Changeset 292445 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

Timestamp:

Apr 5, 2022, 5:54:05 PM (3 years ago)

Author:

[email protected]

Message:

[JSC] Strictly annotate pointers with TrustedImmPtr in CCallHelpers
​https://bugs.webkit.org/show_bug.cgi?id=238827

Reviewed by Mark Lam.

This allows us to detect pointer use in DFG easy. This is important in unlinked DFG development.
We also consistently use m_graph instead of m_jit.graph() in DFG::SpeculativeJIT.

We also purge CodeBlock* embedding in DFG code completely. Now we load it from the cfr
instead (compileLogShadowChickenTail and callOperationWithCallFrameRollbackOnException).

• dfg/DFGArrayifySlowPathGenerator.h:
• dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
• dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

• dfg/DFGOSRExit.cpp:

(JSC::DFG::OSRExit::OSRExit):
(JSC::DFG::OSRExit::compileExit):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::osrWriteBarrier):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::emitGetCallee):
(JSC::DFG::SpeculativeJIT::emitOSRExitFuzzCheck):
(JSC::DFG::SpeculativeJIT::speculationCheck):
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
(JSC::DFG::SpeculativeJIT::checkArray):
(JSC::DFG::SpeculativeJIT::useChildren):
(JSC::DFG::SpeculativeJIT::compileGetById):
(JSC::DFG::SpeculativeJIT::compileGetByIdFlush):
(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):
(JSC::DFG::SpeculativeJIT::compileInById):
(JSC::DFG::SpeculativeJIT::compileInByVal):
(JSC::DFG::SpeculativeJIT::compileHasPrivate):
(JSC::DFG::SpeculativeJIT::compileStringSlice):
(JSC::DFG::SpeculativeJIT::compileLoopHint):
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::createOSREntries):
(JSC::DFG::SpeculativeJIT::linkOSREntries):
(JSC::DFG::SpeculativeJIT::compileCheckTraps):
(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
(JSC::DFG::SpeculativeJIT::compilePutByVal):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
(JSC::DFG::compileClampDoubleToByte):
(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::nextBlock):
(JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid):
(JSC::DFG::SpeculativeJIT::identifierUID):
(JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
(JSC::DFG::SpeculativeJIT::compileToBoolean):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compileGetByVal):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileArithRandom):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32):
(JSC::DFG::SpeculativeJIT::compileCompareEqPtr):
(JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
(JSC::DFG::SpeculativeJIT::compileToBoolean):
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
(JSC::DFG::SpeculativeJIT::emitUntypedBranch):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compileGetByVal):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileArithRandom):
(JSC::DFG::SpeculativeJIT::compileDateGet):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::getPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
(JSC::FTL::DFG::LowerDFGToB3::cachedPutById):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames):
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
(JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
(JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

• ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

• jit/CCallHelpers.cpp:
• jit/CCallHelpers.h:

(JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value): Deleted.

• jit/JIT.cpp:

(JSC::JIT::emitEnterOptimizationCheck):

• jit/JITArithmetic.cpp:

(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):

• jit/JITOpcodes.cpp:

(JSC::JIT::emitSlow_op_new_object):
(JSC::JIT::emit_op_catch):
(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::op_enter_handlerGenerator):
(JSC::JIT::emit_op_debug):
(JSC::JIT::emitSlow_op_loop_hint):
(JSC::JIT::emit_op_new_regexp):
(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_profile_type):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_put_getter_by_id):
(JSC::JIT::emit_op_put_setter_by_id):
(JSC::JIT::emit_op_put_getter_setter_by_id):
(JSC::JIT::emitWriteBarrier):

• wasm/js/WasmToJS.cpp:

(JSC::Wasm::wasmToJS):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (207 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -80 +80 @@
     , m_lastGeneratedNode(LastNodeType)
     , m_indexInBlock(0)
-    , m_generationInfo(m_jit.graph().frameRegisterCount())
+    , m_generationInfo(m_graph.frameRegisterCount())
     , m_compileOkay(true)
-    , m_state(m_jit.graph())
-    , m_interpreter(m_jit.graph(), m_state)
+    , m_state(m_graph)
+    , m_interpreter(m_graph, m_state)
     , m_stream(&jit.jitCode()->variableEventStream)
     , m_minifiedGraph(&jit.jitCode()->minifiedDFG)
@@ -208 +208 @@
         } else {
             m_jit.move(
-                TrustedImmPtr::weakPointer(m_jit.graph(), inlineCallFrame->calleeRecovery.constant().asCell()),
+                TrustedImmPtr::weakPointer(m_graph, inlineCallFrame->calleeRecovery.constant().asCell()),
                 calleeGPR);
         }
@@ -226 +226 @@
 {
     if (!Options::useOSRExitFuzz()
-        || !canUseOSRExitFuzzing(m_jit.graph().baselineCodeBlockFor(m_origin.semantic))
+        || !canUseOSRExitFuzzing(m_graph.baselineCodeBlockFor(m_origin.semantic))
         || !doOSRExitFuzzing())
         return MacroAssembler::Jump();
@@ -271 +271 @@
     } else
         m_jit.appendExitInfo(jumpToFail);
-    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
+    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_graph.methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
 }
 
