diff -up webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix_2_4 webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
--- webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix_2_4	2016-03-07 11:32:36.130671900 +0100
+++ webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	2016-03-07 13:15:35.451673413 +0100
@@ -321,7 +321,7 @@ macro doCallToJavaScript(makeCall, doRet
 
 .calleeFramePopped:
     loadp Callee[cfr], temp3 # VM.topCallFrame
-    loadp ScopeChain[cfr], temp4
+    loadp ScopeChain + PayloadOffset[cfr], temp4
     storep temp4, [temp3]
 
     doReturn(extraStackSpace)
@@ -598,7 +598,7 @@ end
 
 
 macro branchIfException(label)
-    loadp ScopeChain[cfr], t3
+    loadp ScopeChain + PayloadOffset[cfr], t3
     andp MarkedBlockMask, t3
     loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     bieq VM::m_exception + TagOffset[t3], EmptyValueTag, .noException
@@ -2039,7 +2039,7 @@ _llint_op_catch:
     # the interpreter's throw trampoline (see _llint_throw_trampoline).
     # The throwing code must have known that we were throwing to the interpreter,
     # and have set VM::targetInterpreterPCForThrow.
-    loadp ScopeChain[cfr], t3
+    loadp ScopeChain + PayloadOffset[cfr], t3
     andp MarkedBlockMask, t3
     loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     loadp VM::callFrameForThrow[t3], cfr
@@ -2122,7 +2122,7 @@ macro nativeCallTrampoline(executableOff
     storei CellTag, ScopeChain + TagOffset[cfr]
     storei t1, ScopeChain + PayloadOffset[cfr]
     if X86
-        loadp ScopeChain[cfr], t3
+        loadp PayloadOffset + ScopeChain[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
         storep cfr, VM::topCallFrame[t3]
@@ -2135,11 +2135,11 @@ macro nativeCallTrampoline(executableOff
         move t0, cfr
         call executableOffsetToFunction[t1]
         addp 16 - 4, sp
-        loadp ScopeChain[cfr], t3
+        loadp PayloadOffset + ScopeChain[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     elsif ARM or ARMv7 or ARMv7_TRADITIONAL or MIPS or SH4
-        loadp ScopeChain[cfr], t3
+        loadp PayloadOffset + ScopeChain[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
         storep cfr, VM::topCallFrame[t3]
@@ -2155,11 +2155,11 @@ macro nativeCallTrampoline(executableOff
         end
         call executableOffsetToFunction[t1]
         restoreReturnAddressBeforeReturn(t3)
-        loadp ScopeChain[cfr], t3
+        loadp PayloadOffset + ScopeChain[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     elsif C_LOOP
-        loadp ScopeChain[cfr], t3
+        loadp PayloadOffset + ScopeChain[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
         storep cfr, VM::topCallFrame[t3]
@@ -2172,7 +2172,7 @@ macro nativeCallTrampoline(executableOff
         move t2, cfr
         cloopCallNative executableOffsetToFunction[t1]
         restoreReturnAddressBeforeReturn(t3)
-        loadp ScopeChain[cfr], t3
+        loadp PayloadOffset + ScopeChain[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     else
@@ -2212,7 +2212,7 @@ macro resolveScope()
     addi 1, t2
 
 .resolveScopeAfterActivationCheck:
-    loadp ScopeChain[cfr], t0
+    loadp ScopeChain + PayloadOffset[cfr], t0
     btiz t2, .resolveScopeLoopEnd
 
 .resolveScopeLoop:
@@ -2271,7 +2271,7 @@ _llint_op_resolve_scope:
 
 macro loadWithStructureCheck(operand, slowPath)
     loadisFromInstruction(operand, t0)
-    loadp [cfr, t0, 8], t0
+    loadp PayloadOffset[cfr, t0, 8], t0
     loadpFromInstruction(5, t1)
     bpneq JSCell::m_structure[t0], t1, slowPath
 end
diff -up webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.cloop_fix_2_4 webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
--- webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter.asm.cloop_fix_2_4	2015-05-20 11:03:24.000000000 +0200
+++ webkitgtk-2.4.9/Source/JavaScriptCore/llint/LowLevelInterpreter.asm	2016-03-07 11:32:36.129671904 +0100
@@ -299,13 +299,21 @@ macro assertNotConstant(index)
 end
 
 macro functionForCallCodeBlockGetter(targetRegister)
-    loadp Callee[cfr], targetRegister
+    if JSVALUE64
+        loadp Callee[cfr], targetRegister
+    else
+        loadp Callee + PayloadOffset[cfr], targetRegister
+    end
     loadp JSFunction::m_executable[targetRegister], targetRegister
     loadp FunctionExecutable::m_codeBlockForCall[targetRegister], targetRegister
 end
 
 macro functionForConstructCodeBlockGetter(targetRegister)
-    loadp Callee[cfr], targetRegister
+    if JSVALUE64
+        loadp Callee[cfr], targetRegister
+    else
+        loadp Callee + PayloadOffset[cfr], targetRegister
+    end
     loadp JSFunction::m_executable[targetRegister], targetRegister
     loadp FunctionExecutable::m_codeBlockForConstruct[targetRegister], targetRegister
 end