diff --git a/JavaScriptCore/kjs/string_object.cpp b/JavaScriptCore/kjs/string_object.cpp
index 36563c3..a115697 100644
--- a/JavaScriptCore/kjs/string_object.cpp
+++ b/JavaScriptCore/kjs/string_object.cpp
@@ -50,15 +50,15 @@
   setInternalValue(String(string));
 }
 
-Value StringInstanceImp::lengthGetter(ExecState *exec, const Identifier& propertyName, const PropertySlot &slot)
+ValueImp *StringInstanceImp::lengthGetter(ExecState *exec, const Identifier& propertyName, const PropertySlot &slot)
 {
-    return Value(static_cast<StringInstanceImp *>(slot.slotBase())->internalValue().toString(exec).size());
+    return jsNumber(static_cast<StringInstanceImp *>(slot.slotBase())->internalValue()->toString(exec).size());
 }
 
-Value StringInstanceImp::indexGetter(ExecState *exec, const Identifier& propertyName, const PropertySlot &slot)
+ValueImp *StringInstanceImp::indexGetter(ExecState *exec, const Identifier& propertyName, const PropertySlot &slot)
 {
-    const UChar c = static_cast<StringInstanceImp *>(slot.slotBase())->internalValue().toString(exec)[slot.index()];
-    return Value(UString(&c, 1));
+    const UChar c = static_cast<StringInstanceImp *>(slot.slotBase())->internalValue()->toString(exec)[slot.index()];
+    return jsString(UString(&c, 1));
 }
 
 bool StringInstanceImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot &slot)
@@ -71,7 +71,7 @@
   bool ok;
   const unsigned index = propertyName.toArrayIndex(&ok);
   if (ok) {
-    const UString s = internalValue().toString(exec);
+    const UString s = internalValue()->toString(exec);
     const unsigned length = s.size();
     if (index >= length)
       return false;
@@ -82,7 +82,7 @@
   return ObjectImp::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void StringInstanceImp::put(ExecState *exec, const Identifier &propertyName, const Value &value, int attr)
+void StringInstanceImp::put(ExecState *exec, const Identifier &propertyName, ValueImp *value, int attr)
 {
   if (propertyName == lengthPropertyName)
     return;
@@ -142,10 +142,8 @@
                                        ObjectPrototypeImp *objProto)
   : StringInstanceImp(objProto)
 {
-  Value protect(this);
   // The constructor will be added later, after StringObjectImp has been built
-  putDirect(lengthPropertyName, NumberImp::zero(), DontDelete|ReadOnly|DontEnum);
-
+  putDirect(lengthPropertyName, jsZero(), DontDelete|ReadOnly|DontEnum);
 }
 
 bool StringPrototypeImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot &slot)
@@ -157,10 +155,9 @@
 
 StringProtoFuncImp::StringProtoFuncImp(ExecState *exec, int i, int len)
   : InternalFunctionImp(
-    static_cast<FunctionPrototypeImp*>(exec->lexicalInterpreter()->builtinFunctionPrototype().imp())
+    static_cast<FunctionPrototypeImp*>(exec->lexicalInterpreter()->builtinFunctionPrototype())
     ), id(i)
 {
-  Value protect(this);
   putDirect(lengthPropertyName, len, DontDelete|ReadOnly|DontEnum);
 }
 
@@ -171,8 +168,8 @@
 
 static inline bool regExpIsGlobal(RegExpImp *regExp, ExecState *exec)
 {
-    Value globalProperty = regExp->get(exec,"global");
-    return globalProperty.type() != UndefinedType && globalProperty.toBoolean(exec);
+    ValueImp *globalProperty = regExp->get(exec,"global");
+    return !globalProperty->isUndefined() && globalProperty->toBoolean(exec);
 }
 
 static inline void expandSourceRanges(UString::Range * & array, int& count, int& capacity)
@@ -259,22 +256,22 @@
   return substitutedReplacement;
 }
 
-static Value replace(ExecState *exec, const UString &source, const Value &pattern, const Value &replacement)
+static ValueImp *replace(ExecState *exec, const UString &source, ValueImp *pattern, ValueImp *replacement)
 {
   ObjectImp *replacementFunction = 0;
   UString replacementString;
 
