@ -703,7 +720,7 @@
         // Fast case - push within vector, always update m_length & m_numValuesInVector.
         unsigned length = storage->length();
         if (length < storage->vectorLength()) {
-            storage->m_vector[length].set(exec->vm(), this, value);
+            storage->m_vector[length].set(vm, this, value);
             storage->setLength(length + 1);
             ++storage->m_numValuesInVector;
             return;
@@ -711,10 +728,10 @@
 
         // Pushing to an array of invalid length (2^31-1) stores the property, but throws a range error.
         if (storage->length() > MAX_ARRAY_INDEX) {
-            methodTable(exec->vm())->putByIndex(this, exec, storage->length(), value, true);
+            methodTable(vm)->putByIndex(this, exec, storage->length(), value, true);
             // Per ES5.1 15.4.4.7 step 6 & 15.4.5.1 step 3.d.
             if (!exec->hadException())
-                exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Invalid array length")));
+                throwException(exec, scope, createRangeError(exec, ASCIILiteral("Invalid array length")));
             return;
         }
 
@@ -963,6 +980,9 @@
 // Returns true if the unshift can be handled, false to fallback.    
 bool JSArray::unshiftCountWithArrayStorage(ExecState* exec, unsigned startIndex, unsigned count, ArrayStorage* storage)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     unsigned length = storage->length();
 
     RELEASE_ASSERT(startIndex <= length);
@@ -981,13 +1001,13 @@
         storage = newButterfly->arrayStorage();
         storage->m_indexBias -= count;
         storage->setVectorLength(vectorLength + count);
-        setButterflyWithoutChangingStructure(exec->vm(), newButterfly);
+        setButterflyWithoutChangingStructure(vm, newButterfly);
     } else if (!moveFront && vectorLength - length >= count)
         storage = storage->butterfly()->arrayStorage();
-    else if (unshiftCountSlowCase(exec->vm(), moveFront, count))
+    else if (unshiftCountSlowCase(vm, moveFront, count))
         storage = arrayStorage();
     else {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return true;
     }
 
@@ -1007,6 +1027,9 @@
 
 bool JSArray::unshiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Butterfly* butterfly = m_butterfly.get();
     
     switch (indexingType()) {
@@ -1022,10 +1045,10 @@
         // We may have to walk the entire array to do the unshift. We're willing to do so
         // only if it's not horribly slow.
         if (oldLength - startIndex >= MIN_SPARSE_ARRAY_INDEX)
-            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
+            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
         
-        if (!ensureLength(exec->vm(), oldLength + count)) {
-            throwOutOfMemoryError(exec);
+        if (!ensureLength(vm, oldLength + count)) {
+            throwOutOfMemoryError(exec, scope);
             return false;
         }
         butterfly = m_butterfly.get();
@@ -1035,7 +1058,7 @@
         for (unsigned i = oldLength; i-- > startIndex;) {
             JSValue v = butterfly->contiguous()[i].get();
             if (UNLIKELY(!v))
-                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
+                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
         }
 
         for (unsigned i = oldLength; i-- > startIndex;) {
@@ -1058,10 +1081,10 @@
         // We may have to walk the entire array to do the unshift. We're willing to do so
         // only if it's not horribly slow.
         if (oldLength - startIndex >= MIN_SPARSE_ARRAY_INDEX)
-            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
+            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
         
-        if (!ensureLength(exec->vm(), oldLength + count)) {
-            throwOutOfMemoryError(exec);
+        if (!ensureLength(vm, oldLength + count)) {
+            throwOutOfMemoryError(exec, scope);
             return false;
         }
         butterfly = m_butterfly.get();
@@ -1071,7 +1094,7 @@
         for (unsigned i = oldLength; i-- > startIndex;) {
             double v = butterfly->contiguousDouble()[i];
             if (UNLIKELY(v != v))
-                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
+                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
         }
 
         for (unsigned i = oldLength; i-- > startIndex;) {
diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp b/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
index cc702f4..689d601 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp
@@ -79,6 +79,9 @@
 
 static EncodedJSValue JSC_HOST_CALL constructArrayBuffer(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSArrayBufferConstructor* constructor =
         jsCast<JSArrayBufferConstructor*>(exec->callee());
     
@@ -96,19 +99,21 @@
     
     auto buffer = ArrayBuffer::tryCreate(length, 1);
     if (!buffer)
-        return JSValue::encode(throwOutOfMemoryError(exec));
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
 
     Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), constructor->globalObject()->arrayBufferStructure());
     if (exec->hadException())
         return JSValue::encode(JSValue());
-    JSArrayBuffer* result = JSArrayBuffer::create(exec->vm(), arrayBufferStructure, WTFMove(buffer));
+    JSArrayBuffer* result = JSArrayBuffer::create(vm, arrayBufferStructure, WTFMove(buffer));
     
     return JSValue::encode(result);
 }
 
 static EncodedJSValue JSC_HOST_CALL callArrayBuffer(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "ArrayBuffer"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "ArrayBuffer"));
 }
 
 ConstructType JSArrayBufferConstructor::getConstructData(
diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp b/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp
index f052928..8d8d967 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,14 +37,17 @@
 
 static EncodedJSValue JSC_HOST_CALL arrayBufferProtoFuncSlice(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSFunction* callee = jsCast<JSFunction*>(exec->callee());
     
     JSArrayBuffer* thisObject = jsDynamicCast<JSArrayBuffer*>(exec->thisValue());
     if (!thisObject)
-        return throwVMTypeError(exec, ASCIILiteral("Receiver of slice must be an array buffer."));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver of slice must be an array buffer."));
     
     if (!exec->argumentCount())
-        return throwVMTypeError(exec, ASCIILiteral("Slice requires at least one argument."));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Slice requires at least one argument."));
     
     int32_t begin = exec->argument(0).toInt32(exec);
     if (exec->hadException())
@@ -60,11 +63,11 @@
     
     RefPtr<ArrayBuffer> newBuffer = thisObject->impl()->slice(begin, end);
     if (!newBuffer)
-        return JSValue::encode(throwOutOfMemoryError(exec));
+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
     
     Structure* structure = callee->globalObject()->arrayBufferStructure();
     
-    JSArrayBuffer* result = JSArrayBuffer::create(exec->vm(), structure, newBuffer);
+    JSArrayBuffer* result = JSArrayBuffer::create(vm, structure, newBuffer);
     
     return JSValue::encode(result);
 }
diff --git a/Source/JavaScriptCore/runtime/JSCInlines.h b/Source/JavaScriptCore/runtime/JSCInlines.h
index e6b4f57..0408b16 100644
--- a/Source/JavaScriptCore/runtime/JSCInlines.h
+++ b/Source/JavaScriptCore/runtime/JSCInlines.h
@@ -51,6 +51,7 @@
 #include "Operations.h"
 #include "SlotVisitorInlines.h"
 #include "StructureInlines.h"
+#include "ThrowScope.h"
 #include "WeakGCMapInlines.h"
 
 #endif // JSCInlines_h
diff --git a/Source/JavaScriptCore/runtime/JSCJSValue.cpp b/Source/JavaScriptCore/runtime/JSCJSValue.cpp
index 0a77b95..36ff545 100644
--- a/Source/JavaScriptCore/runtime/JSCJSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSCJSValue.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2007, 2008, 2012 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -94,6 +94,8 @@
 
 JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ASSERT(!isCell());
 
     if (isInt32() || isDouble())
@@ -102,8 +104,7 @@
         return constructBooleanFromImmediateBoolean(exec, globalObject, asValue());
 
     ASSERT(isUndefinedOrNull());
-    VM& vm = exec->vm();
-    vm.throwException(exec, createNotAnObjectError(exec, *this));
+    throwException(exec, scope, createNotAnObjectError(exec, *this));
     return nullptr;
 }
 
@@ -124,6 +125,9 @@
 
 JSObject* JSValue::synthesizePrototype(ExecState* exec) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (isCell()) {
         if (isString())
             return exec->lexicalGlobalObject()->stringPrototype();
@@ -137,8 +141,7 @@
         return exec->lexicalGlobalObject()->booleanPrototype();
 
     ASSERT(isUndefinedOrNull());
-    VM& vm = exec->vm();
-    vm.throwException(exec, createNotAnObjectError(exec, *this));
+    throwException(exec, scope, createNotAnObjectError(exec, *this));
     return nullptr;
 }
 
@@ -146,6 +149,7 @@
 bool JSValue::putToPrimitive(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (Optional<uint32_t> index = parseIndex(propertyName))
         return putToPrimitiveByIndex(exec, index.value(), value, slot.isStrictMode());
@@ -160,7 +164,7 @@
             prototype = obj->getPrototypeDirect();
             if (prototype.isNull()) {
                 if (slot.isStrictMode())
-                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                    throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
                 return false;
             }
         }
@@ -172,7 +176,7 @@
         if (offset != invalidOffset) {
             if (attributes & ReadOnly) {
                 if (slot.isStrictMode())
-                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                    throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
                 return false;
             }
 
@@ -196,12 +200,15 @@
     }
     
     if (slot.isStrictMode())
-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+        throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
     return false;
 }
 
 bool JSValue::putToPrimitiveByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (propertyName > MAX_ARRAY_INDEX) {
         PutPropertySlot slot(*this, shouldThrow);
         return putToPrimitive(exec, Identifier::from(exec, propertyName), value, slot);
@@ -217,7 +224,7 @@
         return putResult;
     
     if (shouldThrow)
-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+        throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
     return false;
 }
 
@@ -338,13 +345,15 @@
 
 JSString* JSValue::toStringSlowCase(ExecState* exec, bool returnEmptyStringOnError) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     auto errorValue = [&] () -> JSString* {
         if (returnEmptyStringOnError)
             return jsEmptyString(exec);
         return nullptr;
     };
     
-    VM& vm = exec->vm();
     ASSERT(!isString());
     if (isInt32()) {
         auto integer = asInt32();
@@ -363,7 +372,7 @@
     if (isUndefined())
         return vm.smallStrings.undefinedString();
     if (isSymbol()) {
-        throwTypeError(exec, ASCIILiteral("Cannot convert a symbol to a string"));
+        throwTypeError(exec, scope, ASCIILiteral("Cannot convert a symbol to a string"));
         return errorValue();
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSCJSValueInlines.h b/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
index fbd0e91..779d603 100644
--- a/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
+++ b/Source/JavaScriptCore/runtime/JSCJSValueInlines.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -633,8 +633,11 @@
 
 inline PreferredPrimitiveType toPreferredPrimitiveType(ExecState* exec, JSValue value)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!value.isString()) {
-        throwTypeError(exec, ASCIILiteral("Primitive hint is not a string."));
+        throwTypeError(exec, scope, ASCIILiteral("Primitive hint is not a string."));
         return NoPreference;
     }
 
@@ -649,7 +652,7 @@
     if (WTF::equal(hintString, "string"))
         return PreferString;
 
-    throwTypeError(exec, ASCIILiteral("Expected primitive hint to match one of 'default', 'number', 'string'."));
+    throwTypeError(exec, scope, ASCIILiteral("Expected primitive hint to match one of 'default', 'number', 'string'."));
     return NoPreference;
 }
 
@@ -1031,9 +1034,12 @@
 
 ALWAYS_INLINE bool JSValue::requireObjectCoercible(ExecState* exec) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!isUndefinedOrNull())
         return true;
-    exec->vm().throwException(exec, createNotAnObjectError(exec, *this));
+    throwException(exec, scope, createNotAnObjectError(exec, *this));
     return false;
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSDataView.cpp b/Source/JavaScriptCore/runtime/JSDataView.cpp
index 09c5cdd..c6dbd92 100644
--- a/Source/JavaScriptCore/runtime/JSDataView.cpp
+++ b/Source/JavaScriptCore/runtime/JSDataView.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,16 +47,18 @@
     ExecState* exec, Structure* structure, PassRefPtr<ArrayBuffer> passedBuffer,
     unsigned byteOffset, unsigned byteLength)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     RefPtr<ArrayBuffer> buffer = passedBuffer;
     if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, byteLength, sizeof(uint8_t))) {
-        throwVMError(exec, createRangeError(exec, ASCIILiteral("Length out of range of buffer")));
+        throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Length out of range of buffer")));
         return nullptr;
     }
     if (!ArrayBufferView::verifyByteOffsetAlignment(byteOffset, sizeof(uint8_t))) {
-        exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Byte offset is not aligned")));
+        throwException(exec, scope, createRangeError(exec, ASCIILiteral("Byte offset is not aligned")));
         return nullptr;
     }
-    VM& vm = exec->vm();
     ConstructionContext context(
         structure, buffer, byteOffset, byteLength, ConstructionContext::DataView);
     ASSERT(context);
diff --git a/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp b/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp
index 4d58e0d..de93d21 100644
--- a/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -122,12 +122,15 @@
 template<typename Adaptor>
 EncodedJSValue getData(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSDataView* dataView = jsDynamicCast<JSDataView*>(exec->thisValue());
     if (!dataView)
-        return throwVMTypeError(exec, ASCIILiteral("Receiver of DataView method must be a DataView"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver of DataView method must be a DataView"));
     
     if (!exec->argumentCount())
-        return throwVMTypeError(exec, ASCIILiteral("Need at least one argument (the byteOffset)"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Need at least one argument (the byteOffset)"));
     
     unsigned byteOffset = exec->uncheckedArgument(0).toUInt32(exec);
     if (exec->hadException())
@@ -143,7 +146,7 @@
     
     unsigned byteLength = dataView->length();
     if (elementSize > byteLength || byteOffset > byteLength - elementSize)
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("Out of bounds access")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Out of bounds access")));
 
     const unsigned dataSize = sizeof(typename Adaptor::Type);
     union {
@@ -167,12 +170,15 @@
 template<typename Adaptor>
 EncodedJSValue setData(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSDataView* dataView = jsDynamicCast<JSDataView*>(exec->thisValue());
     if (!dataView)
-        return throwVMTypeError(exec, ASCIILiteral("Receiver of DataView method must be a DataView"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver of DataView method must be a DataView"));
     
     if (exec->argumentCount() < 2)
-        return throwVMTypeError(exec, ASCIILiteral("Need at least two argument (the byteOffset and value)"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Need at least two argument (the byteOffset and value)"));
     
     unsigned byteOffset = exec->uncheckedArgument(0).toUInt32(exec);
     if (exec->hadException())
@@ -198,7 +204,7 @@
     
     unsigned byteLength = dataView->length();
     if (elementSize > byteLength || byteOffset > byteLength - elementSize)
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("Out of bounds access")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Out of bounds access")));
 
     uint8_t* dataPtr = static_cast<uint8_t*>(dataView->vector()) + byteOffset;
 
@@ -220,27 +226,36 @@
 
 EncodedJSValue JSC_HOST_CALL dataViewProtoGetterBuffer(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSDataView* view = jsDynamicCast<JSDataView*>(exec->thisValue());
     if (!view)
-        return throwVMTypeError(exec, "DataView.prototype.buffer expects |this| to be a DataView object");
+        return throwVMTypeError(exec, scope, "DataView.prototype.buffer expects |this| to be a DataView object");
 
     return JSValue::encode(view->jsBuffer(exec));
 }
 
 EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteLength(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSDataView* view = jsDynamicCast<JSDataView*>(exec->thisValue());
     if (!view)
-        return throwVMTypeError(exec, "DataView.prototype.buffer expects |this| to be a DataView object");
+        return throwVMTypeError(exec, scope, "DataView.prototype.buffer expects |this| to be a DataView object");
 
     return JSValue::encode(jsNumber(view->length()));
 }
 
 EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteOffset(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSDataView* view = jsDynamicCast<JSDataView*>(exec->thisValue());
     if (!view)
-        return throwVMTypeError(exec, "DataView.prototype.buffer expects |this| to be a DataView object");
+        return throwVMTypeError(exec, scope, "DataView.prototype.buffer expects |this| to be a DataView object");
 
     return JSValue::encode(jsNumber(view->byteOffset()));
 }
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index b7517c1..32e772f 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -50,7 +50,9 @@
 
 EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState* exec)
 {
-    return throwVMError(exec, createNotAConstructorError(exec, exec->callee()));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMError(exec, scope, createNotAConstructorError(exec, exec->callee()));
 }
 
 const ClassInfo JSFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(JSFunction) };
@@ -321,6 +323,9 @@
 
 EncodedJSValue JSFunction::callerGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSFunction* thisObj = jsCast<JSFunction*>(JSValue::decode(thisValue));
     ASSERT(!thisObj->isHostFunction());
     JSValue caller = retrieveCallerFunction(exec, thisObj);
@@ -335,7 +340,7 @@
     JSFunction* function = jsCast<JSFunction*>(caller);
     if (function->isHostOrBuiltinFunction() || !function->jsExecutable()->isStrictMode())
         return JSValue::encode(caller);
-    return JSValue::encode(throwTypeError(exec, ASCIILiteral("Function.caller used to retrieve strict caller")));
+    return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Function.caller used to retrieve strict caller")));
 }
 
 bool JSFunction::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
@@ -423,6 +428,9 @@
 
 bool JSFunction::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSFunction* thisObject = jsCast<JSFunction*>(cell);
 
     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
@@ -437,25 +445,28 @@
         // Make sure prototype has been reified, such that it can only be overwritten
         // following the rules set out in ECMA-262 8.12.9.
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
-        thisObject->methodTable(exec->vm())->getOwnPropertySlot(thisObject, exec, propertyName, slot);
+        thisObject->methodTable(vm)->getOwnPropertySlot(thisObject, exec, propertyName, slot);
         if (thisObject->m_rareData)
             thisObject->m_rareData->clear("Store to prototype property of a function");
         // Don't allow this to be cached, since a [[Put]] must clear m_rareData.
         PutPropertySlot dontCache(thisObject);
+        scope.release();
         return Base::put(thisObject, exec, propertyName, value, dontCache);
     }
     if (thisObject->jsExecutable()->isStrictMode() && (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().caller)) {
         // This will trigger the property to be reified, if this is not already the case!
         bool okay = thisObject->hasProperty(exec, propertyName);
         ASSERT_UNUSED(okay, okay);
+        scope.release();
         return Base::put(thisObject, exec, propertyName, value, slot);
     }
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().caller) {
         if (slot.isStrictMode())
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
     thisObject->reifyLazyPropertyIfNeeded(exec, propertyName);
+    scope.release();
     return Base::put(thisObject, exec, propertyName, value, slot);
 }
 
@@ -480,6 +491,9 @@
 
 bool JSFunction::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool throwException)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSFunction* thisObject = jsCast<JSFunction*>(object);
     if (thisObject->isHostOrBuiltinFunction()) {
         thisObject->reifyBoundNameIfNeeded(exec, propertyName);
@@ -490,7 +504,7 @@
         // Make sure prototype has been reified, such that it can only be overwritten
         // following the rules set out in ECMA-262 8.12.9.
         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
-        thisObject->methodTable(exec->vm())->getOwnPropertySlot(thisObject, exec, propertyName, slot);
+        thisObject->methodTable(vm)->getOwnPropertySlot(thisObject, exec, propertyName, slot);
         if (thisObject->m_rareData)
             thisObject->m_rareData->clear("Store to prototype property of a function");
         return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
@@ -520,27 +534,27 @@
      
     if (descriptor.configurablePresent() && descriptor.configurable()) {
         if (throwException)
-            throwTypeError(exec, ASCIILiteral("Attempting to change configurable attribute of unconfigurable property."));
+            throwTypeError(exec, scope, ASCIILiteral("Attempting to change configurable attribute of unconfigurable property."));
         return false;
     }
     if (descriptor.enumerablePresent() && descriptor.enumerable()) {
         if (throwException)
-            throwTypeError(exec, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property."));
+            throwTypeError(exec, scope, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property."));
         return false;
     }
     if (descriptor.isAccessorDescriptor()) {
         if (throwException)
-            throwTypeError(exec, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+            throwTypeError(exec, scope, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
         return false;
     }
     if (descriptor.writablePresent() && descriptor.writable()) {
         if (throwException)
-            throwTypeError(exec, ASCIILiteral("Attempting to change writable attribute of unconfigurable property."));
+            throwTypeError(exec, scope, ASCIILiteral("Attempting to change writable attribute of unconfigurable property."));
         return false;
     }
     if (!valueCheck) {
         if (throwException)
-            throwTypeError(exec, ASCIILiteral("Attempting to change value of a readonly property."));
+            throwTypeError(exec, scope, ASCIILiteral("Attempting to change value of a readonly property."));
         return false;
     }
     return true;
diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h
index b06f554..cea7a3b 100644
--- a/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h
+++ b/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@
 #define JSGenericTypedArrayView_h
 
 #include "JSArrayBufferView.h"
+#include "ThrowScope.h"
 #include "ToNativeFromValue.h"
 
 namespace JSC {
@@ -168,12 +169,15 @@
     
     bool setIndex(ExecState* exec, unsigned i, JSValue jsValue)
     {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
         typename Adaptor::Type value = toNativeFromValue<Adaptor>(exec, jsValue);
         if (exec->hadException())
             return false;
 
         if (isNeutered()) {
-            throwTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+            throwTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
             return false;
         }
 
diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h
index 15ab401..8f81fe4 100644
--- a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h
+++ b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h
@@ -80,8 +80,11 @@
 template<typename ViewClass>
 inline JSObject* constructGenericTypedArrayViewFromIterator(ExecState* exec, Structure* structure, JSValue iterator)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!iterator.isObject())
-        return throwTypeError(exec, ASCIILiteral("Symbol.Iterator for the first argument did not return an object."));
+        return throwTypeError(exec, scope, ASCIILiteral("Symbol.Iterator for the first argument did not return an object."));
 
     MarkedArgumentBuffer storage;
     while (true) {
@@ -118,8 +121,10 @@
 template<typename ViewClass>
 inline JSObject* constructGenericTypedArrayViewWithArguments(ExecState* exec, Structure* structure, EncodedJSValue firstArgument, unsigned offset, Optional<unsigned> lengthOpt)
 {
-    JSValue firstValue = JSValue::decode(firstArgument);
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue firstValue = JSValue::decode(firstArgument);
 
     if (JSArrayBuffer* jsBuffer = jsDynamicCast<JSArrayBuffer*>(firstValue)) {
         RefPtr<ArrayBuffer> buffer = jsBuffer->impl();
@@ -129,7 +134,7 @@
             length = lengthOpt.value();
         else {
             if ((buffer->byteLength() - offset) % ViewClass::elementSize)
-                return throwRangeError(exec, "ArrayBuffer length minus the byteOffset is not a multiple of the element size");
+                return throwRangeError(exec, scope, "ArrayBuffer length minus the byteOffset is not a multiple of the element size");
             length = (buffer->byteLength() - offset) / ViewClass::elementSize;
 
