diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 851e546..742dd3f 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,17 @@
+2019-01-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r239825.
+        https://bugs.webkit.org/show_bug.cgi?id=193330
+
+        Broke tests on armv7/linux bots (Requested by guijemont on
+        #webkit).
+
+        Reverted changeset:
+
+        "Enable DFG on ARM/Linux again"
+        https://bugs.webkit.org/show_bug.cgi?id=192496
+        https://trac.webkit.org/changeset/239825
+
 2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>
 
         Enable DFG on ARM/Linux again
diff --git a/JSTests/stress/regress-192717.js b/JSTests/stress/regress-192717.js
index f941a85..91a1ed8 100644
--- a/JSTests/stress/regress-192717.js
+++ b/JSTests/stress/regress-192717.js
@@ -1,5 +1,5 @@
-//@ skip if $memoryLimited or $buildType == "debug"
 //@ runDefault("--useLLInt=false", "--forceCodeBlockToJettisonDueToOldAge=true", "--maxPerThreadStackUsage=200000", "--exceptionStackTraceLimit=1", "--defaultErrorStackTraceLimit=1")
+//@ skip if $memoryLimited or $buildType == "debug"
 
 let foo = 'let a';
 for (let i = 0; i < 400000; i++)
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 166bd73..21f7788 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,17 @@
+2019-01-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r239825.
+        https://bugs.webkit.org/show_bug.cgi?id=193330
+
+        Broke tests on armv7/linux bots (Requested by guijemont on
+        #webkit).
+
+        Reverted changeset:
+
+        "Enable DFG on ARM/Linux again"
+        https://bugs.webkit.org/show_bug.cgi?id=192496
+        https://trac.webkit.org/changeset/239825
+
 2019-01-10  Justin Fan  <justin_fan@apple.com>
 
         [WebGPU] Fix vertex-buffer-triangle-strip test and small update to GPURenderPipeline
diff --git a/LayoutTests/js/script-tests/dfg-float32array.js b/LayoutTests/js/script-tests/dfg-float32array.js
index 1fef877..4211465d 100644
--- a/LayoutTests/js/script-tests/dfg-float32array.js
+++ b/LayoutTests/js/script-tests/dfg-float32array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that float32 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-float64array.js b/LayoutTests/js/script-tests/dfg-float64array.js
index b712bd2..d58990e 100644
--- a/LayoutTests/js/script-tests/dfg-float64array.js
+++ b/LayoutTests/js/script-tests/dfg-float64array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that float64 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-int16array.js b/LayoutTests/js/script-tests/dfg-int16array.js
index 19ad96f..3e1efc3 100644
--- a/LayoutTests/js/script-tests/dfg-int16array.js
+++ b/LayoutTests/js/script-tests/dfg-int16array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that int16 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-int32array-overflow-values.js b/LayoutTests/js/script-tests/dfg-int32array-overflow-values.js
index bf551c3..2edd518 100644
--- a/LayoutTests/js/script-tests/dfg-int32array-overflow-values.js
+++ b/LayoutTests/js/script-tests/dfg-int32array-overflow-values.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that int32 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-int32array.js b/LayoutTests/js/script-tests/dfg-int32array.js
index 6627129..490c6a3 100644
--- a/LayoutTests/js/script-tests/dfg-int32array.js
+++ b/LayoutTests/js/script-tests/dfg-int32array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that int32 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-int8array.js b/LayoutTests/js/script-tests/dfg-int8array.js
index 05f69e36..feb83e3 100644
--- a/LayoutTests/js/script-tests/dfg-int8array.js
+++ b/LayoutTests/js/script-tests/dfg-int8array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that int8 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-uint16array.js b/LayoutTests/js/script-tests/dfg-uint16array.js
index 234e897..ba53b7b 100644
--- a/LayoutTests/js/script-tests/dfg-uint16array.js
+++ b/LayoutTests/js/script-tests/dfg-uint16array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that uint16 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-uint32array.js b/LayoutTests/js/script-tests/dfg-uint32array.js
index bea38e0..f1c48ab 100644
--- a/LayoutTests/js/script-tests/dfg-uint32array.js
+++ b/LayoutTests/js/script-tests/dfg-uint32array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that uint32 arrays work in the DFG."
diff --git a/LayoutTests/js/script-tests/dfg-uint8array.js b/LayoutTests/js/script-tests/dfg-uint8array.js
index 339d855..95e8bcb 100644
--- a/LayoutTests/js/script-tests/dfg-uint8array.js
+++ b/LayoutTests/js/script-tests/dfg-uint8array.js
@@ -1,4 +1,4 @@
-//@ noNoLLIntRunLayoutTest if $architecture == "arm"
+//@ noNoLLIntRunLayoutTest if $architecture == "arm" and $hostOS == "darwin"
 