@@ -286 +286 @@
     } else
         m_jit.appendExitInfo(jumpsToFail);
-    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
+    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_graph.methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
 }
 
@@ -295 +295 @@
     unsigned index = m_jit.m_osrExit.size();
     m_jit.appendExitInfo();
-    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
+    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_graph.methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size()));
     return OSRExitJumpPlaceholder(index);
 }
@@ -320 +320 @@
     unsigned recoveryIndex = m_jit.appendSpeculationRecovery(recovery);
     m_jit.appendExitInfo(jumpToFail);
-    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size(), recoveryIndex));
+    m_jit.appendOSRExit(OSRExit(kind, jsValueSource, m_graph.methodOfGettingAValueProfileFor(m_currentNode, node), this, m_stream->size(), recoveryIndex));
 }
 
@@ -513 +513 @@
         ASSERT(info.gpr() == source);
         if (node->hasConstant()) {
-            DFG_ASSERT(m_jit.graph(), m_currentNode, node->isCellConstant());
+            DFG_ASSERT(m_graph, m_currentNode, node->isCellConstant());
             node->asCell(); // To get the assertion.
             fillAction = SetCellConstant;
@@ -857 +857 @@
     GPRReg baseReg = base.gpr();
     
-    if (arrayMode.alreadyChecked(m_jit.graph(), node, m_state.forNode(node->child1()))) {
+    if (arrayMode.alreadyChecked(m_graph, node, m_state.forNode(node->child1()))) {
         // We can purge Empty check completely in this case of CheckArrayOrEmpty since CellUse only accepts SpecCell | SpecEmpty.
 #if USE(JSVALUE64)
@@ -1018 +1018 @@
     if (node->flags() & NodeHasVarArgs) {
         for (unsigned childIdx = node->firstChild(); childIdx < node->firstChild() + node->numChildren(); childIdx++) {
-            if (!!m_jit.graph().m_varArgChildren[childIdx])
-                use(m_jit.graph().m_varArgChildren[childIdx]);
+            if (!!m_graph.m_varArgChildren[childIdx])
+                use(m_graph.m_varArgChildren[childIdx]);
         }
     } else {
@@ -1101 +1101 @@
 
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
         break;
     }
@@ -1166 +1166 @@
 
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
         break;
     }
@@ -1212 +1212 @@
             slowPath = slowPathCall(
                 slowCases, this, operationDeleteByIdOptimize,
-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), JSValueRegs(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
+                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), JSValueRegs(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
         }
 #else
@@ -1223 +1223 @@
             slowPath = slowPathCall(
                 slowCases, this, operationDeleteByIdOptimize,
-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
+                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits(), TrustedImm32(node->ecmaMode().value()));
         }
 #endif
@@ -1298 +1298 @@
             slowPath = slowPathCall(
                 slowCases, this, operationDeleteByValOptimize,
-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), JSValueRegs(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
+                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), JSValueRegs(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
         }
 #else
@@ -1309 +1309 @@
             slowPath = slowPathCall(
                 slowCases, this, operationDeleteByValOptimize,
-                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
+                resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), CCallHelpers::CellValue(baseGPR), keyRegs, TrustedImm32(node->ecmaMode().value()));
         }
 #endif
@@ -1379 +1379 @@
             slowCases, this, operationInByIdOptimize,
             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits());
+            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), CCallHelpers::CellValue(baseGPR), node->cacheableIdentifier().rawBits());
     }
 
@@ -1429 +1429 @@
             slowCases, this, operationInByValOptimize,
             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
+            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), nullptr, CCallHelpers::CellValue(baseGPR), keyRegs);
     }
 
@@ -1483 +1483 @@
             slowCases, this, type == AccessType::HasPrivateName ? operationHasPrivateNameOptimize : operationHasPrivateBrandOptimize,
             NeedToSpill, ExceptionCheckRequirement::CheckNeeded,
-            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyOrBrandGPR));
+            resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyOrBrandGPR));
     }
 
@@ -1912 +1912 @@
     VM& vm = this->vm();
     auto nonEmptyCase = m_jit.branch32(MacroAssembler::Below, startIndexGPR, tempGPR);
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(vm)), tempGPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, jsEmptyString(vm)), tempGPR);
     doneCases.append(m_jit.jump());
 
@@ -1942 +1942 @@
     m_jit.loadPtr(CCallHelpers::Address(tempGPR), tempGPR);
 