         }
@@ -139,7 +144,7 @@
     ASSERT(!offset && !lengthOpt);
     
     if (ViewClass::TypedArrayStorageType == TypeDataView)
-        return throwTypeError(exec, ASCIILiteral("Expected ArrayBuffer for the first argument."));
+        return throwTypeError(exec, scope, ASCIILiteral("Expected ArrayBuffer for the first argument."));
     
     // For everything but DataView, we allow construction with any of:
     // - Another array. This creates a copy of the of that array.
@@ -174,7 +179,7 @@
                     CallData callData;
                     CallType callType = getCallData(iteratorFunc, callData);
                     if (callType == CallType::None)
-                        return throwTypeError(exec, ASCIILiteral("Symbol.Iterator for the first argument cannot be called."));
+                        return throwTypeError(exec, scope, ASCIILiteral("Symbol.Iterator for the first argument cannot be called."));
 
                     ArgList arguments;
                     JSValue iterator = call(exec, iteratorFunc, callType, callData, object, arguments);
@@ -206,15 +211,15 @@
     if (firstValue.isInt32())
         length = firstValue.asInt32();
     else if (!firstValue.isNumber())
-        return throwTypeError(exec, ASCIILiteral("Invalid array length argument"));
+        return throwTypeError(exec, scope, ASCIILiteral("Invalid array length argument"));
     else {
         length = static_cast<int>(firstValue.asNumber());
         if (length != firstValue.asNumber())
-            return throwTypeError(exec, ASCIILiteral("Invalid array length argument (fractional lengths not allowed)"));
+            return throwTypeError(exec, scope, ASCIILiteral("Invalid array length argument (fractional lengths not allowed)"));
     }
 
     if (length < 0)
-        return throwRangeError(exec, "Requested length is negative");
+        return throwRangeError(exec, scope, "Requested length is negative");
     return ViewClass::create(exec, structure, length);
 }
 
@@ -224,6 +229,9 @@
 template<typename ViewClass>
 EncodedJSValue JSC_HOST_CALL constructGenericTypedArrayView(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     InternalFunction* function = asInternalFunction(exec->callee());
     Structure* parentStructure = function->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType);
     Structure* structure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), parentStructure);
@@ -234,7 +242,7 @@
 
     if (!argCount) {
         if (ViewClass::TypedArrayStorageType == TypeDataView)
-            return throwVMTypeError(exec, ASCIILiteral("DataView constructor requires at least one argument."));
+            return throwVMTypeError(exec, scope, ASCIILiteral("DataView constructor requires at least one argument."));
 
         return JSValue::encode(ViewClass::create(exec, structure, 0));
     }
@@ -268,7 +276,9 @@
 template<typename ViewClass>
 static EncodedJSValue JSC_HOST_CALL callGenericTypedArrayView(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, ViewClass::info()->className));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, ViewClass::info()->className));
 }
 
 template<typename ViewClass>
diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
index c32273a..a4d212c 100644
--- a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
+++ b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h
@@ -48,15 +48,17 @@
 JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::create(
     ExecState* exec, Structure* structure, unsigned length)
 {
-    ConstructionContext context(exec->vm(), structure, length, sizeof(typename Adaptor::Type));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConstructionContext context(vm, structure, length, sizeof(typename Adaptor::Type));
     if (!context) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return nullptr;
     }
     JSGenericTypedArrayView* result =
-        new (NotNull, allocateCell<JSGenericTypedArrayView>(exec->vm().heap))
-        JSGenericTypedArrayView(exec->vm(), context);
-    result->finishCreation(exec->vm());
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
     return result;
 }
 
@@ -64,17 +66,19 @@
 JSGenericTypedArrayView<Adaptor>* JSGenericTypedArrayView<Adaptor>::createUninitialized(
     ExecState* exec, Structure* structure, unsigned length)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ConstructionContext context(
-        exec->vm(), structure, length, sizeof(typename Adaptor::Type),
+        vm, structure, length, sizeof(typename Adaptor::Type),
         ConstructionContext::DontInitialize);
     if (!context) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return nullptr;
     }
     JSGenericTypedArrayView* result =
-        new (NotNull, allocateCell<JSGenericTypedArrayView>(exec->vm().heap))
-        JSGenericTypedArrayView(exec->vm(), context);
-    result->finishCreation(exec->vm());
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
     return result;
 }
 
@@ -83,22 +87,24 @@
     ExecState* exec, Structure* structure, PassRefPtr<ArrayBuffer> passedBuffer,
     unsigned byteOffset, unsigned length)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     RefPtr<ArrayBuffer> buffer = passedBuffer;
     size_t size = sizeof(typename Adaptor::Type);
     if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, length, size)) {
-        exec->vm().throwException(exec, createRangeError(exec, "Length out of range of buffer"));
+        throwException(exec, scope, createRangeError(exec, "Length out of range of buffer"));
         return nullptr;
     }
     if (!ArrayBufferView::verifyByteOffsetAlignment(byteOffset, size)) {
-        exec->vm().throwException(exec, createRangeError(exec, "Byte offset is not aligned"));
+        throwException(exec, scope, createRangeError(exec, "Byte offset is not aligned"));
         return nullptr;
     }
-    ConstructionContext context(exec->vm(), structure, buffer, byteOffset, length);
+    ConstructionContext context(vm, structure, buffer, byteOffset, length);
     ASSERT(context);
     JSGenericTypedArrayView* result =
-        new (NotNull, allocateCell<JSGenericTypedArrayView>(exec->vm().heap))
-        JSGenericTypedArrayView(exec->vm(), context);
-    result->finishCreation(exec->vm());
+        new (NotNull, allocateCell<JSGenericTypedArrayView>(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result->finishCreation(vm);
     return result;
 }
 
@@ -128,10 +134,12 @@
 bool JSGenericTypedArrayView<Adaptor>::validateRange(
     ExecState* exec, unsigned offset, unsigned length)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (canAccessRangeQuickly(offset, length))
         return true;
     
-    exec->vm().throwException(exec, createRangeError(exec, "Range consisting of offset and length are out of bounds"));
+    throwException(exec, scope, createRangeError(exec, "Range consisting of offset and length are out of bounds"));
     return false;
 }
 
@@ -290,8 +298,10 @@
 template<typename Adaptor>
 EncodedJSValue JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError(ExecState* exec, EncodedJSValue object, PropertyName)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ASSERT_UNUSED(object, jsCast<JSGenericTypedArrayView*>(JSValue::decode(object))->isNeutered());
-    return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+    return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 }
 
 template<typename Adaptor>
diff --git a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
index 412420a..f480066 100644
--- a/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
+++ b/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
@@ -47,6 +47,9 @@
 template<typename Functor>
 inline JSArrayBufferView* speciesConstruct(ExecState* exec, JSObject* exemplar, MarkedArgumentBuffer& args, const Functor& defaultConstructor)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue constructor = exemplar->get(exec, exec->propertyNames().constructor);
     if (exec->hadException())
         return nullptr;
@@ -54,7 +57,7 @@
     if (constructor.isUndefined())
         return defaultConstructor();
     if (!constructor.isObject()) {
-        throwTypeError(exec, ASCIILiteral("constructor Property should not be null"));
+        throwTypeError(exec, scope, ASCIILiteral("constructor Property should not be null"));
         return nullptr;
     }
 
@@ -73,11 +76,11 @@
         if (!view->isNeutered())
             return view;
 
-        throwTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        throwTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
         return nullptr;
     }
 
-    throwTypeError(exec, ASCIILiteral("species constructor did not return a TypedArray View"));
+    throwTypeError(exec, scope, ASCIILiteral("species constructor did not return a TypedArray View"));
     return nullptr;
 }
 
@@ -96,43 +99,45 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSet(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSet(VM& vm, ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.22
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
 
-    if (!exec->argumentCount())
-        return throwVMTypeError(exec, ASCIILiteral("Expected at least one argument"));
+    if (UNLIKELY(!exec->argumentCount()))
+        return throwVMTypeError(exec, scope, ASCIILiteral("Expected at least one argument"));
 
     unsigned offset;
     if (exec->argumentCount() >= 2) {
         double offsetNumber = exec->uncheckedArgument(1).toInteger(exec);
-        if (exec->hadException())
+        if (UNLIKELY(scope.exception()))
             return JSValue::encode(jsUndefined());
-        if (offsetNumber < 0)
-            return throwVMRangeError(exec, "Offset should not be negative");
+        if (UNLIKELY(offsetNumber < 0))
+            return throwVMRangeError(exec, scope, "Offset should not be negative");
         offset = static_cast<unsigned>(std::min(offsetNumber, static_cast<double>(std::numeric_limits<unsigned>::max())));
     } else
         offset = 0;
 
-    if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+    if (UNLIKELY(thisObject->isNeutered()))
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     JSObject* sourceArray = jsDynamicCast<JSObject*>(exec->uncheckedArgument(0));
-    if (!sourceArray)
-        return throwVMTypeError(exec, ASCIILiteral("First argument should be an object"));
+    if (UNLIKELY(!sourceArray))
+        return throwVMTypeError(exec, scope, ASCIILiteral("First argument should be an object"));
 
     unsigned length;
     if (isTypedView(sourceArray->classInfo()->typedArrayStorageType)) {
         JSArrayBufferView* sourceView = jsCast<JSArrayBufferView*>(sourceArray);
-        if (sourceView->isNeutered())
-            return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        if (UNLIKELY(sourceView->isNeutered()))
+            return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
         length = jsCast<JSArrayBufferView*>(sourceArray)->length();
     } else
-        length = sourceArray->get(exec, exec->vm().propertyNames->length).toUInt32(exec);
+        length = sourceArray->get(exec, vm.propertyNames->length).toUInt32(exec);
 
-    if (exec->hadException())
+    if (UNLIKELY(scope.exception()))
         return JSValue::encode(jsUndefined());
 
     thisObject->set(exec, offset, sourceArray, 0, length, CopyType::Unobservable);
@@ -140,13 +145,15 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncCopyWithin(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncCopyWithin(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.5
-    VM& vm = exec->vm();
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     long length = thisObject->length();
     long to = argumentClampedIndexFromStartOrEnd(exec, 0, length);
@@ -165,7 +172,7 @@
     long count = std::min(length - std::max(to, from), final - from);
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     typename ViewClass::ElementType* array = thisObject->typedVector();
     memmove(array + to, array + from, count * thisObject->elementSize);
@@ -174,12 +181,14 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIncludes(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIncludes(VM& vm, ExecState* exec)
 {
-    VM& vm = exec->vm();
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     unsigned length = thisObject->length();
 
@@ -193,7 +202,7 @@
         return JSValue::encode(jsUndefined());
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     typename ViewClass::ElementType* array = thisObject->typedVector();
     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
@@ -219,16 +228,18 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIndexOf(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIndexOf(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.13
-    VM& vm = exec->vm();
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     if (!exec->argumentCount())
-        return throwVMTypeError(exec, ASCIILiteral("Expected at least one argument"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Expected at least one argument"));
 
     unsigned length = thisObject->length();
 
@@ -238,7 +249,7 @@
         return encodedJSValue();
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     typename ViewClass::ElementType* array = thisObject->typedVector();
     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
@@ -256,11 +267,14 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncJoin(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncJoin(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     // 22.2.3.14
     auto joinWithSeparator = [&] (StringView separator) -> EncodedJSValue {
@@ -289,21 +303,23 @@
         return JSValue::encode(jsUndefined());
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
     return joinWithSeparator(separatorString->view(exec).get());
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncLastIndexOf(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncLastIndexOf(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.16
-    VM& vm = exec->vm();
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     if (!exec->argumentCount())
-        return throwVMTypeError(exec, ASCIILiteral("Expected at least one argument"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Expected at least one argument"));
 
     unsigned length = thisObject->length();
 
@@ -326,7 +342,7 @@
         return JSValue::encode(JSValue());
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
     if (!targetOption)
@@ -345,7 +361,7 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncBuffer(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncBuffer(VM&, ExecState* exec)
 {
     // 22.2.3.3
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
@@ -354,7 +370,7 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncLength(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncLength(VM&, ExecState* exec)
 {
     // 22.2.3.17
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
@@ -363,7 +379,7 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteLength(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteLength(VM&, ExecState* exec)
 {
     // 22.2.3.2
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
@@ -372,7 +388,7 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteOffset(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteOffset(VM&, ExecState* exec)
 {
     // 22.2.3.3
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
@@ -381,12 +397,15 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncReverse(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncReverse(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.21
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     typename ViewClass::ElementType* array = thisObject->typedVector();
     std::reverse(array, array + thisObject->length());
@@ -395,12 +414,15 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSort(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSort(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.25
     ViewClass* thisObject = jsCast<ViewClass*>(exec->argument(0));
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     thisObject->sort();
 
@@ -408,15 +430,17 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSlice(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSlice(VM& vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.26
-    VM& vm = exec->vm();
     JSFunction* callee = jsCast<JSFunction*>(exec->callee());
 
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     unsigned thisLength = thisObject->length();
 
@@ -428,7 +452,7 @@
         return encodedJSValue();
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     // Clamp end to begin.
     end = std::max(begin, end);
@@ -448,7 +472,7 @@
 
     ASSERT(!result->isNeutered());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     // We return early here since we don't allocate a backing store if length is 0 and memmove does not like nullptrs
     if (!length)
@@ -492,15 +516,17 @@
 }
 
 template<typename ViewClass>
-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSubarrayCreate(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSubarrayCreate(VM&vm, ExecState* exec)
 {
+//    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 22.2.3.23
-    VM& vm = exec->vm();
     JSFunction* callee = jsCast<JSFunction*>(exec->callee());
 
     ViewClass* thisObject = jsCast<ViewClass*>(exec->thisValue());
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
 
     // Get the length here; later assert that the length didn't change.
     unsigned thisLength = thisObject->length();
@@ -552,7 +578,7 @@
     if (jsDynamicCast<JSArrayBufferView*>(result))
         return JSValue::encode(result);
 
-    throwTypeError(exec, "species constructor did not return a TypedArray View");
+    throwTypeError(exec, scope, "species constructor did not return a TypedArray View");
     return JSValue::encode(JSValue());
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index c7fad30..16fadfc 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -1202,19 +1202,22 @@
 
 UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, const VariableEnvironment* variablesUnderTDZ)
 {
+    VM& vm = this->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ParserError error;
     JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
     EvalContextType evalContextType = executable->executableInfo().evalContextType();
     
-    UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm().codeCache()->getEvalCodeBlock(
-        vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, debuggerMode, error, evalContextType, variablesUnderTDZ);
+    UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm.codeCache()->getEvalCodeBlock(
+        vm, executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, debuggerMode, error, evalContextType, variablesUnderTDZ);
 
     if (hasDebugger())
         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
 
     if (error.isValid()) {
-        throwVMError(callFrame, error.toErrorObject(this, executable->source()));
+        throwVMError(callFrame, scope, error.toErrorObject(this, executable->source()));
         return nullptr;
     }
 
@@ -1223,16 +1226,19 @@
 
 UnlinkedModuleProgramCodeBlock* JSGlobalObject::createModuleProgramCodeBlock(CallFrame* callFrame, ModuleProgramExecutable* executable)
 {
+    VM& vm = this->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ParserError error;
     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
-    UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock = vm().codeCache()->getModuleProgramCodeBlock(
-        vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, debuggerMode, error);
+    UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock = vm.codeCache()->getModuleProgramCodeBlock(
+        vm, executable, executable->source(), JSParserBuiltinMode::NotBuiltin, debuggerMode, error);
 
     if (hasDebugger())
         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
 
     if (error.isValid()) {
-        throwVMError(callFrame, error.toErrorObject(this, executable->source()));
+        throwVMError(callFrame, scope, error.toErrorObject(this, executable->source()));
         return nullptr;
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index fdb3e7b..0289a16 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2012, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2009, 2012, 2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
  *  Copyright (C) 2007 Maks Orlovich
  *
@@ -76,11 +76,14 @@
 template<typename CharacterType>
 static JSValue encode(ExecState* exec, const Bitmap<256>& doNotEscape, const CharacterType* characters, unsigned length)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 18.2.6.1.1 Runtime Semantics: Encode ( string, unescapedSet )
     // https://tc39.github.io/ecma262/#sec-encode
 
-    auto throwException = [exec] {
-        return exec->vm().throwException(exec, createURIError(exec, ASCIILiteral("String contained an illegal UTF-16 sequence.")));
+    auto throwException = [&scope, exec] {
+        return JSC::throwException(exec, scope, createURIError(exec, ASCIILiteral("String contained an illegal UTF-16 sequence.")));
     };
 
     StringBuilder builder;
@@ -163,6 +166,9 @@
 ALWAYS_INLINE
 static JSValue decode(ExecState* exec, const CharType* characters, int length, const Bitmap<256>& doNotUnescape, bool strict)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSStringBuilder builder;
     int k = 0;
     UChar u = 0;
@@ -203,7 +209,7 @@
             }
             if (charLen == 0) {
                 if (strict)
-                    return exec->vm().throwException(exec, createURIError(exec, ASCIILiteral("URI error")));
+                    return throwException(exec, scope, createURIError(exec, ASCIILiteral("URI error")));
                 // The only case where we don't use "strict" mode is the "unescape" function.
                 // For that, it's good to support the wonky "%u" syntax for compatibility with WinIE.
                 if (k <= length - 6 && p[1] == 'u'
@@ -640,13 +646,16 @@
 
 EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue x = exec->argument(0);
     if (!x.isString())
         return JSValue::encode(x);
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
     if (!globalObject->evalEnabled()) {
-        exec->vm().throwException(exec, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
+        throwException(exec, scope, createEvalError(exec, globalObject->evalDisabledErrorMessage()));
         return JSValue::encode(jsUndefined());
     }
 
@@ -845,12 +854,16 @@
 
 EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState* exec)
 {
-    return throwVMTypeError(exec);
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope);
 }
     
 EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeErrorArgumentsCalleeAndCaller(ExecState* exec)
 {
-    return throwVMTypeError(exec, "'arguments', 'callee', and 'caller' cannot be accessed in strict mode.");
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope, "'arguments', 'callee', and 'caller' cannot be accessed in strict mode.");
 }
 
 class GlobalFuncProtoGetterFunctor {
@@ -887,8 +900,11 @@
 
 EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState* exec)
 {
-    if (exec->thisValue().isUndefinedOrNull()) 
-        return throwVMTypeError(exec, ASCIILiteral("Can't convert undefined or null to object"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (exec->thisValue().isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Can't convert undefined or null to object"));
 
     JSObject* thisObject = jsDynamicCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode));
 
@@ -944,8 +960,11 @@
 
 EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState* exec)
 {
-    if (exec->thisValue().isUndefinedOrNull()) 
-        return throwVMTypeError(exec, ASCIILiteral("Can't convert undefined or null to object"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    if (exec->thisValue().isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral("Can't convert undefined or null to object"));
 
     JSValue value = exec->argument(0);
 
@@ -962,7 +981,6 @@
     if (!value.isObject() && !value.isNull())
         return JSValue::encode(jsUndefined());
 
-    VM& vm = exec->vm();
     bool shouldThrowIfCantSet = true;
     thisObject->setPrototype(vm, exec, value, shouldThrowIfCantSet);
     return JSValue::encode(jsUndefined());
diff --git a/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp b/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp
index 04b08f4..49827ca 100644
--- a/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -110,11 +110,14 @@
 
 bool JSModuleEnvironment::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSModuleEnvironment* thisObject = jsCast<JSModuleEnvironment*>(cell);
     // All imported bindings are immutable.
     JSModuleRecord::Resolution resolution = thisObject->moduleRecord()->resolveImport(exec, Identifier::fromUid(exec, propertyName.uid()));
     if (resolution.type == JSModuleRecord::Resolution::Type::Resolved) {
-        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
+        throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
         return false;
     }
     return Base::put(thisObject, exec, propertyName, value, slot);
diff --git a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
index d5fb224..89834c4 100644
--- a/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
@@ -100,6 +100,9 @@
 
 bool JSModuleNamespaceObject::getOwnPropertySlot(JSObject* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-getownproperty-p
 
     JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
@@ -129,7 +132,7 @@
         JSModuleEnvironment* targetEnvironment = targetModule->moduleEnvironment();
 
         PropertySlot trampolineSlot(targetEnvironment, PropertySlot::InternalMethodType::Get);
-        bool found = targetEnvironment->methodTable(exec->vm())->getOwnPropertySlot(targetEnvironment, exec, resolution.localName, trampolineSlot);
+        bool found = targetEnvironment->methodTable(vm)->getOwnPropertySlot(targetEnvironment, exec, resolution.localName, trampolineSlot);
         ASSERT_UNUSED(found, found);
 
         JSValue value = trampolineSlot.getValue(exec, propertyName);
@@ -137,7 +140,7 @@
 
         // If the value is filled with TDZ value, throw a reference error.
         if (!value) {
-            throwVMError(exec, createTDZError(exec));
+            throwVMError(exec, scope, createTDZError(exec));
             return false;
         }
 
@@ -162,16 +165,22 @@
 
 bool JSModuleNamespaceObject::put(JSCell*, ExecState* exec, PropertyName, JSValue, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-set-p-v-receiver
     if (slot.isStrictMode())
-        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
+        throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
     return false;
 }
 
 bool JSModuleNamespaceObject::putByIndex(JSCell*, ExecState* exec, unsigned, JSValue, bool shouldThrow)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (shouldThrow)
-        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
+        throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
     return false;
 }
 
@@ -193,17 +202,23 @@
 
 bool JSModuleNamespaceObject::defineOwnProperty(JSObject*, ExecState* exec, PropertyName, const PropertyDescriptor&, bool shouldThrow)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-defineownproperty-p-desc
     if (shouldThrow)
-        throwTypeError(exec, ASCIILiteral("Attempting to define property on object that is not extensible."));
+        throwTypeError(exec, scope, ASCIILiteral("Attempting to define property on object that is not extensible."));
     return false;
 }
 
 EncodedJSValue JSC_HOST_CALL moduleNamespaceObjectSymbolIterator(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSModuleNamespaceObject* object = jsDynamicCast<JSModuleNamespaceObject*>(exec->thisValue());
     if (!object)
-        return throwVMTypeError(exec, ASCIILiteral("|this| should be a module namespace object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("|this| should be a module namespace object"));
     return JSValue::encode(JSPropertyNameIterator::create(exec, exec->lexicalGlobalObject()->propertyNameIteratorStructure(), object));
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSModuleRecord.cpp b/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
index 0da9520..4371c0f 100644
--- a/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
+++ b/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
@@ -681,6 +681,9 @@
 
