diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index ae5b5c72..b65e340 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,87 @@
+2019-12-02  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Put some destructible objects to IsoSubspace
+        https://bugs.webkit.org/show_bug.cgi?id=204771
+
+        Reviewed by Mark Lam.
+
+        This patch puts DateInstance, ErrorInstance, and Intl objects in IsoSubspace.
+        By using specific IsoHeapCellType, we can use JSNonFinalObject as base-classes of
+        them instead of using JSDestructibleObject. We also introduce STATIC_ASSERT_ISO_SUBSPACE_SHARABLE
+        to ensure that derived class of some IsoSubspace'ed one is intentional and safe.
+
+        * runtime/ArrayConstructor.h:
+        * runtime/AsyncFunctionConstructor.h:
+        * runtime/AsyncGeneratorFunctionConstructor.h:
+        * runtime/BigIntConstructor.h:
+        * runtime/BooleanConstructor.h:
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::destroy): Deleted.
+        * runtime/DateInstance.h:
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::destroy): Deleted.
+        * runtime/ErrorInstance.h:
+        (JSC::ErrorInstance::destroy):
+        (JSC::ErrorInstance::subspaceFor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.h:
+        * runtime/GeneratorFunctionConstructor.h:
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::IntlCollator):
+        (JSC::IntlCollator::destroy): Deleted.
+        * runtime/IntlCollator.h:
+        * runtime/IntlCollatorConstructor.h:
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::IntlDateTimeFormat):
+        (JSC::IntlDateTimeFormat::destroy): Deleted.
+        * runtime/IntlDateTimeFormat.h:
+        * runtime/IntlDateTimeFormatConstructor.h:
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::IntlNumberFormat):
+        (JSC::IntlNumberFormat::destroy): Deleted.
+        * runtime/IntlNumberFormat.h:
+        * runtime/IntlNumberFormatConstructor.h:
+        * runtime/IntlPluralRules.cpp:
+        (JSC::IntlPluralRules::IntlPluralRules):
+        (JSC::IntlPluralRules::destroy): Deleted.
+        * runtime/IntlPluralRules.h:
+        * runtime/IntlPluralRulesConstructor.h:
+        * runtime/JSArrayBufferConstructor.h:
+        * runtime/JSCell.h:
+        * runtime/JSObject.h:
+        * runtime/JSTypedArrayConstructors.h:
+        * runtime/JSTypedArrayViewConstructor.h:
+        * runtime/MapConstructor.h:
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NullGetterFunction.h:
+        * runtime/NullSetterFunction.h:
+        * runtime/NumberConstructor.h:
+        * runtime/ObjectConstructor.h:
+        * runtime/ProxyConstructor.h:
+        * runtime/RegExpConstructor.h:
+        * runtime/SetConstructor.h:
+        * runtime/StringConstructor.h:
+        * runtime/SymbolConstructor.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        * runtime/WeakMapConstructor.h:
+        * runtime/WeakObjectRefConstructor.h:
+        * runtime/WeakSetConstructor.h:
+        * tools/JSDollarVM.cpp:
+        * wasm/js/JSWebAssemblyCompileError.h:
+        * wasm/js/JSWebAssemblyLinkError.h:
+        * wasm/js/JSWebAssemblyRuntimeError.h:
+        * wasm/js/WebAssemblyCompileErrorConstructor.h:
+        * wasm/js/WebAssemblyInstanceConstructor.h:
+        * wasm/js/WebAssemblyLinkErrorConstructor.h:
+        * wasm/js/WebAssemblyMemoryConstructor.h:
+        * wasm/js/WebAssemblyModuleConstructor.h:
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.h:
+        * wasm/js/WebAssemblyTableConstructor.h:
+
 2019-12-02  Mark Lam  <mark.lam@apple.com>
 
         Only check each use...FuzzerAgent() option in VM constructor if any of the options are enabled.
diff --git a/Source/JavaScriptCore/runtime/ArrayConstructor.h b/Source/JavaScriptCore/runtime/ArrayConstructor.h
index 7a08533..119fea0 100644
--- a/Source/JavaScriptCore/runtime/ArrayConstructor.h
+++ b/Source/JavaScriptCore/runtime/ArrayConstructor.h
@@ -55,6 +55,7 @@
 private:
     ArrayConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ArrayConstructor, InternalFunction);
 
 JSArray* constructArrayWithSizeQuirk(JSGlobalObject*, ArrayAllocationProfile*, JSValue length, JSValue prototype = JSValue());
 
diff --git a/Source/JavaScriptCore/runtime/AsyncFunctionConstructor.h b/Source/JavaScriptCore/runtime/AsyncFunctionConstructor.h
index f1cfa60..6ca9e90 100644
--- a/Source/JavaScriptCore/runtime/AsyncFunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/AsyncFunctionConstructor.h
@@ -53,5 +53,6 @@
     AsyncFunctionConstructor(VM&, Structure*);
     void finishCreation(VM&, AsyncFunctionPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncFunctionConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionConstructor.h b/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionConstructor.h
index e59f5bd..37f2b25 100644
--- a/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionConstructor.h
@@ -53,5 +53,6 @@
     AsyncGeneratorFunctionConstructor(VM&, Structure*);
     void finishCreation(VM&, AsyncGeneratorFunctionPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncGeneratorFunctionConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/BigIntConstructor.h b/Source/JavaScriptCore/runtime/BigIntConstructor.h
index 172429f..18c4606 100644
--- a/Source/JavaScriptCore/runtime/BigIntConstructor.h
+++ b/Source/JavaScriptCore/runtime/BigIntConstructor.h
@@ -58,5 +58,6 @@
 private:
     BigIntConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(BigIntConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/BooleanConstructor.h b/Source/JavaScriptCore/runtime/BooleanConstructor.h
index 461e714..efafca8 100644
--- a/Source/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/Source/JavaScriptCore/runtime/BooleanConstructor.h
@@ -51,6 +51,7 @@
 private:
     BooleanConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(BooleanConstructor, InternalFunction);
 