-    addSlowPathGenerator(slowPathCall(bigCharacter, this, operationSingleCharacterString, tempGPR, &vm, tempGPR));
+    addSlowPathGenerator(slowPathCall(bigCharacter, this, operationSingleCharacterString, tempGPR, TrustedImmPtr(&vm), tempGPR));
 
     addSlowPathGenerator(slowPathCall(slowCases, this, operationStringSubstr, tempGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), stringGPR, startIndexGPR, tempGPR));
@@ -2115 +2115 @@
         bool emitEarlyReturn = true;
         node->origin.semantic.walkUpInlineStack([&](CodeOrigin origin) {
-            CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(origin);
+            CodeBlock* baselineCodeBlock = m_graph.baselineCodeBlockFor(origin);
             if (!baselineCodeBlock->loopHintsAreEligibleForFuzzingEarlyReturn())
                 emitEarlyReturn = false;
         });
         if (emitEarlyReturn) {
-            CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
+            CodeBlock* baselineCodeBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
             BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
             const auto* instruction = baselineCodeBlock->instructions().at(bytecodeIndex.offset()).ptr();
@@ -2127 +2127 @@
             m_jit.pushToSave(GPRInfo::regT0);
             m_jit.loadPtr(ptr, GPRInfo::regT0);
-            auto skipEarlyReturn = m_jit.branchPtr(CCallHelpers::Below, GPRInfo::regT0, CCallHelpers::TrustedImmPtr(Options::earlyReturnFromInfiniteLoopsLimit()));
+            auto skipEarlyReturn = m_jit.branchPtr(CCallHelpers::Below, GPRInfo::regT0, TrustedImmPtr(Options::earlyReturnFromInfiniteLoopsLimit()));
 
             if constexpr (validateDFGDoesGC) {
@@ -2215 +2215 @@
 
     if (m_block->isCatchEntrypoint) {
-        m_jit.addPtr(CCallHelpers::TrustedImm32(-(m_jit.graph().frameRegisterCount() * sizeof(Register))), GPRInfo::callFrameRegister,  CCallHelpers::stackPointerRegister);
+        m_jit.addPtr(CCallHelpers::TrustedImm32(-(m_graph.frameRegisterCount() * sizeof(Register))), GPRInfo::callFrameRegister,  CCallHelpers::stackPointerRegister);
         m_jit.emitSaveCalleeSaves();
         m_jit.emitMaterializeTagCheckRegisters();
@@ -2241 +2241 @@
             continue; // No need to record dead SetLocal's.
         format = dataFormatFor(variable->flushFormat());
-        DFG_ASSERT(m_jit.graph(), node, !operand.isArgument() || operand.virtualRegister().toArgument() >= 0);
+        DFG_ASSERT(m_graph, node, !operand.isArgument() || operand.virtualRegister().toArgument() >= 0);
         m_stream->appendAndLog(VariableEvent::setLocal(operand, variable->machineLocal(), format));
     }
@@ -2290 +2290 @@
             dataLogLn("SpeculativeJIT generating Node @", (int)m_currentNode->index(), " (", m_currentNode->origin.semantic.bytecodeIndex().offset(), ") at JIT offset 0x", m_jit.debugOffset());
 
-        if (Options::validateDFGExceptionHandling() && (mayExit(m_jit.graph(), m_currentNode) != DoesNotExit || m_currentNode->isTerminal()))
-            m_jit.jitReleaseAssertNoException(m_jit.vm());
+        if (Options::validateDFGExceptionHandling() && (mayExit(m_graph, m_currentNode) != DoesNotExit || m_currentNode->isTerminal()))
+            m_jit.jitReleaseAssertNoException(vm());
 
         m_jit.pcToCodeOriginMapBuilder().appendItem(m_jit.labelIgnoringWatchpoints(), m_origin.semantic);
@@ -2351 +2351 @@
     m_origin = NodeOrigin(CodeOrigin(BytecodeIndex(0)), CodeOrigin(BytecodeIndex(0)), true);
 
-    auto& arguments = m_jit.graph().m_rootToArguments.find(m_jit.graph().block(0))->value;
+    auto& arguments = m_graph.m_rootToArguments.find(m_graph.block(0))->value;
     for (unsigned i = 0; i < m_jit.codeBlock()->numParameters(); ++i) {
         Node* node = arguments[i];
@@ -2423 +2423 @@
     
