Index: webkit-qtwebkit-23/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
===================================================================
--- webkit-qtwebkit-23.orig/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ webkit-qtwebkit-23/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -86,6 +86,11 @@ else
     const TagOffset = 4
     const PayloadOffset = 0
 end
+if JSVALUE64
+    const CellOffset = 0
+else
+    const CellOffset = PayloadOffset
+end
 
 # Constant for reasoning about butterflies.
 const IsArray                  = 1
@@ -263,13 +268,13 @@ macro assertNotConstant(index)
 end
 
 macro functionForCallCodeBlockGetter(targetRegister)
-    loadp Callee[cfr], targetRegister
+    loadp Callee + CellOffset[cfr], targetRegister
     loadp JSFunction::m_executable[targetRegister], targetRegister
     loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
 end
 
 macro functionForConstructCodeBlockGetter(targetRegister)
-    loadp Callee[cfr], targetRegister
+    loadp Callee + CellOffset[cfr], targetRegister
     loadp JSFunction::m_executable[targetRegister], targetRegister
     loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
 end
@@ -555,7 +560,11 @@ end
 
 macro putToBaseVariableBody(variableOffset, scratch1, scratch2, scratch3)
     loadisFromInstruction(1, scratch1)
-    loadp PayloadOffset[cfr, scratch1, 8], scratch1
+    if JSVALUE64
+        loadp [cfr, scratch1, 8], scratch1
+    else
+        loadp PayloadOffset[cfr, scratch1, 8], scratch1
+    end
     loadp JSVariableObject::m_registers[scratch1], scratch1
     loadisFromInstruction(3, scratch2)
     if JSVALUE64
@@ -684,7 +693,7 @@ _llint_op_resolve_global_var:
 macro resolveScopedVarBody(resolveOperations)
     # First ResolveOperation is to skip scope chain nodes
     getScope(macro(dest)
-                 loadp ScopeChain + PayloadOffset[cfr], dest
+                 loadp ScopeChain + CellOffset[cfr], dest
              end,
              ResolveOperation::m_scopesToSkip[resolveOperations], t1, t2)
     loadp JSVariableObject::m_registers[t1], t1 # t1 now contains the activation registers
@@ -709,7 +718,7 @@ _llint_op_resolve_scoped_var_on_top_scop
     loadisFromInstruction(1, t3)
 
     # We know we want the top scope chain entry
-    loadp ScopeChain + PayloadOffset[cfr], t1
+    loadp ScopeChain + CellOffset[cfr], t1
     loadp JSVariableObject::m_registers[t1], t1 # t1 now contains the activation registers
     
     # Second ResolveOperation tells us what offset to use
@@ -724,14 +733,18 @@ _llint_op_resolve_scoped_var_with_top_sc
     # First ResolveOperation tells us what register to check
     loadis ResolveOperation::m_activationRegister[t0], t1
 
-    loadp PayloadOffset[cfr, t1, 8], t1
+    if JSVALUE64
+        loadp [cfr, t1, 8], t1
+    else
+        loadp PayloadOffset[cfr, t1, 8], t1
+    end
 
     getScope(macro(dest)
                  btpz t1, .scopeChainNotCreated
                      loadp JSScope::m_next[t1], dest
                  jmp .done
                  .scopeChainNotCreated:
-                     loadp ScopeChain + PayloadOffset[cfr], dest
+                     loadp ScopeChain + CellOffset[cfr], dest
                  .done:
              end, 
              # Second ResolveOperation tells us how many more nodes to skip
@@ -786,7 +799,7 @@ _llint_op_resolve_base_to_scope:
     getResolveOperation(4, t0, t1)
     # First ResolveOperation is to skip scope chain nodes
     getScope(macro(dest)
-                 loadp ScopeChain + PayloadOffset[cfr], dest
+                 loadp ScopeChain + CellOffset[cfr], dest
              end,
              ResolveOperation::m_scopesToSkip[t0], t1, t2)
     loadisFromInstruction(1, t3)
@@ -804,14 +817,18 @@ _llint_op_resolve_base_to_scope_with_top
     # First ResolveOperation tells us what register to check
     loadis ResolveOperation::m_activationRegister[t0], t1
 
-    loadp PayloadOffset[cfr, t1, 8], t1
+    if JSVALUE64
+        loadp [cfr, t1, 8], t1
+    else
+        loadp PayloadOffset[cfr, t1, 8], t1
+    end
 
     getScope(macro(dest)
                  btpz t1, .scopeChainNotCreated
                      loadp JSScope::m_next[t1], dest
                  jmp .done
                  .scopeChainNotCreated:
-                     loadp ScopeChain + PayloadOffset[cfr], dest
+                     loadp ScopeChain + CellOffset[cfr], dest
                  .done:
              end, 
              # Second ResolveOperation tells us how many more nodes to skip
@@ -841,7 +858,7 @@ macro interpretResolveWithBase(opcodeLen
     getResolveOperation(4, t0, t1)
     btpz t0, .slowPath
 
-    loadp ScopeChain[cfr], t3
+    loadp ScopeChain + CellOffset[cfr], t3
     # Get the base
     loadis ResolveOperation::m_operation[t0], t2
 
@@ -856,14 +873,18 @@ macro interpretResolveWithBase(opcodeLen
 
     bineq t2, ResolveOperationSkipTopScopeNode, .notSkipTopScopeNode
         loadis ResolveOperation::m_activationRegister[t0], t1
-        loadp PayloadOffset[cfr, t1, 8], t1
+        if JSVALUE64
+            loadp [cfr, t1, 8], t1
+        else
+            loadp PayloadOffset[cfr, t1, 8], t1
+        end
 
         getScope(macro(dest)
                      btpz t1, .scopeChainNotCreated
                          loadp JSScope::m_next[t1], dest
                      jmp .done
                      .scopeChainNotCreated:
-                         loadp ScopeChain + PayloadOffset[cfr], dest
+                         loadp ScopeChain + CellOffset[cfr], dest
                      .done:
                  end,
                  sizeof ResolveOperation + ResolveOperation::m_scopesToSkip[t0], t1, t2)
Index: webkit-qtwebkit-23/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
===================================================================
--- webkit-qtwebkit-23.orig/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ webkit-qtwebkit-23/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -1287,7 +1287,7 @@ _llint_op_get_by_pname:
     loadp JSCell::m_structure[t2], t0
     bpneq t0, JSPropertyNameIterator::m_cachedStructure[t3], .opGetByPnameSlow
     loadi 24[PC], t0
-    loadi [cfr, t0, 8], t0
+    loadi PayloadOffset[cfr, t0, 8], t0
     subi 1, t0
     biaeq t0, JSPropertyNameIterator::m_numCacheableSlots[t3], .opGetByPnameSlow
     bilt t0, JSPropertyNameIterator::m_cachedStructureInlineCapacity[t3], .opGetByPnameInlineProperty
@@ -1718,7 +1718,7 @@ _llint_op_next_pname:
     loadi 20[PC], t2
     loadi PayloadOffset[cfr, t2, 8], t2
     loadp JSPropertyNameIterator::m_jsStrings[t2], t3
-    loadi [t3, t0, 8], t3
+    loadi PayloadOffset[t3, t0, 8], t3
     addi 1, t0
     storei t0, PayloadOffset[cfr, t1, 8]
     loadi 4[PC], t1