 JSObject* constructBooleanFromImmediateBoolean(JSGlobalObject*, JSValue);
 
diff --git a/Source/JavaScriptCore/runtime/DateConstructor.h b/Source/JavaScriptCore/runtime/DateConstructor.h
index 92fd136..92b8ed3 100644
--- a/Source/JavaScriptCore/runtime/DateConstructor.h
+++ b/Source/JavaScriptCore/runtime/DateConstructor.h
@@ -52,6 +52,7 @@
 private:
     DateConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(DateConstructor, InternalFunction);
 
 JSObject* constructDate(JSGlobalObject*, JSValue newTarget, const ArgList&);
 JSValue dateNowImpl();
diff --git a/Source/JavaScriptCore/runtime/DateInstance.cpp b/Source/JavaScriptCore/runtime/DateInstance.cpp
index c8079d5..915854b 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.cpp
+++ b/Source/JavaScriptCore/runtime/DateInstance.cpp
@@ -50,11 +50,6 @@
     m_internalNumber = timeClip(time);
 }
 
-void DateInstance::destroy(JSCell* cell)
-{
-    static_cast<DateInstance*>(cell)->DateInstance::~DateInstance();
-}
-
 const GregorianDateTime* DateInstance::calculateGregorianDateTime(VM& vm) const
 {
     double milli = internalNumber();
diff --git a/Source/JavaScriptCore/runtime/DateInstance.h b/Source/JavaScriptCore/runtime/DateInstance.h
index 9e77839..d53eb3e 100644
--- a/Source/JavaScriptCore/runtime/DateInstance.h
+++ b/Source/JavaScriptCore/runtime/DateInstance.h
@@ -20,20 +20,25 @@
 
 #pragma once
 
-#include "JSDestructibleObject.h"
+#include "JSObject.h"
 
 namespace JSC {
 
-class DateInstance final : public JSDestructibleObject {
-protected:
-    JS_EXPORT_PRIVATE DateInstance(VM&, Structure*);
-    void finishCreation(VM&);
-    JS_EXPORT_PRIVATE void finishCreation(VM&, double);
-
-    JS_EXPORT_PRIVATE static void destroy(JSCell*);
-
+class DateInstance final : public JSNonFinalObject {
 public:
-    using Base = JSDestructibleObject;
+    using Base = JSNonFinalObject;
+
+    static constexpr bool needsDestruction = true;
+    static void destroy(JSCell* cell)
+    {
+        static_cast<DateInstance*>(cell)->DateInstance::~DateInstance();
+    }
+
+    template<typename CellType, SubspaceAccess mode>
+    static IsoSubspace* subspaceFor(VM& vm)
+    {
+        return &vm.dateInstanceSpace;
+    }
 
     static DateInstance* create(VM& vm, Structure* structure, double date)
     {
@@ -77,6 +82,9 @@
     static ptrdiff_t offsetOfData() { return OBJECT_OFFSETOF(DateInstance, m_data); }
 
 private:
+    JS_EXPORT_PRIVATE DateInstance(VM&, Structure*);
+    void finishCreation(VM&);
+    JS_EXPORT_PRIVATE void finishCreation(VM&, double);
     JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTime(VM&) const;
     JS_EXPORT_PRIVATE const GregorianDateTime* calculateGregorianDateTimeUTC(VM&) const;
 
diff --git a/Source/JavaScriptCore/runtime/ErrorConstructor.h b/Source/JavaScriptCore/runtime/ErrorConstructor.h
index 873518b..93d5271 100644
--- a/Source/JavaScriptCore/runtime/ErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/ErrorConstructor.h
@@ -55,6 +55,7 @@
     ErrorConstructor(VM&, Structure*);
 
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ErrorConstructor, InternalFunction);
 
 static_assert(sizeof(ErrorConstructor) == sizeof(InternalFunction), "");
 
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.cpp b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
index 0c2def3..fd48bbf 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.cpp
@@ -132,11 +132,6 @@
     }
 }
 
-void ErrorInstance::destroy(JSCell* cell)
-{
-    static_cast<ErrorInstance*>(cell)->ErrorInstance::~ErrorInstance();
-}
-
 // Based on ErrorPrototype's errorProtoFuncToString(), but is modified to
 // have no observable side effects to the user (i.e. does not call proxies,
 // and getters).
diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
index 84e3d48..f1fac59 100644
--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
@@ -20,16 +20,28 @@
 
 #pragma once
 
-#include "JSDestructibleObject.h"
+#include "JSObject.h"
 #include "RuntimeType.h"
 #include "StackFrame.h"
 
 namespace JSC {
 
-class ErrorInstance : public JSDestructibleObject {
+class ErrorInstance : public JSNonFinalObject {
 public:
-    typedef JSDestructibleObject Base;
+    using Base = JSNonFinalObject;
     static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
+    static constexpr bool needsDestruction = true;
+
+    static void destroy(JSCell* cell)
+    {
+        static_cast<ErrorInstance*>(cell)->ErrorInstance::~ErrorInstance();
+    }
+
+    template<typename CellType, SubspaceAccess mode>
+    static IsoSubspace* subspaceFor(VM& vm)
+    {
+        return vm.errorInstanceSpace<mode>();
+    }
 
     enum SourceTextWhereErrorOccurred { FoundExactSource, FoundApproximateSource };
     typedef String (*SourceAppender) (const String& originalMessage, const String& sourceText, RuntimeType, SourceTextWhereErrorOccurred);
@@ -75,19 +87,12 @@
     bool materializeErrorInfoIfNeeded(VM&);
     bool materializeErrorInfoIfNeeded(VM&, PropertyName);
 