     ASSERT(!m_currentNode);
-    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
+    for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
         m_jit.setForBlockIndex(blockIndex);
-        m_block = m_jit.graph().block(blockIndex);
+        m_block = m_graph.block(blockIndex);
         compileCurrentBlock();
     }
@@ -2434 +2434 @@
 void SpeculativeJIT::createOSREntries()
 {
-    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
-        BasicBlock* block = m_jit.graph().block(blockIndex);
+    for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_graph.block(blockIndex);
         if (!block)
             continue;
@@ -2449 +2449 @@
 {
     unsigned osrEntryIndex = 0;
-    for (BlockIndex blockIndex = 0; blockIndex < m_jit.graph().numBlocks(); ++blockIndex) {
-        BasicBlock* block = m_jit.graph().block(blockIndex);
+    for (BlockIndex blockIndex = 0; blockIndex < m_graph.numBlocks(); ++blockIndex) {
+        BasicBlock* block = m_graph.block(blockIndex);
         if (!block)
             continue;
@@ -2456 +2456 @@
             continue;
         if (block->isCatchEntrypoint) {
-            auto& argumentsVector = m_jit.graph().m_rootToArguments.find(block)->value;
+            auto& argumentsVector = m_graph.m_rootToArguments.find(block)->value;
             Vector<FlushFormat> argumentFormats;
             argumentFormats.reserveInitialCapacity(argumentsVector.size());
@@ -2475 +2475 @@
 
     m_jit.jitCode()->finalizeOSREntrypoints(WTFMove(m_jit.m_osrEntry));
-    m_jit.jitCode()->common.finalizeCatchEntrypoints(WTFMove(m_jit.graph().m_catchEntrypoints));
+    m_jit.jitCode()->common.finalizeCatchEntrypoints(WTFMove(m_graph.m_catchEntrypoints));
 
     ASSERT(osrEntryIndex == m_osrEntryHeads.size());
@@ -2496 +2496 @@
 
     JITCompiler::Jump needTrapHandling = m_jit.branchTest32(JITCompiler::NonZero,
-        JITCompiler::AbsoluteAddress(m_jit.vm().traps().trapBitsAddress()),
+        JITCompiler::AbsoluteAddress(vm().traps().trapBitsAddress()),
         TrustedImm32(VMTraps::AsyncEvents));
 
@@ -2505 +2505 @@
 void SpeculativeJIT::compileContiguousPutByVal(Node* node)
 {
-    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1));
-    JSValueOperand value(this, m_jit.graph().varArgChild(node, 2), ManualOperandSpeculation);
+    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
+    SpeculateStrictInt32Operand property(this, m_graph.varArgChild(node, 1));
+    JSValueOperand value(this, m_graph.varArgChild(node, 2), ManualOperandSpeculation);
 
     GPRReg baseReg = base.gpr();
@@ -2516 +2516 @@
         return;
 
-    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    StorageOperand storage(this, m_graph.varArgChild(node, 3));
     GPRReg storageReg = storage.gpr();
 
@@ -2574 +2574 @@
     ArrayMode arrayMode = node->arrayMode();
 
-    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1));
-    SpeculateDoubleOperand value(this, m_jit.graph().varArgChild(node, 2));
+    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
+    SpeculateStrictInt32Operand property(this, m_graph.varArgChild(node, 1));
+    SpeculateDoubleOperand value(this, m_graph.varArgChild(node, 2));
 
     GPRReg baseReg = base.gpr();
@@ -2583 +2583 @@
 
     DFG_TYPE_CHECK(
-        JSValueRegs(), m_jit.graph().varArgChild(node, 2), SpecFullRealNumber,
+        JSValueRegs(), m_graph.varArgChild(node, 2), SpecFullRealNumber,
         m_jit.branchIfNaN(valueReg));
 
@@ -2589 +2589 @@
         return;
 
-    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    StorageOperand storage(this, m_graph.varArgChild(node, 3));
     GPRReg storageReg = storage.gpr();
 
@@ -2648 +2648 @@
 {
     ArrayMode arrayMode = node->arrayMode().modeForPut();
-    Edge child1 = m_jit.graph().varArgChild(node, 0);
-    Edge child2 = m_jit.graph().varArgChild(node, 1);
-    Edge child3 = m_jit.graph().varArgChild(node, 2);
-    Edge child4 = m_jit.graph().varArgChild(node, 3);
+    Edge child1 = m_graph.varArgChild(node, 0);
+    Edge child2 = m_graph.varArgChild(node, 1);
+    Edge child3 = m_graph.varArgChild(node, 2);
+    Edge child4 = m_graph.varArgChild(node, 3);
 
     switch (arrayMode.type()) {
@@ -2667 +2667 @@
     case Array::BigUint64Array:
 #endif
-        DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
+        DFG_CRASH(m_graph, node, "Bad array mode type");
         break;
 #if USE(JSVALUE64)
@@ -2674 +2674 @@
 #endif
     case Array::Generic: {
-        DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal || node->op() == PutByValDirect, node->op());
+        DFG_ASSERT(m_graph, node, node->op() == PutByVal || node->op() == PutByValDirect, node->op());
         if (m_graph.m_slowPutByVal.contains(node) || (child1.useKind() != CellUse && child1.useKind() != KnownCellUse)) {
             if (child1.useKind() == CellUse || child1.useKind() == KnownCellUse) {
@@ -2756 +2756 @@
             slowPath = slowPathCall(
                 slowCases, this, operation,
-                NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, gen.stubInfo(), nullptr);
+                NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), baseRegs, propertyRegs, valueRegs, TrustedImmPtr(gen.stubInfo()), nullptr);
         }
 