 JSModuleNamespaceObject* JSModuleRecord::getModuleNamespace(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // http://www.ecma-international.org/ecma-262/6.0/#sec-getmodulenamespace
     if (m_moduleNamespaceObject)
         return m_moduleNamespaceObject.get();
@@ -694,11 +697,11 @@
         const JSModuleRecord::Resolution resolution = resolveExport(exec, Identifier::fromUid(exec, name.get()));
         switch (resolution.type) {
         case Resolution::Type::NotFound:
-            throwSyntaxError(exec, makeString("Exported binding name '", String(name.get()), "' is not found."));
+            throwSyntaxError(exec, scope, makeString("Exported binding name '", String(name.get()), "' is not found."));
             return nullptr;
 
         case Resolution::Type::Error:
-            throwSyntaxError(exec, makeString("Exported binding name 'default' cannot be resolved by star export entries."));
+            throwSyntaxError(exec, scope, makeString("Exported binding name 'default' cannot be resolved by star export entries."));
             return nullptr;
 
         case Resolution::Type::Ambiguous:
@@ -710,29 +713,33 @@
         }
     }
 
-    m_moduleNamespaceObject.set(exec->vm(), this, JSModuleNamespaceObject::create(exec, globalObject, globalObject->moduleNamespaceObjectStructure(), this, unambiguousNames));
+    m_moduleNamespaceObject.set(vm, this, JSModuleNamespaceObject::create(exec, globalObject, globalObject->moduleNamespaceObjectStructure(), this, unambiguousNames));
     return m_moduleNamespaceObject.get();
 }
 
 void JSModuleRecord::link(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ModuleProgramExecutable* executable = ModuleProgramExecutable::create(exec, sourceCode());
     if (!executable) {
-        throwSyntaxError(exec);
+        throwSyntaxError(exec, scope);
         return;
     }
-    m_moduleProgramExecutable.set(exec->vm(), this, executable);
+    m_moduleProgramExecutable.set(vm, this, executable);
     instantiateDeclarations(exec, executable);
 }
 
 void JSModuleRecord::instantiateDeclarations(ExecState* exec, ModuleProgramExecutable* moduleProgramExecutable)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
 
     SymbolTable* symbolTable = moduleProgramExecutable->moduleEnvironmentSymbolTable();
-    JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(exec->vm(), exec->lexicalGlobalObject(), exec->lexicalGlobalObject(), symbolTable, jsTDZValue(), this);
-
-    VM& vm = exec->vm();
+    JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(vm, exec->lexicalGlobalObject(), exec->lexicalGlobalObject(), symbolTable, jsTDZValue(), this);
 
     // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
     // section 15.2.1.16.4 step 9.
@@ -745,15 +752,15 @@
             Resolution resolution = resolveExport(exec, exportEntry.exportName);
             switch (resolution.type) {
             case Resolution::Type::NotFound:
-                throwSyntaxError(exec, makeString("Indirectly exported binding name '", String(exportEntry.exportName.impl()), "' is not found."));
+                throwSyntaxError(exec, scope, makeString("Indirectly exported binding name '", String(exportEntry.exportName.impl()), "' is not found."));
                 return;
 
             case Resolution::Type::Ambiguous:
-                throwSyntaxError(exec, makeString("Indirectly exported binding name '", String(exportEntry.exportName.impl()), "' cannot be resolved due to ambiguous multiple bindings."));
+                throwSyntaxError(exec, scope, makeString("Indirectly exported binding name '", String(exportEntry.exportName.impl()), "' cannot be resolved due to ambiguous multiple bindings."));
                 return;
 
             case Resolution::Type::Error:
-                throwSyntaxError(exec, makeString("Indirectly exported binding name 'default' cannot be resolved by star export entries."));
+                throwSyntaxError(exec, scope, makeString("Indirectly exported binding name 'default' cannot be resolved by star export entries."));
                 return;
 
             case Resolution::Type::Resolved:
@@ -779,15 +786,15 @@
             Resolution resolution = importedModule->resolveExport(exec, importEntry.importName);
             switch (resolution.type) {
             case Resolution::Type::NotFound:
-                throwSyntaxError(exec, makeString("Importing binding name '", String(importEntry.importName.impl()), "' is not found."));
+                throwSyntaxError(exec, scope, makeString("Importing binding name '", String(importEntry.importName.impl()), "' is not found."));
                 return;
 
             case Resolution::Type::Ambiguous:
-                throwSyntaxError(exec, makeString("Importing binding name '", String(importEntry.importName.impl()), "' cannot be resolved due to ambiguous multiple bindings."));
+                throwSyntaxError(exec, scope, makeString("Importing binding name '", String(importEntry.importName.impl()), "' cannot be resolved due to ambiguous multiple bindings."));
                 return;
 
             case Resolution::Type::Error:
-                throwSyntaxError(exec, makeString("Importing binding name 'default' cannot be resolved by star export entries."));
+                throwSyntaxError(exec, scope, makeString("Importing binding name 'default' cannot be resolved by star export entries."));
                 return;
 
             case Resolution::Type::Resolved:
diff --git a/Source/JavaScriptCore/runtime/JSONObject.cpp b/Source/JavaScriptCore/runtime/JSONObject.cpp
index 97765d6..f81f161 100644
--- a/Source/JavaScriptCore/runtime/JSONObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSONObject.cpp
@@ -297,6 +297,8 @@
 Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
 {
     VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // Call the toJSON function.
     value = toJSON(value, propertyName);
     if (vm.exception())
@@ -368,7 +370,7 @@
     // Handle cycle detection, and put the holder on the stack.
     for (unsigned i = 0; i < m_holderStack.size(); i++) {
         if (m_holderStack[i].object() == object) {
-            throwTypeError(m_exec, ASCIILiteral("JSON.stringify cannot serialize cyclic structures."));
+            throwTypeError(m_exec, scope, ASCIILiteral("JSON.stringify cannot serialize cyclic structures."));
             return StringifyFailed;
         }
     }
@@ -589,10 +591,13 @@
                                  ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
 NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
 {
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Vector<PropertyNameArray, 16, UnsafeVectorOverflow> propertyStack;
     Vector<uint32_t, 16, UnsafeVectorOverflow> indexStack;
-    LocalStack<JSObject, 16> objectStack(m_exec->vm());
-    LocalStack<JSArray, 16> arrayStack(m_exec->vm());
+    LocalStack<JSObject, 16> objectStack(vm);
+    LocalStack<JSArray, 16> arrayStack(vm);
     Vector<unsigned, 16, UnsafeVectorOverflow> arrayLengthStack;
     
     Vector<WalkerState, 16, UnsafeVectorOverflow> stateStack;
@@ -607,7 +612,7 @@
                 ASSERT(inValue.isObject());
                 ASSERT(isJSArray(asObject(inValue)) || asObject(inValue)->inherits(JSArray::info()));
                 if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
-                    return throwStackOverflowError(m_exec);
+                    return throwStackOverflowError(m_exec, scope);
 
                 JSArray* array = asArray(inValue);
                 arrayStack.push(array);
@@ -663,7 +668,7 @@
                 ASSERT(inValue.isObject());
                 ASSERT(!isJSArray(asObject(inValue)) && !asObject(inValue)->inherits(JSArray::info()));
                 if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
-                    return throwStackOverflowError(m_exec);
+                    return throwStackOverflowError(m_exec, scope);
 
                 JSObject* object = asObject(inValue);
                 objectStack.push(object);
@@ -736,31 +741,34 @@
     }
     JSObject* finalHolder = constructEmptyObject(m_exec);
     PutPropertySlot slot(finalHolder);
-    finalHolder->methodTable()->put(finalHolder, m_exec, m_exec->vm().propertyNames->emptyIdentifier, outValue, slot);
+    finalHolder->methodTable()->put(finalHolder, m_exec, vm.propertyNames->emptyIdentifier, outValue, slot);
     return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
 }
 
 // ECMA-262 v5 15.12.2
 EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!exec->argumentCount())
-        return throwVMError(exec, createError(exec, ASCIILiteral("JSON.parse requires at least one parameter")));
+        return throwVMError(exec, scope, createError(exec, ASCIILiteral("JSON.parse requires at least one parameter")));
     JSString::SafeView source = exec->uncheckedArgument(0).toString(exec)->view(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
 
     JSValue unfiltered;
-    LocalScope scope(exec->vm());
+    LocalScope localScope(vm);
     if (source.is8Bit()) {
         LiteralParser<LChar> jsonParser(exec, source.characters8(), source.length(), StrictJSON);
         unfiltered = jsonParser.tryLiteralParse();
         if (!unfiltered)
-            return throwVMError(exec, createSyntaxError(exec, jsonParser.getErrorMessage()));
+            return throwVMError(exec, scope, createSyntaxError(exec, jsonParser.getErrorMessage()));
     } else {
         LiteralParser<UChar> jsonParser(exec, source.characters16(), source.length(), StrictJSON);
         unfiltered = jsonParser.tryLiteralParse();
         if (!unfiltered)
-            return throwVMError(exec, createSyntaxError(exec, jsonParser.getErrorMessage()));        
+            return throwVMError(exec, scope, createSyntaxError(exec, jsonParser.getErrorMessage()));
     }
     
     if (exec->argumentCount() < 2)
@@ -771,18 +779,21 @@
     CallType callType = getCallData(function, callData);
     if (callType == CallType::None)
         return JSValue::encode(unfiltered);
-    return JSValue::encode(Walker(exec, Local<JSObject>(exec->vm(), asObject(function)), callType, callData).walk(unfiltered));
+    return JSValue::encode(Walker(exec, Local<JSObject>(vm, asObject(function)), callType, callData).walk(unfiltered));
 }
 
 // ECMA-262 v5 15.12.3
 EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!exec->argumentCount())
-        return throwVMError(exec, createError(exec, ASCIILiteral("No input to stringify")));
-    LocalScope scope(exec->vm());
-    Local<Unknown> value(exec->vm(), exec->uncheckedArgument(0));
-    Local<Unknown> replacer(exec->vm(), exec->argument(1));
-    Local<Unknown> space(exec->vm(), exec->argument(2));
+        return throwVMError(exec, scope, createError(exec, ASCIILiteral("No input to stringify")));
+    LocalScope localScope(vm);
+    Local<Unknown> value(vm, exec->uncheckedArgument(0));
+    Local<Unknown> replacer(vm, exec->argument(1));
+    Local<Unknown> space(vm, exec->argument(2));
     JSValue result = Stringifier(exec, replacer, space).stringify(value).get();
     return JSValue::encode(result);
 }
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index ec43436..6e72e59 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003-2006, 2008, 2009, 2012-2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2006, 2008-2009, 2012-2016 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -1354,6 +1354,7 @@
 
 bool JSObject::setPrototypeWithCycleCheck(VM& vm, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ASSERT(methodTable(vm)->toThis(this, exec, NotStrictMode) == this);
 
     if (this->getPrototypeDirect() == prototype)
@@ -1365,7 +1366,7 @@
 
     if (!isExtensible) {
         if (shouldThrowIfCantSet)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
 
@@ -1374,7 +1375,7 @@
     while (nextPrototype && nextPrototype.isObject()) {
         if (nextPrototype == this) {
             if (shouldThrowIfCantSet)
-                throwTypeError(exec, ASCIILiteral("cyclic __proto__ value"));
+                throwTypeError(exec, scope, ASCIILiteral("cyclic __proto__ value"));
             return false;
         }
         if (UNLIKELY(asObject(nextPrototype)->methodTable(vm)->getPrototype != defaultGetPrototype))
@@ -1616,28 +1617,31 @@
 template<TypeHintMode mode = TypeHintMode::DoesNotTakeHint>
 static ALWAYS_INLINE JSValue callToPrimitiveFunction(ExecState* exec, const JSObject* object, PropertyName propertyName, PreferredPrimitiveType hint)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue function = object->get(exec, propertyName);
-    if (exec->hadException())
-        return exec->exception();
+    if (scope.exception())
+        return scope.exception();
     if (function.isUndefined() && mode == TypeHintMode::TakesHint)
         return JSValue();
     CallData callData;
     CallType callType = getCallData(function, callData);
     if (callType == CallType::None)
-        return exec->exception();
+        return scope.exception();
 
     MarkedArgumentBuffer callArgs;
     if (mode == TypeHintMode::TakesHint) {
         JSString* hintString = nullptr;
         switch (hint) {
         case NoPreference:
-            hintString = exec->vm().smallStrings.defaultString();
+            hintString = vm.smallStrings.defaultString();
             break;
         case PreferNumber:
-            hintString = exec->vm().smallStrings.numberString();
+            hintString = vm.smallStrings.numberString();
             break;
         case PreferString:
-            hintString = exec->vm().smallStrings.stringString();
+            hintString = vm.smallStrings.stringString();
             break;
         }
         callArgs.append(hintString);
@@ -1645,40 +1649,47 @@
 
     JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), callArgs);
     ASSERT(!result.isGetterSetter());
-    if (exec->hadException())
-        return exec->exception();
+    if (scope.exception())
+        return scope.exception();
     if (result.isObject())
-        return mode == TypeHintMode::DoesNotTakeHint ? JSValue() : throwTypeError(exec, ASCIILiteral("Symbol.toPrimitive returned an object"));
+        return mode == TypeHintMode::DoesNotTakeHint ? JSValue() : throwTypeError(exec, scope, ASCIILiteral("Symbol.toPrimitive returned an object"));
     return result;
 }
 
 // ECMA 7.1.1
 JSValue JSObject::ordinaryToPrimitive(ExecState* exec, PreferredPrimitiveType hint) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // Make sure that whatever default value methods there are on object's prototype chain are
     // being watched.
-    this->structure()->startWatchingInternalPropertiesIfNecessaryForEntireChain(exec->vm());
+    this->structure()->startWatchingInternalPropertiesIfNecessaryForEntireChain(vm);
 
     JSValue value;
     if (hint == PreferString) {
         value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
         value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
     } else {
         value = callToPrimitiveFunction(exec, this, exec->propertyNames().valueOf, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
         value = callToPrimitiveFunction(exec, this, exec->propertyNames().toString, hint);
+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
         if (value)
             return value;
     }
 
     ASSERT(!exec->hadException());
 
-    return throwTypeError(exec, ASCIILiteral("No default value"));
+    return throwTypeError(exec, scope, ASCIILiteral("No default value"));
 }
 
 JSValue JSObject::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
@@ -1727,12 +1738,14 @@
 bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue hasInstanceValue)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
 
     if (!hasInstanceValue.isUndefinedOrNull() && hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction()) {
         CallData callData;
         CallType callType = JSC::getCallData(hasInstanceValue, callData);
         if (callType == CallType::None) {
-            vm.throwException(exec, createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(exec, this));
+            throwException(exec, scope, createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(exec, this));
             return false;
         }
 
@@ -1747,7 +1760,7 @@
         return defaultHasInstance(exec, value, get(exec, exec->propertyNames().prototype));
     if (info.implementsHasInstance())
         return methodTable(vm)->customHasInstance(this, exec, value);
-    vm.throwException(exec, createInvalidInstanceofParameterErrorNotFunction(exec, this));
+    throwException(exec, scope, createInvalidInstanceofParameterErrorNotFunction(exec, this));
     return false;
 }
 
@@ -1760,15 +1773,17 @@
 
 bool JSObject::defaultHasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!value.isObject())
         return false;
 
     if (!proto.isObject()) {
-        throwTypeError(exec, ASCIILiteral("instanceof called on an object with an invalid prototype property."));
+        throwTypeError(exec, scope, ASCIILiteral("instanceof called on an object with an invalid prototype property."));
         return false;
     }
 
-    VM& vm = exec->vm();
     JSObject* object = asObject(value);
     while (true) {
         JSValue objectValue = object->getPrototype(vm, exec);
@@ -2238,6 +2253,9 @@
 template<IndexingType indexingShape>
 bool JSObject::putByIndexBeyondVectorLengthWithoutAttributes(ExecState* exec, unsigned i, JSValue value)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ASSERT((indexingType() & IndexingShapeMask) == indexingShape);
     ASSERT(!indexingShouldBeSparse());
 
@@ -2247,8 +2265,6 @@
     // or equal to the vector length.
     ASSERT(i >= butterfly->vectorLength());
     
-    VM& vm = exec->vm();
-    
     if (i > MAX_STORAGE_VECTOR_INDEX
         || (i >= MIN_SPARSE_ARRAY_INDEX && !isDenseEnoughForVector(i, countElements<indexingShape>(butterfly)))
         || indexIsSufficientlyBeyondLengthForSparseMap(i, butterfly->vectorLength())) {
@@ -2262,7 +2278,7 @@
     }
 
     if (!ensureLength(vm, i + 1)) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return false;
     }
     butterfly = m_butterfly.get();
@@ -2300,6 +2316,7 @@
 bool JSObject::putByIndexBeyondVectorLengthWithArrayStorage(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, ArrayStorage* storage)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     // i should be a valid array index that is outside of the current vector.
     ASSERT(i <= MAX_ARRAY_INDEX);
@@ -2327,7 +2344,7 @@
             return true;
         }
         // We don't want to, or can't use a vector to hold this property - allocate a sparse map & add the value.
-        map = allocateSparseIndexMap(exec->vm());
+        map = allocateSparseIndexMap(vm);
         return map->putEntry(exec, this, i, value, shouldThrow);
     }
 
@@ -2337,7 +2354,7 @@
         // Prohibit growing the array if length is not writable.
         if (map->lengthIsReadOnly() || !isStructureExtensible()) {
             if (shouldThrow)
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
             return false;
         }
         length = i + 1;
@@ -2347,7 +2364,7 @@
     // We are currently using a map - check whether we still want to be doing so.
     // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
     unsigned numValuesInArray = storage->m_numValuesInVector + map->size();
-    if (map->sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(exec->vm(), length))
+    if (map->sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(vm, length))
         return map->putEntry(exec, this, i, value, shouldThrow);
 
     // Reread m_storage after increaseVectorLength, update m_numValuesInVector.
@@ -2944,6 +2961,9 @@
 bool validateAndApplyPropertyDescriptor(ExecState* exec, JSObject* object, PropertyName propertyName, bool isExtensible,
     const PropertyDescriptor& descriptor, bool isCurrentDefined, const PropertyDescriptor& current, bool throwException)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // If we have a new property we can just put it on normally
     // Step 2.
     if (!isCurrentDefined) {
@@ -2951,7 +2971,7 @@
         // Step 2.a
         if (!isExtensible) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral("Attempting to define property on object that is not extensible."));
+                throwTypeError(exec, scope, ASCIILiteral("Attempting to define property on object that is not extensible."));
             return false;
         }
         if (!object)
@@ -2974,12 +2994,12 @@
     if (!current.configurable()) {
         if (descriptor.configurable()) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral("Attempting to change configurable attribute of unconfigurable property."));
+                throwTypeError(exec, scope, ASCIILiteral("Attempting to change configurable attribute of unconfigurable property."));
             return false;
         }
         if (descriptor.enumerablePresent() && descriptor.enumerable() != current.enumerable()) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property."));
+                throwTypeError(exec, scope, ASCIILiteral("Attempting to change enumerable attribute of unconfigurable property."));
             return false;
         }
     }
@@ -2988,7 +3008,7 @@
     // A generic descriptor is simply changing the attributes of an existing property
     if (descriptor.isGenericDescriptor()) {
         if (!current.attributesEqual(descriptor) && object) {
-            object->methodTable(exec->vm())->deleteProperty(object, exec, propertyName);
+            object->methodTable(vm)->deleteProperty(object, exec, propertyName);
             return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
         }
         return true;
@@ -2999,14 +3019,14 @@
     if (descriptor.isDataDescriptor() != current.isDataDescriptor()) {
         if (!current.configurable()) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+                throwTypeError(exec, scope, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
             return false;
         }
 
         if (!object)
             return true;
 
-        object->methodTable(exec->vm())->deleteProperty(object, exec, propertyName);
+        object->methodTable(vm)->deleteProperty(object, exec, propertyName);
         return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
     }
 
@@ -3016,13 +3036,13 @@
         if (!current.configurable()) {
             if (!current.writable() && descriptor.writable()) {
                 if (throwException)
-                    throwTypeError(exec, ASCIILiteral("Attempting to change writable attribute of unconfigurable property."));
+                    throwTypeError(exec, scope, ASCIILiteral("Attempting to change writable attribute of unconfigurable property."));
                 return false;
             }
             if (!current.writable()) {
                 if (descriptor.value() && !sameValue(exec, current.value(), descriptor.value())) {
                     if (throwException)
-                        throwTypeError(exec, ASCIILiteral("Attempting to change value of a readonly property."));
+                        throwTypeError(exec, scope, ASCIILiteral("Attempting to change value of a readonly property."));
                     return false;
                 }
             }
@@ -3031,7 +3051,7 @@
             return true;
         if (!object)
             return true;
-        object->methodTable(exec->vm())->deleteProperty(object, exec, propertyName);
+        object->methodTable(vm)->deleteProperty(object, exec, propertyName);
         return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
     }
 
@@ -3041,17 +3061,17 @@
     if (!current.configurable()) {
         if (descriptor.setterPresent() && !(current.setterPresent() && JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral("Attempting to change the setter of an unconfigurable property."));
+                throwTypeError(exec, scope, ASCIILiteral("Attempting to change the setter of an unconfigurable property."));
             return false;
         }
         if (descriptor.getterPresent() && !(current.getterPresent() && JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral("Attempting to change the getter of an unconfigurable property."));
+                throwTypeError(exec, scope, ASCIILiteral("Attempting to change the getter of an unconfigurable property."));
             return false;
         }
         if (current.attributes() & CustomAccessor) {
             if (throwException)
-                throwTypeError(exec, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
+                throwTypeError(exec, scope, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
             return false;
         }
     }
@@ -3059,33 +3079,33 @@
     // Step 10/11.
     if (!object)
         return true;
-    JSValue accessor = object->getDirect(exec->vm(), propertyName);
+    JSValue accessor = object->getDirect(vm, propertyName);
     if (!accessor)
         return false;
     GetterSetter* getterSetter;
     bool getterSetterChanged = false;
     if (accessor.isCustomGetterSetter()) {
-        getterSetter = GetterSetter::create(exec->vm(), exec->lexicalGlobalObject());
+        getterSetter = GetterSetter::create(vm, exec->lexicalGlobalObject());
         auto* customGetterSetter = jsCast<CustomGetterSetter*>(accessor);
         if (customGetterSetter->setter())
-            getterSetter->setSetter(exec->vm(), exec->lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Setter));
+            getterSetter->setSetter(vm, exec->lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Setter));
         if (customGetterSetter->getter())
-            getterSetter->setGetter(exec->vm(), exec->lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Getter));
+            getterSetter->setGetter(vm, exec->lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Getter));
     } else {
         ASSERT(accessor.isGetterSetter());
         getterSetter = asGetterSetter(accessor);
     }
     if (descriptor.setterPresent()) {
-        getterSetter = getterSetter->withSetter(exec->vm(), exec->lexicalGlobalObject(), descriptor.setterObject());
+        getterSetter = getterSetter->withSetter(vm, exec->lexicalGlobalObject(), descriptor.setterObject());
         getterSetterChanged = true;
     }
     if (descriptor.getterPresent()) {
-        getterSetter = getterSetter->withGetter(exec->vm(), exec->lexicalGlobalObject(), descriptor.getterObject());
+        getterSetter = getterSetter->withGetter(vm, exec->lexicalGlobalObject(), descriptor.getterObject());
         getterSetterChanged = true;
     }
     if (current.attributesEqual(descriptor) && !getterSetterChanged)
         return true;
-    object->methodTable(exec->vm())->deleteProperty(object, exec, propertyName);
+    object->methodTable(vm)->deleteProperty(object, exec, propertyName);
     unsigned attrs = descriptor.attributesOverridingCurrent(current);
     object->putDirectAccessor(exec, propertyName, getterSetter, attrs | Accessor);
     return true;
@@ -3233,6 +3253,9 @@
 // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-getmethod
 JSValue JSObject::getMethod(ExecState* exec, CallData& callData, CallType& callType, const Identifier& ident, const String& errorMessage)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue method = get(exec, ident);
     if (exec->hadException())
         return jsUndefined();
@@ -3241,13 +3264,13 @@
         if (method.isUndefinedOrNull())
             return jsUndefined();
 