-    template<typename CellType, SubspaceAccess mode>
-    static IsoSubspace* subspaceFor(VM& vm)
-    {
-        return vm.errorInstanceSpace<mode>();
-    }
-
     void finalizeUnconditionally(VM&);
 
 protected:
     explicit ErrorInstance(VM&, Structure*);
 
     void finishCreation(JSGlobalObject*, VM&, const String&, bool useCurrentFrame = true);
-    static void destroy(JSCell*);
 
     static bool getOwnPropertySlot(JSObject*, JSGlobalObject*, PropertyName, PropertySlot&);
     static void getOwnNonIndexPropertyNames(JSObject*, JSGlobalObject*, PropertyNameArray&, EnumerationMode);
diff --git a/Source/JavaScriptCore/runtime/FunctionConstructor.h b/Source/JavaScriptCore/runtime/FunctionConstructor.h
index f64559a..dc98031 100644
--- a/Source/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/FunctionConstructor.h
@@ -52,6 +52,7 @@
     FunctionConstructor(VM&, Structure*);
     void finishCreation(VM&, FunctionPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(FunctionConstructor, InternalFunction);
 
 enum class FunctionConstructionMode {
     Function,
diff --git a/Source/JavaScriptCore/runtime/FunctionPrototype.h b/Source/JavaScriptCore/runtime/FunctionPrototype.h
index 9c6d378..96b034a 100644
--- a/Source/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/Source/JavaScriptCore/runtime/FunctionPrototype.h
@@ -52,5 +52,6 @@
 private:
     FunctionPrototype(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(FunctionPrototype, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/GeneratorFunctionConstructor.h b/Source/JavaScriptCore/runtime/GeneratorFunctionConstructor.h
index 6a08d0e..f5f4f22 100644
--- a/Source/JavaScriptCore/runtime/GeneratorFunctionConstructor.h
+++ b/Source/JavaScriptCore/runtime/GeneratorFunctionConstructor.h
@@ -59,5 +59,6 @@
     GeneratorFunctionConstructor(VM&, Structure*);
     void finishCreation(VM&, GeneratorFunctionPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(GeneratorFunctionConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/IntlCollator.cpp b/Source/JavaScriptCore/runtime/IntlCollator.cpp
index 1b19786..23a4986 100644
--- a/Source/JavaScriptCore/runtime/IntlCollator.cpp
+++ b/Source/JavaScriptCore/runtime/IntlCollator.cpp
@@ -70,7 +70,7 @@
 }
 
 IntlCollator::IntlCollator(VM& vm, Structure* structure)
-    : JSDestructibleObject(vm, structure)
+    : Base(vm, structure)
 {
 }
 
@@ -80,11 +80,6 @@
     ASSERT(inherits(vm, info()));
 }
 
-void IntlCollator::destroy(JSCell* cell)
-{
-    static_cast<IntlCollator*>(cell)->IntlCollator::~IntlCollator();
-}
-
 void IntlCollator::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     IntlCollator* thisObject = jsCast<IntlCollator*>(cell);
diff --git a/Source/JavaScriptCore/runtime/IntlCollator.h b/Source/JavaScriptCore/runtime/IntlCollator.h
index 2cd0fe0..bc05211 100644
--- a/Source/JavaScriptCore/runtime/IntlCollator.h
+++ b/Source/JavaScriptCore/runtime/IntlCollator.h
@@ -27,7 +27,7 @@
 
 #if ENABLE(INTL)
 
-#include "JSDestructibleObject.h"
+#include "JSObject.h"
 
 struct UCollator;
 
@@ -36,9 +36,22 @@
 class IntlCollatorConstructor;
 class JSBoundFunction;
 
-class IntlCollator final : public JSDestructibleObject {
+class IntlCollator final : public JSNonFinalObject {
 public:
-    typedef JSDestructibleObject Base;
+    using Base = JSNonFinalObject;
+
+    static constexpr bool needsDestruction = true;
+
+    static void destroy(JSCell* cell)
+    {
+        static_cast<IntlCollator*>(cell)->IntlCollator::~IntlCollator();
+    }
+
+    template<typename CellType, SubspaceAccess mode>
+    static IsoSubspace* subspaceFor(VM& vm)
+    {
+        return vm.intlCollatorSpace<mode>();
+    }
 
     static IntlCollator* create(VM&, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -55,7 +68,6 @@
 protected:
     IntlCollator(VM&, Structure*);
     void finishCreation(VM&);
-    static void destroy(JSCell*);
     static void visitChildren(JSCell*, SlotVisitor&);
 
 private:
diff --git a/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h b/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h
index 3ed9beb..82e6cd0 100644
--- a/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h
+++ b/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h
@@ -54,6 +54,7 @@
 private:
     IntlCollatorConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlCollatorConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
index fad9578..fdf2f68 100644
--- a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
+++ b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
@@ -86,7 +86,7 @@
 }
 
 IntlDateTimeFormat::IntlDateTimeFormat(VM& vm, Structure* structure)
-    : JSDestructibleObject(vm, structure)
+    : Base(vm, structure)
 {
 }
 
@@ -96,11 +96,6 @@
     ASSERT(inherits(vm, info()));
 }
 
-void IntlDateTimeFormat::destroy(JSCell* cell)
-{
-    static_cast<IntlDateTimeFormat*>(cell)->IntlDateTimeFormat::~IntlDateTimeFormat();
-}
-
 void IntlDateTimeFormat::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     IntlDateTimeFormat* thisObject = jsCast<IntlDateTimeFormat*>(cell);
diff --git a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.h b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.h
index 0cc915d..c9668a1 100644
--- a/Source/JavaScriptCore/runtime/IntlDateTimeFormat.h
+++ b/Source/JavaScriptCore/runtime/IntlDateTimeFormat.h
@@ -27,7 +27,7 @@
 
 #if ENABLE(INTL)
 
-#include "JSDestructibleObject.h"
+#include "JSObject.h"
 #include <unicode/udat.h>
 #include <unicode/uvernum.h>
 
@@ -38,9 +38,22 @@
 class IntlDateTimeFormatConstructor;
 class JSBoundFunction;
 
