diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 722907d..b2a4e14 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,26 @@
+2020-01-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r254480, r254496, and r254517.
+        https://bugs.webkit.org/show_bug.cgi?id=206278
+
+        "It regressed JetStream2 and Speedometer2" (Requested by
+        saamyjoon on #webkit).
+
+        Reverted changesets:
+
+        "Throw away baseline code if there is an optimized
+        replacement"
+        https://bugs.webkit.org/show_bug.cgi?id=202503
+        https://trac.webkit.org/changeset/254480
+
+        "Unreviewed. Change useLLInt=0 to forceBaseline=1"
+        https://trac.webkit.org/changeset/254496
+
+        "Add an option that enables/disables throwing away baseline
+        JIT code"
+        https://bugs.webkit.org/show_bug.cgi?id=206244
+        https://trac.webkit.org/changeset/254517
+
 2020-01-13  Saam Barati  <sbarati@apple.com>
 
         Unreviewed. Change useLLInt=0 to forceBaseline=1
diff --git a/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js b/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js
index 4c608f8..d21b37e 100644
--- a/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js
+++ b/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js
@@ -1,4 +1,4 @@
-//@ runDefault("--collectContinuously=true", "--collectContinuouslyPeriodMS=0.15", "--forceBaseline=true", "--useFTLJIT=false", "--jitPolicyScale=0")
+//@ runDefault("--collectContinuously=true", "--collectContinuouslyPeriodMS=0.15", "--useLLInt=false", "--useFTLJIT=false", "--jitPolicyScale=0")
 
 // This test exercises DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined().
 
diff --git a/JSTests/stress/getter-setter-inlining-should-emit-movhint.js b/JSTests/stress/getter-setter-inlining-should-emit-movhint.js
index faefcd8..28896f6 100644
--- a/JSTests/stress/getter-setter-inlining-should-emit-movhint.js
+++ b/JSTests/stress/getter-setter-inlining-should-emit-movhint.js
@@ -1,4 +1,4 @@
-//@ runDefault("--useRandomizingFuzzerAgent=1", "--usePolymorphicCallInliningForNonStubStatus=1", "--seedOfRandomizingFuzzerAgent=2896922505", "--forceBaseline=1", "--useConcurrentJIT=0")
+//@ runDefault("--useRandomizingFuzzerAgent=1", "--usePolymorphicCallInliningForNonStubStatus=1", "--seedOfRandomizingFuzzerAgent=2896922505", "--useLLInt=0", "--useConcurrentJIT=0")
 function foo(o) {
     o.f = 0;
     return o.f;
diff --git a/JSTests/stress/make-dictionary-repatch.js b/JSTests/stress/make-dictionary-repatch.js
index 584478d..9922837 100644
--- a/JSTests/stress/make-dictionary-repatch.js
+++ b/JSTests/stress/make-dictionary-repatch.js
@@ -1,4 +1,4 @@
-//@ if $jitTests then runNoCJIT("--useDFGJIT=false", "--forceBaseline=true") else skip end
+//@ if $jitTests then runNoCJIT("--useDFGJIT=false", "--useLLInt=false") else skip end
 
 function foo(o) {
     return o.f;
diff --git a/JSTests/stress/merging-ic-variants-should-bail-if-structures-overlap.js b/JSTests/stress/merging-ic-variants-should-bail-if-structures-overlap.js
index 3deeb8a..43e5bc97 100644
--- a/JSTests/stress/merging-ic-variants-should-bail-if-structures-overlap.js
+++ b/JSTests/stress/merging-ic-variants-should-bail-if-structures-overlap.js
@@ -1,4 +1,4 @@
-//@ runDefault("--validateGraphAtEachPhase=1", "--forceBaseline=1")
+//@ runDefault("--validateGraphAtEachPhase=1", "--useLLInt=0")
 
 let items = [];
 for (let i = 0; i < 8; ++i) {
diff --git a/JSTests/stress/proxy-getter-stack-overflow.js b/JSTests/stress/proxy-getter-stack-overflow.js
index b053cb9..631f870 100644
--- a/JSTests/stress/proxy-getter-stack-overflow.js
+++ b/JSTests/stress/proxy-getter-stack-overflow.js
@@ -1,4 +1,4 @@
-//@ if $jitTests then runDefault("--forceBaseline=1") else skip end
+//@ if $jitTests then runDefault("--useLLInt=0") else skip end
 
 const o = {};
 const handler = {
diff --git a/JSTests/stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js b/JSTests/stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js
index 9d2469f..83552bc 100644
--- a/JSTests/stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js
+++ b/JSTests/stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js
@@ -1,4 +1,4 @@
-//@ runDefault("--numberOfGCMarkers=1", "--useDFGJIT=false", "--forceBaseline=true")
+//@ runDefault("--numberOfGCMarkers=1", "--useDFGJIT=false", "--useLLInt=false")
 
 function foo() {
     gc();
diff --git a/JSTests/stress/regress-192717.js b/JSTests/stress/regress-192717.js
index 1407d8c..f941a85 100644
--- a/JSTests/stress/regress-192717.js
+++ b/JSTests/stress/regress-192717.js
@@ -1,5 +1,5 @@
 //@ skip if $memoryLimited or $buildType == "debug"
-//@ runDefault("--forceBaseline=true", "--forceCodeBlockToJettisonDueToOldAge=true", "--maxPerThreadStackUsage=200000", "--exceptionStackTraceLimit=1", "--defaultErrorStackTraceLimit=1")
+//@ runDefault("--useLLInt=false", "--forceCodeBlockToJettisonDueToOldAge=true", "--maxPerThreadStackUsage=200000", "--exceptionStackTraceLimit=1", "--defaultErrorStackTraceLimit=1")
 
 let foo = 'let a';
 for (let i = 0; i < 400000; i++)
diff --git a/JSTests/stress/retry-cache-later.js b/JSTests/stress/retry-cache-later.js
index 5d3e853..1f4cfda 100644
--- a/JSTests/stress/retry-cache-later.js
+++ b/JSTests/stress/retry-cache-later.js
@@ -1,4 +1,4 @@
-//@ runNoCJIT("--forceBaseline=true", "--useDFGJIT=false")
+//@ runNoCJIT("--useLLInt=false", "--useDFGJIT=false")
 