-        throwVMTypeError(exec, errorMessage);
+        throwVMTypeError(exec, scope, errorMessage);
         return jsUndefined();
     }
 
     callType = method.asCell()->methodTable()->getCallData(method.asCell(), callData);
     if (callType == CallType::None) {
-        throwVMTypeError(exec, errorMessage);
+        throwVMTypeError(exec, scope, errorMessage);
         return jsUndefined();
     }
 
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 345fd87..fca284f 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -42,7 +42,6 @@
 #include "PutDirectIndexMode.h"
 #include "PutPropertySlot.h"
 #include "RuntimeType.h"
-
 #include "Structure.h"
 #include "VM.h"
 #include "JSString.h"
@@ -66,10 +65,11 @@
 class PropertyDescriptor;
 class PropertyNameArray;
 class Structure;
+class ThrowScope;
 struct HashTable;
 struct HashTableValue;
 
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String&);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&, const String&);
 extern JS_EXPORTDATA const char* StrictModeReadonlyPropertyWriteError;
 extern JS_EXPORTDATA const char* UnconfigurablePropertyChangeAccessMechanismError;
 
@@ -1665,37 +1665,6 @@
     return name;
 }
 
-// Section 7.3.17 of the spec. 
-template <typename AddFunction> // Add function should have a type like: (JSValue, RuntimeType) -> bool
-void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String& errorMessage, AddFunction addFunction)
-{
-    VM& vm = exec->vm();
-    Vector<JSValue> result;
-    JSValue lengthProperty = arrayLikeValue.get(exec, exec->vm().propertyNames->length);
-    if (vm.exception())
-        return;
-    double lengthAsDouble = lengthProperty.toLength(exec);
-    if (vm.exception())
-        return;
-    RELEASE_ASSERT(lengthAsDouble >= 0.0 && lengthAsDouble == std::trunc(lengthAsDouble));
-    uint64_t length = static_cast<uint64_t>(lengthAsDouble);
-    for (uint64_t index = 0; index < length; index++) {
-        JSValue  next = arrayLikeValue.get(exec, index);
-        if (vm.exception())
-            return;
-
-        RuntimeType type = runtimeTypeForValue(next);
-        if (!(type & legalTypesFilter)) {
-            throwTypeError(exec, errorMessage);
-            return;
-        }
-
-        bool exitEarly = addFunction(next, type);
-        if (exitEarly)
-            return;
-    }
-}
-
 bool validateAndApplyPropertyDescriptor(ExecState*, JSObject*, PropertyName, bool isExtensible,
     const PropertyDescriptor& descriptor, bool isCurrentDefined, const PropertyDescriptor& current, bool throwException);
 
diff --git a/Source/JavaScriptCore/runtime/JSObjectInlines.h b/Source/JavaScriptCore/runtime/JSObjectInlines.h
index aae127c..d343990 100644
--- a/Source/JavaScriptCore/runtime/JSObjectInlines.h
+++ b/Source/JavaScriptCore/runtime/JSObjectInlines.h
@@ -30,6 +30,39 @@
 
 namespace JSC {
 
+// Section 7.3.17 of the spec.
+template <typename AddFunction> // Add function should have a type like: (JSValue, RuntimeType) -> bool
+void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String& errorMessage, AddFunction addFunction)
+{
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    Vector<JSValue> result;
+    JSValue lengthProperty = arrayLikeValue.get(exec, vm.propertyNames->length);
+    if (vm.exception())
+        return;
+    double lengthAsDouble = lengthProperty.toLength(exec);
+    if (vm.exception())
+        return;
+    RELEASE_ASSERT(lengthAsDouble >= 0.0 && lengthAsDouble == std::trunc(lengthAsDouble));
+    uint64_t length = static_cast<uint64_t>(lengthAsDouble);
+    for (uint64_t index = 0; index < length; index++) {
+        JSValue next = arrayLikeValue.get(exec, index);
+        if (vm.exception())
+            return;
+        
+        RuntimeType type = runtimeTypeForValue(next);
+        if (!(type & legalTypesFilter)) {
+            throwTypeError(exec, scope, errorMessage);
+            return;
+        }
+        
+        bool exitEarly = addFunction(next, type);
+        if (exitEarly)
+            return;
+    }
+}
+
 ALWAYS_INLINE bool JSObject::canPerformFastPutInline(ExecState* exec, VM& vm, PropertyName propertyName)
 {
     if (UNLIKELY(propertyName == exec->propertyNames().underscoreProto))
@@ -55,10 +88,12 @@
 // ECMA 8.6.2.2
 ALWAYS_INLINE bool JSObject::putInline(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSObject* thisObject = jsCast<JSObject*>(cell);
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
-    VM& vm = exec->vm();
 
     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
@@ -69,10 +104,10 @@
         return putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
 
     if (thisObject->canPerformFastPutInline(exec, vm, propertyName)) {
-        ASSERT(!thisObject->structure(vm)->prototypeChainMayInterceptStoreTo(exec->vm(), propertyName));
+        ASSERT(!thisObject->structure(vm)->prototypeChainMayInterceptStoreTo(vm, propertyName));
         if (!thisObject->putDirectInternal<PutModePut>(vm, propertyName, value, 0, slot)) {
             if (slot.isStrictMode())
-                throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
+                throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
             return false;
         }
         return true;
diff --git a/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp b/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp
index f42fcc9..6312e86 100644
--- a/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -96,12 +96,13 @@
 
 static EncodedJSValue JSC_HOST_CALL constructPromise(ExecState* exec)
 {
-    JSGlobalObject* globalObject = exec->callee()->globalObject();
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    JSGlobalObject* globalObject = exec->callee()->globalObject();
 
     JSValue newTarget = exec->newTarget();
     if (newTarget.isUndefined())
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     Structure* promiseStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->promiseStructure());
     if (exec->hadException())
@@ -114,7 +115,9 @@
 
 static EncodedJSValue JSC_HOST_CALL callPromise(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "Promise"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Promise"));
 }
 
 ConstructType JSPromiseConstructor::getConstructData(JSCell*, ConstructData& constructData)
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 92d8e66..b7ded12 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -143,9 +143,12 @@
 
 EncodedJSValue JSC_HOST_CALL propertyNameIteratorFuncNext(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSPropertyNameIterator* iterator = jsDynamicCast<JSPropertyNameIterator*>(exec->thisValue());
     if (!iterator)
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Cannot call PropertyNameIterator.next() on a non-PropertyNameIterator object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Cannot call PropertyNameIterator.next() on a non-PropertyNameIterator object")));
 
     JSValue result;
     if (iterator->next(exec, result))
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index 7537d50..cb35767 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2004, 2007, 2008, 2015 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2007-2008, 2015-2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -380,11 +380,14 @@
 
 void JSRopeString::outOfMemory(ExecState* exec) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     clearFibers();
     ASSERT(isRope());
     ASSERT(m_value.isNull());
     if (exec)
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
 }
 
 JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
diff --git a/Source/JavaScriptCore/runtime/JSStringBuilder.h b/Source/JavaScriptCore/runtime/JSStringBuilder.h
index 92377a9..ce0635d 100644
--- a/Source/JavaScriptCore/runtime/JSStringBuilder.h
+++ b/Source/JavaScriptCore/runtime/JSStringBuilder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -71,17 +71,19 @@
 
     JSValue build(ExecState* exec)
     {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
         if (!m_okay)
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
         if (m_is8Bit) {
             buffer8.shrinkToFit();
             if (!buffer8.data())
-                return throwOutOfMemoryError(exec);
+                return throwOutOfMemoryError(exec, scope);
             return jsString(exec, String::adopt(buffer8));
         }
         buffer16.shrinkToFit();
         if (!buffer16.data())
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
         return jsString(exec, String::adopt(buffer16));
     }
 
@@ -127,9 +129,11 @@
 template<typename StringType, typename... StringTypes>
 inline JSValue jsMakeNontrivialString(ExecState* exec, const StringType& string, const StringTypes&... strings)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     String result = WTF::tryMakeString(string, strings...);
     if (!result)
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
     return jsNontrivialString(exec, WTFMove(result));
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.cpp b/Source/JavaScriptCore/runtime/JSStringJoiner.cpp
index e8dc2e3..b560e85 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.cpp
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -81,6 +81,9 @@
 
 inline unsigned JSStringJoiner::joinedLength(ExecState& state) const
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     unsigned numberOfStrings = m_strings.size();
     if (!numberOfStrings)
         return 0;
@@ -91,7 +94,7 @@
 
     unsigned result;
     if (totalLength.safeGet(result) == CheckedState::DidOverflow) {
-        throwOutOfMemoryError(&state);
+        throwOutOfMemoryError(&state, scope);
         return 0;
     }
     return result;
@@ -99,6 +102,9 @@
 
 JSValue JSStringJoiner::join(ExecState& state)
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     ASSERT(m_strings.size() <= m_strings.capacity());
 
     unsigned length = joinedLength(state);
@@ -115,7 +121,7 @@
         result = joinStrings<UChar>(m_strings, m_separator, length);
 
     if (result.isNull())
-        return throwOutOfMemoryError(&state);
+        return throwOutOfMemoryError(&state, scope);
 
     return jsString(&state, WTFMove(result));
 }
diff --git a/Source/JavaScriptCore/runtime/JSStringJoiner.h b/Source/JavaScriptCore/runtime/JSStringJoiner.h
index f9e8bbd..1e83a78 100644
--- a/Source/JavaScriptCore/runtime/JSStringJoiner.h
+++ b/Source/JavaScriptCore/runtime/JSStringJoiner.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -60,16 +60,20 @@
     : m_separator(separator)
     , m_isAll8Bit(m_separator.is8Bit())
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!m_strings.tryReserveCapacity(stringCount)))
-        throwOutOfMemoryError(&state);
+        throwOutOfMemoryError(&state, scope);
 }
 
 inline JSStringJoiner::JSStringJoiner(ExecState& state, LChar separator, unsigned stringCount)
     : m_singleCharacterSeparator(separator)
     , m_separator { &m_singleCharacterSeparator, 1 }
 {
+    VM& vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!m_strings.tryReserveCapacity(stringCount)))
-        throwOutOfMemoryError(&state);
+        throwOutOfMemoryError(&state, scope);
 }
 
 ALWAYS_INLINE void JSStringJoiner::append(StringViewWithUnderlyingString&& string)
diff --git a/Source/JavaScriptCore/runtime/JSSymbolTableObject.h b/Source/JavaScriptCore/runtime/JSSymbolTableObject.h
index 2c696b2..a898b09 100644
--- a/Source/JavaScriptCore/runtime/JSSymbolTableObject.h
+++ b/Source/JavaScriptCore/runtime/JSSymbolTableObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, 2014, 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2014-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +32,7 @@
 #include "JSScope.h"
 #include "PropertyDescriptor.h"
 #include "SymbolTable.h"
+#include "ThrowScope.h"
 #include "VariableWriteFireDetail.h"
 
 namespace JSC {
@@ -166,6 +167,7 @@
 inline bool symbolTablePut(SymbolTableObjectType* object, ExecState* exec, PropertyName propertyName, JSValue value, bool shouldThrowReadOnlyError, bool ignoreReadOnlyErrors, bool& putResult)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     WatchpointSet* set = nullptr;
     WriteBarrierBase<Unknown>* reg;
@@ -182,7 +184,7 @@
         ASSERT(!fastEntry.isNull());
         if (fastEntry.isReadOnly() && !ignoreReadOnlyErrors) {
             if (shouldThrowReadOnlyError)
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
             putResult = false;
             return true;
         }
@@ -200,9 +202,9 @@
     // the right for barriers to be able to trigger GC. And I don't want to hold VM
     // locks while GC'ing.
     if (symbolTablePutMode == SymbolTablePutMode::Invalidate)
-        symbolTablePutInvalidateWatchpointSet(exec->vm(), object, propertyName, value, reg, set);
+        symbolTablePutInvalidateWatchpointSet(vm, object, propertyName, value, reg, set);
     else
-        symbolTablePutTouchWatchpointSet(exec->vm(), object, propertyName, value, reg, set);
+        symbolTablePutTouchWatchpointSet(vm, object, propertyName, value, reg, set);
     putResult = true;
     return true;
 }
diff --git a/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp b/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp
index 88e61a7..02c2fa1 100644
--- a/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -66,7 +66,9 @@
 
 static EncodedJSValue JSC_HOST_CALL constructTypedArrayView(ExecState* exec)
 {
-    return throwVMTypeError(exec, ASCIILiteral("%TypedArray% should not be called directly"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope, ASCIILiteral("%TypedArray% should not be called directly"));
 }
 
 ConstructType JSTypedArrayViewConstructor::getConstructData(JSCell*, ConstructData& constructData)
diff --git a/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp b/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp
index 95dce97..1ead2e8e 100644
--- a/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp
@@ -39,26 +39,26 @@
 #define CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(functionName) do {                           \
     switch (thisValue.getObject()->classInfo()->typedArrayStorageType) {                        \
     case TypeUint8Clamped:                                                                      \
-        return functionName<JSUint8ClampedArray>(exec);                                         \
+        return functionName<JSUint8ClampedArray>(vm, exec);                                     \
     case TypeInt32:                                                                             \
-        return functionName<JSInt32Array>(exec);                                                \
+        return functionName<JSInt32Array>(vm, exec);                                            \
     case TypeUint32:                                                                            \
-        return functionName<JSUint32Array>(exec);                                               \
+        return functionName<JSUint32Array>(vm, exec);                                           \
     case TypeFloat64:                                                                           \
-        return functionName<JSFloat64Array>(exec);                                              \
+        return functionName<JSFloat64Array>(vm, exec);                                          \
     case TypeFloat32:                                                                           \
-        return functionName<JSFloat32Array>(exec);                                              \
+        return functionName<JSFloat32Array>(vm, exec);                                          \
     case TypeInt8:                                                                              \
-        return functionName<JSInt8Array>(exec);                                                 \
+        return functionName<JSInt8Array>(vm, exec);                                             \
     case TypeUint8:                                                                             \
-        return functionName<JSUint8Array>(exec);                                                \
+        return functionName<JSUint8Array>(vm, exec);                                            \
     case TypeInt16:                                                                             \
-        return functionName<JSInt16Array>(exec);                                                \
+        return functionName<JSInt16Array>(vm, exec);                                            \
     case TypeUint16:                                                                            \
-        return functionName<JSUint16Array>(exec);                                               \
+        return functionName<JSUint16Array>(vm, exec);                                           \
     case NotTypedArray:                                                                         \
     case TypeDataView:                                                                          \
-        return throwVMTypeError(exec,                                                           \
+        return throwVMTypeError(exec, scope,                                                    \
             ASCIILiteral("Receiver should be a typed array view"));                             \
     }                                                                                           \
     RELEASE_ASSERT_NOT_REACHED();                                                               \
@@ -72,14 +72,16 @@
 
 EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncLength(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue argument = exec->argument(0);
     if (!argument.isCell() || !isTypedView(argument.asCell()->classInfo()->typedArrayStorageType))
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view"));
 
     JSArrayBufferView* thisObject = jsCast<JSArrayBufferView*>(argument);
 
     if (thisObject->isNeutered())
-        return throwVMTypeError(exec, ASCIILiteral("Underlying ArrayBuffer has been detached from the view"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Underlying ArrayBuffer has been detached from the view"));
 
     return JSValue::encode(jsNumber(thisObject->length()));
 }
@@ -94,111 +96,139 @@
 
 EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSort(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->argument(0);
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSort);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncSet(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
-    if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    if (UNLIKELY(!thisValue.isObject()))
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSet);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncCopyWithin(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncCopyWithin);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncIncludes(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMError(exec, createTypeError(exec, "Receiver should be a typed array view but was not an object"));
+        return throwVMError(exec, scope, createTypeError(exec, "Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIncludes);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncLastIndexOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncLastIndexOf);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncIndexOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIndexOf);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncJoin(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncJoin);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncBuffer(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncBuffer);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncLength(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncLength);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncByteLength(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteLength);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncByteOffset(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteOffset);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncReverse(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncReverse);
 }
 
 EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSubarrayCreate(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSubarrayCreate);
 }
 
 static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncSlice(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSlice);
 }
 
diff --git a/Source/JavaScriptCore/runtime/MapConstructor.cpp b/Source/JavaScriptCore/runtime/MapConstructor.cpp
index cd7979f..68524ef 100644
--- a/Source/JavaScriptCore/runtime/MapConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/MapConstructor.cpp
@@ -50,11 +50,16 @@
 
 static EncodedJSValue JSC_HOST_CALL callMap(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "Map"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Map"));
 }
 
 static EncodedJSValue JSC_HOST_CALL constructMap(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     Structure* mapStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->mapStructure());
     if (exec->hadException())
@@ -71,11 +76,11 @@
     CallData adderFunctionCallData;
     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
     if (adderFunctionCallType == CallType::None)
-        return JSValue::encode(throwTypeError(exec));
+        return JSValue::encode(throwTypeError(exec, scope));
 
     forEachInIterable(exec, iterable, [&](VM& vm, ExecState* exec, JSValue nextItem) {
         if (!nextItem.isObject()) {
-            throwTypeError(exec);
+            throwTypeError(exec, scope);
             return;
         }
 
diff --git a/Source/JavaScriptCore/runtime/MapDataInlines.h b/Source/JavaScriptCore/runtime/MapDataInlines.h
index fd35420..07d4dff 100644
--- a/Source/JavaScriptCore/runtime/MapDataInlines.h
+++ b/Source/JavaScriptCore/runtime/MapDataInlines.h
@@ -204,6 +204,9 @@
 template<typename Entry, typename JSIterator>
 inline CheckedBoolean MapDataImpl<Entry, JSIterator>::ensureSpaceForAppend(ExecState* exec, JSCell* owner)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (m_capacity > m_size)
         return true;
 
@@ -211,7 +214,7 @@
     void* newStorage = nullptr;
     DeferGC defer(*exec->heap());
     if (!exec->heap()->tryAllocateStorage(owner, requiredSize * sizeof(Entry), &newStorage)) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return false;
     }
     Entry* newEntries = static_cast<Entry*>(newStorage);
diff --git a/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp b/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp
index 0b060eb..63606a3 100644
--- a/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,9 +50,12 @@
 
 EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSMapIterator* iterator = jsDynamicCast<JSMapIterator*>(callFrame->thisValue());
     if (!iterator)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot call MapIterator.next() on a non-MapIterator object")));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot call MapIterator.next() on a non-MapIterator object")));
 
     JSValue result;
     if (iterator->next(callFrame, result))
diff --git a/Source/JavaScriptCore/runtime/MapPrototype.cpp b/Source/JavaScriptCore/runtime/MapPrototype.cpp
index 3f2d530..efd4416 100644
--- a/Source/JavaScriptCore/runtime/MapPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/MapPrototype.cpp
@@ -90,13 +90,16 @@
 
 ALWAYS_INLINE static JSMap* getMap(CallFrame* callFrame, JSValue thisValue)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!thisValue.isObject()) {
-        throwVMError(callFrame, createNotAnObjectError(callFrame, thisValue));
+        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
         return nullptr;
     }
     JSMap* map = jsDynamicCast<JSMap*>(thisValue);
     if (!map) {
-        throwTypeError(callFrame, ASCIILiteral("Map operation called on non-Map object"));
+        throwTypeError(callFrame, scope, ASCIILiteral("Map operation called on non-Map object"));
         return nullptr;
     }
     return map;
@@ -155,26 +158,35 @@
 
 EncodedJSValue JSC_HOST_CALL mapProtoFuncValues(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSMap* thisObj = jsDynamicCast<JSMap*>(callFrame->thisValue());
     if (!thisObj)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot create a Map value iterator for a non-Map object.")));
-    return JSValue::encode(JSMapIterator::create(callFrame->vm(), callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateValue));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Map value iterator for a non-Map object.")));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateValue));
 }
 
 EncodedJSValue JSC_HOST_CALL mapProtoFuncEntries(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSMap* thisObj = jsDynamicCast<JSMap*>(callFrame->thisValue());
     if (!thisObj)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot create a Map entry iterator for a non-Map object.")));
-    return JSValue::encode(JSMapIterator::create(callFrame->vm(), callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateKeyValue));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Map entry iterator for a non-Map object.")));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateKeyValue));
 }
 
 EncodedJSValue JSC_HOST_CALL mapProtoFuncKeys(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSMap* thisObj = jsDynamicCast<JSMap*>(callFrame->thisValue());
     if (!thisObj)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot create a Map key iterator for a non-Map object.")));
-    return JSValue::encode(JSMapIterator::create(callFrame->vm(), callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateKey));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Map key iterator for a non-Map object.")));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame->callee()->globalObject()->mapIteratorStructure(), thisObj, IterateKey));
 }
 
 EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp b/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp
index 2a5600b..9ad3c4c 100644
--- a/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -109,6 +109,8 @@
 EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeParseModule(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     const Identifier moduleKey = exec->argument(0).toPropertyKey(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -127,7 +129,7 @@
         JSParserStrictMode::Strict, JSParserCommentMode::Module, SourceParseMode::ModuleAnalyzeMode, SuperBinding::NotNeeded, error);
 
     if (error.isValid()) {
-        throwVMError(exec, error.toErrorObject(exec->lexicalGlobalObject(), sourceCode));
+        throwVMError(exec, scope, error.toErrorObject(exec->lexicalGlobalObject(), sourceCode));
         return JSValue::encode(jsUndefined());
     }
     ASSERT(moduleProgramNode);
diff --git a/Source/JavaScriptCore/runtime/NullSetterFunction.cpp b/Source/JavaScriptCore/runtime/NullSetterFunction.cpp
index 032950d..977286e 100644
--- a/Source/JavaScriptCore/runtime/NullSetterFunction.cpp
+++ b/Source/JavaScriptCore/runtime/NullSetterFunction.cpp
@@ -72,8 +72,11 @@
 
 static EncodedJSValue JSC_HOST_CALL callReturnUndefined(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (callerIsStrict(exec))
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Setting a property that has only a getter")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Setting a property that has only a getter")));
     return JSValue::encode(jsUndefined());
 }
 
diff --git a/Source/JavaScriptCore/runtime/NumberPrototype.cpp b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
index aa6305fb..9666e65e 100644
--- a/Source/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -364,15 +364,18 @@
 // to argument-plus-one significant figures).
 EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     double x;
     if (!toThisNumber(exec->thisValue(), x))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     // Get the argument. 
     int decimalPlacesInExponent;
     bool isUndefined;
     if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlacesInExponent, isUndefined))
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toExponential() argument must be between 0 and 20")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toExponential() argument must be between 0 and 20")));
 
     // Handle NaN and Infinity.
     if (!std::isfinite(x))
@@ -395,15 +398,18 @@
 // method will instead fallback to calling ToString. 
 EncodedJSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     double x;
     if (!toThisNumber(exec->thisValue(), x))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     // Get the argument. 
     int decimalPlaces;
     bool isUndefined; // This is ignored; undefined treated as 0.
     if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlaces, isUndefined))
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toFixed() argument must be between 0 and 20")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toFixed() argument must be between 0 and 20")));
 
     // 15.7.4.5.7 states "If x >= 10^21, then let m = ToString(x)"
     // This also covers Ininity, and structure the check so that NaN
@@ -428,15 +434,18 @@
 // with smaller values converted to exponential representation.
 EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     double x;
     if (!toThisNumber(exec->thisValue(), x))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     // Get the argument. 
     int significantFigures;
     bool isUndefined;
     if (!getIntegerArgumentInRange(exec, 1, 21, significantFigures, isUndefined))
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toPrecision() argument must be between 1 and 21")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toPrecision() argument must be between 1 and 21")));
 
     // To precision called with no argument is treated as ToString.
     if (isUndefined)
@@ -485,22 +494,23 @@
 
 EncodedJSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     double doubleValue;
     if (!toThisNumber(exec->thisValue(), doubleValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     int32_t radix = extractRadixFromArgs(exec);
     if (radix < 2 || radix > 36)
-        return throwVMError(exec, createRangeError(exec, ASCIILiteral("toString() radix argument must be between 2 and 36")));
+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("toString() radix argument must be between 2 and 36")));
 
     int32_t integerValue = static_cast<int32_t>(doubleValue);
     if (integerValue == doubleValue)
         return integerValueToString(exec, radix, integerValue);
 
-    if (radix == 10) {
-        VM* vm = &exec->vm();
-        return JSValue::encode(jsString(vm, vm->numericStrings.add(doubleValue)));
-    }
+    if (radix == 10)
+        return JSValue::encode(jsString(&vm, vm.numericStrings.add(doubleValue)));
 
     if (!std::isfinite(doubleValue))
         return JSValue::encode(jsNontrivialString(exec, String::numberToStringECMAScript(doubleValue)));
@@ -511,19 +521,25 @@
 
 EncodedJSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     double x;
     if (!toThisNumber(exec->thisValue(), x))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     return JSValue::encode(jsNumber(x).toString(exec));
 }
 
 EncodedJSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     double x;
     JSValue thisValue = exec->thisValue();
     if (!toThisNumber(thisValue, x))
-        return throwVMTypeError(exec, WTF::makeString("thisNumberValue called on incompatible ", jsCast<JSString*>(jsTypeStringForValue(exec, thisValue))->value(exec)));
+        return throwVMTypeError(exec, scope, WTF::makeString("thisNumberValue called on incompatible ", jsCast<JSString*>(jsTypeStringForValue(exec, thisValue))->value(exec)));
     return JSValue::encode(jsNumber(x));
 }
 
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
index 46d0cc8..248c12f 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -217,13 +217,16 @@
 
 EncodedJSValue JSC_HOST_CALL objectConstructorSetPrototypeOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue objectValue = exec->argument(0);
     if (objectValue.isUndefinedOrNull())
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     JSValue protoValue = exec->argument(1);
     if (!protoValue.isObject() && !protoValue.isNull())
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     JSObject* object = objectValue.toObject(exec);
     if (exec->hadException())
@@ -232,7 +235,6 @@
     if (!checkProtoSetterAccessAllowed(exec, object))
         return JSValue::encode(objectValue);
 
-    VM& vm = exec->vm();
     bool shouldThrowIfCantSet = true;
     bool didSetPrototype = object->setPrototype(vm, exec, protoValue, shouldThrowIfCantSet);
     ASSERT_UNUSED(didSetPrototype, vm.exception() || didSetPrototype);
@@ -344,8 +346,10 @@
 bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor& desc)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!in.isObject()) {
-        throwTypeError(exec, ASCIILiteral("Property description must be an object."));
+        throwTypeError(exec, scope, ASCIILiteral("Property description must be an object."));
         return false;
     }
     JSObject* description = asObject(in);
@@ -390,7 +394,7 @@
         if (!get.isUndefined()) {
             CallData callData;
             if (getCallData(get, callData) == CallType::None) {
-                throwTypeError(exec, ASCIILiteral("Getter must be a function."));
+                throwTypeError(exec, scope, ASCIILiteral("Getter must be a function."));
                 return false;
             }
         }
@@ -405,7 +409,7 @@
         if (!set.isUndefined()) {
             CallData callData;
             if (getCallData(set, callData) == CallType::None) {
-                throwTypeError(exec, ASCIILiteral("Setter must be a function."));
+                throwTypeError(exec, scope, ASCIILiteral("Setter must be a function."));
                 return false;
             }
         }
@@ -417,12 +421,12 @@
         return true;
 
     if (desc.value()) {
-        throwTypeError(exec, ASCIILiteral("Invalid property.  'value' present on property with getter or setter."));
+        throwTypeError(exec, scope, ASCIILiteral("Invalid property.  'value' present on property with getter or setter."));
         return false;
     }
 
     if (desc.writablePresent()) {
-        throwTypeError(exec, ASCIILiteral("Invalid property.  'writable' present on property with getter or setter."));
+        throwTypeError(exec, scope, ASCIILiteral("Invalid property.  'writable' present on property with getter or setter."));
         return false;
     }
     return true;
@@ -430,19 +434,25 @@
 
 EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!exec->argument(0).isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Properties can only be defined on Objects."));
-    JSObject* O = asObject(exec->argument(0));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Properties can only be defined on Objects."));
+    JSObject* obj = asObject(exec->argument(0));
     auto propertyName = exec->argument(1).toPropertyKey(exec);
     if (exec->hadException())
         return JSValue::encode(jsNull());
     PropertyDescriptor descriptor;
-    if (!toPropertyDescriptor(exec, exec->argument(2), descriptor))
+    auto success = toPropertyDescriptor(exec, exec->argument(2), descriptor);
+    ASSERT(!scope.exception() == success);
+    if (!success)
         return JSValue::encode(jsNull());
     ASSERT((descriptor.attributes() & Accessor) || (!descriptor.isAccessorDescriptor()));
     ASSERT(!exec->hadException());
-    O->methodTable(exec->vm())->defineOwnProperty(O, exec, propertyName, descriptor, true);
-    return JSValue::encode(O);
+    obj->methodTable(vm)->defineOwnProperty(obj, exec, propertyName, descriptor, true);
+    scope.release();
+    return JSValue::encode(obj);
 }
 
 static JSValue defineProperties(ExecState* exec, JSObject* object, JSObject* properties)
@@ -485,8 +495,11 @@
 
 EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!exec->argument(0).isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Properties can only be defined on Objects."));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Properties can only be defined on Objects."));
     JSObject* targetObj = asObject(exec->argument(0));
     JSObject* props = exec->argument(1).toObject(exec);
     if (!props)
@@ -496,16 +509,19 @@
 
 EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue proto = exec->argument(0);
     if (!proto.isObject() && !proto.isNull())
-        return throwVMTypeError(exec, ASCIILiteral("Object prototype may only be an Object or null."));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Object prototype may only be an Object or null."));
     JSObject* newObject = proto.isObject()
         ? constructEmptyObject(exec, asObject(proto))
         : constructEmptyObject(exec, exec->lexicalGlobalObject()->nullPrototypeObjectStructure());
     if (exec->argument(1).isUndefined())
         return JSValue::encode(newObject);
     if (!exec->argument(1).isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Property descriptor list must be an Object."));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Property descriptor list must be an Object."));
     return JSValue::encode(defineProperties(exec, newObject, asObject(exec->argument(1))));
 }
 
diff --git a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
index 6455763..025c1d0 100644
--- a/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008, 2011, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -127,6 +127,9 @@
 
 EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -134,7 +137,7 @@
     JSValue get = exec->argument(1);
     CallData callData;
     if (getCallData(get, callData) == CallType::None)
-        return throwVMTypeError(exec, ASCIILiteral("invalid getter usage"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("invalid getter usage"));
 
     auto propertyName = exec->argument(0).toPropertyKey(exec);
     if (exec->hadException())
@@ -146,13 +149,16 @@
     descriptor.setConfigurable(true);
 
     bool shouldThrow = true;
-    thisObject->methodTable(exec->vm())->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+    thisObject->methodTable(vm)->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
 
     return JSValue::encode(jsUndefined());
 }
 
 EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -160,7 +166,7 @@
     JSValue set = exec->argument(1);
     CallData callData;
     if (getCallData(set, callData) == CallType::None)
-        return throwVMTypeError(exec, ASCIILiteral("invalid setter usage"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("invalid setter usage"));
 
     auto propertyName = exec->argument(0).toPropertyKey(exec);
     if (exec->hadException())
@@ -172,7 +178,7 @@
     descriptor.setConfigurable(true);
 
     bool shouldThrow = true;
-    thisObject->methodTable(exec->vm())->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
+    thisObject->methodTable(vm)->defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
 
     return JSValue::encode(jsUndefined());
 }
@@ -269,6 +275,8 @@
 EncodedJSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
     if (thisValue.isUndefinedOrNull())
         return JSValue::encode(thisValue.isUndefined() ? vm.smallStrings.undefinedObjectString() : vm.smallStrings.nullObjectString());
@@ -303,7 +311,7 @@
             return JSValue();
         String newString = WTF::tryMakeString("[object ", WTFMove(tag), "]");
         if (!newString)
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
 
         auto result = jsNontrivialString(&vm, newString);
         thisObject->structure(vm)->setObjectToStringValue(exec, vm, result, toStringTagSlot);
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index 45fbfc6..4f9bb5c 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2002, 2005, 2006, 2007, 2008, 2009, 2013, 2014 Apple Inc. All rights reserved.
+ *  Copyright (C) 2002, 2005-2009, 2013-2014, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -40,6 +40,7 @@
 ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     int32_t length1 = s1->length();
     if (!length1)
@@ -48,7 +49,7 @@
     if (!length2)
         return s1;
     if (sumOverflows<int32_t>(length1, length2))
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
 
     return JSRopeString::create(vm, s1, s2);
 }
@@ -56,13 +57,14 @@
 ALWAYS_INLINE JSValue jsString(ExecState* exec, const String& u1, const String& u2, const String& u3)
 {
     VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
 
     int32_t length1 = u1.length();
     int32_t length2 = u2.length();
     int32_t length3 = u3.length();
     
     if (length1 < 0 || length2 < 0 || length3 < 0)
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
     
     if (!length1)
         return jsString(exec, jsString(vm, u2), jsString(vm, u3));
@@ -72,7 +74,7 @@
         return jsString(exec, jsString(vm, u1), jsString(vm, u2));
 
     if (sumOverflows<int32_t>(length1, length2, length3))
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
 
     return JSRopeString::create(exec->vm(), jsString(vm, u1), jsString(vm, u2), jsString(vm, u3));
 }
@@ -80,12 +82,13 @@
 ALWAYS_INLINE JSValue jsStringFromRegisterArray(ExecState* exec, Register* strings, unsigned count)
 {
     VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
     JSRopeString::RopeBuilder ropeBuilder(*vm);
 
     for (unsigned i = 0; i < count; ++i) {
         JSValue v = strings[-static_cast<int>(i)].jsValue();
         if (!ropeBuilder.append(v.toString(exec)))
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
     }
 
     return ropeBuilder.release();
@@ -94,13 +97,14 @@
 ALWAYS_INLINE JSValue jsStringFromArguments(ExecState* exec, JSValue thisValue)
 {
     VM* vm = &exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(*vm);
     JSRopeString::RopeBuilder ropeBuilder(*vm);
     ropeBuilder.append(thisValue.toString(exec));
 
     for (unsigned i = 0; i < exec->argumentCount(); ++i) {
         JSValue v = exec->argument(i);
         if (!ropeBuilder.append(v.toString(exec)))
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
     }
 
     return ropeBuilder.release();
diff --git a/Source/JavaScriptCore/runtime/ProxyConstructor.cpp b/Source/JavaScriptCore/runtime/ProxyConstructor.cpp
index f425ee9..8f26294 100644
--- a/Source/JavaScriptCore/runtime/ProxyConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/ProxyConstructor.cpp
@@ -56,8 +56,9 @@
 
 static EncodedJSValue JSC_HOST_CALL makeRevocableProxy(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     if (exec->argumentCount() < 2)
-        return throwVMTypeError(exec, ASCIILiteral("Proxy.revocable needs to be called with two arguments: the target and the handler"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Proxy.revocable needs to be called with two arguments: the target and the handler"));
 
     VM& vm = exec->vm();
     ArgList args(exec);
@@ -81,7 +82,8 @@
 
 static EncodedJSValue JSC_HOST_CALL proxyRevocableConstructorThrowError(ExecState* exec)
 {
-    return throwVMTypeError(exec, ASCIILiteral("Proxy.revocable cannot be constructed. It can only be called"));
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    return throwVMTypeError(exec, scope, ASCIILiteral("Proxy.revocable cannot be constructed. It can only be called"));
 }
 
 void ProxyConstructor::finishCreation(VM& vm, const char* name, JSGlobalObject* globalObject)
@@ -94,8 +96,9 @@
 
 static EncodedJSValue JSC_HOST_CALL constructProxyObject(ExecState* exec)
 {
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
     if (exec->newTarget().isUndefined())
-        return throwVMTypeError(exec, ASCIILiteral("new.target of Proxy construct should not be undefined"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("new.target of Proxy construct should not be undefined"));
 
     ArgList args(exec);
     JSValue target = args.at(0);
@@ -111,7 +114,8 @@
 
 static EncodedJSValue JSC_HOST_CALL callProxy(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "Proxy"));
+    auto scope = DECLARE_THROW_SCOPE(exec->vm());
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Proxy"));
 }
 
 CallType ProxyConstructor::getCallData(JSCell*, CallData& callData)
diff --git a/Source/JavaScriptCore/runtime/ProxyObject.cpp b/Source/JavaScriptCore/runtime/ProxyObject.cpp
index 2647653..d52f17f 100644
--- a/Source/JavaScriptCore/runtime/ProxyObject.cpp
+++ b/Source/JavaScriptCore/runtime/ProxyObject.cpp
@@ -31,6 +31,7 @@
 #include "IdentifierInlines.h"
 #include "JSCJSValueInlines.h"
 #include "JSCellInlines.h"
+#include "JSObjectInlines.h"
 #include "ObjectConstructor.h"
 #include "SlotVisitorInlines.h"
 #include "StructureInlines.h"
@@ -79,19 +80,20 @@
 
 void ProxyObject::finishCreation(VM& vm, ExecState* exec, JSValue target, JSValue handler)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
     Base::finishCreation(vm);
     if (!target.isObject()) {
-        throwTypeError(exec, ASCIILiteral("A Proxy's 'target' should be an Object"));
+        throwTypeError(exec, scope, ASCIILiteral("A Proxy's 'target' should be an Object"));
         return;
     }
     if (ProxyObject* targetAsProxy = jsDynamicCast<ProxyObject*>(target)) {
         if (targetAsProxy->handler().isNull()) {
-            throwTypeError(exec, ASCIILiteral("If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked"));
+            throwTypeError(exec, scope, ASCIILiteral("If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked"));
             return;
         }
     }
     if (!handler.isObject()) {
-        throwTypeError(exec, ASCIILiteral("A Proxy's 'handler' should be an Object"));
+        throwTypeError(exec, scope, ASCIILiteral("A Proxy's 'handler' should be an Object"));
         return;
     }
 
@@ -116,8 +118,9 @@
 static JSValue performProxyGet(ExecState* exec, ProxyObject* proxyObject, JSValue receiver, PropertyName propertyName)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return JSValue();
     }
 
@@ -135,7 +138,7 @@
 
     JSValue handlerValue = proxyObject->handler();
     if (handlerValue.isNull())
-        return throwTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return throwTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
 
     JSObject* handler = jsCast<JSObject*>(handlerValue);
     CallData callData;
@@ -159,10 +162,10 @@
     if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
         if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
             if (!sameValue(exec, descriptor.value(), trapResult))
-                return throwTypeError(exec, ASCIILiteral("Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"));
+                return throwTypeError(exec, scope, ASCIILiteral("Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"));
         } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.getter().isUndefined()) {
             if (!trapResult.isUndefined())
-                return throwTypeError(exec, ASCIILiteral("Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined"));
+                return throwTypeError(exec, scope, ASCIILiteral("Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined"));
         }
     }
 
@@ -185,8 +188,9 @@
 bool ProxyObject::performInternalMethodGetOwnProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
     JSObject* target = this->target();
@@ -200,7 +204,7 @@
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -221,7 +225,7 @@
         return false;
 
     if (!trapResult.isUndefined() && !trapResult.isObject()) {
-        throwVMTypeError(exec, ASCIILiteral("result of 'getOwnPropertyDescriptor' call should either be an Object or undefined"));
+        throwVMTypeError(exec, scope, ASCIILiteral("result of 'getOwnPropertyDescriptor' call should either be an Object or undefined"));
         return false;
     }
 
@@ -234,7 +238,7 @@
         if (!isTargetPropertyDescriptorDefined)
             return false;
         if (!targetPropertyDescriptor.configurable()) {
-            throwVMTypeError(exec, ASCIILiteral("When the result of 'getOwnPropertyDescriptor' is undefined the target must be configurable"));
+            throwVMTypeError(exec, scope, ASCIILiteral("When the result of 'getOwnPropertyDescriptor' is undefined the target must be configurable"));
             return false;
         }
         // FIXME: this doesn't work if 'target' is another Proxy. We don't have isExtensible implemented in a way that fits w/ Proxys.
@@ -246,7 +250,7 @@
             // FIXME: Come up with a test for this error. I'm not sure how to because
             // Object.seal(o) will make all fields [[Configurable]] false.
             // https://bugs.webkit.org/show_bug.cgi?id=154376
-            throwVMTypeError(exec, ASCIILiteral("When 'getOwnPropertyDescriptor' returns undefined, the 'target' of a Proxy should be extensible"));
+            throwVMTypeError(exec, scope, ASCIILiteral("When 'getOwnPropertyDescriptor' returns undefined, the 'target' of a Proxy should be extensible"));
             return false;
         }
 
@@ -264,13 +268,13 @@
     bool valid = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, isExtensible,
         trapResultAsDescriptor, isTargetPropertyDescriptorDefined, targetPropertyDescriptor, throwException);
     if (!valid) {
-        throwVMTypeError(exec, ASCIILiteral("Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test"));
         return false;
     }
 
     if (!trapResultAsDescriptor.configurable()) {
         if (!isTargetPropertyDescriptorDefined || targetPropertyDescriptor.configurable()) {
-            throwVMTypeError(exec, ASCIILiteral("Result from 'getOwnPropertyDescriptor' can't be non-configurable when the 'target' doesn't have it as an own property or if it is a configurable own property on 'target'"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Result from 'getOwnPropertyDescriptor' can't be non-configurable when the 'target' doesn't have it as an own property or if it is a configurable own property on 'target'"));
             return false;
         }
     }
@@ -291,8 +295,9 @@
 bool ProxyObject::performHasProperty(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
     JSObject* target = this->target();
@@ -307,7 +312,7 @@
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -338,14 +343,14 @@
             return false;
         if (isPropertyDescriptorDefined) {
             if (!descriptor.configurable()) {
-                throwVMTypeError(exec, ASCIILiteral("Proxy 'has' must return 'true' for non-configurable properties"));
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'has' must return 'true' for non-configurable properties"));
                 return false;
             }
             bool isExtensible = target->isExtensible(exec);
             if (exec->hadException())
                 return false;
             if (!isExtensible) {
-                throwVMTypeError(exec, ASCIILiteral("Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property"));
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property"));
                 return false;
             }
         }
@@ -356,8 +361,10 @@
 
 bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
-    if (UNLIKELY(!exec->vm().isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
         return false;
     }
     slot.disableCaching();
@@ -394,8 +401,9 @@
 bool ProxyObject::performPut(ExecState* exec, JSValue putValue, JSValue thisValue, PropertyName propertyName, PerformDefaultPutFunction performDefaultPut)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
 
@@ -404,7 +412,7 @@
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -436,11 +444,11 @@
     if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
         if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
             if (!sameValue(exec, descriptor.value(), putValue)) {
-                throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'"));
+                throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'"));
                 return false;
             }
         } else if (descriptor.isAccessorDescriptor() && !descriptor.configurable() && descriptor.setter().isUndefined()) {
-            throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false"));
             return false;
         }
     }
@@ -486,14 +494,15 @@
 static EncodedJSValue JSC_HOST_CALL performProxyCall(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return JSValue::encode(JSValue());
     }
     ProxyObject* proxy = jsCast<ProxyObject*>(exec->callee());
     JSValue handlerValue = proxy->handler();
     if (handlerValue.isNull())
-        return throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
 
     JSObject* handler = jsCast<JSObject*>(handlerValue);
     CallData callData;
@@ -535,14 +544,15 @@
 static EncodedJSValue JSC_HOST_CALL performProxyConstruct(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return JSValue::encode(JSValue());
     }
     ProxyObject* proxy = jsCast<ProxyObject*>(exec->callee());
     JSValue handlerValue = proxy->handler();
     if (handlerValue.isNull())
-        return throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
 
     JSObject* handler = jsCast<JSObject*>(handlerValue);
     CallData callData;
@@ -569,7 +579,7 @@
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
     if (!result.isObject())
-        return throwVMTypeError(exec, ASCIILiteral("Result from Proxy handler's 'construct' method should be an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("Result from Proxy handler's 'construct' method should be an object"));
     return JSValue::encode(result);
 }
 