-class IntlDateTimeFormat final : public JSDestructibleObject {
+class IntlDateTimeFormat final : public JSNonFinalObject {
 public:
-    typedef JSDestructibleObject Base;
+    using Base = JSNonFinalObject;
+
+    static constexpr bool needsDestruction = true;
+
+    static void destroy(JSCell* cell)
+    {
+        static_cast<IntlDateTimeFormat*>(cell)->IntlDateTimeFormat::~IntlDateTimeFormat();
+    }
+
+    template<typename CellType, SubspaceAccess mode>
+    static IsoSubspace* subspaceFor(VM& vm)
+    {
+        return vm.intlDateTimeFormatSpace<mode>();
+    }
 
     static IntlDateTimeFormat* create(VM&, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -60,7 +73,6 @@
 protected:
     IntlDateTimeFormat(VM&, Structure*);
     void finishCreation(VM&);
-    static void destroy(JSCell*);
     static void visitChildren(JSCell*, SlotVisitor&);
 
 private:
diff --git a/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h b/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h
index 07e0780..044da4e 100644
--- a/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h
+++ b/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h
@@ -54,6 +54,7 @@
 private:
     IntlDateTimeFormatConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlDateTimeFormatConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp b/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp
index db739ab..67112c6 100644
--- a/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp
+++ b/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp
@@ -67,7 +67,7 @@
 }
 
 IntlNumberFormat::IntlNumberFormat(VM& vm, Structure* structure)
-    : JSDestructibleObject(vm, structure)
+    : Base(vm, structure)
 {
 }
 
@@ -77,11 +77,6 @@
     ASSERT(inherits(vm, info()));
 }
 
-void IntlNumberFormat::destroy(JSCell* cell)
-{
-    static_cast<IntlNumberFormat*>(cell)->IntlNumberFormat::~IntlNumberFormat();
-}
-
 void IntlNumberFormat::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     IntlNumberFormat* thisObject = jsCast<IntlNumberFormat*>(cell);
diff --git a/Source/JavaScriptCore/runtime/IntlNumberFormat.h b/Source/JavaScriptCore/runtime/IntlNumberFormat.h
index e5450b4..d89b1c5 100644
--- a/Source/JavaScriptCore/runtime/IntlNumberFormat.h
+++ b/Source/JavaScriptCore/runtime/IntlNumberFormat.h
@@ -27,7 +27,7 @@
 
 #if ENABLE(INTL)
 
-#include "JSDestructibleObject.h"
+#include "JSObject.h"
 #include <unicode/unum.h>
 #include <unicode/uvernum.h>
 
@@ -38,9 +38,22 @@
 class IntlNumberFormatConstructor;
 class JSBoundFunction;
 
-class IntlNumberFormat final : public JSDestructibleObject {
+class IntlNumberFormat final : public JSNonFinalObject {
 public:
-    typedef JSDestructibleObject Base;
+    using Base = JSNonFinalObject;
+
+    static constexpr bool needsDestruction = true;
+
+    static void destroy(JSCell* cell)
+    {
+        static_cast<IntlNumberFormat*>(cell)->IntlNumberFormat::~IntlNumberFormat();
+    }
+
+    template<typename CellType, SubspaceAccess mode>
+    static IsoSubspace* subspaceFor(VM& vm)
+    {
+        return vm.intlNumberFormatSpace<mode>();
+    }
 
     static IntlNumberFormat* create(VM&, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -60,7 +73,6 @@
 protected:
     IntlNumberFormat(VM&, Structure*);
     void finishCreation(VM&);
-    static void destroy(JSCell*);
     static void visitChildren(JSCell*, SlotVisitor&);
 
 private:
diff --git a/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h b/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h
index 03abeba..8f9a88f 100644
--- a/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h
+++ b/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h
@@ -54,6 +54,7 @@
 private:
     IntlNumberFormatConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlNumberFormatConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/IntlPluralRules.cpp b/Source/JavaScriptCore/runtime/IntlPluralRules.cpp
index a41d80c..a6e1533 100644
--- a/Source/JavaScriptCore/runtime/IntlPluralRules.cpp
+++ b/Source/JavaScriptCore/runtime/IntlPluralRules.cpp
@@ -72,7 +72,7 @@
 }
 
 IntlPluralRules::IntlPluralRules(VM& vm, Structure* structure)
-    : JSDestructibleObject(vm, structure)
+    : Base(vm, structure)
 {
 }
 
@@ -82,11 +82,6 @@
     ASSERT(inherits(vm, info()));
 }
 
-void IntlPluralRules::destroy(JSCell* cell)
-{
-    static_cast<IntlPluralRules*>(cell)->IntlPluralRules::~IntlPluralRules();
-}
-
 void IntlPluralRules::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
     IntlPluralRules* thisObject = jsCast<IntlPluralRules*>(cell);
diff --git a/Source/JavaScriptCore/runtime/IntlPluralRules.h b/Source/JavaScriptCore/runtime/IntlPluralRules.h
index c40ee61..706b986 100644
--- a/Source/JavaScriptCore/runtime/IntlPluralRules.h
+++ b/Source/JavaScriptCore/runtime/IntlPluralRules.h
@@ -27,7 +27,7 @@
 
 #if ENABLE(INTL)
 
-#include "JSDestructibleObject.h"
+#include "JSObject.h"
 #include <unicode/unum.h>
 #include <unicode/upluralrules.h>
 #include <unicode/uvernum.h>
@@ -40,9 +40,22 @@
 class IntlPluralRulesConstructor;
 class JSBoundFunction;
 
-class IntlPluralRules final : public JSDestructibleObject {
+class IntlPluralRules final : public JSNonFinalObject {
 public:
-    typedef JSDestructibleObject Base;
+    using Base = JSNonFinalObject;
+
+    static constexpr bool needsDestruction = true;
+
+    static void destroy(JSCell* cell)
+    {
+        static_cast<IntlPluralRules*>(cell)->IntlPluralRules::~IntlPluralRules();
+    }
+
+    template<typename CellType, SubspaceAccess mode>
+    static IsoSubspace* subspaceFor(VM& vm)
+    {
+        return vm.intlPluralRulesSpace<mode>();
+    }
 
     static IntlPluralRules* create(VM&, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -56,7 +69,6 @@
 protected:
     IntlPluralRules(VM&, Structure*);
     void finishCreation(VM&);
-    static void destroy(JSCell*);
     static void visitChildren(JSCell*, SlotVisitor&);
 