@@ -2950 +2950 @@
     addSlowPathGenerator(
         slowPathCall(
-            bigCharacter, this, operationSingleCharacterString, scratchReg, &vm, scratchReg));
+            bigCharacter, this, operationSingleCharacterString, scratchReg, TrustedImmPtr(&vm), scratchReg));
 
     if (node->arrayMode().isOutOfBounds()) {
@@ -2970 +2970 @@
             // indexed properties either.
             // https://bugs.webkit.org/show_bug.cgi?id=144668
-            m_jit.graph().registerAndWatchStructureTransition(stringPrototypeStructure);
-            m_jit.graph().registerAndWatchStructureTransition(objectPrototypeStructure);
+            m_graph.registerAndWatchStructureTransition(stringPrototypeStructure);
+            m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
 
             addSlowPathGenerator(makeUnique<SaneStringGetByValSlowPathGenerator>(
@@ -3526 +3526 @@
     static constexpr double byteMax = 255;
     static constexpr double half = 0.5;
-    jit.loadDouble(JITCompiler::TrustedImmPtr(&zero), scratch);
+    jit.loadDouble(SpeculativeJIT::TrustedImmPtr(&zero), scratch);
     MacroAssembler::Jump tooSmall = jit.branchDouble(MacroAssembler::DoubleLessThanOrEqualOrUnordered, source, scratch);
-    jit.loadDouble(JITCompiler::TrustedImmPtr(&byteMax), scratch);
+    jit.loadDouble(SpeculativeJIT::TrustedImmPtr(&byteMax), scratch);
     MacroAssembler::Jump tooBig = jit.branchDouble(MacroAssembler::DoubleGreaterThanAndOrdered, source, scratch);
     
-    jit.loadDouble(JITCompiler::TrustedImmPtr(&half), scratch);
+    jit.loadDouble(SpeculativeJIT::TrustedImmPtr(&half), scratch);
     // FIXME: This should probably just use a floating point round!
     // https://bugs.webkit.org/show_bug.cgi?id=72054
@@ -3554 +3554 @@
     if (node->op() == PutByValAlias)
         return JITCompiler::Jump();
-    JSArrayBufferView* view = m_jit.graph().tryGetFoldableView(
-        m_state.forNode(m_jit.graph().child(node, 0)).m_value, node->arrayMode());
+    JSArrayBufferView* view = m_graph.tryGetFoldableView(
+        m_state.forNode(m_graph.child(node, 0)).m_value, node->arrayMode());
     if (view) {
         size_t length = view->length();
-        Node* indexNode = m_jit.graph().child(node, 1).node();
+        Node* indexNode = m_graph.child(node, 1).node();
         if (indexNode->isAnyIntConstant() && static_cast<uint64_t>(indexNode->asAnyInt()) < length)
             return JITCompiler::Jump();
@@ -3883 +3883 @@
     ASSERT(isInt(type));
 
-    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1));
-    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
+    SpeculateStrictInt32Operand property(this, m_graph.varArgChild(node, 1));
+    StorageOperand storage(this, m_graph.varArgChild(node, 3));
 
     GPRTemporary scratch(this);
@@ -3905 +3905 @@
         propertyTag, valueTag,
 #endif
-        m_jit.graph().varArgChild(node, 2), slowPathCases, isClamped(type));
+        m_graph.varArgChild(node, 2), slowPathCases, isClamped(type));
     if (!result) {
         noResult(node);
@@ -4003 +4003 @@
     ASSERT(isFloat(type));
 
-    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateStrictInt32Operand property(this, m_jit.graph().varArgChild(node, 1));
-    SpeculateDoubleOperand valueOp(this, m_jit.graph().varArgChild(node, 2));
-    StorageOperand storage(this, m_jit.graph().varArgChild(node, 3));
+    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
+    SpeculateStrictInt32Operand property(this, m_graph.varArgChild(node, 1));
+    SpeculateDoubleOperand valueOp(this, m_graph.varArgChild(node, 2));
+    StorageOperand storage(this, m_graph.varArgChild(node, 3));
 