 description(
 "This tests that uint8 arrays work in the DFG."
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 65a5e57..416edca 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2019-01-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r239825.
+        https://bugs.webkit.org/show_bug.cgi?id=193330
+
+        Broke tests on armv7/linux bots (Requested by guijemont on
+        #webkit).
+
+        Reverted changeset:
+
+        "Enable DFG on ARM/Linux again"
+        https://bugs.webkit.org/show_bug.cgi?id=192496
+        https://trac.webkit.org/changeset/239825
+
 2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>
 
         Enable DFG on ARM/Linux again
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index f9d0030..1378540 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -749,7 +749,7 @@
             m_jumps.append(other.m_jumps.begin(), other.m_jumps.size());
         }
 
-        bool empty() const
+        bool empty()
         {
             return !m_jumps.size();
         }
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index 6d464f3..069cf85 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -75,6 +75,8 @@
 
 #if NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
 
+static_assert(is64Bit(), "we only support callee save registers on 64-bit");
+
 // Based on AssemblyHelpers::emitRestoreCalleeSavesFor().
 static void restoreCalleeSavesFor(Context& context, CodeBlock* codeBlock)
 {
@@ -135,14 +137,8 @@
         size_t uintptrOffset = entry.offset() / sizeof(UCPURegister);
         if (entry.reg().isGPR())
             context.gpr(entry.reg().gpr()) = calleeSaveBuffer[uintptrOffset];
-        else {
-#if USE(JSVALUE64)
+        else
             context.fpr(entry.reg().fpr()) = bitwise_cast<double>(calleeSaveBuffer[uintptrOffset]);
-#else
-            // FIXME: <https://webkit.org/b/193275> support callee-saved floating point registers on 32-bit architectures
-            RELEASE_ASSERT_NOT_REACHED();
-#endif
-        }
     }
 }
 
@@ -165,14 +161,8 @@
             continue;
         if (entry.reg().isGPR())
             stack.set(calleeSaveBuffer, entry.offset(), context.gpr<UCPURegister>(entry.reg().gpr()));
-        else {
-#if USE(JSVALUE64)
+        else
             stack.set(calleeSaveBuffer, entry.offset(), context.fpr<UCPURegister>(entry.reg().fpr()));
-#else
-            // FIXME: <https://webkit.org/b/193275> support callee-saved floating point registers on 32-bit architectures
-            RELEASE_ASSERT_NOT_REACHED();
-#endif
-        }
     }
 }
 
diff --git a/Source/JavaScriptCore/jit/CallFrameShuffler.cpp b/Source/JavaScriptCore/jit/CallFrameShuffler.cpp
index 81c3e2d..6df81e1 100644
--- a/Source/JavaScriptCore/jit/CallFrameShuffler.cpp
+++ b/Source/JavaScriptCore/jit/CallFrameShuffler.cpp
@@ -51,14 +51,8 @@
         m_lockedRegisters.clear(GPRInfo::toRegister(i));
     for (unsigned i = FPRInfo::numberOfRegisters; i--; )
         m_lockedRegisters.clear(FPRInfo::toRegister(i));
-
-#if USE(JSVALUE64)
-    // ... as well as the runtime registers on 64-bit architectures.
-    // However do not use these registers on 32-bit architectures since
-    // saving and restoring callee-saved registers in CallFrameShuffler isn't supported
-    // on 32-bit architectures yet.
+    // ... as well as the runtime registers.
     m_lockedRegisters.exclude(RegisterSet::vmCalleeSaveRegisters());
-#endif
 