 private:
diff --git a/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.h b/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.h
index d83ea1c..c8cdb2e 100644
--- a/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.h
+++ b/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.h
@@ -54,6 +54,7 @@
 private:
     IntlPluralRulesConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlPluralRulesConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.h b/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.h
index 8aaca5d..43139f6 100644
--- a/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.h
+++ b/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.h
@@ -61,7 +61,7 @@
 
 using JSArrayBufferConstructor = JSGenericArrayBufferConstructor<ArrayBufferSharingMode::Default>;
 using JSSharedArrayBufferConstructor = JSGenericArrayBufferConstructor<ArrayBufferSharingMode::Shared>;
-static_assert(sizeof(JSArrayBufferConstructor::Base) == sizeof(JSArrayBufferConstructor), "");
-static_assert(sizeof(JSSharedArrayBufferConstructor::Base) == sizeof(JSSharedArrayBufferConstructor), "");
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSArrayBufferConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSSharedArrayBufferConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
index 2084237..047de07 100644
--- a/Source/JavaScriptCore/runtime/JSCell.h
+++ b/Source/JavaScriptCore/runtime/JSCell.h
@@ -98,9 +98,10 @@
     enum CreatingEarlyCellTag { CreatingEarlyCell };
     JSCell(CreatingEarlyCellTag);
     
+    JS_EXPORT_PRIVATE static void destroy(JSCell*);
+
 protected:
     JSCell(VM&, Structure*);
-    JS_EXPORT_PRIVATE static void destroy(JSCell*);
 
 public:
     // Querying the type.
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index 7e7dec2..143ea25 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -1628,4 +1628,9 @@
 #define JSC_NATIVE_GETTER_WITHOUT_TRANSITION(jsName, cppName, attributes) \
     JSC_NATIVE_INTRINSIC_GETTER_WITHOUT_TRANSITION((jsName), (cppName), (attributes), NoIntrinsic)
 
+
+#define STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(DerivedClass, BaseClass) \
+    static_assert(sizeof(DerivedClass) == sizeof(BaseClass)); \
+    static_assert(DerivedClass::destroy == BaseClass::destroy);
+
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSTypedArrayConstructors.h b/Source/JavaScriptCore/runtime/JSTypedArrayConstructors.h
index 91eaae6..01920a4 100644
--- a/Source/JavaScriptCore/runtime/JSTypedArrayConstructors.h
+++ b/Source/JavaScriptCore/runtime/JSTypedArrayConstructors.h
@@ -31,15 +31,25 @@
 
 namespace JSC {
 
-typedef JSGenericTypedArrayViewConstructor<JSInt8Array> JSInt8ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSInt16Array> JSInt16ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSInt32Array> JSInt32ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSUint8Array> JSUint8ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSUint8ClampedArray> JSUint8ClampedArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSUint16Array> JSUint16ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSUint32Array> JSUint32ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSFloat32Array> JSFloat32ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSFloat64Array> JSFloat64ArrayConstructor;
-typedef JSGenericTypedArrayViewConstructor<JSDataView> JSDataViewConstructor;
+using JSInt8ArrayConstructor = JSGenericTypedArrayViewConstructor<JSInt8Array>;
+using JSInt16ArrayConstructor = JSGenericTypedArrayViewConstructor<JSInt16Array>;
+using JSInt32ArrayConstructor = JSGenericTypedArrayViewConstructor<JSInt32Array>;
+using JSUint8ArrayConstructor = JSGenericTypedArrayViewConstructor<JSUint8Array>;
+using JSUint8ClampedArrayConstructor = JSGenericTypedArrayViewConstructor<JSUint8ClampedArray>;
+using JSUint16ArrayConstructor = JSGenericTypedArrayViewConstructor<JSUint16Array>;
+using JSUint32ArrayConstructor = JSGenericTypedArrayViewConstructor<JSUint32Array>;
+using JSFloat32ArrayConstructor = JSGenericTypedArrayViewConstructor<JSFloat32Array>;
+using JSFloat64ArrayConstructor = JSGenericTypedArrayViewConstructor<JSFloat64Array>;
+using JSDataViewConstructor = JSGenericTypedArrayViewConstructor<JSDataView>;
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSInt8ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSInt16ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSInt32ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSUint8ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSUint8ClampedArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSUint16ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSUint32ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSFloat32ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSFloat64ArrayConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSDataViewConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h b/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h
index 0fafe8a..34a806a 100644
--- a/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h
+++ b/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.h
@@ -52,5 +52,6 @@
 
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTypedArrayViewConstructor, InternalFunction);
     
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/MapConstructor.h b/Source/JavaScriptCore/runtime/MapConstructor.h
index 1bbab76..db9d47d 100644
--- a/Source/JavaScriptCore/runtime/MapConstructor.h
+++ b/Source/JavaScriptCore/runtime/MapConstructor.h
@@ -55,6 +55,7 @@
 
     void finishCreation(VM&, MapPrototype*, GetterSetter* speciesSymbol);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(MapConstructor, InternalFunction);
 
 EncodedJSValue JSC_HOST_CALL mapPrivateFuncMapBucketHead(JSGlobalObject*, CallFrame*);
 EncodedJSValue JSC_HOST_CALL mapPrivateFuncMapBucketNext(JSGlobalObject*, CallFrame*);
diff --git a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
index 166ee71..bf33e69 100644
--- a/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
+++ b/Source/JavaScriptCore/runtime/NativeErrorConstructor.h
@@ -75,11 +75,11 @@
 using TypeErrorConstructor = NativeErrorConstructor<ErrorType::TypeError>;
 using URIErrorConstructor = NativeErrorConstructor<ErrorType::URIError>;
 