     FPRTemporary scratch(this);
@@ -4110 +4110 @@
     }
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
     }
 }
@@ -4116 +4116 @@
 void SpeculativeJIT::compileGetPrivateNameByVal(Node* node, JSValueRegs base, JSValueRegs property)
 {
-    DFG_ASSERT(m_jit.graph(), node, node->op() == GetPrivateName);
-    DFG_ASSERT(m_jit.graph(), node, m_graph.child(node, 1).useKind() == SymbolUse);
+    DFG_ASSERT(m_graph, node, node->op() == GetPrivateName);
+    DFG_ASSERT(m_graph, node, m_graph.child(node, 1).useKind() == SymbolUse);
 
     std::optional<GPRTemporary> stubInfo;
@@ -4157 +4157 @@
         return slowPathCall(
             slowCases, this, operationGetPrivateNameOptimize,
-            result.regs(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(),
+            result.regs(), TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()),
             base, CCallHelpers::CellValue(property.payloadGPR()));
     };
@@ -4223 +4223 @@
 
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
         break;
     }
@@ -4230 +4230 @@
 void SpeculativeJIT::compilePutByValForCellWithString(Node* node)
 {
-    SpeculateCellOperand arg1(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateCellOperand arg2(this, m_jit.graph().varArgChild(node, 1));
-    JSValueOperand arg3(this, m_jit.graph().varArgChild(node, 2));
+    SpeculateCellOperand arg1(this, m_graph.varArgChild(node, 0));
+    SpeculateCellOperand arg2(this, m_graph.varArgChild(node, 1));
+    JSValueOperand arg3(this, m_graph.varArgChild(node, 2));
 
     GPRReg arg1GPR = arg1.gpr();
@@ -4238 +4238 @@
     JSValueRegs arg3Regs = arg3.jsValueRegs();
 
-    speculateString(m_jit.graph().varArgChild(node, 1), arg2GPR);
+    speculateString(m_graph.varArgChild(node, 1), arg2GPR);
 
     flushRegisters();
@@ -4253 +4253 @@
 void SpeculativeJIT::compilePutByValForCellWithSymbol(Node* node)
 {
-    SpeculateCellOperand arg1(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateCellOperand arg2(this, m_jit.graph().varArgChild(node, 1));
-    JSValueOperand arg3(this, m_jit.graph().varArgChild(node, 2));
+    SpeculateCellOperand arg1(this, m_graph.varArgChild(node, 0));
+    SpeculateCellOperand arg2(this, m_graph.varArgChild(node, 1));
+    JSValueOperand arg3(this, m_graph.varArgChild(node, 2));
 
     GPRReg arg1GPR = arg1.gpr();
@@ -4261 +4261 @@
     JSValueRegs arg3Regs = arg3.jsValueRegs();
 
-    speculateSymbol(m_jit.graph().varArgChild(node, 1), arg2GPR);
+    speculateSymbol(m_graph.varArgChild(node, 1), arg2GPR);
 
     flushRegisters();
@@ -4360 +4360 @@
         slowPath = slowPathCall(
             slowCases, this, operation,
-            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, gen.stubInfo(), nullptr);
+            NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(propertyGPR), valueRegs, TrustedImmPtr(gen.stubInfo()), nullptr);
     }
 
@@ -4438 +4438 @@
         slowPath = slowPathCall(
             slowCases, this, operationCheckPrivateBrandOptimize, NoResult,
-            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), baseRegs, CCallHelpers::CellValue(brandGPR));
+            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), baseRegs, CCallHelpers::CellValue(brandGPR));
     }
 
@@ -4486 +4486 @@
         slowPath = slowPathCall(
             slowCases, this, operationSetPrivateBrandOptimize, NoResult,
-            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(brandGPR));
+            TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), CCallHelpers::CellValue(baseGPR), CCallHelpers::CellValue(brandGPR));
     }
 
@@ -4625 +4625 @@
     } else {
         slowPath = slowPathCall(
-            slowCases, this, operationInstanceOfOptimize, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), gen.stubInfo(), valueRegs, prototypeRegs);
+            slowCases, this, operationInstanceOfOptimize, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), TrustedImmPtr(gen.stubInfo()), valueRegs, prototypeRegs);
     }
     
@@ -4663 +4663 @@
 #endif
     
-    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse);
-    DFG_ASSERT(m_jit.graph(), node, node->child2().useKind() == UntypedUse);
+    DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse);
+    DFG_ASSERT(m_graph, node, node->child2().useKind() == UntypedUse);
     
     std::optional<GPRTemporary> stubInfo;
@@ -4777 +4777 @@
     Edge& rightChild = node->child2();
 
-    DFG_ASSERT(m_jit.graph(), node, node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(HeapBigIntUse) || node->isBinaryUseKind(BigInt32Use));
+    DFG_ASSERT(m_graph, node, node->isBinaryUseKind(UntypedUse) || node->isBinaryUseKind(AnyBigIntUse) || node->isBinaryUseKind(HeapBigIntUse) || node->isBinaryUseKind(BigInt32Use));
 
     if (isKnownNotNumber(leftChild.node()) || isKnownNotNumber(rightChild.node())) {
@@ -5262 +5262 @@
     }
 