     ASSERT(!data.callee.isInJSStack() || data.callee.virtualRegister().isLocal());
     addNew(VirtualRegister(CallFrameSlot::callee), data.callee);
diff --git a/Source/JavaScriptCore/jit/GPRInfo.h b/Source/JavaScriptCore/jit/GPRInfo.h
index 175d530..1a0a5c9 100644
--- a/Source/JavaScriptCore/jit/GPRInfo.h
+++ b/Source/JavaScriptCore/jit/GPRInfo.h
@@ -526,9 +526,13 @@
 
 #endif // CPU(X86_64)
 
-#if CPU(ARM_THUMB2)
+#if CPU(ARM)
 #define NUMBER_OF_ARGUMENT_REGISTERS 4u
+#if CPU(ARM_THUMB2)
 #define NUMBER_OF_CALLEE_SAVES_REGISTERS 1u
+#else
+#define NUMBER_OF_CALLEE_SAVES_REGISTERS 0u
+#endif
 
 class GPRInfo {
 public:
@@ -544,7 +548,11 @@
     static const GPRReg regT4 = ARMRegisters::r8;
     static const GPRReg regT5 = ARMRegisters::r9;
     static const GPRReg regT6 = ARMRegisters::r10;
-    static const GPRReg regT7 = ARMRegisters::r5;
+#if CPU(ARM_THUMB2)
+    static const GPRReg regT7 = ARMRegisters::r11;
+#else 
+    static const GPRReg regT7 = ARMRegisters::r7;
+#endif
     static const GPRReg regT8 = ARMRegisters::r4;
     static const GPRReg regCS0 = ARMRegisters::r11;
     // These registers match the baseline JIT.
@@ -579,7 +587,11 @@
         ASSERT(reg != InvalidGPRReg);
         ASSERT(static_cast<int>(reg) < 16);
         static const unsigned indexForRegister[16] =
-            { 0, 1, 2, 3, 8, 7, InvalidIndex, InvalidIndex, 4, 5, 6, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
+#if CPU(ARM_THUMB2)
+            { 0, 1, 2, 3, 8, InvalidIndex, InvalidIndex, InvalidIndex, 4, 5, 6, 7, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
+#else
+            { 0, 1, 2, 3, 8, InvalidIndex, InvalidIndex, 7, 4, 5, 6, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex, InvalidIndex };
+#endif
         unsigned result = indexForRegister[reg];
         return result;
     }
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index a505a55..05b3a69 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -2012,11 +2012,6 @@
 
 
 op(llint_throw_from_slow_path_trampoline, macro()
-    loadp Callee[cfr], t1
-    andp MarkedBlockMask, t1
-    loadp MarkedBlockFooterOffset + MarkedBlock::Footer::m_vm[t1], t1
-    copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2)
-
     callSlowPath(_llint_slow_path_handle_exception)
 
     # When throwing from the interpreter (i.e. throwing from LLIntSlowPaths), so
@@ -2025,6 +2020,7 @@
     loadp Callee[cfr], t1
     andp MarkedBlockMask, t1
     loadp MarkedBlockFooterOffset + MarkedBlock::Footer::m_vm[t1], t1
+    copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2)
     jmp VM::targetMachinePCForThrow[t1]
 end)
 
diff --git a/Source/JavaScriptCore/offlineasm/arm.rb b/Source/JavaScriptCore/offlineasm/arm.rb
index 85e0b8e..d78b82e 100644
--- a/Source/JavaScriptCore/offlineasm/arm.rb
+++ b/Source/JavaScriptCore/offlineasm/arm.rb
@@ -34,7 +34,7 @@
 #  x2 => t2, a2, r2
 #  x3 => t3, a3, r3
 #  x6 =>            (callee-save scratch)
-#  x7 => cfr
+#  x7 => cfr        (ARMv7 only)
 #  x8 => t4         (callee-save)
 #  x9 => t5         (callee-save)
 # x10 =>            (callee-save scratch)
@@ -55,6 +55,15 @@
 # d6 =>              (scratch)
 # d7 =>              (scratch)
 