@@ -590,8 +600,9 @@
 bool ProxyObject::performDelete(ExecState* exec, PropertyName propertyName, DefaultDeleteFunction performDefaultDelete)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
 
@@ -600,7 +611,7 @@
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -631,7 +642,7 @@
     PropertyDescriptor descriptor;
     if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
         if (!descriptor.configurable()) {
-            throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"));
             return false;
         }
     }
@@ -666,14 +677,15 @@
 bool ProxyObject::performPreventExtensions(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -702,7 +714,7 @@
         if (exec->hadException())
             return false;
         if (targetIsExtensible) {
-            throwVMTypeError(exec, ASCIILiteral("Proxy's 'preventExtensions' trap returned true even though its target is extensible. It should have returned false"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'preventExtensions' trap returned true even though its target is extensible. It should have returned false"));
             return false;
         }
     }
@@ -718,14 +730,15 @@
 bool ProxyObject::performIsExtensible(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -757,11 +770,11 @@
     if (trapResultAsBool != isTargetExtensible) {
         if (isTargetExtensible) {
             ASSERT(!trapResultAsBool);
-            throwVMTypeError(exec, ASCIILiteral("Proxy object's 'isExtensible' trap returned false when the target is extensible. It should have returned true"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy object's 'isExtensible' trap returned false when the target is extensible. It should have returned true"));
         } else {
             ASSERT(!isTargetExtensible);
             ASSERT(trapResultAsBool);
-            throwVMTypeError(exec, ASCIILiteral("Proxy object's 'isExtensible' trap returned true when the target is non-extensible. It should have returned false"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy object's 'isExtensible' trap returned true when the target is non-extensible. It should have returned false"));
         }
     }
     
@@ -776,8 +789,9 @@
 bool ProxyObject::performDefineOwnProperty(ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
 
@@ -791,7 +805,7 @@
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -836,11 +850,11 @@
 
     if (!isTargetDescriptorDefined) {
         if (!targetIsExtensible) {
-            throwVMTypeError(exec, ASCIILiteral("Proxy's 'defineProperty' trap returned true even though getOwnPropertyDescriptor of the Proxy's target returned undefined and the target is non-extensible"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap returned true even though getOwnPropertyDescriptor of the Proxy's target returned undefined and the target is non-extensible"));
             return false;
         }
         if (settingConfigurableToFalse) {
-            throwVMTypeError(exec, ASCIILiteral("Proxy's 'defineProperty' trap returned true for a non-configurable field even though getOwnPropertyDescriptor of the Proxy's target returned undefined"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap returned true for a non-configurable field even though getOwnPropertyDescriptor of the Proxy's target returned undefined"));
             return false;
         }
 
@@ -853,11 +867,11 @@
     bool throwException = false;
     bool isCompatibleDescriptor = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, targetIsExtensible, descriptor, isCurrentDefined, current, throwException);
     if (!isCompatibleDescriptor) {
-        throwVMTypeError(exec, ASCIILiteral("Proxy's 'defineProperty' trap did not define a property on its target that is compatible with the trap's input descriptor"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap did not define a property on its target that is compatible with the trap's input descriptor"));
         return false;
     }
     if (settingConfigurableToFalse && targetDescriptor.configurable()) {
-        throwVMTypeError(exec, ASCIILiteral("Proxy's 'defineProperty' trap did not define a non-configurable property on its target even though the input descriptor to the trap said it must do so"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'defineProperty' trap did not define a non-configurable property on its target even though the input descriptor to the trap said it must do so"));
         return false;
     }
     
@@ -873,13 +887,14 @@
 void ProxyObject::performGetOwnPropertyNames(ExecState* exec, PropertyNameArray& trapResult, EnumerationMode enumerationMode)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return;
     }
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return;
     }
 
@@ -969,7 +984,7 @@
 
     for (UniquedStringImpl* impl : targetNonConfigurableKeys) {
         if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
-            throwVMTypeError(exec, makeString("Proxy object's 'target' has the non-configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
+            throwVMTypeError(exec, scope, makeString("Proxy object's 'target' has the non-configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
             return;
         }
     }
@@ -979,13 +994,13 @@
 
     for (UniquedStringImpl* impl : targetConfigurableKeys) {
         if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
-            throwVMTypeError(exec, makeString("Proxy object's non-extensible 'target' has configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
+            throwVMTypeError(exec, scope, makeString("Proxy object's non-extensible 'target' has configurable property '", String(impl), "' that was not in the result from the 'ownKeys' trap"));
             return;
         }
     }
 
     if (uncheckedResultKeys.size()) {
-        throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'ownKeys' method returned a key that was not present in its non-extensible target"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'ownKeys' method returned a key that was not present in its non-extensible target"));
         return;
     }
 }
@@ -1022,14 +1037,15 @@
     ASSERT(prototype.isObject() || prototype.isNull());
 
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return false;
     }
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return false;
     }
 
@@ -1057,7 +1073,7 @@
     
     if (!trapResultAsBool) {
         if (shouldThrowIfCantSet)
-            throwVMTypeError(exec, ASCIILiteral("Proxy 'setPrototypeOf' returned false indicating it could not set the prototype value. The operation was expected to succeed"));
+            throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'setPrototypeOf' returned false indicating it could not set the prototype value. The operation was expected to succeed"));
         return false;
     }
 
@@ -1071,7 +1087,7 @@
     if (vm.exception())
         return false;
     if (!sameValue(exec, prototype, targetPrototype)) {
-        throwVMTypeError(exec, ASCIILiteral("Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false"));
         return false;
     }
 
@@ -1086,14 +1102,15 @@
 JSValue ProxyObject::performGetPrototype(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
+        throwStackOverflowError(exec, scope);
         return JSValue();
     }
 
     JSValue handlerValue = this->handler();
     if (handlerValue.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
         return JSValue();
     }
 
@@ -1115,7 +1132,7 @@
         return JSValue();
 
     if (!trapResult.isObject() && !trapResult.isNull()) {
-        throwVMTypeError(exec, ASCIILiteral("Proxy handler's 'getPrototypeOf' trap should either return an object or null"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy handler's 'getPrototypeOf' trap should either return an object or null"));
         return JSValue();
     }
 
@@ -1129,7 +1146,7 @@
     if (vm.exception())
         return JSValue();
     if (!sameValue(exec, targetPrototype, trapResult)) {
-        throwVMTypeError(exec, ASCIILiteral("Proxy's 'getPrototypeOf' trap for a non-extensible target should return the same value as the target's prototype"));
+        throwVMTypeError(exec, scope, ASCIILiteral("Proxy's 'getPrototypeOf' trap for a non-extensible target should return the same value as the target's prototype"));
         return JSValue();
     }
 
diff --git a/Source/JavaScriptCore/runtime/ReflectObject.cpp b/Source/JavaScriptCore/runtime/ReflectObject.cpp
index 175122f..5452958 100644
--- a/Source/JavaScriptCore/runtime/ReflectObject.cpp
+++ b/Source/JavaScriptCore/runtime/ReflectObject.cpp
@@ -95,26 +95,29 @@
 // https://tc39.github.io/ecma262/#sec-reflect.construct
 EncodedJSValue JSC_HOST_CALL reflectObjectConstruct(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.construct requires the first argument be a constructor")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the first argument be a constructor")));
 
     ConstructData constructData;
     ConstructType constructType;
     if (!target.isConstructor(constructType, constructData))
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.construct requires the first argument be a constructor")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the first argument be a constructor")));
 
     JSValue newTarget = target;
     if (exec->argumentCount() >= 3) {
         newTarget = exec->argument(2);
         if (!newTarget.isConstructor())
-            return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.construct requires the third argument be a constructor if present")));
+            return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the third argument be a constructor if present")));
     }
 
     MarkedArgumentBuffer arguments;
     JSObject* argumentsObject = jsDynamicCast<JSObject*>(exec->argument(1));
     if (!argumentsObject)
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.construct requires the second argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.construct requires the second argument be an object")));
 
     createListFromArrayLike(exec, argumentsObject, RuntimeTypeMaskAllTypes, ASCIILiteral("This error must not be raised"), [&] (JSValue value, RuntimeType) -> bool {
         arguments.append(value);
@@ -129,9 +132,12 @@
 // https://tc39.github.io/ecma262/#sec-reflect.defineproperty
 EncodedJSValue JSC_HOST_CALL reflectObjectDefineProperty(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.defineProperty requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.defineProperty requires the first argument be an object")));
     auto propertyName = exec->argument(1).toPropertyKey(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -145,25 +151,31 @@
     // Reflect.defineProperty should not throw an error when the defineOwnProperty operation fails.
     bool shouldThrow = false;
     JSObject* targetObject = asObject(target);
-    return JSValue::encode(jsBoolean(targetObject->methodTable(exec->vm())->defineOwnProperty(targetObject, exec, propertyName, descriptor, shouldThrow)));
+    return JSValue::encode(jsBoolean(targetObject->methodTable(vm)->defineOwnProperty(targetObject, exec, propertyName, descriptor, shouldThrow)));
 }
 
 // FIXME: Reflect.enumerate is removed in ECMA 2016 draft.
 // http://www.ecma-international.org/ecma-262/6.0/#sec-reflect.enumerate
 EncodedJSValue JSC_HOST_CALL reflectObjectEnumerate(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.enumerate requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.enumerate requires the first argument be an object")));
     return JSValue::encode(JSPropertyNameIterator::create(exec, exec->lexicalGlobalObject()->propertyNameIteratorStructure(), asObject(target)));
 }
 
 // https://tc39.github.io/ecma262/#sec-reflect.get
 EncodedJSValue JSC_HOST_CALL reflectObjectGet(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.get requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.get requires the first argument be an object")));
 
     const Identifier propertyName = exec->argument(1).toPropertyKey(exec);
     if (exec->hadException())
@@ -180,9 +192,12 @@
 // https://tc39.github.io/ecma262/#sec-reflect.getownpropertydescriptor
 EncodedJSValue JSC_HOST_CALL reflectObjectGetOwnPropertyDescriptor(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.getOwnPropertyDescriptor requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.getOwnPropertyDescriptor requires the first argument be an object")));
 
     auto key = exec->argument(1).toPropertyKey(exec);
     if (exec->hadException())
@@ -194,18 +209,24 @@
 // https://tc39.github.io/ecma262/#sec-reflect.getprototypeof
 EncodedJSValue JSC_HOST_CALL reflectObjectGetPrototypeOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.getPrototypeOf requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.getPrototypeOf requires the first argument be an object")));
     return JSValue::encode(objectConstructorGetPrototypeOf(exec, asObject(target)));
 }
 
 // https://tc39.github.io/ecma262/#sec-reflect.isextensible
 EncodedJSValue JSC_HOST_CALL reflectObjectIsExtensible(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.isExtensible requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.isExtensible requires the first argument be an object")));
 
     bool isExtensible = asObject(target)->isExtensible(exec);
     if (exec->hadException())
@@ -216,20 +237,26 @@
 // https://tc39.github.io/ecma262/#sec-reflect.ownkeys
 EncodedJSValue JSC_HOST_CALL reflectObjectOwnKeys(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.ownKeys requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.ownKeys requires the first argument be an object")));
     return JSValue::encode(ownPropertyKeys(exec, jsCast<JSObject*>(target), PropertyNameMode::StringsAndSymbols, DontEnumPropertiesMode::Include));
 }
 
 // https://tc39.github.io/ecma262/#sec-reflect.preventextensions
 EncodedJSValue JSC_HOST_CALL reflectObjectPreventExtensions(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.preventExtensions requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.preventExtensions requires the first argument be an object")));
     JSObject* object = asObject(target);
-    bool result = object->methodTable(exec->vm())->preventExtensions(object, exec);
+    bool result = object->methodTable(vm)->preventExtensions(object, exec);
     if (exec->hadException())
         return JSValue::encode(JSValue());
     return JSValue::encode(jsBoolean(result));
@@ -238,9 +265,12 @@
 // https://tc39.github.io/ecma262/#sec-reflect.set
 EncodedJSValue JSC_HOST_CALL reflectObjectSet(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.set requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.set requires the first argument be an object")));
     JSObject* targetObject = asObject(target);
 
     auto propertyName = exec->argument(1).toPropertyKey(exec);
@@ -254,25 +284,27 @@
     // Do not raise any readonly errors that happen in strict mode.
     bool shouldThrowIfCantSet = false;
     PutPropertySlot slot(receiver, shouldThrowIfCantSet);
-    return JSValue::encode(jsBoolean(targetObject->methodTable(exec->vm())->put(targetObject, exec, propertyName, exec->argument(2), slot)));
+    return JSValue::encode(jsBoolean(targetObject->methodTable(vm)->put(targetObject, exec, propertyName, exec->argument(2), slot)));
 }
 
 // https://tc39.github.io/ecma262/#sec-reflect.setprototypeof
 EncodedJSValue JSC_HOST_CALL reflectObjectSetPrototypeOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue target = exec->argument(0);
     if (!target.isObject())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.setPrototypeOf requires the first argument be an object")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.setPrototypeOf requires the first argument be an object")));
     JSValue proto = exec->argument(1);
     if (!proto.isObject() && !proto.isNull())
-        return JSValue::encode(throwTypeError(exec, ASCIILiteral("Reflect.setPrototypeOf requires the second argument be either an object or null")));
+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral("Reflect.setPrototypeOf requires the second argument be either an object or null")));
 
     JSObject* object = asObject(target);
 
     if (!checkProtoSetterAccessAllowed(exec, object))
         return JSValue::encode(jsBoolean(false));
 
-    VM& vm = exec->vm();
     bool shouldThrowIfCantSet = false;
     bool didSetPrototype = object->setPrototype(vm, exec, proto, shouldThrowIfCantSet);
     if (vm.exception())
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
index d23789b..0126141 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -210,6 +210,9 @@
 
 inline RegExpFlags toFlags(ExecState* exec, JSValue flags)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (flags.isUndefined())
         return NoFlags;
     JSString* flagsString = flags.toString(exec);
@@ -222,13 +225,15 @@
     if (exec->hadException())
         return InvalidFlags;
     if (result == InvalidFlags)
-        throwSyntaxError(exec, ASCIILiteral("Invalid flags supplied to RegExp constructor."));
+        throwSyntaxError(exec, scope, ASCIILiteral("Invalid flags supplied to RegExp constructor."));
     return result;
 }
 
 static JSObject* regExpCreate(ExecState* exec, JSGlobalObject* globalObject, JSValue newTarget, JSValue patternArg, JSValue flagsArg)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     String pattern = patternArg.isUndefined() ? emptyString() : patternArg.toString(exec)->value(exec);
     if (exec->hadException())
         return nullptr;
@@ -239,7 +244,7 @@
 
     RegExp* regExp = RegExp::create(vm, pattern, flags);
     if (!regExp->isValid())
-        return vm.throwException(exec, createSyntaxError(exec, regExp->errorMessage()));
+        return throwException(exec, scope, createSyntaxError(exec, regExp->errorMessage()));
 
     Structure* structure = getRegExpStructure(exec, globalObject, newTarget);
     if (vm.exception())
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.cpp b/Source/JavaScriptCore/runtime/RegExpObject.cpp
index 970504b..10c9299 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpObject.cpp
@@ -171,6 +171,8 @@
 template<typename FixEndFunc>
 JSValue collectMatches(VM& vm, ExecState* exec, JSString* string, const String& s, RegExpConstructor* constructor, RegExp* regExp, const FixEndFunc& fixEnd)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     MatchResult result = constructor->performMatch(vm, regExp, string, s, 0);
     if (!result)
         return jsNull();
@@ -197,7 +199,7 @@
             MatchResult savedResult = result;
             do {
                 if (array->length() + matchCount >= MAX_STORAGE_VECTOR_LENGTH) {
-                    throwOutOfMemoryError(exec);
+                    throwOutOfMemoryError(exec, scope);
                     return jsUndefined();
                 }
                 
diff --git a/Source/JavaScriptCore/runtime/RegExpObject.h b/Source/JavaScriptCore/runtime/RegExpObject.h
index bb02a57..b157261 100644
--- a/Source/JavaScriptCore/runtime/RegExpObject.h
+++ b/Source/JavaScriptCore/runtime/RegExpObject.h
@@ -23,6 +23,7 @@
 
 #include "JSObject.h"
 #include "RegExp.h"
+#include "ThrowScope.h"
 
 namespace JSC {
     
@@ -43,22 +44,28 @@
 
     bool setLastIndex(ExecState* exec, size_t lastIndex)
     {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
         if (LIKELY(m_lastIndexIsWritable)) {
             m_lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
             return true;
         }
-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+        throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
     bool setLastIndex(ExecState* exec, JSValue lastIndex, bool shouldThrow)
     {
+        VM& vm = exec->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
         if (LIKELY(m_lastIndexIsWritable)) {
             m_lastIndex.set(exec->vm(), this, lastIndex);
             return true;
         }
 
         if (shouldThrow)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
     JSValue getLastIndex() const
diff --git a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
index afc3ed7..4f9758d 100644
--- a/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -98,9 +98,12 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncTestFast(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(RegExpObject::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString* string = exec->argument(0).toStringOrNull(exec);
     if (!string)
         return JSValue::encode(jsUndefined());
@@ -109,9 +112,12 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(RegExpObject::info()))
-        return throwVMTypeError(exec, "Builtin RegExp exec can only be called on a RegExp object");
+        return throwVMTypeError(exec, scope, "Builtin RegExp exec can only be called on a RegExp object");
     JSString* string = exec->argument(0).toStringOrNull(exec);
     if (!string)
         return JSValue::encode(jsUndefined());
@@ -120,9 +126,12 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncMatchFast(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(RegExpObject::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString* string = exec->argument(0).toStringOrNull(exec);
     if (!string)
         return JSValue::encode(jsUndefined());
@@ -133,9 +142,12 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!thisValue.inherits(RegExpObject::info()))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     RegExp* regExp;
     JSValue arg0 = exec->argument(0);
@@ -143,7 +155,7 @@
     
     if (arg0.inherits(RegExpObject::info())) {
         if (!arg1.isUndefined())
-            return throwVMTypeError(exec, ASCIILiteral("Cannot supply flags when constructing one RegExp from another."));
+            return throwVMTypeError(exec, scope, ASCIILiteral("Cannot supply flags when constructing one RegExp from another."));
         regExp = asRegExpObject(arg0)->regExp();
     } else {
         String pattern = !exec->argumentCount() ? emptyString() : arg0.toString(exec)->value(exec);
@@ -156,15 +168,15 @@
             if (exec->hadException())
                 return JSValue::encode(jsUndefined());
             if (flags == InvalidFlags)
-                return throwVMError(exec, createSyntaxError(exec, ASCIILiteral("Invalid flags supplied to RegExp constructor.")));
+                return throwVMError(exec, scope, createSyntaxError(exec, ASCIILiteral("Invalid flags supplied to RegExp constructor.")));
         }
-        regExp = RegExp::create(exec->vm(), pattern, flags);
+        regExp = RegExp::create(vm, pattern, flags);
     }
 
     if (!regExp->isValid())
-        return throwVMError(exec, createSyntaxError(exec, regExp->errorMessage()));
+        return throwVMError(exec, scope, createSyntaxError(exec, regExp->errorMessage()));
 
-    asRegExpObject(thisValue)->setRegExp(exec->vm(), regExp);
+    asRegExpObject(thisValue)->setRegExp(vm, regExp);
     asRegExpObject(thisValue)->setLastIndex(exec, 0);
     return JSValue::encode(thisValue);
 }
@@ -212,9 +224,12 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     JSObject* thisObject = asObject(thisValue);
 
@@ -222,7 +237,6 @@
     if (JSValue earlyReturnValue = checker.earlyReturnValue())
         return JSValue::encode(earlyReturnValue);
 
-    VM& vm = exec->vm();
     JSValue sourceValue = thisObject->get(exec, vm.propertyNames->source);
     if (vm.exception())
         return JSValue::encode(jsUndefined());
@@ -242,11 +256,14 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterGlobal(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
         if (thisValue.inherits(RegExpPrototype::info()))
             return JSValue::encode(jsUndefined());
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.global getter can only be called on a RegExp object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.global getter can only be called on a RegExp object"));
     }
 
     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->global()));
@@ -254,11 +271,14 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterIgnoreCase(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
         if (thisValue.inherits(RegExpPrototype::info()))
             return JSValue::encode(jsUndefined());
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.ignoreCase getter can only be called on a RegExp object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.ignoreCase getter can only be called on a RegExp object"));
     }
 
     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->ignoreCase()));
@@ -266,11 +286,14 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterMultiline(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
         if (thisValue.inherits(RegExpPrototype::info()))
             return JSValue::encode(jsUndefined());
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.multiline getter can only be called on a RegExp object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.multiline getter can only be called on a RegExp object"));
     }
 
     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->multiline()));
@@ -278,11 +301,14 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterSticky(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
         if (thisValue.inherits(RegExpPrototype::info()))
             return JSValue::encode(jsUndefined());
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.sticky getter can only be called on a RegExp object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.sticky getter can only be called on a RegExp object"));
     }
     
     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->sticky()));
@@ -290,11 +316,14 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterUnicode(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
         if (thisValue.inherits(RegExpPrototype::info()))
             return JSValue::encode(jsUndefined());
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.unicode getter can only be called on a RegExp object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.unicode getter can only be called on a RegExp object"));
     }
     
     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)->regExp()->unicode()));
@@ -302,9 +331,12 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterFlags(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.isObject()))
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.flags getter can only be called on an object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.flags getter can only be called on an object"));
 
     auto flags = flagsString(exec, asObject(thisValue));
     if (exec->hadException())
@@ -421,11 +453,14 @@
 
 EncodedJSValue JSC_HOST_CALL regExpProtoGetterSource(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
         if (thisValue.inherits(RegExpPrototype::info()))
             return JSValue::encode(jsString(exec, ASCIILiteral("(?:)")));
-        return throwVMTypeError(exec, ASCIILiteral("The RegExp.prototype.source getter can only be called on a RegExp object"));
+        return throwVMTypeError(exec, scope, ASCIILiteral("The RegExp.prototype.source getter can only be called on a RegExp object"));
     }
 