 function foo(o) {
     return o.i7;
diff --git a/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp b/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp
index a26595d..6e5b82f 100644
--- a/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp
+++ b/Source/JavaScriptCore/API/tests/ExecutionTimeLimitTest.cpp
@@ -119,11 +119,11 @@
 int testExecutionTimeLimit()
 {
     static const TierOptions tierOptionsList[] = {
-        { "LLINT",    0_ms,   "--useConcurrentJIT=false --useJIT=false" },
-        { "Baseline", 0_ms,   "--useConcurrentJIT=false --useJIT=true --useDFGJIT=false" },
-        { "DFG",      200_ms,   "--useConcurrentJIT=false --useJIT=true --useDFGJIT=true --useFTLJIT=false" },
+        { "LLINT",    0_ms,   "--useConcurrentJIT=false --useLLInt=true --useJIT=false" },
+        { "Baseline", 0_ms,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=false" },
+        { "DFG",      200_ms,   "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=false" },
 #if ENABLE(FTL_JIT)
-        { "FTL",      500_ms, "--useConcurrentJIT=false --useJIT=true --useDFGJIT=true --useFTLJIT=true" },
+        { "FTL",      500_ms, "--useConcurrentJIT=false --useLLInt=true --useJIT=true --useDFGJIT=true --useFTLJIT=true" },
 #endif
     };
     
diff --git a/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp b/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp
index e906815..fbe4687 100644
--- a/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp
+++ b/Source/JavaScriptCore/API/tests/PingPongStackOverflowTest.cpp
@@ -122,7 +122,7 @@
 
     auto origSoftReservedZoneSize = Options::softReservedZoneSize();
     auto origReservedZoneSize = Options::reservedZoneSize();
-    auto origForceBaseline = Options::forceBaseline();
+    auto origUseLLInt = Options::useLLInt();
     auto origMaxPerThreadStackUsage = Options::maxPerThreadStackUsage();
 
     Options::softReservedZoneSize() = 128 * KB;
@@ -131,7 +131,7 @@
     // Normally, we want to disable the LLINT to force the use of JITted code which is necessary for
     // reproducing the regression in https://bugs.webkit.org/show_bug.cgi?id=148749. However, we only
     // want to do this if the LLINT isn't the only available execution engine.
-    Options::forceBaseline() = true;
+    Options::useLLInt() = false;
 #endif
 
     const char* scriptString =
@@ -178,7 +178,7 @@
 
     Options::softReservedZoneSize() = origSoftReservedZoneSize;
     Options::reservedZoneSize() = origReservedZoneSize;
-    Options::forceBaseline() = origForceBaseline;
+    Options::useLLInt() = origUseLLInt;
     Options::maxPerThreadStackUsage() = origMaxPerThreadStackUsage;
 
     return failed;
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 7e9a6ac..d90f0af 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,26 @@
+2020-01-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r254480, r254496, and r254517.
+        https://bugs.webkit.org/show_bug.cgi?id=206278
+
+        "It regressed JetStream2 and Speedometer2" (Requested by
+        saamyjoon on #webkit).
+
+        Reverted changesets:
+
+        "Throw away baseline code if there is an optimized
+        replacement"
+        https://bugs.webkit.org/show_bug.cgi?id=202503
+        https://trac.webkit.org/changeset/254480
+
+        "Unreviewed. Change useLLInt=0 to forceBaseline=1"
+        https://trac.webkit.org/changeset/254496
+
+        "Add an option that enables/disables throwing away baseline
+        JIT code"
+        https://bugs.webkit.org/show_bug.cgi?id=206244
+        https://trac.webkit.org/changeset/254517
+
 2020-01-14  Keith Miller  <keith_miller@apple.com>
 
         Fix scanSideState assertion
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 1f93a3a..78eb4f7 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -442,8 +442,14 @@
                 const UnlinkedHandlerInfo& unlinkedHandler = unlinkedCodeBlock->exceptionHandler(i);
                 HandlerInfo& handler = m_rareData->m_exceptionHandlers[i];
 #if ENABLE(JIT)
-                auto& instruction = *instructions().at(unlinkedHandler.target).ptr();
-                MacroAssemblerCodePtr<BytecodePtrTag> codePtr = LLInt::getCodePtr<BytecodePtrTag>(instruction);
+                auto instruction = instructions().at(unlinkedHandler.target);
+                MacroAssemblerCodePtr<BytecodePtrTag> codePtr;
+                if (instruction->isWide32())
+                    codePtr = LLInt::getWide32CodePtr<BytecodePtrTag>(op_catch);
+                else if (instruction->isWide16())
+                    codePtr = LLInt::getWide16CodePtr<BytecodePtrTag>(op_catch);
+                else
+                    codePtr = LLInt::getCodePtr<BytecodePtrTag>(op_catch);
                 handler.initialize(unlinkedHandler, CodeLocationLabel<ExceptionHandlerPtrTag>(codePtr.retagged<ExceptionHandlerPtrTag>()));
 #else
                 handler.initialize(unlinkedHandler);
@@ -1382,36 +1388,6 @@
     UNUSED_PARAM(vm);
 
     updateAllPredictions();
-
-#if ENABLE(JIT)
-    // If BaselineJIT code is not executing, and an optimized replacement exists, we attempt
-    // to discard baseline JIT code and reinstall LLInt code to save JIT memory.
-    if (!Options::forceBaseline() && Options::enableThrowingAwayBaselineCode() && jitType() == JITType::BaselineJIT && !m_vm->heap.codeBlockSet().isCurrentlyExecuting(this)) {
-        if (CodeBlock* optimizedCodeBlock = optimizedReplacement()) {
-            if (!optimizedCodeBlock->m_osrExitCounter) {
-                m_jitCode = nullptr;
-                LLInt::setEntrypoint(this);
-                RELEASE_ASSERT(jitType() == JITType::InterpreterThunk);
-
-                for (size_t i = 0; i < m_unlinkedCode->numberOfExceptionHandlers(); i++) {
-                    const UnlinkedHandlerInfo& unlinkedHandler = m_unlinkedCode->exceptionHandler(i);
-                    HandlerInfo& handler = m_rareData->m_exceptionHandlers[i];
-                    auto& instruction = *instructions().at(unlinkedHandler.target).ptr();
-                    MacroAssemblerCodePtr<BytecodePtrTag> codePtr = LLInt::getCodePtr<BytecodePtrTag>(instruction);
-                    handler.initialize(unlinkedHandler, CodeLocationLabel<ExceptionHandlerPtrTag>(codePtr.retagged<ExceptionHandlerPtrTag>()));
-                }
-
-                unlinkIncomingCalls();
-
-                // It's safe to clear these out here because in finalizeUnconditionally all compiler threads
-                // are safepointed, meaning they're running either before or after bytecode parser, and bytecode
-                // parser is the only data structure pointing into the various *infos.
-                resetJITData();
-            }
-        }
-    }
-
-#endif
     