-    CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
+    CodeBlock* baselineCodeBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -5346 +5346 @@
     }
 
-    CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
+    CodeBlock* baselineCodeBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -5609 +5609 @@
         if (node->identifierNumber() != UINT32_MAX)
             errorMessage = identifierUID(node->identifierNumber());
-        addSlowPathGenerator(slowPathCall(slowCases, this, operationToObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, errorMessage));
+        addSlowPathGenerator(slowPathCall(slowCases, this, operationToObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), valueRegs, TrustedImmPtr(errorMessage)));
     } else
         addSlowPathGenerator(slowPathCall(slowCases, this, operationCallObjectConstructor, resultGPR, TrustedImmPtr(node->cellOperand()), valueRegs));
@@ -5750 +5750 @@
 
     default: {
-        DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse, node->child1().useKind());
+        DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
         JSValueOperand op1(this, node->child1());
         JSValueRegs op1Regs = op1.jsValueRegs();
@@ -5928 +5928 @@
 {
     // FIXME: add a fast path, at least for BigInt32, but probably also for HeapBigInt here.
-    CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
+    CodeBlock* baselineCodeBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     UnaryArithProfile* arithProfile = baselineCodeBlock->unaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -6172 +6172 @@
     }
 
-    CodeBlock* baselineCodeBlock = m_jit.graph().baselineCodeBlockFor(node->origin.semantic);
+    CodeBlock* baselineCodeBlock = m_graph.baselineCodeBlockFor(node->origin.semantic);
     BytecodeIndex bytecodeIndex = node->origin.semantic.bytecodeIndex();
     BinaryArithProfile* arithProfile = baselineCodeBlock->binaryArithProfileForBytecodeIndex(bytecodeIndex);
@@ -6645 +6645 @@
     }
 
-    DFG_ASSERT(m_jit.graph(), node, node->binaryUseKind() == UntypedUse || node->binaryUseKind() == AnyBigIntUse || node->binaryUseKind() == BigInt32Use, node->binaryUseKind());
+    DFG_ASSERT(m_graph, node, node->binaryUseKind() == UntypedUse || node->binaryUseKind() == AnyBigIntUse || node->binaryUseKind() == BigInt32Use, node->binaryUseKind());
     JSValueOperand op1(this, leftChild, ManualOperandSpeculation);
     JSValueOperand op2(this, rightChild, ManualOperandSpeculation);
@@ -7033 +7033 @@
     }
 
-    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse, node->child1().useKind());
+    DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
 
     JSValueOperand argument(this, node->child1());
@@ -7165 +7165 @@
 
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
         break;
     }
@@ -7178 +7178 @@
 
     static constexpr double oneConstant = 1.0;
-    assembler.loadDouble(MacroAssembler::TrustedImmPtr(&oneConstant), result);
+    assembler.loadDouble(SpeculativeJIT::TrustedImmPtr(&oneConstant), result);
 
     MacroAssembler::Label startLoop(assembler.label());
@@ -7220 +7220 @@
     }
 
-    DFG_ASSERT(m_jit.graph(), node, node->binaryUseKind() == UntypedUse || node->binaryUseKind() == AnyBigIntUse || node->binaryUseKind() == BigInt32Use, node->binaryUseKind());
+    DFG_ASSERT(m_graph, node, node->binaryUseKind() == UntypedUse || node->binaryUseKind() == AnyBigIntUse || node->binaryUseKind() == BigInt32Use, node->binaryUseKind());
 
     JSValueOperand left(this, leftChild, ManualOperandSpeculation);
@@ -8237 +8237 @@
     GPRReg eqGPR = eq.gpr();
 
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(vm())), eqGPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, jsEmptyString(vm())), eqGPR);
     m_jit.comparePtr(invert ? CCallHelpers::Equal : CCallHelpers::NotEqual, strGPR, eqGPR, eqGPR);
     unblessedBooleanResult(eqGPR, node);
@@ -8254 +8254 @@
         valueRegs, node->child1(), (~SpecCellCheck) | SpecString, m_jit.branchIfNotString(cellGPR));
 
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(vm())), tempGPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, jsEmptyString(vm())), tempGPR);
     m_jit.comparePtr(invert ? CCallHelpers::Equal : CCallHelpers::NotEqual, cellGPR, tempGPR, tempGPR);
     auto done = m_jit.jump();
@@ -8275 +8275 @@
     speculateString(nodeUse, strGPR);
 
-    branchPtr(CCallHelpers::Equal, strGPR, TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(vm())), notTaken);
+    branchPtr(CCallHelpers::Equal, strGPR, TrustedImmPtr::weakPointer(m_graph, jsEmptyString(vm())), notTaken);
     jump(taken);
 
@@ -8292 +8292 @@
     DFG_TYPE_CHECK(valueRegs, nodeUse, (~SpecCellCheck) | SpecString, m_jit.branchIfNotString(cellGPR));
 
