WebKit side of merge from r41149 to r41181.

JavaScriptCore/jit/JITPropertyAccess.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 287 matching lines @@
 }
 
 void JIT::privateCompilePatchGetArrayLength(ProcessorReturnAddress returnAddress)
 {
     StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     returnAddress.relinkCallerToFunction(JITStubs::cti_op_get_by_id_array_fail);
 
     // Check eax is an array
-    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_interpreter->m_jsArrayVptr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
     loadPtr(Address(regT0, FIELD_OFFSET(JSArray, m_storage)), regT2);
     load32(Address(regT2, FIELD_OFFSET(ArrayStorage, m_length)), regT2);
 
     Jump failureCases2 = branch32(Above, regT2, Imm32(JSImmediate::maxImmediateInt));
 
     emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
 
@@ skipping 375 matching lines @@
     stubInfo->stubRoutine = patchBuffer.entry();
     
     returnAddress.relinkCallerToFunction(code);
 }
 
 #endif
 
 } // namespace JSC
 
 #endif // ENABLE(JIT)