-  if (replacement.type() == ObjectType && replacement.toObject(exec).implementsCall())
-    replacementFunction = replacement.toObject(exec).imp();
+  if (replacement->isObject() && replacement->toObject(exec)->implementsCall())
+    replacementFunction = replacement->toObject(exec);
   else
-    replacementString = replacement.toString(exec);
+    replacementString = replacement->toString(exec);
 
-  if (pattern.type() == ObjectType && pattern.toObject(exec).inherits(&RegExpImp::info)) {
-    RegExpImp* imp = static_cast<RegExpImp *>( pattern.toObject(exec).imp() );
+  if (pattern->isObject() && pattern->toObject(exec)->inherits(&RegExpImp::info)) {
+    RegExpImp* imp = static_cast<RegExpImp *>( pattern->toObject(exec) );
     RegExp *reg = imp->regExp();
     bool global = regExpIsGlobal(imp, exec);
 
-    RegExpObjectImp* regExpObj = static_cast<RegExpObjectImp*>(exec->lexicalInterpreter()->builtinRegExp().imp());
+    RegExpObjectImp* regExpObj = static_cast<RegExpObjectImp*>(exec->lexicalInterpreter()->builtinRegExp());
 
     int matchIndex = 0;
     int lastIndex = 0;
@@ -302,20 +299,20 @@
           int completeMatchStart = (*ovector)[0];
           List args;
 
-          args.append(Value(matchString));
+          args.append(jsString(matchString));
           
           for (unsigned i = 0; i < reg->subPatterns(); i++) {
               int matchStart = (*ovector)[(i + 1) * 2];
               int matchLen = (*ovector)[(i + 1) * 2 + 1] - matchStart;
               
-              args.append(Value(source.substr(matchStart, matchLen)));
+              args.append(jsString(source.substr(matchStart, matchLen)));
           }
           
-          args.append(Value(completeMatchStart));
-          args.append(Value(source));
+          args.append(jsNumber(completeMatchStart));
+          args.append(jsString(source));
 
           replacementString = replacementFunction->call(exec, exec->dynamicInterpreter()->globalObject(), 
-                                                        args).toString(exec);
+                                                        args)->toString(exec);
       }
       
       UString substitutedReplacement = substituteBackreferences(replacementString, source, ovector, reg);
@@ -344,7 +341,7 @@
   }
   
   // First arg is a string
-  UString patternString = pattern.toString(exec);
+  UString patternString = pattern->toString(exec);
   int matchPos = source.find(patternString);
   int matchLen = patternString.size();
   // Do the replacement
@@ -354,31 +351,31 @@
   if (replacementFunction) {
       List args;
       
-      args.append(Value(source.substr(matchPos, matchLen)));
-      args.append(Value(matchPos));
-      args.append(Value(source));
+      args.append(jsString(source.substr(matchPos, matchLen)));
+      args.append(jsNumber(matchPos));
+      args.append(jsString(source));
       
       replacementString = replacementFunction->call(exec, exec->dynamicInterpreter()->globalObject(), 
-                                                    args).toString(exec);
+                                                    args)->toString(exec);
   }
 
   return String(source.substr(0, matchPos) + replacementString + source.substr(matchPos + matchLen));
 }
 
 // ECMA 15.5.4.2 - 15.5.4.20
-Value StringProtoFuncImp::call(ExecState *exec, Object &thisObj, const List &args)
+ValueImp *StringProtoFuncImp::callAsFunction(ExecState *exec, ObjectImp *thisObj, const List &args)
 {
-  Value result;
+  ValueImp *result = NULL;
 
   // toString and valueOf are no generic function.
   if (id == ToString || id == ValueOf) {
-    if (thisObj.isNull() || !thisObj.inherits(&StringInstanceImp::info)) {
-      Object err = Error::create(exec,TypeError);
+    if (!thisObj || !thisObj->inherits(&StringInstanceImp::info)) {
+      ObjectImp *err = Error::create(exec,TypeError);
       exec->setException(err);
       return err;
     }
 
-    return String(thisObj.internalValue().toString(exec));
+    return String(thisObj->internalValue()->toString(exec));
   }
 
   UString u, u2, u3;
@@ -386,11 +383,11 @@
   double dpos;
   double d = 0.0;
 