+def isARMv7
+    case $activeBackend
+    when "ARMv7"
+        true
+    else
+        raise "bad value for $activeBackend: #{$activeBackend}"
+    end
+end
+
 class Node
     def armSingle
         doubleOperand = armOperand
@@ -82,11 +91,13 @@
         $asm.puts "mov #{register.armOperand}, \##{value}"
     elsif (~value) >= 0 && (~value) < 256
         $asm.puts "mvn #{register.armOperand}, \##{~value}"
-    else
+    elsif isARMv7
         $asm.puts "movw #{register.armOperand}, \##{value & 0xffff}"
         if (value & 0xffff0000) != 0
             $asm.puts "movt #{register.armOperand}, \##{(value >> 16) & 0xffff}"
         end
+    else
+        $asm.puts "ldr #{register.armOperand}, =#{value}"
     end
 end
 
@@ -108,7 +119,7 @@
         when "t5"
             "r9"
         when "cfr"
-            "r7"
+            isARMv7 ?  "r7" : "r11"
         when "csr0"
             "r11"
         when "lr"
@@ -598,6 +609,9 @@
             else
                 $asm.puts "mov pc, #{operands[0].armOperand}"
             end
+            if not isARMv7 and not isARMv7Traditional
+                $asm.puts ".ltorg"
+            end
         when "call"
             if operands[0].label?
                 if OS_DARWIN
@@ -678,7 +692,7 @@
             $asm.puts "add #{dest.armOperand}, pc, #{dest.armOperand}"
             $asm.puts "ldr #{dest.armOperand}, [#{dest.armOperand}, #{temp.armOperand}]"
 
-            offset = 4
+            offset = $activeBackend == "ARMv7" ? 4 : 8
 
             $asm.deferNextLabelAction {
                 $asm.puts "#{gotLabel}:"
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index 786ba97..324ee66 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,17 @@
+2019-01-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r239825.
+        https://bugs.webkit.org/show_bug.cgi?id=193330
+
+        Broke tests on armv7/linux bots (Requested by guijemont on
+        #webkit).
+
+        Reverted changeset:
+
+        "Enable DFG on ARM/Linux again"
+        https://bugs.webkit.org/show_bug.cgi?id=192496
+        https://trac.webkit.org/changeset/239825
+
 2019-01-10  John Wilander  <wilander@apple.com>
 
         Override the session configuration for cookieAcceptPolicy
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index a574b04..8e1aa52 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -760,6 +760,9 @@
 #if !defined(ENABLE_JIT)
 #define ENABLE_JIT 1
 #endif
+/* But still disable DFG for now. */
+#undef ENABLE_DFG_JIT
+#define ENABLE_DFG_JIT 0
 #else
 /* Disable JIT and force C_LOOP on all 32bit-architectures but ARMv7-Thumb2/Linux. */
 #undef ENABLE_JIT
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index f0adc259..cd5f8e9 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,17 @@
+2019-01-10  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r239825.
+        https://bugs.webkit.org/show_bug.cgi?id=193330
+
+        Broke tests on armv7/linux bots (Requested by guijemont on
+        #webkit).
+
+        Reverted changeset:
+
+        "Enable DFG on ARM/Linux again"
+        https://bugs.webkit.org/show_bug.cgi?id=192496
+        https://trac.webkit.org/changeset/239825
+
 2019-01-10  Zhifei Fang  <zhifei_fang@apple.com>
 
         Disable the run-jsc-stress-test remote host key check.
diff --git a/Tools/Scripts/run-jsc-stress-tests b/Tools/Scripts/run-jsc-stress-tests
index 632940b..1df9301 100755
--- a/Tools/Scripts/run-jsc-stress-tests
+++ b/Tools/Scripts/run-jsc-stress-tests
@@ -449,7 +449,7 @@
 $architecture = determineArchitecture unless $architecture
 $isFTLPlatform = !($architecture == "x86" || $architecture == "arm" || $architecture == "mips" || $hostOS == "windows")
 
-if ["mips", "x86"].include?($architecture)
+if ["arm", "mips", "x86"].include?($architecture)
     # The JIT is temporarily disabled on these platforms since
     # https://trac.webkit.org/changeset/237547
     $jitTests = false