     if (JITCode::couldBeInterpreted(jitType()))
         finalizeLLIntInlineCaches();
@@ -1539,6 +1515,18 @@
     return ensureJITData(locker).m_negICs.add(arithProfile);
 }
 
+StructureStubInfo* CodeBlock::findStubInfo(CodeOrigin codeOrigin)
+{
+    ConcurrentJSLocker locker(m_lock);
+    if (auto* jitData = m_jitData.get()) {
+        for (StructureStubInfo* stubInfo : jitData->m_stubInfos) {
+            if (stubInfo->codeOrigin == codeOrigin)
+                return stubInfo;
+        }
+    }
+    return nullptr;
+}
+
 ByValInfo* CodeBlock::addByValInfo()
 {
     ConcurrentJSLocker locker(m_lock);
@@ -1551,6 +1539,18 @@
     return ensureJITData(locker).m_callLinkInfos.add();
 }
 
+CallLinkInfo* CodeBlock::getCallLinkInfoForBytecodeIndex(BytecodeIndex index)
+{
+    ConcurrentJSLocker locker(m_lock);
+    if (auto* jitData = m_jitData.get()) {
+        for (CallLinkInfo* callLinkInfo : jitData->m_callLinkInfos) {
+            if (callLinkInfo->codeOrigin() == CodeOrigin(index))
+                return callLinkInfo;
+        }
+    }
+    return nullptr;
+}
+
 RareCaseProfile* CodeBlock::addRareCaseProfile(BytecodeIndex bytecodeIndex)
 {
     ConcurrentJSLocker locker(m_lock);
@@ -1598,22 +1598,13 @@
         // We can clear these because no other thread will have references to any stub infos, call
         // link infos, or by val infos if we don't have JIT code. Attempts to query these data
         // structures using the concurrent API (getICStatusMap and friends) will return nothing if we
-        // don't have JIT code. So it's safe to call this if we fail a baseline JIT compile.
-        //
-        // We also call this from finalizeUnconditionally when we degrade from baseline JIT to LLInt
-        // code. This is safe to do since all compiler threads are safepointed in finalizeUnconditionally,
-        // which means we've made it past bytecode parsing. Only the bytecode parser will hold onto
-        // references to these various *infos via its use of ICStatusMap.
-
-        for (StructureStubInfo* stubInfo : jitData->m_stubInfos) {
-            stubInfo->aboutToDie();
-            stubInfo->deref();
-        }
-
+        // don't have JIT code.
+        jitData->m_stubInfos.clear();
+        jitData->m_callLinkInfos.clear();
+        jitData->m_byValInfos.clear();
         // We can clear this because the DFG's queries to these data structures are guarded by whether
         // there is JIT code.
-
-        m_jitData = nullptr;
+        jitData->m_rareCaseProfiles.clear();
     }
 }
 #endif
@@ -1745,24 +1736,10 @@
 }
 
 #if ENABLE(JIT)
-CodeBlock* CodeBlock::optimizedReplacement(JITType typeToReplace)
-{
-    CodeBlock* replacement = this->replacement();
-    if (!replacement)
-        return nullptr;
-    if (JITCode::isHigherTier(replacement->jitType(), typeToReplace))
-        return replacement;
-    return nullptr;
-}
-
-CodeBlock* CodeBlock::optimizedReplacement()
-{
-    return optimizedReplacement(jitType());
-}
-
 bool CodeBlock::hasOptimizedReplacement(JITType typeToReplace)
 {
-    return !!optimizedReplacement(typeToReplace);
+    CodeBlock* replacement = this->replacement();
+    return replacement && JITCode::isHigherTier(replacement->jitType(), typeToReplace);
 }
 
 bool CodeBlock::hasOptimizedReplacement()
@@ -2824,7 +2801,7 @@
 void CodeBlock::tallyFrequentExitSites()
 {
     ASSERT(JITCode::isOptimizingJIT(jitType()));
-    ASSERT(JITCode::isBaselineCode(alternative()->jitType()));
+    ASSERT(alternative()->jitType() == JITType::BaselineJIT);
     
     CodeBlock* profiledBlock = alternative();
     
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 549d72f..68fd01f 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -258,11 +258,6 @@
 
     Optional<BytecodeIndex> bytecodeIndexFromCallSiteIndex(CallSiteIndex);
 
-    // Because we might throw out baseline JIT code and all its baseline JIT data (m_jitData),
-    // you need to be careful about the lifetime of when you use the return value of this function.
-    // The return value may have raw pointers into this data structure that gets thrown away.
-    // Specifically, you need to ensure that no GC can be finalized (typically that means no
-    // allocations) between calling this and the last use of it.
     void getICStatusMap(const ConcurrentJSLocker&, ICStatusMap& result);
     void getICStatusMap(ICStatusMap& result);
     
@@ -282,10 +277,6 @@
         SegmentedVector<RareCaseProfile, 8> m_rareCaseProfiles;
         std::unique_ptr<PCToCodeOriginMap> m_pcToCodeOriginMap;
         std::unique_ptr<RegisterAtOffsetList> m_calleeSaveRegisters;
-        // FIXME: Now that we unconditionally OSR exit to the LLInt, we might be able to prune
-        // the number of entries we have in this to contain entries only for opcodes we use
-        // it for. Today, that's only for loop OSR entry.
-        // https://bugs.webkit.org/show_bug.cgi?id=206207
         JITCodeMap m_jitCodeMap;
     };
 