     String pattern = asRegExpObject(thisValue)->regExp()->pattern();
@@ -539,6 +574,7 @@
 EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     // 1. [handled by JS builtin] Let rx be the this value.
     // 2. [handled by JS builtin] If Type(rx) is not Object, throw a TypeError exception.
@@ -644,7 +680,7 @@
         });
     
     if (resultLength + dryRunCount >= MAX_STORAGE_VECTOR_LENGTH) {
-        throwOutOfMemoryError(exec);
+        throwOutOfMemoryError(exec, scope);
         return JSValue::encode(jsUndefined());
     }
     
diff --git a/Source/JavaScriptCore/runtime/Reject.h b/Source/JavaScriptCore/runtime/Reject.h
index 7f1a5db..052effd 100644
--- a/Source/JavaScriptCore/runtime/Reject.h
+++ b/Source/JavaScriptCore/runtime/Reject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,8 +33,10 @@
 
 inline bool reject(ExecState* exec, bool throwException, const char* message)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     if (throwException)
-        throwTypeError(exec, message);
+        throwTypeError(exec, scope, message);
     return false;
 }
 
diff --git a/Source/JavaScriptCore/runtime/SetConstructor.cpp b/Source/JavaScriptCore/runtime/SetConstructor.cpp
index a8c311c..58e0b6c 100644
--- a/Source/JavaScriptCore/runtime/SetConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/SetConstructor.cpp
@@ -51,11 +51,16 @@
 
 static EncodedJSValue JSC_HOST_CALL callSet(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "Set"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "Set"));
 }
 
 static EncodedJSValue JSC_HOST_CALL constructSet(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     Structure* setStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->setStructure());
     if (exec->hadException())
@@ -72,7 +77,7 @@
     CallData adderFunctionCallData;
     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
     if (adderFunctionCallType == CallType::None)
-        return JSValue::encode(throwTypeError(exec));
+        return JSValue::encode(throwTypeError(exec, scope));
 
     forEachInIterable(exec, iterable, [&](VM&, ExecState* exec, JSValue nextValue) {
         MarkedArgumentBuffer arguments;
diff --git a/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp b/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp
index 4448832..1e92e79 100644
--- a/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp
@@ -50,10 +50,13 @@
 
 EncodedJSValue JSC_HOST_CALL SetIteratorPrototypeFuncNext(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue result;
     JSSetIterator* iterator = jsDynamicCast<JSSetIterator*>(callFrame->thisValue());
     if (!iterator)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot call SetIterator.next() on a non-SetIterator object")));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot call SetIterator.next() on a non-SetIterator object")));
 
     if (iterator->next(callFrame, result))
         return JSValue::encode(createIteratorResultObject(callFrame, result, false));
diff --git a/Source/JavaScriptCore/runtime/SetPrototype.cpp b/Source/JavaScriptCore/runtime/SetPrototype.cpp
index b17a430..f893ec5 100644
--- a/Source/JavaScriptCore/runtime/SetPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/SetPrototype.cpp
@@ -84,13 +84,16 @@
 
 ALWAYS_INLINE static JSSet* getSet(CallFrame* callFrame, JSValue thisValue)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!thisValue.isObject()) {
-        throwVMError(callFrame, createNotAnObjectError(callFrame, thisValue));
+        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
         return nullptr;
     }
     JSSet* set = jsDynamicCast<JSSet*>(thisValue);
     if (!set) {
-        throwTypeError(callFrame, ASCIILiteral("Set operation called on non-Set object"));
+        throwTypeError(callFrame, scope, ASCIILiteral("Set operation called on non-Set object"));
         return nullptr;
     }
     return set;
@@ -141,18 +144,24 @@
     
 EncodedJSValue JSC_HOST_CALL setProtoFuncValues(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSSet* thisObj = jsDynamicCast<JSSet*>(callFrame->thisValue());
     if (!thisObj)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot create a Set value iterator for a non-Set object.")));
-    return JSValue::encode(JSSetIterator::create(callFrame->vm(), callFrame->callee()->globalObject()->setIteratorStructure(), thisObj, IterateValue));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Set value iterator for a non-Set object.")));
+    return JSValue::encode(JSSetIterator::create(vm, callFrame->callee()->globalObject()->setIteratorStructure(), thisObj, IterateValue));
 }
 
 EncodedJSValue JSC_HOST_CALL setProtoFuncEntries(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSSet* thisObj = jsDynamicCast<JSSet*>(callFrame->thisValue());
     if (!thisObj)
-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral("Cannot create a Set entry iterator for a non-Set object.")));
-    return JSValue::encode(JSSetIterator::create(callFrame->vm(), callFrame->callee()->globalObject()->setIteratorStructure(), thisObj, IterateKeyValue));
+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral("Cannot create a Set entry iterator for a non-Set object.")));
+    return JSValue::encode(JSSetIterator::create(vm, callFrame->callee()->globalObject()->setIteratorStructure(), thisObj, IterateKeyValue));
 }
 
 EncodedJSValue JSC_HOST_CALL privateFuncIsSet(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp b/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp
index c8e003b..431120fc 100644
--- a/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp
+++ b/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, 2012, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -90,6 +90,8 @@
 
 bool SparseArrayValueMap::putEntry(ExecState* exec, JSObject* array, unsigned i, JSValue value, bool shouldThrow)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ASSERT(value);
     
     AddResult result = add(array, i);
@@ -101,7 +103,7 @@
     if (result.isNewEntry && !array->isStructureExtensible()) {
         remove(result.iterator);
         if (shouldThrow)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
     
@@ -148,14 +150,17 @@
 
 bool SparseArrayEntry::put(ExecState* exec, JSValue thisValue, SparseArrayValueMap* map, JSValue value, bool shouldThrow)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!(attributes & Accessor)) {
         if (attributes & ReadOnly) {
             if (shouldThrow)
-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
             return false;
         }
 
-        set(exec->vm(), map, value);
+        set(vm, map, value);
         return true;
     }
 
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.cpp b/Source/JavaScriptCore/runtime/StringConstructor.cpp
index db564bb..74d2305 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/StringConstructor.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -90,6 +90,9 @@
 
 static EncodedJSValue JSC_HOST_CALL stringFromCodePoint(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     unsigned length = exec->argumentCount();
     StringBuilder builder;
     builder.reserveCapacity(length);
@@ -102,7 +105,7 @@
         uint32_t codePoint = static_cast<uint32_t>(codePointAsDouble);
 
         if (codePoint != codePointAsDouble || codePoint > UCHAR_MAX_VALUE)
-            return throwVMError(exec, createRangeError(exec, ASCIILiteral("Arguments contain a value that is out of range of code points")));
+            return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("Arguments contain a value that is out of range of code points")));
 
         if (U_IS_BMP(codePoint))
             builder.append(static_cast<UChar>(codePoint));
diff --git a/Source/JavaScriptCore/runtime/StringObject.cpp b/Source/JavaScriptCore/runtime/StringObject.cpp
index 52d4ec2..6c480a8 100644
--- a/Source/JavaScriptCore/runtime/StringObject.cpp
+++ b/Source/JavaScriptCore/runtime/StringObject.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -63,6 +63,9 @@
 
 bool StringObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     StringObject* thisObject = jsCast<StringObject*>(cell);
 
     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
@@ -70,7 +73,7 @@
 
     if (propertyName == exec->propertyNames().length) {
         if (slot.isStrictMode())
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
     if (Optional<uint32_t> index = parseIndex(propertyName))
@@ -80,10 +83,13 @@
 
 bool StringObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     StringObject* thisObject = jsCast<StringObject*>(cell);
     if (thisObject->internalValue()->canGetIndex(propertyName)) {
         if (shouldThrow)
-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
         return false;
     }
     return JSObject::putByIndex(cell, exec, propertyName, value, shouldThrow);
diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
index 1d9095e..d8c4ded 100644
--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
@@ -289,6 +289,9 @@
 
 static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (rangeCount == 1) {
         int sourceSize = source.length();
         int position = substringRanges[0].position;
@@ -311,7 +314,7 @@
         const LChar* sourceData = source.characters8();
         auto impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
         if (!impl)
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
 
         int bufferPos = 0;
         for (int i = 0; i < rangeCount; i++) {
@@ -329,7 +332,7 @@
 
     auto impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
     if (!impl)
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
 
     int bufferPos = 0;
     for (int i = 0; i < rangeCount; i++) {
@@ -344,6 +347,9 @@
 
 static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const String& source, const StringRange* substringRanges, int rangeCount, const String* separators, int separatorCount)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (rangeCount == 1 && separatorCount == 0) {
         int sourceSize = source.length();
         int position = substringRanges[0].position;
@@ -364,7 +370,7 @@
             allSeparators8Bit = false;
     }
     if (totalLength.hasOverflowed())
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
 
     if (!totalLength)
         return jsEmptyString(exec);
@@ -375,7 +381,7 @@
 
         auto impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
         if (!impl)
-            return throwOutOfMemoryError(exec);
+            return throwOutOfMemoryError(exec, scope);
 
         int maxCount = std::max(rangeCount, separatorCount);
         int bufferPos = 0;
@@ -400,7 +406,7 @@
     UChar* buffer;
     auto impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
     if (!impl)
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
 
     int maxCount = std::max(rangeCount, separatorCount);
     int bufferPos = 0;
@@ -752,10 +758,13 @@
 template <typename CharacterType>
 static inline JSString* repeatCharacter(ExecState& exec, CharacterType character, unsigned repeatCount)
 {
+    VM& vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     CharacterType* buffer = nullptr;
     auto impl = StringImpl::tryCreateUninitialized(repeatCount, buffer);
     if (!impl) {
-        throwOutOfMemoryError(&exec);
+        throwOutOfMemoryError(&exec, scope);
         return nullptr;
     }
 
@@ -797,8 +806,10 @@
 ALWAYS_INLINE EncodedJSValue replace(
     VM& vm, ExecState* exec, JSValue thisValue, JSValue searchValue, JSValue replaceValue)
 {
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString* string = thisValue.toString(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -841,6 +852,9 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     // Also used for valueOf.
 
@@ -850,14 +864,17 @@
     if (thisValue.inherits(StringObject::info()))
         return JSValue::encode(asStringObject(thisValue)->internalValue());
 
-    return throwVMTypeError(exec);
+    return throwVMTypeError(exec, scope);
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString::SafeView string = thisValue.toString(exec)->view(exec);
     JSValue a0 = exec->argument(0);
     if (a0.isUInt32()) {
@@ -874,9 +891,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString::SafeView string = thisValue.toString(exec)->view(exec);
     JSValue a0 = exec->argument(0);
     if (a0.isUInt32()) {
@@ -903,9 +923,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncCodePointAt(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     String string = thisValue.toWTFString(exec);
     unsigned length = string.length();
@@ -929,20 +952,26 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (thisValue.isString() && exec->argumentCount() == 1)
         return JSValue::encode(jsString(exec, asString(thisValue), exec->uncheckedArgument(0).toString(exec)));
 
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     return JSValue::encode(jsStringFromArguments(exec, thisValue));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     JSValue a0 = exec->argument(0);
     JSValue a1 = exec->argument(1);
@@ -977,9 +1006,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     JSValue a0 = exec->argument(0);
     JSValue a1 = exec->argument(1);
@@ -1014,9 +1046,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1201,9 +1236,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     unsigned len;
     JSString* jsString = 0;
     String uString;
@@ -1257,9 +1295,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     JSString* jsString = thisValue.toString(exec);
     if (exec->hadException())
@@ -1297,9 +1338,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString* sVal = thisValue.toString(exec);
     const String& s = sVal->value(exec);
     String lowercasedString = s.convertToLowercaseWithoutLocale();
@@ -1310,9 +1354,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString* sVal = thisValue.toString(exec);
     const String& s = sVal->value(exec);
     String uppercasedString = s.convertToUppercaseWithoutLocale();
@@ -1323,9 +1370,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1340,10 +1390,13 @@
 #if ENABLE(INTL)
 static EncodedJSValue toLocaleCase(ExecState* state, int32_t (*convertCase)(UChar*, int32_t, const UChar*, int32_t, const char*, UErrorCode*))
 {
+    VM& vm = state->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     // 1. Let O be RequireObjectCoercible(this value).
     JSValue thisValue = state->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(state);
+        return throwVMTypeError(state, scope);
 
     // 2. Let S be ToString(O).
     JSString* sVal = thisValue.toString(state);
@@ -1411,10 +1464,10 @@
         Vector<UChar> buffer(resultLength);
         convertCase(buffer.data(), resultLength, view.upconvertedCharacters(), viewLength, utf8LocaleBuffer.data(), &error);
         if (U_FAILURE(error))
-            return throwVMTypeError(state, u_errorName(error));
+            return throwVMTypeError(state, scope, u_errorName(error));
         lower = String(buffer.data(), resultLength);
     } else
-        return throwVMTypeError(state, u_errorName(error));
+        return throwVMTypeError(state, scope, u_errorName(error));
 
     // 18. Return L.
     return JSValue::encode(jsString(state, lower));
@@ -1438,9 +1491,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1449,9 +1505,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1460,9 +1519,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1471,9 +1533,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1482,9 +1547,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1493,9 +1561,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1504,9 +1575,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1515,9 +1589,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1526,9 +1603,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1537,9 +1617,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1553,9 +1636,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1605,9 +1691,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1621,9 +1710,12 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     String s = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1667,8 +1759,11 @@
 
 static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!checkObjectCoercible(thisValue))
-        return throwTypeError(exec);
+        return throwTypeError(exec, scope);
     String str = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return jsUndefined();
@@ -1720,21 +1815,23 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncStartsWith(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     String stringToSearchIn = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
     JSValue a0 = exec->argument(0);
-    VM& vm = exec->vm();
     bool isRegularExpression = isRegExp(vm, exec, a0);
     if (vm.exception())
         return JSValue::encode(JSValue());
     if (isRegularExpression)
-        return throwVMTypeError(exec, "Argument to String.prototype.startsWith cannot be a RegExp");
+        return throwVMTypeError(exec, scope, "Argument to String.prototype.startsWith cannot be a RegExp");
 
     String searchString = a0.toString(exec)->value(exec);
     if (exec->hadException())
@@ -1756,21 +1853,23 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncEndsWith(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     String stringToSearchIn = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
     JSValue a0 = exec->argument(0);
-    VM& vm = exec->vm();
     bool isRegularExpression = isRegExp(vm, exec, a0);
     if (vm.exception())
         return JSValue::encode(JSValue());
     if (isRegularExpression)
-        return throwVMTypeError(exec, "Argument to String.prototype.endsWith cannot be a RegExp");
+        return throwVMTypeError(exec, scope, "Argument to String.prototype.endsWith cannot be a RegExp");
 
     String searchString = a0.toString(exec)->value(exec);
     if (exec->hadException())
@@ -1808,21 +1907,23 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
 
     String stringToSearchIn = thisValue.toString(exec)->value(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
     JSValue a0 = exec->argument(0);
-    VM& vm = exec->vm();
     bool isRegularExpression = isRegExp(vm, exec, a0);
     if (vm.exception())
         return JSValue::encode(JSValue());
     if (isRegularExpression)
-        return throwVMTypeError(exec, "Argument to String.prototype.includes cannot be a RegExp");
+        return throwVMTypeError(exec, scope, "Argument to String.prototype.includes cannot be a RegExp");
 
     String searchString = a0.toString(exec)->value(exec);
     if (exec->hadException())
@@ -1855,42 +1956,51 @@
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncIterator(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString* string = thisValue.toString(exec);
     return JSValue::encode(JSStringIterator::create(exec, exec->callee()->globalObject()->stringIteratorStructure(), string));
 }
 
 static JSValue normalize(ExecState* exec, const UChar* source, size_t sourceLength, UNormalizationMode form)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     UErrorCode status = U_ZERO_ERROR;
     int32_t normalizedStringLength = unorm_normalize(source, sourceLength, form, 0, nullptr, 0, &status);
 
     if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR) {
         // The behavior is not specified when normalize fails.
         // Now we throw a type erorr since it seems that the contents of the string are invalid.
-        return throwTypeError(exec);
+        return throwTypeError(exec, scope);
     }
 
     UChar* buffer = nullptr;
     auto impl = StringImpl::tryCreateUninitialized(normalizedStringLength, buffer);
     if (!impl)
-        return throwOutOfMemoryError(exec);
+        return throwOutOfMemoryError(exec, scope);
 
     status = U_ZERO_ERROR;
     unorm_normalize(source, sourceLength, form, 0, buffer, normalizedStringLength, &status);
     if (U_FAILURE(status))
-        return throwTypeError(exec);
+        return throwTypeError(exec, scope);
 
     return jsString(exec, WTFMove(impl));
 }
 
 EncodedJSValue JSC_HOST_CALL stringProtoFuncNormalize(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (!checkObjectCoercible(thisValue))
-        return throwVMTypeError(exec);
+        return throwVMTypeError(exec, scope);
     JSString::SafeView source = thisValue.toString(exec)->view(exec);
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
@@ -1911,7 +2021,7 @@
         else if (formString == "NFKD")
             form = UNORM_NFKD;
         else
-            return throwVMError(exec, createRangeError(exec, ASCIILiteral("argument does not match any normalization form")));
+            return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral("argument does not match any normalization form")));
     }
 
     return JSValue::encode(normalize(exec, source.get().upconvertedCharacters(), source.length(), form));
diff --git a/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp b/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp
index 6383107..33e45a6 100644
--- a/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp
+++ b/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ *  Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -28,7 +28,9 @@
 
 JSValue StringRecursionChecker::throwStackOverflowError()
 {
-    return JSC::throwStackOverflowError(m_exec);
+    VM& vm = m_exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSC::throwStackOverflowError(m_exec, scope);
 }
 
 JSValue StringRecursionChecker::emptyString()
diff --git a/Source/JavaScriptCore/runtime/Symbol.cpp b/Source/JavaScriptCore/runtime/Symbol.cpp
index 4c45823..666fc1c 100644
--- a/Source/JavaScriptCore/runtime/Symbol.cpp
+++ b/Source/JavaScriptCore/runtime/Symbol.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2015-2016 Yusuke Suzuki <utatane.tea@gmail.com>.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -87,7 +87,9 @@
 
 double Symbol::toNumber(ExecState* exec) const
 {
-    throwTypeError(exec, ASCIILiteral("Cannot convert a symbol to a number"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwTypeError(exec, scope, ASCIILiteral("Cannot convert a symbol to a number"));
     return 0.0;
 }
 
diff --git a/Source/JavaScriptCore/runtime/SymbolConstructor.cpp b/Source/JavaScriptCore/runtime/SymbolConstructor.cpp
index d21d595..df10562 100644
--- a/Source/JavaScriptCore/runtime/SymbolConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/SymbolConstructor.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -110,16 +110,19 @@
 
 EncodedJSValue JSC_HOST_CALL symbolConstructorKeyFor(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue symbolValue = exec->argument(0);
     if (!symbolValue.isSymbol())
-        return JSValue::encode(throwTypeError(exec, SymbolKeyForTypeError));
+        return JSValue::encode(throwTypeError(exec, scope, SymbolKeyForTypeError));
 
     SymbolImpl* uid = asSymbol(symbolValue)->privateName().uid();
     if (!uid->symbolRegistry())
         return JSValue::encode(jsUndefined());
 
-    ASSERT(uid->symbolRegistry() == &exec->vm().symbolRegistry());
-    return JSValue::encode(jsString(exec, exec->vm().symbolRegistry().keyForSymbol(*uid)));
+    ASSERT(uid->symbolRegistry() == &vm.symbolRegistry());
+    return JSValue::encode(jsString(exec, vm.symbolRegistry().keyForSymbol(*uid)));
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/SymbolPrototype.cpp b/Source/JavaScriptCore/runtime/SymbolPrototype.cpp
index d8f4c90..0f022a3 100644
--- a/Source/JavaScriptCore/runtime/SymbolPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/SymbolPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
  * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -72,16 +72,19 @@
 
 EncodedJSValue JSC_HOST_CALL symbolProtoFuncToString(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     Symbol* symbol = nullptr;
     if (thisValue.isSymbol())
         symbol = asSymbol(thisValue);
     else {
         if (!thisValue.isObject())
-            return throwVMTypeError(exec, SymbolToStringTypeError);
+            return throwVMTypeError(exec, scope, SymbolToStringTypeError);
         JSObject* thisObject = asObject(thisValue);
         if (!thisObject->inherits(SymbolObject::info()))
-            return throwVMTypeError(exec, SymbolToStringTypeError);
+            return throwVMTypeError(exec, scope, SymbolToStringTypeError);
         symbol = asSymbol(jsCast<SymbolObject*>(thisObject)->internalValue());
     }
 
@@ -90,16 +93,19 @@
 
 EncodedJSValue JSC_HOST_CALL symbolProtoFuncValueOf(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSValue thisValue = exec->thisValue();
     if (thisValue.isSymbol())
         return JSValue::encode(thisValue);
 
     if (!thisValue.isObject())
-        return throwVMTypeError(exec, SymbolValueOfTypeError);
+        return throwVMTypeError(exec, scope, SymbolValueOfTypeError);
 