-static_assert(sizeof(EvalErrorConstructor) == sizeof(InternalFunction), "");
-static_assert(sizeof(RangeErrorConstructor) == sizeof(InternalFunction), "");
-static_assert(sizeof(ReferenceErrorConstructor) == sizeof(InternalFunction), "");
-static_assert(sizeof(SyntaxErrorConstructor) == sizeof(InternalFunction), "");
-static_assert(sizeof(TypeErrorConstructor) == sizeof(InternalFunction), "");
-static_assert(sizeof(URIErrorConstructor) == sizeof(InternalFunction), "");
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(EvalErrorConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(RangeErrorConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ReferenceErrorConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(SyntaxErrorConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TypeErrorConstructor, InternalFunction);
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(URIErrorConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NullGetterFunction.h b/Source/JavaScriptCore/runtime/NullGetterFunction.h
index 3565a97..17bc12b 100644
--- a/Source/JavaScriptCore/runtime/NullGetterFunction.h
+++ b/Source/JavaScriptCore/runtime/NullGetterFunction.h
@@ -51,5 +51,6 @@
 private:
     NullGetterFunction(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(NullGetterFunction, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NullSetterFunction.h b/Source/JavaScriptCore/runtime/NullSetterFunction.h
index d0f06c8..5e11151 100644
--- a/Source/JavaScriptCore/runtime/NullSetterFunction.h
+++ b/Source/JavaScriptCore/runtime/NullSetterFunction.h
@@ -51,5 +51,6 @@
 private:
     NullSetterFunction(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(NullSetterFunction, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/NumberConstructor.h b/Source/JavaScriptCore/runtime/NumberConstructor.h
index 58cf928..0657c1f 100644
--- a/Source/JavaScriptCore/runtime/NumberConstructor.h
+++ b/Source/JavaScriptCore/runtime/NumberConstructor.h
@@ -63,5 +63,6 @@
 private:
     NumberConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(NumberConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ObjectConstructor.h b/Source/JavaScriptCore/runtime/ObjectConstructor.h
index 75c6ee9..52eaf8a 100644
--- a/Source/JavaScriptCore/runtime/ObjectConstructor.h
+++ b/Source/JavaScriptCore/runtime/ObjectConstructor.h
@@ -59,6 +59,7 @@
 private:
     ObjectConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ObjectConstructor, InternalFunction);
 
 inline JSFinalObject* constructEmptyObject(VM& vm, Structure* structure)
 {
diff --git a/Source/JavaScriptCore/runtime/ProxyConstructor.h b/Source/JavaScriptCore/runtime/ProxyConstructor.h
index 97325f8..5c93a66 100644
--- a/Source/JavaScriptCore/runtime/ProxyConstructor.h
+++ b/Source/JavaScriptCore/runtime/ProxyConstructor.h
@@ -50,5 +50,6 @@
 
     static EncodedJSValue getGetter(JSGlobalObject*, EncodedJSValue thisValue, PropertyName);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ProxyConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/RegExpConstructor.h b/Source/JavaScriptCore/runtime/RegExpConstructor.h
index 0fe6101..c405ebe 100644
--- a/Source/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/Source/JavaScriptCore/runtime/RegExpConstructor.h
@@ -55,8 +55,7 @@
 private:
     RegExpConstructor(VM&, Structure*);
 };
-
-static_assert(sizeof(RegExpConstructor) == sizeof(InternalFunction), "");
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(RegExpConstructor, InternalFunction);
 
 JSObject* constructRegExp(JSGlobalObject*, const ArgList&, JSObject* callee = nullptr, JSValue newTarget = jsUndefined());
 
diff --git a/Source/JavaScriptCore/runtime/SetConstructor.h b/Source/JavaScriptCore/runtime/SetConstructor.h
index 71ab695..eb1c61b 100644
--- a/Source/JavaScriptCore/runtime/SetConstructor.h
+++ b/Source/JavaScriptCore/runtime/SetConstructor.h
@@ -54,6 +54,7 @@
     SetConstructor(VM&, Structure*);
     void finishCreation(VM&, SetPrototype*, GetterSetter* speciesSymbol);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(SetConstructor, InternalFunction);
 
 EncodedJSValue JSC_HOST_CALL setPrivateFuncSetBucketHead(JSGlobalObject*, CallFrame*);
 EncodedJSValue JSC_HOST_CALL setPrivateFuncSetBucketNext(JSGlobalObject*, CallFrame*);
diff --git a/Source/JavaScriptCore/runtime/StringConstructor.h b/Source/JavaScriptCore/runtime/StringConstructor.h
index 68ad2cb..5f9471e 100644
--- a/Source/JavaScriptCore/runtime/StringConstructor.h
+++ b/Source/JavaScriptCore/runtime/StringConstructor.h
@@ -50,6 +50,7 @@
     StringConstructor(VM&, Structure*);
     void finishCreation(VM&, StringPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(StringConstructor, InternalFunction);
 
 JSString* JSC_HOST_CALL stringFromCharCode(JSGlobalObject*, int32_t);
 JSString* stringConstructor(JSGlobalObject*, JSValue);
diff --git a/Source/JavaScriptCore/runtime/SymbolConstructor.h b/Source/JavaScriptCore/runtime/SymbolConstructor.h
index 48c6075..194a44e 100644
--- a/Source/JavaScriptCore/runtime/SymbolConstructor.h
+++ b/Source/JavaScriptCore/runtime/SymbolConstructor.h
@@ -58,5 +58,6 @@
 private:
     SymbolConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(SymbolConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
index e4a49bc..0836b60 100644
--- a/Source/JavaScriptCore/runtime/VM.cpp
+++ b/Source/JavaScriptCore/runtime/VM.cpp
@@ -39,6 +39,7 @@
 #include "CommonSlowPaths.h"
 #include "CustomGetterSetter.h"
 #include "DFGWorklist.h"
+#include "DateInstance.h"
 #include "DirectEvalExecutable.h"
 #include "Disassembler.h"
 #include "DoublePredictionFuzzerAgent.h"
@@ -178,6 +179,13 @@
 #include "JSCCallbackFunction.h"
 #endif
 
+#if ENABLE(INTL)
+#include "IntlCollator.h"
+#include "IntlDateTimeFormat.h"
+#include "IntlNumberFormat.h"
+#include "IntlPluralRules.h"
+#endif
+
 namespace JSC {
 