@@ -316,9 +307,18 @@
 
     StructureStubInfo* addStubInfo(AccessType);
 
+    // O(n) operation. Use getStubInfoMap() unless you really only intend to get one
+    // stub info.
+    StructureStubInfo* findStubInfo(CodeOrigin);
+
     ByValInfo* addByValInfo();
 
     CallLinkInfo* addCallLinkInfo();
+
+    // This is a slow function call used primarily for compiling OSR exits in the case
+    // that there had been inlining. Chances are if you want to use this, you're really
+    // looking for a CallLinkInfoMap to amortize the cost of calling this.
+    CallLinkInfo* getCallLinkInfoForBytecodeIndex(BytecodeIndex);
     
     void setJITCodeMap(JITCodeMap&& jitCodeMap)
     {
@@ -412,6 +412,7 @@
     
     void setJITCode(Ref<JITCode>&& code)
     {
+        ASSERT(heap()->isDeferred());
         if (!code->isShared())
             heap()->reportExtraMemoryAllocated(code->size());
 
@@ -443,8 +444,6 @@
     DFG::CapabilityLevel capabilityLevel();
     DFG::CapabilityLevel capabilityLevelState() { return static_cast<DFG::CapabilityLevel>(m_capabilityLevelState); }
 
-    CodeBlock* optimizedReplacement(JITType typeToReplace);
-    CodeBlock* optimizedReplacement(); // the typeToReplace is my JITType
     bool hasOptimizedReplacement(JITType typeToReplace);
     bool hasOptimizedReplacement(); // the typeToReplace is my JITType
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index 1fd52c3..45fbc43 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -81,7 +81,7 @@
     
     ASSERT(codeBlock);
     ASSERT(codeBlock->alternative());
-    ASSERT(JITCode::isBaselineCode(codeBlock->alternative()->jitType()));
+    ASSERT(codeBlock->alternative()->jitType() == JITType::BaselineJIT);
     ASSERT(!profiledDFGCodeBlock || profiledDFGCodeBlock->jitType() == JITType::DFGJIT);
     
     if (logCompilationChanges(mode))
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
index 3018a1b..27e2aa8 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp
@@ -142,53 +142,85 @@
     doneAdjusting.link(&jit);
 }
 
-static MacroAssemblerCodePtr<JSEntryPtrTag> callerReturnPC(CodeBlock* baselineCodeBlockForCaller, BytecodeIndex callBytecodeIndex, InlineCallFrame::Kind trueCallerCallKind)
+MacroAssemblerCodePtr<JSEntryPtrTag> callerReturnPC(CodeBlock* baselineCodeBlockForCaller, BytecodeIndex callBytecodeIndex, InlineCallFrame::Kind trueCallerCallKind, bool& callerIsLLInt)
 {
+    callerIsLLInt = Options::forceOSRExitToLLInt() || baselineCodeBlockForCaller->jitType() == JITType::InterpreterThunk;
+
     if (callBytecodeIndex.checkpoint())
         return LLInt::getCodePtr<JSEntryPtrTag>(checkpoint_osr_exit_from_inlined_call_trampoline);
 
     MacroAssemblerCodePtr<JSEntryPtrTag> jumpTarget;
 
-    const Instruction& callInstruction = *baselineCodeBlockForCaller->instructions().at(callBytecodeIndex).ptr();
+    if (callerIsLLInt) {
+        const Instruction& callInstruction = *baselineCodeBlockForCaller->instructions().at(callBytecodeIndex).ptr();
 #define LLINT_RETURN_LOCATION(name) (callInstruction.isWide16() ? LLInt::getWide16CodePtr<JSEntryPtrTag>(name##_return_location) : (callInstruction.isWide32() ? LLInt::getWide32CodePtr<JSEntryPtrTag>(name##_return_location) : LLInt::getCodePtr<JSEntryPtrTag>(name##_return_location)))
 
-    switch (trueCallerCallKind) {
-    case InlineCallFrame::Call:
-        jumpTarget = LLINT_RETURN_LOCATION(op_call);
-        break;
-    case InlineCallFrame::Construct:
-        jumpTarget = LLINT_RETURN_LOCATION(op_construct);
-        break;
-    case InlineCallFrame::CallVarargs:
-        jumpTarget = LLINT_RETURN_LOCATION(op_call_varargs_slow);
-        break;
-    case InlineCallFrame::ConstructVarargs:
-        jumpTarget = LLINT_RETURN_LOCATION(op_construct_varargs_slow);
-        break;
-    case InlineCallFrame::GetterCall: {
-        if (callInstruction.opcodeID() == op_get_by_id)
-            jumpTarget = LLINT_RETURN_LOCATION(op_get_by_id);
-        else if (callInstruction.opcodeID() == op_get_by_val)
-            jumpTarget = LLINT_RETURN_LOCATION(op_get_by_val);
-        else
+        switch (trueCallerCallKind) {
+        case InlineCallFrame::Call:
+            jumpTarget = LLINT_RETURN_LOCATION(op_call);
+            break;
+        case InlineCallFrame::Construct:
+            jumpTarget = LLINT_RETURN_LOCATION(op_construct);
+            break;
+        case InlineCallFrame::CallVarargs:
+            jumpTarget = LLINT_RETURN_LOCATION(op_call_varargs_slow);
+            break;
+        case InlineCallFrame::ConstructVarargs:
+            jumpTarget = LLINT_RETURN_LOCATION(op_construct_varargs_slow);
+            break;
+        case InlineCallFrame::GetterCall: {
+            if (callInstruction.opcodeID() == op_get_by_id)
+                jumpTarget = LLINT_RETURN_LOCATION(op_get_by_id);
+            else if (callInstruction.opcodeID() == op_get_by_val)
+                jumpTarget = LLINT_RETURN_LOCATION(op_get_by_val);
+            else
+                RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        case InlineCallFrame::SetterCall: {
+            if (callInstruction.opcodeID() == op_put_by_id)
+                jumpTarget = LLINT_RETURN_LOCATION(op_put_by_id);
+            else if (callInstruction.opcodeID() == op_put_by_val)
+                jumpTarget = LLINT_RETURN_LOCATION(op_put_by_val);
+            else
+                RELEASE_ASSERT_NOT_REACHED();
+            break;
+        }
+        default:
             RELEASE_ASSERT_NOT_REACHED();
-        break;
-    }
-    case InlineCallFrame::SetterCall: {
-        if (callInstruction.opcodeID() == op_put_by_id)
-            jumpTarget = LLINT_RETURN_LOCATION(op_put_by_id);
-        else if (callInstruction.opcodeID() == op_put_by_val)
-            jumpTarget = LLINT_RETURN_LOCATION(op_put_by_val);
-        else
-            RELEASE_ASSERT_NOT_REACHED();
-        break;
-    }
-    default:
-        RELEASE_ASSERT_NOT_REACHED();
-    }
+        }
 