-  UString s = thisObj.toString(exec);
+  UString s = thisObj->toString(exec);
 
   int len = s.size();
-  Value a0 = args[0];
-  Value a1 = args[1];
+  ValueImp *a0 = args[0];
+  ValueImp *a1 = args[1];
 
   switch (id) {
   case ToString:
@@ -400,7 +397,7 @@
   case CharAt:
     // Other browsers treat an omitted parameter as 0 rather than NaN.
     // That doesn't match the ECMA standard, but is needed for site compatibility.
-    dpos = a0.isA(UndefinedType) ? 0 : a0.toInteger(exec);
+    dpos = a0->isUndefined() ? 0 : a0->toInteger(exec);
     if (dpos >= 0 && dpos < len) // false for NaN
       u = s.substr(static_cast<int>(dpos), 1);
     else
@@ -410,26 +407,26 @@
   case CharCodeAt:
     // Other browsers treat an omitted parameter as 0 rather than NaN.
     // That doesn't match the ECMA standard, but is needed for site compatibility.
-    dpos = a0.isA(UndefinedType) ? 0 : a0.toInteger(exec);
+    dpos = a0->isUndefined() ? 0 : a0->toInteger(exec);
     if (dpos >= 0 && dpos < len) // false for NaN
       result = Number(s[static_cast<int>(dpos)].unicode());
     else
-      result = Number(NaN);
+      result = jsNaN();
     break;
   case Concat: {
     ListIterator it = args.begin();
     for ( ; it != args.end() ; ++it) {
-        s += it->dispatchToString(exec);
+        s += it->toString(exec);
     }
     result = String(s);
     break;
   }
   case IndexOf:
-    u2 = a0.toString(exec);
-    if (a1.type() == UndefinedType)
+    u2 = a0->toString(exec);
+    if (a1->isUndefined())
       dpos = 0;
     else {
-      dpos = a1.toInteger(exec);
+      dpos = a1->toInteger(exec);
       if (dpos >= 0) { // false for NaN
         if (dpos > len)
           dpos = len;
@@ -439,12 +436,12 @@
     result = Number(s.find(u2, static_cast<int>(dpos)));
     break;
   case LastIndexOf:
-    u2 = a0.toString(exec);
-    d = a1.toNumber(exec);
-    if (a1.type() == UndefinedType || KJS::isNaN(d))
+    u2 = a0->toString(exec);
+    d = a1->toNumber(exec);
+    if (a1->isUndefined() || KJS::isNaN(d))
       dpos = len;
     else {
-      dpos = a1.toInteger(exec);
+      dpos = a1->toInteger(exec);
       if (dpos >= 0) { // false for NaN
         if (dpos > len)
           dpos = len;
@@ -458,9 +455,9 @@
     u = s;
     RegExp *reg, *tmpReg = 0;
     RegExpImp *imp = 0;
-    if (a0.isA(ObjectType) && a0.toObject(exec).inherits(&RegExpImp::info))
+    if (a0->isObject() && a0->getObject()->inherits(&RegExpImp::info))
     {
-      imp = static_cast<RegExpImp *>( a0.toObject(exec).imp() );
+      imp = static_cast<RegExpImp *>(a0);
       reg = imp->regExp();
     }
     else
@@ -469,9 +466,9 @@
        *  If regexp is not an object whose [[Class]] property is "RegExp", it is
        *  replaced with the result of the expression new RegExp(regexp).
        */
-      reg = tmpReg = new RegExp(a0.toString(exec), RegExp::None);
+      reg = tmpReg = new RegExp(a0->toString(exec), RegExp::None);
     }
-    RegExpObjectImp* regExpObj = static_cast<RegExpObjectImp*>(exec->lexicalInterpreter()->builtinRegExp().imp());
+    RegExpObjectImp* regExpObj = static_cast<RegExpObjectImp*>(exec->lexicalInterpreter()->builtinRegExp());
     int **ovector = regExpObj->registerRegexp(reg, u);
     UString mstr = reg->match(u, -1, &pos, ovector);
     if (id == Search) {
@@ -492,7 +489,7 @@
 	int lastIndex = 0;
 	while (pos >= 0) {
           if (mstr.isNull())
-            list.append(UndefinedImp::staticUndefined);
+            list.append(jsUndefined());
           else
 	    list.append(String(mstr));
 	  lastIndex = pos;
@@ -508,7 +505,7 @@
 	  // other browsers and because Null is a false value.
 	  result = Null(); 
 	} else {
-	  result = exec->lexicalInterpreter()->builtinArray().construct(exec, list);
+	  result = exec->lexicalInterpreter()->builtinArray()->construct(exec, list);
 	}
       }
     }
@@ -521,7 +518,7 @@
   case Slice: // http://developer.netscape.com/docs/manuals/js/client/jsref/string.htm#1194366
     {
         // The arg processing is very much like ArrayProtoFunc::Slice
-        double begin = args[0].toInteger(exec);
+        double begin = args[0]->toInteger(exec);
         if (begin >= 0) { // false for NaN
           if (begin > len)
             begin = len;
@@ -531,8 +528,8 @@
             begin = 0;
         }
         double end = len;
-        if (args[1].type() != UndefinedType) {
-          end = args[1].toInteger(exec);
+        if (!args[1]->isUndefined()) {