 #if ENABLE(JIT)
@@ -267,6 +275,8 @@
     , immutableButterflyHeapCellType(makeUnique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithInteriorPointers)))
     , cellHeapCellType(makeUnique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
     , destructibleCellHeapCellType(makeUnique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
+    , dateInstanceHeapCellType(makeUnique<IsoHeapCellType<DateInstance>>())
+    , errorInstanceHeapCellType(makeUnique<IsoHeapCellType<ErrorInstance>>())
     , stringHeapCellType(makeUnique<IsoHeapCellType<JSString>>())
     , weakMapHeapCellType(makeUnique<IsoHeapCellType<JSWeakMap>>())
     , weakSetHeapCellType(makeUnique<IsoHeapCellType<JSWeakSet>>())
@@ -277,6 +287,12 @@
 #ifdef JSC_GLIB_API_ENABLED
     , jscCallbackFunctionHeapCellType(makeUnique<IsoHeapCellType<JSCCallbackFunction>>())
 #endif
+#if ENABLE(INTL)
+    , intlCollatorHeapCellType(makeUnique<IsoHeapCellType<IntlCollator>>())
+    , intlDateTimeFormatHeapCellType(makeUnique<IsoHeapCellType<IntlDateTimeFormat>>())
+    , intlNumberFormatHeapCellType(makeUnique<IsoHeapCellType<IntlNumberFormat>>())
+    , intlPluralRulesHeapCellType(makeUnique<IsoHeapCellType<IntlPluralRules>>())
+#endif
 #if ENABLE(WEBASSEMBLY)
     , webAssemblyCodeBlockHeapCellType(makeUnique<IsoHeapCellType<JSWebAssemblyCodeBlock>>())
     , webAssemblyFunctionHeapCellType(makeUnique<IsoHeapCellType<WebAssemblyFunction>>())
@@ -289,6 +305,7 @@
     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xbfff3d73
     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x4f5ed7a9
     , bigIntSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), JSBigInt)
+    , dateInstanceSpace ISO_SUBSPACE_INIT(heap, dateInstanceHeapCellType.get(), DateInstance)
     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge) // Hash:0x7b730b20
     , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction) // Hash:0x800fca72
     , getterSetterSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), GetterSetter)
@@ -1317,7 +1334,7 @@
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction) // Hash:0xd7916d41
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, cellHeapCellType.get(), JSCallbackFunction) // Hash:0xe7648ebc
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction) // Hash:0x18091000
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance) // Hash:0x3f40d4a
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, errorInstanceHeapCellType.get(), ErrorInstance) // Hash:0x3f40d4a
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(functionRareDataSpace, destructibleCellHeapCellType.get(), FunctionRareData)
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(generatorSpace, cellHeapCellType.get(), JSGenerator)
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction) // Hash:0x70ed61e4
@@ -1337,6 +1354,12 @@
 #ifdef JSC_GLIB_API_ENABLED
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jscCallbackFunctionSpace, jscCallbackFunctionHeapCellType.get(), JSCCallbackFunction)
 #endif
+#if ENABLE(INTL)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlCollatorSpace, intlCollatorHeapCellType.get(), IntlCollator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlDateTimeFormatSpace, intlDateTimeFormatHeapCellType.get(), IntlDateTimeFormat)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlNumberFormatSpace, intlNumberFormatHeapCellType.get(), IntlNumberFormat)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlPluralRulesSpace, intlPluralRulesHeapCellType.get(), IntlPluralRules)
+#endif
 #if ENABLE(WEBASSEMBLY)
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock) // Hash:0x9ad995cd
 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType.get(), WebAssemblyFunction) // Hash:0x8b7c32db
diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
index 7112a84..5f94d86 100644
--- a/Source/JavaScriptCore/runtime/VM.h
+++ b/Source/JavaScriptCore/runtime/VM.h
@@ -109,6 +109,8 @@
 class CompactVariableMap;
 class CustomGetterSetter;
 class DOMAttributeGetterSetter;
+class DateInstance;
+class ErrorInstance;
 class Exception;
 class ExceptionScope;
 class FastMallocAlignedMemoryAllocator;
@@ -120,6 +122,10 @@
 class HeapProfiler;
 class Identifier;
 class Interpreter;
+class IntlCollator;
+class IntlDateTimeFormat;
+class IntlNumberFormat;
+class IntlPluralRules;
 class JSCCallbackFunction;
 class JSCustomGetterSetterFunction;
 class JSDestructibleObjectHeapCellType;
@@ -345,6 +351,8 @@
     std::unique_ptr<HeapCellType> immutableButterflyHeapCellType;
     std::unique_ptr<HeapCellType> cellHeapCellType;
     std::unique_ptr<HeapCellType> destructibleCellHeapCellType;
+    std::unique_ptr<IsoHeapCellType<DateInstance>> dateInstanceHeapCellType;
+    std::unique_ptr<IsoHeapCellType<ErrorInstance>> errorInstanceHeapCellType;
     std::unique_ptr<IsoHeapCellType<JSString>> stringHeapCellType;
     std::unique_ptr<IsoHeapCellType<JSWeakMap>> weakMapHeapCellType;
     std::unique_ptr<IsoHeapCellType<JSWeakSet>> weakSetHeapCellType;
@@ -355,6 +363,12 @@
 #ifdef JSC_GLIB_API_ENABLED
     std::unique_ptr<IsoHeapCellType<JSCCallbackFunction>> jscCallbackFunctionHeapCellType;
 #endif
+#if ENABLE(INTL)
+    std::unique_ptr<IsoHeapCellType<IntlCollator>> intlCollatorHeapCellType;
+    std::unique_ptr<IsoHeapCellType<IntlDateTimeFormat>> intlDateTimeFormatHeapCellType;
+    std::unique_ptr<IsoHeapCellType<IntlNumberFormat>> intlNumberFormatHeapCellType;
+    std::unique_ptr<IsoHeapCellType<IntlPluralRules>> intlPluralRulesHeapCellType;
+#endif
 #if ENABLE(WEBASSEMBLY)
     std::unique_ptr<IsoHeapCellType<JSWebAssemblyCodeBlock>> webAssemblyCodeBlockHeapCellType;
     std::unique_ptr<IsoHeapCellType<WebAssemblyFunction>> webAssemblyFunctionHeapCellType;
@@ -391,6 +405,7 @@
     CompleteSubspace destructibleObjectSpace;
     