     JSObject* thisObject = asObject(thisValue);
     if (!thisObject->inherits(SymbolObject::info()))
-        return throwVMTypeError(exec, SymbolValueOfTypeError);
+        return throwVMTypeError(exec, scope, SymbolValueOfTypeError);
 
     return JSValue::encode(jsCast<SymbolObject*>(thisObject)->internalValue());
 }
diff --git a/Source/JavaScriptCore/runtime/ThrowScope.cpp b/Source/JavaScriptCore/runtime/ThrowScope.cpp
new file mode 100644
index 0000000..57fd99a
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ThrowScope.cpp
@@ -0,0 +1,395 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ThrowScope.h"
+
+#include "JSCJSValueInlines.h"
+#include "VM.h"
+
+namespace JSC {
+    
+#if ENABLE(THROW_SCOPE_VERIFICATION)
+
+namespace {
+
+// Logs all ThrowScope activity to help debug the source of a verification failure.
+bool traceOn = false;
+
+// A more verbose logging option to dump the C++ stack trace at strategic points to aid debugging.
+bool traceWithStackTraces = false;
+
+// Disabled temporarily until all known verification failures are fixed.
+bool verificationOn = false;
+
+unsigned traceCount = 0;
+};
+
+/*
+    ThrowScope verification works to simulate exception throws and catch cases where
+    exception checks are missing. This is how it works:
+
+ 1. The VM has a m_needExceptionCheck bit that indicates where an exception check is
+    needed. You can think of the m_needExceptionCheck bit being set as a simulated
+    throw.
+
+ 2. Every throw site must declare a ThrowScope instance using DECLARE_THROW_SCOPE at
+    the top of its function (as early as possible) e.g.
+ 
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            throwException(exec, scope, ...);
+        }
+
+    Note: VM::throwException() methods are private, and only calleableby the ThrowScope
+    friend class. All throws must go through a ThrowScope. Hence, we are guaranteed that
+    any function that can throw will have a ThrowScope.
+
+    Note: by convention, every throw helper function must take a ThrowScope argument
+    instead of instantiating its own ThrowScope.  This allows the throw to be attributed
+    to the client code rather than the throw helper itself.
+
+ 3. Verification of needed exception checks
+
+    a. On construction, each ThrowScope will verify that VM::m_needExceptionCheck is
+       not set.
+ 
+       This ensures that the caller of the current function has checked for exceptions
+       where needed before doing more work which led to calling the current function.
+
+    b. On destruction, each ThrowScope will verify that VM::m_needExceptionCheck is
+       not set. This verification will be skipped if the ThrowScope has been released
+       (see (5) below).
+
+       This ensures that the function that owns this ThrowScope is not missing any
+       exception checks before returning.
+ 
+    c. When throwing an exception, the ThrowScope will verify that VM::m_needExceptionCheck
+       is not set, unless it's been ask to rethrow the same Exception object.
+
+ 4. Simulated throws
+
+    Throws are simulated by setting the m_needExceptionCheck bit.
+
+    The bit will only be set in the ThrowScope destructor except when the ThrowScope
+    detects the caller is a LLInt or JIT function. LLInt or JIT functions will always
+    check for exceptions after a host C++ function returns to it. However, they will
+    not clear the m_needExceptionCheck bit.
+
+    Hence, if the ThrowScope destructor detects the caller is a LLInt or JIT function,
+    it will just skip the setting of the bit.
+
+    Note: there is no need, and it is incorrect to set the m_needExceptionCheck bit
+    in the throwException methods. This is because, in practice, we always return
+    immediately after throwing an exception. It doesn't make sense to set the bit in
+    the throw just to have to clear it immediately after before we do verification in
+    the ThrowScope destructor.
+
+ 5. Using ThrowScope::release()
+
+    ThrowScope::release() should only be used at the bottom of a function if:
+ 
+    a. This function is going to let its caller check and handle the exception.
+ 
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            auto result = goo(); // may throw.
+
+            ... // Cleanup code that will are not affected by a pending exceptions.
+
+            scope.release(); // tell the ThrowScope that the caller will handle the exception.
+            return result;
+        }
+ 
+    b. This function is going to do a tail call that may throw.
+
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            ...
+            scope.release(); // tell the ThrowScope that the caller will handle the exception.
+            return goo(); // may throw.
+        }
+ 
+    ThrowScope::release() should not be used in the code paths that branch. For example:
+ 
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            auto result = goo1(); // may throw.
+            scope.release(); // <=================== the WRONG way !!!
+            if (result)
+                return;
+ 
+            result = goo2(); // may throw.
+            ...
+            return result;
+        }
+ 
+    The above will result in a verification failure in goo2()'s ThrowScope.  The proper way
+    to fix this verification is to do wither (6) or (7) below.
+ 
+  6. Checking exceptions with ThrowScope::exception()
+ 
+     ThrowScope::exception() returns the thrown Exception object if there is one pending.
+     Else it returns nullptr.
+ 
+     It also clears the m_needExceptionCheck bit thereby indicating that we've satisifed
+     the needed exception check.
+ 
+     This is how we do it:
+ 
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            auto result = goo1(); // may throw.
+            if (scope.exception())
+                return;
+
+            result = goo2(); // may throw.
+            ...
+            return result;
+        }
+ 
+    But sometimes, for optimization reasons, we may choose to test the result of the callee
+    function instead doing a load of the VM exception value. See (7) below.
+ 
+ 7. Checking exception by checking callee result
+ 
+    This approach should only be applied when it makes a difference to performance.
+    If we need to do this, we should add an ASSERT() that invokes ThrowScope::exception()
+    and verify the result. Since ThrowScope verification is only done on DEBUG builds,
+    this ASSERT will satisfy the verification requirements while not impacting performance.
+ 
+    This is how we do it:
+
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            bool failed = goo1(); // may throw.
+            ASSERT(!!scope.exception() == failed)
+            if (failed)
+                return;
+
+            result = goo2(); // may throw.
+            ...
+            return result;
+        }
+ 
+ 8. Debugging verification failures.
+
+    a. When verification fails, you will see a helpful message followed by an assertion failure.
+       For example:
+ 
+    FAILED exception check verification:
+        Exception thrown from ThrowScope [2] Exit: setUpCall @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1245
+        is unchecked in ThrowScope [1]: varargsSetup @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1398
+
+       The message tells you that failure was detected at in varargsSetup() @ LLIntSlowPaths.cpp
+       line 1398, and that the missing exception check should have happened somewhere between
+       the call to setUpCall() @ LLIntSlowPaths.cpp line 1245 and it.
+
+       If that is insufficient information, you can ...
+
+    b. Turn on ThrowScope tracing
+ 
+       Just set traceOn=true at the top of ThrowScope.cpp, and rebuild. Thereafter, you should
+       see a trace of ThrowScopes being entered and exited as well as their depth e.g.
+
+    ThrowScope [1] Enter: llint_slow_path_jfalse @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1032
+    ThrowScope [1] Exit: llint_slow_path_jfalse @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1032
+
+       You will also see traces of simulated throws e.g.
+
+    ThrowScope [2] Throw from: setUpCall @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1245
+
+       If that is insufficient information, you can ...
+
+    c. Turn on ThrowScope stack dumps
+
+       Just set traceWithStackTraces=true at the top of ThrowScope.cpp, and rebuild.
+       Thereafter, you should see a stack traces at various relevant ThrowScope events.
+
+    d. Using throwScopePrintIfNeedCheck()
+
+       If you have isolated the missing exception check to a function that is large but
+       is unsure which statement can throw and is missing the check, you can sprinkle
+       the function with calls to throwScopePrintIfNeedCheck().
+
+       throwScopePrintIfNeedCheck() will log a line "Need exception check at ..." that
+       inlcudes the file and line number only when it see the m_needExceptionCheck set.
+       This will tell you which statement simulated the throw that is not being checked
+       i.e. the one that preceded the throwScopePrintIfNeedCheck() that printed a line.
+*/
+
+ThrowScope::ThrowScope(VM& vm, ThrowScopeLocation location)
+    : m_vm(vm)
+    , m_previousScope(vm.m_topThrowScope)
+    , m_location(location)
+    , m_depth(m_previousScope ? m_previousScope->m_depth + 1 : 0)
+{
+    m_vm.m_topThrowScope = this;
+
+    if (traceOn) {
+        dataLog("<", traceCount++, "> ThrowScope [", m_depth, "] Enter: ", location.functionName, " @ ", location.file, ":", location.line);
+        if (m_vm.m_needExceptionCheck)
+            dataLog(", needs check");
+        dataLog("\n");
+
+        if (traceWithStackTraces)
+            WTFReportBacktrace();
+    }
+
+    verifyExceptionCheckNeedIsSatisfied(Site::ScopeEntry);
+}
+
+ThrowScope::~ThrowScope()
+{
+    RELEASE_ASSERT(m_vm.m_topThrowScope);
+
+    if (!m_isReleased)
+        verifyExceptionCheckNeedIsSatisfied(Site::ScopeExit);
+    else {
+        // If we released the scope, that means we're letting our callers do the
+        // exception check. However, because our caller may be a LLInt or JIT
+        // function (which always checks for exceptions but won't clear the
+        // m_needExceptionCheck bit), we should clear m_needExceptionCheck here
+        // and let code below decide if we need to simulate a re-throw.
+        m_vm.m_needExceptionCheck = false;
+    }
+
+    bool willBeHandleByLLIntOrJIT = false;
+    void* previousScope = m_previousScope;
+    void* topCallFrame = m_vm.topCallFrame;
+    
+    // If the topCallFrame was pushed on the stack after the previousScope was instantiated,
+    // then this throwScope will be returning to LLINT or JIT code that always do an exception
+    // check. In that case, skip the simulated throw because the LLInt and JIT will be
+    // checking for the exception their own way instead of calling ThrowScope::exception().
+    if (topCallFrame && previousScope > topCallFrame)
+        willBeHandleByLLIntOrJIT = true;
+    
+    if (!willBeHandleByLLIntOrJIT)
+        simulateThrow();
+
+    if (traceOn) {
+        dataLog("<", traceCount++, "> ThrowScope [", m_depth, "] Exit: ", m_location.functionName, " @ ", m_location.file, ":", m_location.line);
+        if (!willBeHandleByLLIntOrJIT)
+            dataLog(", with rethrow");
+        if (m_vm.m_needExceptionCheck)
+            dataLog(", needs check");
+        dataLog("\n");
+
+        if (traceWithStackTraces)
+            WTFReportBacktrace();
+    }
+
+    m_vm.m_topThrowScope = m_previousScope;
+}
+
+void ThrowScope::throwException(ExecState* exec, Exception* exception)
+{
+    if (m_vm.exception() && m_vm.exception() != exception)
+        verifyExceptionCheckNeedIsSatisfied(Site::Throw);
+    
+    m_vm.throwException(exec, exception);
+}
+
+JSValue ThrowScope::throwException(ExecState* exec, JSValue error)
+{
+    if (!error.isCell() || !jsDynamicCast<Exception*>(error.asCell()))
+        verifyExceptionCheckNeedIsSatisfied(Site::Throw);
+    
+    return m_vm.throwException(exec, error);
+}
+
+JSObject* ThrowScope::throwException(ExecState* exec, JSObject* obj)
+{
+    if (!jsDynamicCast<Exception*>(obj))
+        verifyExceptionCheckNeedIsSatisfied(Site::Throw);
+    
+    return m_vm.throwException(exec, obj);
+}
+
+void ThrowScope::printIfNeedCheck(const char* functionName, const char* file, unsigned line)
+{
+    if (m_vm.m_needExceptionCheck)
+        dataLog("<", traceCount++, "> Need exception check at ", functionName, " @ ", file, ":", line, "\n");
+}
+
+void ThrowScope::simulateThrow()
+{
+    RELEASE_ASSERT(m_vm.m_topThrowScope);
+    m_vm.m_simulatedThrowPointLocation = m_location;
+    m_vm.m_simulatedThrowPointDepth = m_depth;
+    m_vm.m_needExceptionCheck = true;
+
+    if (traceOn) {
+        dataLog("<", traceCount++, "> ThrowScope [", m_depth, "] Throw from: ", m_location.functionName, " @ ", m_location.file, ":", m_location.line, "\n");
+        if (traceWithStackTraces)
+            WTFReportBacktrace();
+    }
+}
+
+void ThrowScope::verifyExceptionCheckNeedIsSatisfied(ThrowScope::Site site)
+{
+    if (!verificationOn)
+        return;
+
+    if (UNLIKELY(m_vm.m_needExceptionCheck)) {
+        auto failDepth = m_vm.m_simulatedThrowPointDepth;
+        auto& failLocation = m_vm.m_simulatedThrowPointLocation;
+
+        auto siteName = [] (Site site) -> const char* {
+            switch (site) {
+            case Site::ScopeEntry:
+                return "Entry";
+            case Site::ScopeExit:
+                return "Exit";
+            case Site::Throw:
+                return "Throw";
+            }
+            RELEASE_ASSERT_NOT_REACHED();
+            return nullptr;
+        };
+
+        dataLog(
+            "FAILED exception check verification:\n"
+            "    Exception thrown from ThrowScope [", failDepth, "] ", siteName(site), ": ", failLocation.functionName, " @ ", failLocation.file, ":", failLocation.line, "\n"
+            "    is unchecked in ThrowScope [", m_depth, "]: ", m_location.functionName, " @ ", m_location.file, ":", m_location.line, "\n"
+            "\n");
+
+        RELEASE_ASSERT(!m_vm.m_needExceptionCheck);
+    }
+}
+
+#endif // ENABLE(THROW_SCOPE_VERIFICATION)
+    
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ThrowScope.h b/Source/JavaScriptCore/runtime/ThrowScope.h
new file mode 100644
index 0000000..0e7cddf
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ThrowScope.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThrowScope_h
+#define ThrowScope_h
+
+#include "Exception.h"
+#include "VM.h"
+
+namespace JSC {
+
+class ExecState;
+class JSObject;
+
+#if ENABLE(THROW_SCOPE_VERIFICATION)
+
+class ThrowScope {
+public:
+    JS_EXPORT_PRIVATE ThrowScope(VM&, ThrowScopeLocation);
+    JS_EXPORT_PRIVATE ~ThrowScope();
+
+    ThrowScope(const ThrowScope&) = delete;
+    ThrowScope(ThrowScope&&) = default;
+
+    VM& vm() const { return m_vm; }
+
+    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
+    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
+
+    inline Exception* exception()
+    {
+        m_vm.m_needExceptionCheck = false;
+        return m_vm.exception();
+    }
+
+    inline void release() { m_isReleased = true; }
+
+    JS_EXPORT_PRIVATE void printIfNeedCheck(const char* functionName, const char* file, unsigned line);
+
+private:
+    void simulateThrow();
+
+    enum class Site {
+        ScopeEntry,
+        ScopeExit,
+        Throw
+    };
+    void verifyExceptionCheckNeedIsSatisfied(Site);
+
+    VM& m_vm;
+    ThrowScope* m_previousScope;
+    ThrowScopeLocation m_location;
+    unsigned m_depth;
+    bool m_isReleased { false };
+};
+
+#define DECLARE_THROW_SCOPE(vm__) \
+    JSC::ThrowScope((vm__), JSC::ThrowScopeLocation(__FUNCTION__, __FILE__, __LINE__))
+
+#define throwScopePrintIfNeedCheck(scope__) \
+    scope__.printIfNeedCheck(__FUNCTION__, __FILE__, __LINE__)
+
+#else // not ENABLE(THROW_SCOPE_VERIFICATION)
+
+class ThrowScope {
+public:
+    ThrowScope(VM& vm)
+        : m_vm(vm)
+    { }
+
+    VM& vm() const { return m_vm; }
+    
+    void throwException(ExecState* exec, Exception* exception) { m_vm.throwException(exec, exception); }
+    JSValue throwException(ExecState* exec, JSValue value) { return m_vm.throwException(exec, value); }
+    JSObject* throwException(ExecState* exec, JSObject* obj) { return m_vm.throwException(exec, obj); }
+    
+    Exception* exception() { return m_vm.exception(); }
+    void release() { }
+    
+private:
+    VM& m_vm;
+};
+
+#define DECLARE_THROW_SCOPE(vm__) \
+    JSC::ThrowScope((vm__))
+
+#endif // ENABLE(THROW_SCOPE_VERIFICATION)
+
+ALWAYS_INLINE void throwException(ExecState* exec, ThrowScope& scope, Exception* exception)
+{
+    scope.throwException(exec, exception);
+}
+
+ALWAYS_INLINE JSValue throwException(ExecState* exec, ThrowScope& scope, JSValue value)
+{
+    return scope.throwException(exec, value);
+}
+
+ALWAYS_INLINE JSObject* throwException(ExecState* exec, ThrowScope& scope, JSObject* obj)
+{
+    return scope.throwException(exec, obj);
+}
+
+} // namespace JSC
+
+#endif // ThrowScope_h
diff --git a/Source/JavaScriptCore/runtime/ThrowScopeLocation.h b/Source/JavaScriptCore/runtime/ThrowScopeLocation.h
new file mode 100644
index 0000000..5c52401
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/ThrowScopeLocation.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+struct ThrowScopeLocation {
+    ThrowScopeLocation() { }
+    ThrowScopeLocation(const char* functionName, const char* file, unsigned line)
+        : functionName(functionName)
+        , file(file)
+        , line(line)
+    { }
+    
+    const char* functionName { nullptr };
+    const char* file { nullptr };
+    unsigned line { 0 };
+};
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
index 9150b51..d6f4e80 100644
--- a/Source/JavaScriptCore/runtime/VM.h
+++ b/Source/JavaScriptCore/runtime/VM.h
@@ -48,6 +48,7 @@
 #include "SmallStrings.h"
 #include "SourceCode.h"
 #include "Strong.h"
+#include "ThrowScopeLocation.h"
 #include "ThunkGenerators.h"
 #include "TypedArrayController.h"
 #include "VMEntryRecord.h"
@@ -108,6 +109,7 @@
 class RegExp;
 #endif
 class Symbol;
+class ThrowScope;
 class UnlinkedCodeBlock;
 class UnlinkedEvalCodeBlock;
 class UnlinkedFunctionExecutable;
@@ -449,10 +451,6 @@
     Exception* lastException() const { return m_lastException; }
     JSCell** addressOfLastException() { return reinterpret_cast<JSCell**>(&m_lastException); }
 
-    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
-    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
-    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
-
     void setFailNextNewCodeBlock() { m_failNextNewCodeBlock = true; }
     bool getAndClearFailNextNewCodeBlock()
     {
@@ -644,6 +642,10 @@
         m_lastException = exception;
     }
 
+    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
+    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
+
 #if ENABLE(ASSEMBLER)
     bool m_canUseAssembler;
 #endif
@@ -668,6 +670,13 @@
 
     Exception* m_exception { nullptr };
     Exception* m_lastException { nullptr };
+#if ENABLE(THROW_SCOPE_VERIFICATION)
+    ThrowScope* m_topThrowScope { nullptr };
+    ThrowScopeLocation m_simulatedThrowPointLocation;
+    unsigned m_simulatedThrowPointDepth { 0 };
+    mutable bool m_needExceptionCheck { false };
+#endif
+
     bool m_failNextNewCodeBlock { false };
     DeletePropertyMode m_deletePropertyMode { DeletePropertyMode::Default };
     bool m_globalConstRedeclarationShouldThrow { true };
@@ -690,6 +699,8 @@
 #endif
     std::unique_ptr<ShadowChicken> m_shadowChicken;
     std::unique_ptr<BytecodeIntrinsicRegistry> m_bytecodeIntrinsicRegistry;
+
+    friend class ThrowScope;
 };
 
 #if ENABLE(GC_VALIDATION)
diff --git a/Source/JavaScriptCore/runtime/VMEntryScope.h b/Source/JavaScriptCore/runtime/VMEntryScope.h
index 95c60ac..2942c36 100644
--- a/Source/JavaScriptCore/runtime/VMEntryScope.h
+++ b/Source/JavaScriptCore/runtime/VMEntryScope.h
@@ -41,6 +41,7 @@
     JS_EXPORT_PRIVATE VMEntryScope(VM&, JSGlobalObject*);
     JS_EXPORT_PRIVATE ~VMEntryScope();
 
+    VM& vm() const { return m_vm; }
     JSGlobalObject* globalObject() const { return m_globalObject; }
 
     void addDidPopListener(std::function<void ()>);
diff --git a/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp b/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp
index e9b7ab1..e123238 100644
--- a/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp
@@ -48,11 +48,16 @@
 
 static EncodedJSValue JSC_HOST_CALL callWeakMap(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "WeakMap"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "WeakMap"));
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWeakMap(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     Structure* weakMapStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->weakMapStructure());
     if (exec->hadException())
@@ -69,11 +74,11 @@
     CallData adderFunctionCallData;
     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
     if (adderFunctionCallType == CallType::None)
-        return JSValue::encode(throwTypeError(exec));
+        return JSValue::encode(throwTypeError(exec, scope));
 
     forEachInIterable(exec, iterable, [&](VM& vm, ExecState* exec, JSValue nextItem) {
         if (!nextItem.isObject()) {
-            throwTypeError(exec);
+            throwTypeError(exec, scope);
             return;
         }
 
diff --git a/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp b/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp
index 210b917..bd40d9a 100644
--- a/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,15 +56,18 @@
 
 static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!value.isObject()) {
-        throwTypeError(callFrame, WTF::ASCIILiteral("Called WeakMap function on non-object"));
+        throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakMap function on non-object"));
         return nullptr;
     }
 
     if (JSWeakMap* weakMap = jsDynamicCast<JSWeakMap*>(value))
         return weakMap->weakMapData();
 
-    throwTypeError(callFrame, WTF::ASCIILiteral("Called WeakMap function on a non-WeakMap object"));
+    throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakMap function on a non-WeakMap object"));
     return nullptr;
 }
 
@@ -99,13 +102,16 @@
 
 EncodedJSValue JSC_HOST_CALL protoFuncWeakMapSet(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
     if (!map)
         return JSValue::encode(jsUndefined());
     JSValue key = callFrame->argument(0);
     if (!key.isObject())
-        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral("Attempted to set a non-object key in a WeakMap")));
-    map->set(callFrame->vm(), asObject(key), callFrame->argument(1));
+        return JSValue::encode(throwTypeError(callFrame, scope, WTF::ASCIILiteral("Attempted to set a non-object key in a WeakMap")));
+    map->set(vm, asObject(key), callFrame->argument(1));
     return JSValue::encode(callFrame->thisValue());
 }
 
diff --git a/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp b/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp
index eba4424..b67ceeb 100644
--- a/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp
+++ b/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp
@@ -48,11 +48,16 @@
 
 static EncodedJSValue JSC_HOST_CALL callWeakSet(ExecState* exec)
 {
-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, "WeakSet"));
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "WeakSet"));
 }
 
 static EncodedJSValue JSC_HOST_CALL constructWeakSet(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     Structure* weakSetStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->weakSetStructure());
     if (exec->hadException())
@@ -69,7 +74,7 @@
     CallData adderFunctionCallData;
     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
     if (adderFunctionCallType == CallType::None)
-        return JSValue::encode(throwTypeError(exec));
+        return JSValue::encode(throwTypeError(exec, scope));
 
     forEachInIterable(exec, iterable, [&](VM&, ExecState* exec, JSValue nextValue) {
         MarkedArgumentBuffer arguments;
diff --git a/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp b/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp
index 8ca5bb6..b739057 100644
--- a/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple, Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,15 +54,18 @@
 
 static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (!value.isObject()) {
-        throwTypeError(callFrame, WTF::ASCIILiteral("Called WeakSet function on non-object"));
+        throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakSet function on non-object"));
         return nullptr;
     }
 
     if (JSWeakSet* weakSet = jsDynamicCast<JSWeakSet*>(value))
         return weakSet->weakMapData();
 
-    throwTypeError(callFrame, WTF::ASCIILiteral("Called WeakSet function on a non-WeakSet object"));
+    throwTypeError(callFrame, scope, WTF::ASCIILiteral("Called WeakSet function on a non-WeakSet object"));
     return nullptr;
 }
 
@@ -86,13 +89,16 @@
 
 EncodedJSValue JSC_HOST_CALL protoFuncWeakSetAdd(CallFrame* callFrame)
 {
+    VM& vm = callFrame->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
     if (!map)
         return JSValue::encode(jsUndefined());
     JSValue key = callFrame->argument(0);
     if (!key.isObject())
-        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral("Attempted to add a non-object key to a WeakSet")));
-    map->set(callFrame->vm(), asObject(key), jsUndefined());
+        return JSValue::encode(throwTypeError(callFrame, scope, WTF::ASCIILiteral("Attempted to add a non-object key to a WeakSet")));
+    map->set(vm, asObject(key), jsUndefined());
     return JSValue::encode(callFrame->thisValue());
 }