 #undef LLINT_RETURN_LOCATION
 
+    } else {
+        switch (trueCallerCallKind) {
+        case InlineCallFrame::Call:
+        case InlineCallFrame::Construct:
+        case InlineCallFrame::CallVarargs:
+        case InlineCallFrame::ConstructVarargs: {
+            CallLinkInfo* callLinkInfo =
+                baselineCodeBlockForCaller->getCallLinkInfoForBytecodeIndex(callBytecodeIndex);
+            RELEASE_ASSERT(callLinkInfo);
+
+            jumpTarget = callLinkInfo->callReturnLocation().retagged<JSEntryPtrTag>();
+            break;
+        }
+
+        case InlineCallFrame::GetterCall:
+        case InlineCallFrame::SetterCall: {
+            StructureStubInfo* stubInfo =
+                baselineCodeBlockForCaller->findStubInfo(CodeOrigin(callBytecodeIndex));
+            RELEASE_ASSERT(stubInfo);
+
+            jumpTarget = stubInfo->doneLocation.retagged<JSEntryPtrTag>();
+            break;
+        }
+
+        default:
+            RELEASE_ASSERT_NOT_REACHED();
+        }
+    }
+
     return jumpTarget;
 }
 
@@ -222,6 +254,8 @@
         CodeOrigin* trueCaller = inlineCallFrame->getCallerSkippingTailCalls(&trueCallerCallKind);
         GPRReg callerFrameGPR = GPRInfo::callFrameRegister;
 
+        bool callerIsLLInt = false;
+
         if (!trueCaller) {
             ASSERT(inlineCallFrame->isTail());
             jit.loadPtr(AssemblyHelpers::Address(GPRInfo::callFrameRegister, CallFrame::returnPCOffset()), GPRInfo::regT3);
@@ -237,7 +271,7 @@
         } else {
             CodeBlock* baselineCodeBlockForCaller = jit.baselineCodeBlockFor(*trueCaller);
             auto callBytecodeIndex = trueCaller->bytecodeIndex();
-            MacroAssemblerCodePtr<JSEntryPtrTag> jumpTarget = callerReturnPC(baselineCodeBlockForCaller, callBytecodeIndex, trueCallerCallKind);
+            MacroAssemblerCodePtr<JSEntryPtrTag> jumpTarget = callerReturnPC(baselineCodeBlockForCaller, callBytecodeIndex, trueCallerCallKind, callerIsLLInt);
 
             if (trueCaller->inlineCallFrame()) {
                 jit.addPtr(
@@ -268,8 +302,7 @@
             trueCaller ? AssemblyHelpers::UseExistingTagRegisterContents : AssemblyHelpers::CopyBaselineCalleeSavedRegistersFromBaseFrame,
             GPRInfo::regT2);
 
-        if (trueCaller) {
-            // Set up LLInt registers for our caller in our callee saves.
+        if (callerIsLLInt) {
             CodeBlock* baselineCodeBlockForCaller = jit.baselineCodeBlockFor(*trueCaller);
             jit.storePtr(CCallHelpers::TrustedImmPtr(baselineCodeBlockForCaller->metadataTable()), calleeSaveSlot(inlineCallFrame, baselineCodeBlock, LLInt::Registers::metadataTableGPR));
 #if USE(JSVALUE64)
@@ -355,26 +388,44 @@
     ASSERT(codeBlockForExit == codeBlockForExit->baselineVersion());
     ASSERT(JITCode::isBaselineCode(codeBlockForExit->jitType()));
 
-    auto bytecodeIndex = exit.m_codeOrigin.bytecodeIndex();
-    const Instruction& currentInstruction = *codeBlockForExit->instructions().at(bytecodeIndex).ptr();
-    MacroAssemblerCodePtr<JSEntryPtrTag> destination;
-    if (bytecodeIndex.checkpoint())
-        destination = LLInt::getCodePtr<JSEntryPtrTag>(checkpoint_osr_exit_trampoline);
-    else 
-        destination = LLInt::getCodePtr<JSEntryPtrTag>(currentInstruction);
+    void* jumpTarget;
+    bool exitToLLInt = Options::forceOSRExitToLLInt() || codeBlockForExit->jitType() == JITType::InterpreterThunk;
+    if (exitToLLInt) {
+        auto bytecodeIndex = exit.m_codeOrigin.bytecodeIndex();
+        const Instruction& currentInstruction = *codeBlockForExit->instructions().at(bytecodeIndex).ptr();
+        MacroAssemblerCodePtr<JSEntryPtrTag> destination;
+        if (bytecodeIndex.checkpoint())
+            destination = LLInt::getCodePtr<JSEntryPtrTag>(checkpoint_osr_exit_trampoline);
+        else 
+            destination = LLInt::getCodePtr<JSEntryPtrTag>(currentInstruction);
 
-    if (exit.isExceptionHandler()) {
-        jit.move(CCallHelpers::TrustedImmPtr(&currentInstruction), GPRInfo::regT2);
-        jit.storePtr(GPRInfo::regT2, &vm.targetInterpreterPCForThrow);
-    }
+        if (exit.isExceptionHandler()) {
+            jit.move(CCallHelpers::TrustedImmPtr(&currentInstruction), GPRInfo::regT2);
+            jit.storePtr(GPRInfo::regT2, &vm.targetInterpreterPCForThrow);
+        }
 