     IsoSubspace bigIntSpace;
+    IsoSubspace dateInstanceSpace;
     IsoSubspace executableToCodeBlockEdgeSpace;
     IsoSubspace functionSpace;
     IsoSubspace getterSetterSpace;
@@ -442,6 +457,12 @@
     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakObjectRefSpace)
     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakSetSpace)
     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakMapSpace)
+#if ENABLE(INTL)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlCollatorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlDateTimeFormatSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlNumberFormatSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlPluralRulesSpace)
+#endif
 #if ENABLE(WEBASSEMBLY)
     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyCodeBlockSpace)
     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyFunctionSpace)
diff --git a/Source/JavaScriptCore/runtime/WeakMapConstructor.h b/Source/JavaScriptCore/runtime/WeakMapConstructor.h
index c8eabcf..ebe77e6 100644
--- a/Source/JavaScriptCore/runtime/WeakMapConstructor.h
+++ b/Source/JavaScriptCore/runtime/WeakMapConstructor.h
@@ -54,5 +54,6 @@
     WeakMapConstructor(VM&, Structure*);
     void finishCreation(VM&, WeakMapPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WeakMapConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h b/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h
index 1d54cf4..835139a 100644
--- a/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h
+++ b/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h
@@ -53,7 +53,6 @@
     WeakObjectRefConstructor(VM&, Structure*);
     void finishCreation(VM&, WeakObjectRefPrototype*);
 };
-
-static_assert(sizeof(WeakObjectRefConstructor) == sizeof(InternalFunction));
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WeakObjectRefConstructor, InternalFunction);
 
 }
diff --git a/Source/JavaScriptCore/runtime/WeakSetConstructor.h b/Source/JavaScriptCore/runtime/WeakSetConstructor.h
index 5480c71..0b48671 100644
--- a/Source/JavaScriptCore/runtime/WeakSetConstructor.h
+++ b/Source/JavaScriptCore/runtime/WeakSetConstructor.h
@@ -54,5 +54,6 @@
     WeakSetConstructor(VM&, Structure*);
     void finishCreation(VM&, WeakSetPrototype*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WeakSetConstructor, InternalFunction);
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/tools/JSDollarVM.cpp b/Source/JavaScriptCore/tools/JSDollarVM.cpp
index 70a1a6e..fec3075 100644
--- a/Source/JavaScriptCore/tools/JSDollarVM.cpp
+++ b/Source/JavaScriptCore/tools/JSDollarVM.cpp
@@ -105,8 +105,8 @@
 // globals (since these must have trivial constructors) e.g. DOMJITAttribute.
 // Instead, these constructors should always be ALWAYS_INLINE.
 
-class JSDollarVMCallFrame : public JSDestructibleObject {
-    using Base = JSDestructibleObject;
+class JSDollarVMCallFrame : public JSNonFinalObject {
+    using Base = JSNonFinalObject;
 public:
     JSDollarVMCallFrame(VM& vm, Structure* structure)
         : Base(vm, structure)
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyCompileError.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyCompileError.h
index 6cddc5d..9f4ad88 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyCompileError.h
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyCompileError.h
@@ -33,7 +33,7 @@
 
 class JSWebAssemblyCompileError final : public ErrorInstance {
 public:
-    typedef ErrorInstance Base;
+    using Base = ErrorInstance;
 
     static JSWebAssemblyCompileError* create(JSGlobalObject*, VM&, Structure*, const String&);
     static JSWebAssemblyCompileError* create(JSGlobalObject* globalObject, VM& vm, Structure* structure, JSValue message)
@@ -46,6 +46,7 @@
 protected:
     JSWebAssemblyCompileError(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSWebAssemblyCompileError, ErrorInstance);
 
 JSObject* createJSWebAssemblyCompileError(JSGlobalObject*, VM&, const String&);
 
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyLinkError.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyLinkError.h
index 7855423..55b1d08 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyLinkError.h
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyLinkError.h
@@ -46,6 +46,7 @@
 protected:
     JSWebAssemblyLinkError(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSWebAssemblyLinkError, ErrorInstance);
 
 JSObject* createJSWebAssemblyLinkError(JSGlobalObject*, VM&, const String&);
 
diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h
index 95c5d6a..15ef9b7 100644
--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h
+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyRuntimeError.h
@@ -42,6 +42,7 @@
 protected:
     JSWebAssemblyRuntimeError(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSWebAssemblyRuntimeError, ErrorInstance);
 
 JSObject* createJSWebAssemblyRuntimeError(JSGlobalObject*, VM&, const String&);
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.h
index fbcf877..32b028c 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.h
@@ -50,6 +50,7 @@
 private:
     WebAssemblyCompileErrorConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyCompileErrorConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h
index 7d568bc..cd1ebe3 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h
@@ -54,6 +54,7 @@
 private:
     WebAssemblyInstanceConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyInstanceConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.h
index 3f5ca76..5937ba7 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.h
@@ -50,6 +50,7 @@
 private:
     WebAssemblyLinkErrorConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyLinkErrorConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.h
index 1d86398..3ebe3d4 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.h
@@ -50,6 +50,7 @@
 private:
     WebAssemblyMemoryConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyMemoryConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.h
index 3d5fac4..51d545e 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.h
@@ -55,6 +55,7 @@
 private:
     WebAssemblyModuleConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyModuleConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.h
index 85e8373..7614f28 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.h
@@ -50,6 +50,7 @@
 private:
     WebAssemblyRuntimeErrorConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyRuntimeErrorConstructor, InternalFunction);
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.h
index 38ee1b2..cfff691 100644
--- a/Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.h
+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.h
@@ -50,6 +50,7 @@
 private:
     WebAssemblyTableConstructor(VM&, Structure*);
 };
+STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyTableConstructor, InternalFunction);
 
 } // namespace JSC