diff -up webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.double2intsPPC32 webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm --- webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.double2intsPPC32 2013-03-07 17:55:22.488831605 +0100 +++ webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm 2013-03-07 17:56:04.998829804 +0100 @@ -1729,7 +1729,7 @@ _llint_op_next_pname: loadi 20[PC], t2 loadi PayloadOffset[cfr, t2, 8], t2 loadp JSPropertyNameIterator::m_jsStrings[t2], t3 - loadi [t3, t0, 8], t3 + loadi PayloadOffset[t3, t0, 8], t3 addi 1, t0 storei t0, PayloadOffset[cfr, t1, 8] loadi 4[PC], t1 diff -up webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.double2intsPPC32 webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter.asm --- webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.double2intsPPC32 2013-03-07 17:56:24.953828958 +0100 +++ webkitgtk-1.11.90/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2013-03-07 17:58:05.653824691 +0100 @@ -263,13 +263,13 @@ macro assertNotConstant(index) end macro functionForCallCodeBlockGetter(targetRegister) - loadp Callee[cfr], targetRegister + loadp Callee + PayloadOffset[cfr], targetRegister loadp JSFunction::m_executable[targetRegister], targetRegister loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister end macro functionForConstructCodeBlockGetter(targetRegister) - loadp Callee[cfr], targetRegister + loadp Callee + PayloadOffset[cfr], targetRegister loadp JSFunction::m_executable[targetRegister], targetRegister loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister end @@ -824,7 +824,7 @@ macro interpretResolveWithBase(opcodeLen getResolveOperation(4, t0) btpz t0, .slowPath - loadp ScopeChain[cfr], t3 + loadp ScopeChain + PayloadOffset[cfr], t3 # Get the base loadis ResolveOperation::m_operation[t0], t2