-    jit.move(CCallHelpers::TrustedImmPtr(codeBlockForExit->metadataTable()), LLInt::Registers::metadataTableGPR);
+        jit.move(CCallHelpers::TrustedImmPtr(codeBlockForExit->metadataTable()), LLInt::Registers::metadataTableGPR);
 #if USE(JSVALUE64)
-    jit.move(CCallHelpers::TrustedImmPtr(codeBlockForExit->instructionsRawPointer()), LLInt::Registers::pbGPR);
-    jit.move(CCallHelpers::TrustedImm32(bytecodeIndex.offset()), LLInt::Registers::pcGPR);
+        jit.move(CCallHelpers::TrustedImmPtr(codeBlockForExit->instructionsRawPointer()), LLInt::Registers::pbGPR);
+        jit.move(CCallHelpers::TrustedImm32(bytecodeIndex.offset()), LLInt::Registers::pcGPR);
 #else
-    jit.move(CCallHelpers::TrustedImmPtr(&currentInstruction), LLInt::Registers::pcGPR);
+        jit.move(CCallHelpers::TrustedImmPtr(&currentInstruction), LLInt::Registers::pcGPR);
 #endif
+        jumpTarget = destination.retagged<OSRExitPtrTag>().executableAddress();
+    } else {
+        BytecodeIndex exitIndex = exit.m_codeOrigin.bytecodeIndex();
+        MacroAssemblerCodePtr<JSEntryPtrTag> destination;
+        if (exitIndex.checkpoint())
+            destination = LLInt::getCodePtr<JSEntryPtrTag>(checkpoint_osr_exit_trampoline);
+        else {
+            ASSERT(codeBlockForExit->bytecodeIndexForExit(exitIndex) == exitIndex);
+            destination = codeBlockForExit->jitCodeMap().find(exitIndex);
+        }
+
+        ASSERT(destination);
+
+        jumpTarget = destination.retagged<OSRExitPtrTag>().executableAddress();
+    }
 
     jit.addPtr(AssemblyHelpers::TrustedImm32(JIT::stackPointerOffsetFor(codeBlockForExit) * sizeof(Register)), GPRInfo::callFrameRegister, AssemblyHelpers::stackPointerRegister);
     if (exit.isExceptionHandler()) {
@@ -382,7 +433,7 @@
         jit.storePtr(GPRInfo::callFrameRegister, vm.addressOfCallFrameForCatch());
     }
     
-    jit.move(AssemblyHelpers::TrustedImmPtr(destination.retagged<OSRExitPtrTag>().executableAddress()), GPRInfo::regT2);
+    jit.move(AssemblyHelpers::TrustedImmPtr(jumpTarget), GPRInfo::regT2);
     jit.farJump(GPRInfo::regT2, OSRExitPtrTag);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.h b/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.h
index dba0fe3..39114ea 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.h
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.h
@@ -39,6 +39,7 @@
 void handleExitCounts(VM&, CCallHelpers&, const OSRExitBase&);
 void reifyInlinedCallFrames(CCallHelpers&, const OSRExitBase&);
 void adjustAndJumpToTarget(VM&, CCallHelpers&, const OSRExitBase&);
+MacroAssemblerCodePtr<JSEntryPtrTag> callerReturnPC(CodeBlock* baselineCodeBlockForCaller, BytecodeIndex callBytecodeIndex, InlineCallFrame::Kind callerKind, bool& callerIsLLInt);
 CCallHelpers::Address calleeSaveSlot(InlineCallFrame*, CodeBlock* baselineCodeBlock, GPRReg calleeSave);
 
 template <typename JITCodeType>
diff --git a/Source/JavaScriptCore/heap/CodeBlockSet.cpp b/Source/JavaScriptCore/heap/CodeBlockSet.cpp
index 91eaced..49fcd84 100644
--- a/Source/JavaScriptCore/heap/CodeBlockSet.cpp
+++ b/Source/JavaScriptCore/heap/CodeBlockSet.cpp
@@ -55,11 +55,6 @@
     m_currentlyExecuting.clear();
 }
 
-bool CodeBlockSet::isCurrentlyExecuting(CodeBlock* codeBlock)
-{
-    return m_currentlyExecuting.contains(codeBlock);
-}
-
 void CodeBlockSet::dump(PrintStream& out) const
 {
     CommaPrinter comma;
diff --git a/Source/JavaScriptCore/heap/CodeBlockSet.h b/Source/JavaScriptCore/heap/CodeBlockSet.h
index b0dcb6c..c4c5827 100644
--- a/Source/JavaScriptCore/heap/CodeBlockSet.h
+++ b/Source/JavaScriptCore/heap/CodeBlockSet.h
@@ -56,10 +56,6 @@
     bool contains(const AbstractLocker&, void* candidateCodeBlock);
     Lock& getLock() { return m_lock; }
 
-    // This is expected to run only when we're not adding to the set for now. If
-    // this needs to run concurrently in the future, we'll need to lock around this.
-    bool isCurrentlyExecuting(CodeBlock*);
-
     // Visits each CodeBlock in the heap until the visitor function returns true
     // to indicate that it is done iterating, or until every CodeBlock has been
     // visited.
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index eb2ba41..4396305 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -613,11 +613,11 @@
     vm().builtinExecutables()->finalizeUnconditionally();
     finalizeMarkedUnconditionalFinalizers<FunctionExecutable>(vm().functionExecutableSpace.space);
     finalizeMarkedUnconditionalFinalizers<SymbolTable>(vm().symbolTableSpace);
-    finalizeMarkedUnconditionalFinalizers<ExecutableToCodeBlockEdge>(vm().executableToCodeBlockEdgesWithFinalizers); // We run this before CodeBlock's unconditional finalizer since CodeBlock looks at the owner executable's installed CodeBlock in its finalizeUnconditionally.
     vm().forEachCodeBlockSpace(
         [&] (auto& space) {
             this->finalizeMarkedUnconditionalFinalizers<CodeBlock>(space.set);
         });
+    finalizeMarkedUnconditionalFinalizers<ExecutableToCodeBlockEdge>(vm().executableToCodeBlockEdgesWithFinalizers);
     finalizeMarkedUnconditionalFinalizers<StructureRareData>(vm().structureRareDataSpace);
     finalizeMarkedUnconditionalFinalizers<UnlinkedFunctionExecutable>(vm().unlinkedFunctionExecutableSpace.set);
     if (vm().m_weakSetSpace)
@@ -1522,7 +1522,7 @@
     pruneStaleEntriesFromWeakGCMaps();
     sweepArrayBuffers();
     snapshotUnswept();
-    finalizeUnconditionalFinalizers(); // We rely on these unconditional finalizers running before clearCurrentlyExecuting since CodeBlock's finalizer relies on querying currently executing.
+    finalizeUnconditionalFinalizers();
     removeDeadCompilerWorklistEntries();
     notifyIncrementalSweeper();
     
