diff -up webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
--- webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm.cloop_fix	2014-09-22 13:50:10.398933680 +0200
+++ webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	2014-09-22 13:52:16.362750340 +0200
@@ -2159,7 +2159,7 @@ macro nativeCallTrampoline(executableOff
         else
             call executableOffsetToFunction[t1]
         end
-        loadp Callee[cfr], t3
+        loadp Callee + PayloadOffset[cfr], t3
         andp MarkedBlockMask, t3
         loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
         addp 8, sp
@@ -2256,7 +2256,7 @@ _llint_op_resolve_scope:
 
 macro loadWithStructureCheck(operand, slowPath)
     loadisFromInstruction(operand, t0)
-    loadp [cfr, t0, 8], t0
+    loadp PayloadOffset[cfr, t0, 8], t0
     loadpFromInstruction(5, t1)
     bpneq JSCell::m_structureID[t0], t1, slowPath
 end
diff -up webkitgtk-2.5.90/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp.cloop_fix webkitgtk-2.5.90/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
--- webkitgtk-2.5.90/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp.cloop_fix   2014-09-22 01:23:26.643580502 -0600
+++ webkitgtk-2.5.90/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp     2014-09-22 01:18:25.392657939 -0600
@@ -1392,7 +1392,7 @@ LLINT_SLOW_PATH_DECL(slow_path_get_from_
             {
                 ConcurrentJITLocker locker(codeBlock->m_lock);
                 pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), structure);
-                pc[6].u.operand = slot.cachedOffset();
+                pc[6].u.pointer = reinterpret_cast<void*>(slot.cachedOffset());
             }
             structure->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
         }
diff -up webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm.cloop_fix webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
--- webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm.cloop_fix    2014-09-22 01:22:29.943407090 -0600
+++ webkitgtk-2.5.90/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm      2014-09-22 01:20:25.463025643 -0600
@@ -2094,7 +2094,7 @@ macro loadWithStructureCheck(operand, sl
 end

 macro getProperty()
-    loadisFromInstruction(6, t1)
+    loadpFromInstruction(6, t1)
     loadPropertyAtVariableOffset(t1, t0, t2)
     valueProfile(t2, 7, t0)
     loadisFromInstruction(1, t0)
@@ -2111,7 +2111,7 @@ end

 macro getClosureVar()
     loadp JSEnvironmentRecord::m_registers[t0], t0
-    loadisFromInstruction(6, t1)
+    loadpFromInstruction(6, t1)
     loadq [t0, t1, 8], t0
     valueProfile(t0, 7, t1)
     loadisFromInstruction(1, t1)
@@ -2168,7 +2168,7 @@ _llint_op_get_from_scope:
 macro putProperty()
     loadisFromInstruction(3, t1)
     loadConstantOrVariable(t1, t2)
-    loadisFromInstruction(6, t1)
+    loadpFromInstruction(6, t1)
     storePropertyAtVariableOffset(t1, t0, t2)
 end

@@ -2185,7 +2185,7 @@ macro putClosureVar()
     loadisFromInstruction(3, t1)
     loadConstantOrVariable(t1, t2)
     loadp JSEnvironmentRecord::m_registers[t0], t0
-    loadisFromInstruction(6, t1)
+    loadpFromInstruction(6, t1)
     storeq t2, [t0, t1, 8]
 end

diff -up webkitgtk-2.5.90/Source/JavaScriptCore/runtime/CommonSlowPaths.h.cloop_fix webkitgtk-2.5.90/Source/JavaScriptCore/runtime/CommonSlowPaths.h
--- webkitgtk-2.5.90/Source/JavaScriptCore/runtime/CommonSlowPaths.h.cloop_fix  2014-09-22 01:25:13.843908763 -0600
+++ webkitgtk-2.5.90/Source/JavaScriptCore/runtime/CommonSlowPaths.h    2014-09-22 01:18:25.392657939 -0600
@@ -115,7 +115,7 @@ inline void tryCachePutToScopeGlobal(

     ConcurrentJITLocker locker(codeBlock->m_lock);
     pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
-    pc[6].u.operand = slot.cachedOffset();
+    pc[6].u.pointer = reinterpret_cast<void*>(slot.cachedOffset());
 }

 } // namespace CommonSlowPaths