+          end = args[1]->toInteger(exec);
           if (end >= 0) { // false for NaN
             if (end > len)
               end = len;
@@ -547,18 +544,18 @@
         break;
     }
     case Split: {
-    Object constructor = exec->lexicalInterpreter()->builtinArray();
-    Object res = Object::dynamicCast(constructor.construct(exec,List::empty()));
+    ObjectImp *constructor = exec->lexicalInterpreter()->builtinArray();
+    ObjectImp *res = static_cast<ObjectImp *>(constructor->construct(exec,List::empty()));
     result = res;
     u = s;
     i = p0 = 0;
-    uint32_t limit = a1.type() == UndefinedType ? 0xFFFFFFFFU : a1.toUInt32(exec);
-    if (a0.type() == ObjectType && Object::dynamicCast(a0).inherits(&RegExpImp::info)) {
-      Object obj0 = Object::dynamicCast(a0);
-      RegExp reg(obj0.get(exec,"source").toString(exec));
+    uint32_t limit = a1->isUndefined() ? 0xFFFFFFFFU : a1->toUInt32(exec);
+    if (a0->isObject() && static_cast<ObjectImp *>(a0)->inherits(&RegExpImp::info)) {
+      ObjectImp *obj0 = static_cast<ObjectImp *>(a0);
+      RegExp reg(obj0->get(exec,"source")->toString(exec));
       if (u.isEmpty() && !reg.match(u, 0).isNull()) {
 	// empty string matched by regexp -> empty array
-	res.put(exec,lengthPropertyName, Number(0));
+	res->put(exec,lengthPropertyName, Number(0));
 	break;
       }
       pos = 0;
@@ -572,13 +569,13 @@
 	  break;
 	pos = mpos + (mstr.isEmpty() ? 1 : mstr.size());
 	if (mpos != p0 || !mstr.isEmpty()) {
-	  res.put(exec,i, String(u.substr(p0, mpos-p0)));
+	  res->put(exec,i, String(u.substr(p0, mpos-p0)));
 	  p0 = mpos + mstr.size();
 	  i++;
 	}
       }
     } else {
-      u2 = a0.toString(exec);
+      u2 = a0->toString(exec);
       if (u2.isEmpty()) {
 	if (u.isEmpty()) {
 	  // empty separator matches empty string -> empty array
@@ -586,11 +583,11 @@
 	  break;
 	} else {
 	  while (static_cast<uint32_t>(i) != limit && i < u.size()-1)
-	    res.put(exec, i++, String(u.substr(p0++, 1)));
+	    res->put(exec, i++, String(u.substr(p0++, 1)));
 	}
       } else {
 	while (static_cast<uint32_t>(i) != limit && (pos = u.find(u2, p0)) >= 0) {
-	  res.put(exec, i, String(u.substr(p0, pos-p0)));
+	  res->put(exec, i, String(u.substr(p0, pos-p0)));
 	  p0 = pos + u2.size();
 	  i++;
 	}
@@ -598,13 +595,13 @@
     }
     // add remaining string, if any
     if (static_cast<uint32_t>(i) != limit)
-      res.put(exec, i++, String(u.substr(p0)));
-    res.put(exec,lengthPropertyName, Number(i));
+      res->put(exec, i++, String(u.substr(p0)));
+    res->put(exec,lengthPropertyName, Number(i));
     }
     break;
   case Substr: {
-    double d = a0.toInteger(exec);
-    double d2 = a1.toInteger(exec);
+    double d = a0->toInteger(exec);
+    double d2 = a1->toInteger(exec);
     if (!(d >= 0)) { // true for NaN
       d += len;
       if (!(d >= 0)) // true for NaN
@@ -622,8 +619,8 @@
     break;
   }
   case Substring: {
-    double start = a0.toNumber(exec);
-    double end = a1.toNumber(exec);
+    double start = a0->toNumber(exec);
+    double end = a1->toNumber(exec);
     if (KJS::isNaN(start))
       start = 0;
     if (KJS::isNaN(end))
@@ -636,7 +633,7 @@
       start = len;
     if (end > len)
       end = len;
-    if (a1.type() == UndefinedType)
+    if (a1->isUndefined())
       end = len;
     if (start > end) {
       double temp = end;
@@ -689,16 +686,16 @@
     result = String("<sup>" + s + "</sup>");
     break;
   case Fontcolor:
-    result = String("<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    result = String("<font color=\"" + a0->toString(exec) + "\">" + s + "</font>");
     break;
   case Fontsize:
-    result = String("<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
+    result = String("<font size=\"" + a0->toString(exec) + "\">" + s + "</font>");
     break;
   case Anchor:
-    result = String("<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
+    result = String("<a name=\"" + a0->toString(exec) + "\">" + s + "</a>");
     break;
   case Link:
-    result = String("<a href=\"" + a0.toString(exec) + "\">" + s + "</a>");
+    result = String("<a href=\"" + a0->toString(exec) + "\">" + s + "</a>");
     break;
 #endif
   }
@@ -713,7 +710,6 @@
                                  StringPrototypeImp *stringProto)
   : InternalFunctionImp(funcProto)
 {
-  Value protect(this);
   // ECMA 15.5.3.1 String.prototype
   putDirect(prototypePropertyName, stringProto, DontEnum|DontDelete|ReadOnly);
 