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index 23c1d6c..f0ae725 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -1993,9 +1993,19 @@
 inline SlowPathReturnType dispatchToNextInstruction(CodeBlock* codeBlock, InstructionStream::Ref pc)
 {
     RELEASE_ASSERT(!codeBlock->vm().exceptionForInspection());
-    const Instruction* nextPC = pc.next().ptr();
-    auto nextBytecode = LLInt::getCodePtr<JSEntryPtrTag>(*pc.next().ptr());
-    return encodeResult(nextPC, nextBytecode.executableAddress());
+    if (Options::forceOSRExitToLLInt() || codeBlock->jitType() == JITType::InterpreterThunk) {
+        const Instruction* nextPC = pc.next().ptr();
+        auto nextBytecode = LLInt::getCodePtr<JSEntryPtrTag>(*pc.next().ptr());
+        return encodeResult(nextPC, nextBytecode.executableAddress());
+    }
+
+#if ENABLE(JIT)
+    ASSERT(codeBlock->jitType() == JITType::BaselineJIT);
+    BytecodeIndex nextBytecodeIndex = pc.next().index();
+    auto nextBytecode = codeBlock->jitCodeMap().find(nextBytecodeIndex);
+    return encodeResult(nullptr, nextBytecode.executableAddress());
+#endif
+    RELEASE_ASSERT_NOT_REACHED();
 }
 
 extern "C" SlowPathReturnType slow_path_checkpoint_osr_exit_from_inlined_call(CallFrame* callFrame, EncodedJSValue result)
diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
index d890e86..74ccdeb 100644
--- a/Source/JavaScriptCore/runtime/Options.cpp
+++ b/Source/JavaScriptCore/runtime/Options.cpp
@@ -387,7 +387,7 @@
     Options::validateDFGExceptionHandling() = true;
 #endif
 #if !ENABLE(JIT)
-    Options::forceBaseline() = false;
+    Options::useLLInt() = true;
     Options::useJIT() = false;
     Options::useBaselineJIT() = false;
     Options::useDFGJIT() = false;
@@ -419,7 +419,7 @@
     }
 
     if (!jitEnabledByDefault() && !Options::useJIT())
-        Options::forceBaseline() = false;
+        Options::useLLInt() = true;
 
     if (!Options::useWebAssembly())
         Options::useFastTLSForWasmContext() = false;
@@ -546,6 +546,8 @@
             RELEASE_ASSERT(Options::addressOfOptionDefault(useKernTCSMID) ==  &Options::useKernTCSMDefault());
             RELEASE_ASSERT(Options::addressOfOption(gcMaxHeapSizeID) ==  &Options::gcMaxHeapSize());
             RELEASE_ASSERT(Options::addressOfOptionDefault(gcMaxHeapSizeID) ==  &Options::gcMaxHeapSizeDefault());
+            RELEASE_ASSERT(Options::addressOfOption(forceOSRExitToLLIntID) ==  &Options::forceOSRExitToLLInt());
+            RELEASE_ASSERT(Options::addressOfOptionDefault(forceOSRExitToLLIntID) ==  &Options::forceOSRExitToLLIntDefault());
 
 #ifndef NDEBUG
             Config::enableRestrictedOptions();
@@ -943,9 +945,9 @@
 void Options::ensureOptionsAreCoherent()
 {
     bool coherent = true;
-    if (forceBaseline() && !useJIT()) {
+    if (!(useLLInt() || useJIT())) {
         coherent = false;
-        dataLog("INCOHERENT OPTIONS: forceBaseline can't be true if useJIT is false\n");
+        dataLog("INCOHERENT OPTIONS: at least one of useLLInt or useJIT must be true\n");
     }
     if (!coherent)
         CRASH();
diff --git a/Source/JavaScriptCore/runtime/OptionsList.h b/Source/JavaScriptCore/runtime/OptionsList.h
index 22571c5..46f0916 100644
--- a/Source/JavaScriptCore/runtime/OptionsList.h
+++ b/Source/JavaScriptCore/runtime/OptionsList.h
@@ -81,7 +81,7 @@
     v(Unsigned, dumpOptions, 0, Normal, "dumps JSC options (0 = None, 1 = Overridden only, 2 = All, 3 = Verbose)") \
     v(OptionString, configFile, nullptr, Normal, "file to configure JSC options and logging location") \
     \
-    v(Bool, forceBaseline, false, Normal, "If true, we'll start running code in the baseline JIT and skip starting in the LLInt") \
+    v(Bool, useLLInt,  true, Normal, "allows the LLINT to be used if true") \
     v(Bool, useJIT, jitEnabledByDefault(), Normal, "allows the executable pages to be allocated for JIT and thunks if true") \
     v(Bool, useBaselineJIT, true, Normal, "allows the baseline JIT to be used if true") \
     v(Bool, useDFGJIT, true, Normal, "allows the DFG JIT to be used if true") \
@@ -494,8 +494,8 @@
     v(OptionString, dumpJITMemoryPath, nullptr, Restricted, nullptr) \
     v(Double, dumpJITMemoryFlushInterval, 10, Restricted, "Maximum time in between flushes of the JIT memory dump in seconds.") \
     v(Bool, useUnlinkedCodeBlockJettisoning, false, Normal, "If true, UnlinkedCodeBlock can be jettisoned.") \
+    v(Bool, forceOSRExitToLLInt, false, Normal, "If true, we always exit to the LLInt. If false, we exit to whatever is most convenient.") \
     v(Unsigned, getByValICMaxNumberOfIdentifiers, 4, Normal, "Number of identifiers we see in the LLInt that could cause us to bail on generating an IC for get_by_val.") \
-    v(Bool, enableThrowingAwayBaselineCode, false, Normal, nullptr) \
 
 enum OptionEquivalence {
     SameOption,
diff --git a/Source/JavaScriptCore/runtime/ScriptExecutable.cpp b/Source/JavaScriptCore/runtime/ScriptExecutable.cpp
index 1223e94..ff84202 100644
--- a/Source/JavaScriptCore/runtime/ScriptExecutable.cpp
+++ b/Source/JavaScriptCore/runtime/ScriptExecutable.cpp
@@ -426,10 +426,10 @@
     if (Options::validateBytecode())
         codeBlock->validate();
     