@@ -721,7 +717,7 @@
   putDirect(fromCharCode, new StringObjectFuncImp(exec,funcProto), DontEnum);
 
   // no. of arguments for constructor
-  putDirect(lengthPropertyName, NumberImp::one(), ReadOnly|DontDelete|DontEnum);
+  putDirect(lengthPropertyName, jsOne(), ReadOnly|DontDelete|DontEnum);
 }
 
 
@@ -731,12 +727,12 @@
 }
 
 // ECMA 15.5.2
-Object StringObjectImp::construct(ExecState *exec, const List &args)
+ObjectImp *StringObjectImp::construct(ExecState *exec, const List &args)
 {
-  ObjectImp *proto = exec->lexicalInterpreter()->builtinStringPrototype().imp();
+  ObjectImp *proto = exec->lexicalInterpreter()->builtinStringPrototype();
   if (args.size() == 0)
-    return Object(new StringInstanceImp(proto));
-  return Object(new StringInstanceImp(proto, args.begin()->dispatchToString(exec)));
+    return new StringInstanceImp(proto);
+  return new StringInstanceImp(proto, args.begin()->toString(exec));
 }
 
 bool StringObjectImp::implementsCall() const
@@ -745,13 +741,13 @@
 }
 
 // ECMA 15.5.1
-Value StringObjectImp::call(ExecState *exec, Object &/*thisObj*/, const List &args)
+ValueImp *StringObjectImp::callAsFunction(ExecState *exec, ObjectImp */*thisObj*/, const List &args)
 {
   if (args.isEmpty())
     return String("");
   else {
-    Value v = args[0];
-    return String(v.toString(exec));
+    ValueImp *v = args[0];
+    return String(v->toString(exec));
   }
 }
 
@@ -761,8 +757,7 @@
 StringObjectFuncImp::StringObjectFuncImp(ExecState *exec, FunctionPrototypeImp *funcProto)
   : InternalFunctionImp(funcProto)
 {
-  Value protect(this);
-  putDirect(lengthPropertyName, NumberImp::one(), DontDelete|ReadOnly|DontEnum);
+  putDirect(lengthPropertyName, jsOne(), DontDelete|ReadOnly|DontEnum);
 }
 
 bool StringObjectFuncImp::implementsCall() const
@@ -770,7 +765,7 @@
   return true;
 }
 
-Value StringObjectFuncImp::call(ExecState *exec, Object &/*thisObj*/, const List &args)
+ValueImp *StringObjectFuncImp::callAsFunction(ExecState *exec, ObjectImp */*thisObj*/, const List &args)
 {
   UString s;
   if (args.size()) {