-    if (Options::forceBaseline())
-        setupJIT(vm, codeBlock);
-    else
+    if (Options::useLLInt())
         setupLLInt(codeBlock);
+    else
+        setupJIT(vm, codeBlock);
     
     installCode(vm, codeBlock, codeBlock->codeType(), codeBlock->specializationKind());
     return nullptr;
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index e67ca64..73af85c 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,26 @@
+2020-01-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r254480, r254496, and r254517.
+        https://bugs.webkit.org/show_bug.cgi?id=206278
+
+        "It regressed JetStream2 and Speedometer2" (Requested by
+        saamyjoon on #webkit).
+
+        Reverted changesets:
+
+        "Throw away baseline code if there is an optimized
+        replacement"
+        https://bugs.webkit.org/show_bug.cgi?id=202503
+        https://trac.webkit.org/changeset/254480
+
+        "Unreviewed. Change useLLInt=0 to forceBaseline=1"
+        https://trac.webkit.org/changeset/254496
+
+        "Add an option that enables/disables throwing away baseline
+        JIT code"
+        https://bugs.webkit.org/show_bug.cgi?id=206244
+        https://trac.webkit.org/changeset/254517
+
 2020-01-14  Chris Dumez  <cdumez@apple.com>
 
         document.cookie should not do a sync IPC to the network process for iframes that do not have storage access
diff --git a/Tools/Scripts/run-jsc-stress-tests b/Tools/Scripts/run-jsc-stress-tests
index 3806cad..09e4f17 100755
--- a/Tools/Scripts/run-jsc-stress-tests
+++ b/Tools/Scripts/run-jsc-stress-tests
@@ -498,6 +498,7 @@
 B3O1_OPTIONS = ["--defaultB3OptLevel=1"]
 B3O0_OPTIONS = ["--maxDFGNodesInBasicBlockForPreciseAnalysis=100", "--defaultB3OptLevel=0"]
 FTL_OPTIONS = ["--useFTLJIT=true"]
+FORCE_LLINT_EXIT_OPTIONS = ["--forceOSRExitToLLInt=true"]
 
 require_relative "webkitruby/jsc-stress-test-writer-#{$testWriter}"
 
@@ -654,7 +655,7 @@
 
 def runNoLLInt(*optionalTestSpecificOptions)
     if $jitTests
-        run("no-llint", "--forceBaseline=true", *optionalTestSpecificOptions)
+        run("no-llint", "--useLLInt=false", *optionalTestSpecificOptions)
     end
 end
 
@@ -707,7 +708,7 @@
 end
 
 def runFTLNoCJITB3O0(*optionalTestSpecificOptions)
-    run("ftl-no-cjit-b3o0", "--useArrayAllocationProfiling=false", "--forcePolyProto=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + B3O0_OPTIONS + optionalTestSpecificOptions))
+    run("ftl-no-cjit-b3o0", "--useArrayAllocationProfiling=false", "--forcePolyProto=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + B3O0_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
 end
 
 def runFTLNoCJITValidate(*optionalTestSpecificOptions)
@@ -727,7 +728,7 @@
 end
 
 def runDFGEager(*optionalTestSpecificOptions)
-    run("dfg-eager", *(EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + optionalTestSpecificOptions))
+    run("dfg-eager", *(EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
 end
 
 def runDFGEagerNoCJITValidate(*optionalTestSpecificOptions)
@@ -744,7 +745,7 @@
 end
 
 def runFTLEagerNoCJITValidate(*optionalTestSpecificOptions)
-    run("ftl-eager-no-cjit", "--validateGraph=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + optionalTestSpecificOptions))
+    run("ftl-eager-no-cjit", "--validateGraph=true", "--airForceIRCAllocator=true", *(FTL_OPTIONS + NO_CJIT_OPTIONS + EAGER_OPTIONS + COLLECT_CONTINUOUSLY_OPTIONS + FORCE_LLINT_EXIT_OPTIONS + optionalTestSpecificOptions))
 end
 
 def runFTLEagerNoCJITB3O1(*optionalTestSpecificOptions)
@@ -1059,7 +1060,7 @@
         return
     end
 
-    run("no-llint-modules", "-m", "--forceBaseline=true") if noLLInt
+    run("no-llint-modules", "-m", "--useLLInt=false") if noLLInt
     run("no-cjit-validate-phases-modules", "-m", "--validateBytecode=true", "--validateGraphAtEachPhase=true", *NO_CJIT_OPTIONS)
     run("dfg-eager-modules", "-m", *EAGER_OPTIONS)
     run("dfg-eager-no-cjit-validate-modules", "-m", "--validateGraph=true", *(NO_CJIT_OPTIONS + EAGER_OPTIONS))
@@ -1260,7 +1261,7 @@
 end
 
 def runLayoutTestNoLLInt
-    runLayoutTest("no-llint", "--forceBaseline=true")
+    runLayoutTest("no-llint", "--useLLInt=false")
 end
 
 def runLayoutTestNoCJIT
@@ -1426,7 +1427,7 @@
 end
 
 def runMozillaTestBaselineJIT(mode, *extraFiles)
-    runMozillaTest("baseline", mode, extraFiles, "--forceBaseline=true", "--useDFGJIT=false")
+    runMozillaTest("baseline", mode, extraFiles, "--useLLInt=false", "--useDFGJIT=false")
 end
 
 def runMozillaTestDFGEagerNoCJITValidatePhases(mode, *extraFiles)