-    branchPtr(CCallHelpers::Equal, cellGPR, TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(vm())), notTaken);
+    branchPtr(CCallHelpers::Equal, cellGPR, TrustedImmPtr::weakPointer(m_graph, jsEmptyString(vm())), notTaken);
     jump(taken, ForceJump);
 
@@ -8332 +8332 @@
         VM& vm = this->vm();
         if (vm.primitiveGigacageEnabled().isStillValid())
-            m_jit.graph().watchpoints().addLazily(vm.primitiveGigacageEnabled());
+            m_graph.watchpoints().addLazily(vm.primitiveGigacageEnabled());
         else {
             untagArrayPtr();
@@ -8576 +8576 @@
     GPRTemporary result(this);
     GPRReg resultGPR = result.gpr();
-    auto* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    auto* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     m_jit.loadPtr(globalObject->addressOfGlobalThis(), resultGPR);
     cellResult(resultGPR, node);
@@ -8739 +8739 @@
     
     m_jit.storePtr(scopeGPR, JITCompiler::Address(resultGPR, JSFunction::offsetOfScopeChain()));
-    m_jit.storePtr(TrustedImmPtr::weakPointer(m_jit.graph(), executable), JITCompiler::Address(resultGPR, JSFunction::offsetOfExecutableOrRareData()));
+    m_jit.storePtr(TrustedImmPtr::weakPointer(m_graph, executable), JITCompiler::Address(resultGPR, JSFunction::offsetOfExecutableOrRareData()));
     m_jit.mutatorFence(vm());
 }
@@ -8760 +8760 @@
 
         if (nodeType == NewGeneratorFunction)
-            callOperation(operationNewGeneratorFunction, resultGPR, &vm(), scopeGPR, executable);
+            callOperation(operationNewGeneratorFunction, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable));
         else if (nodeType == NewAsyncFunction)
-            callOperation(operationNewAsyncFunction, resultGPR, &vm(), scopeGPR, executable);
+            callOperation(operationNewAsyncFunction, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable));
         else if (nodeType == NewAsyncGeneratorFunction)
-            callOperation(operationNewAsyncGeneratorFunction, resultGPR, &vm(), scopeGPR, executable);
+            callOperation(operationNewAsyncGeneratorFunction, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable));
         else
-            callOperation(operationNewFunction, resultGPR, &vm(), scopeGPR, executable);
+            callOperation(operationNewFunction, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable));
         m_jit.exceptionCheck();
         cellResult(resultGPR, node);
@@ -8772 +8772 @@
     }
 
-    RegisteredStructure structure = m_jit.graph().registerStructure(
+    RegisteredStructure structure = m_graph.registerStructure(
         [&] () {
-            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
             switch (nodeType) {
             case NewGeneratorFunction:
@@ -8802 +8802 @@
         compileNewFunctionCommon<JSFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSFunction::allocationSize(0), executable);
             
-        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, &vm(), scopeGPR, executable));
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable)));
     }
 
@@ -8808 +8808 @@
         compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable);
 
-        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, &vm(), scopeGPR, executable));
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable)));
     }
 
@@ -8814 +8814 @@
         compileNewFunctionCommon<JSAsyncFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncFunction::allocationSize(0), executable);
 
-        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint, resultGPR, &vm(), scopeGPR, executable));
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable)));
     }
 
@@ -8820 +8820 @@
         compileNewFunctionCommon<JSAsyncGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSAsyncGeneratorFunction::allocationSize(0), executable);
         
-        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, &vm(), scopeGPR, executable));
+        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewAsyncGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, TrustedImmPtr(&vm()), scopeGPR, TrustedImmPtr::weakPointer(m_graph, executable)));
     }
     
@@ -8965 +8965 @@
 {
     SymbolTable* table = node->castOperand<SymbolTable*>();
-    RegisteredStructure structure = m_jit.graph().registerStructure(m_jit.graph().globalObjectFor(
+    RegisteredStructure structure = m_graph.registerStructure(m_graph.globalObjectFor(
         node->origin.semantic)->activationStructure());
         
@@ -8987 +8987 @@
 #if USE(JSVALUE64)
         callOperation(operationCreateActivationDirect,
-            resultGPR, &vm(), structure, scopeGPR, table, TrustedImm64(JSValue::encode(initializationValue)));
+            resultGPR, TrustedImmPtr(&vm()), structure, scopeGPR, TrustedImmPtr::weakPointer(m_graph, table), TrustedImm64(JSValue::encode(initializationValue)));
 #else
         callOperation(operationCreateActivationDirect,
-            resultGPR, &vm(), structure, scopeGPR, table, initializationRegs);
+            resultGPR, TrustedImmPtr(&vm()), structure, scopeGPR, TrustedImmPtr::weakPointer(m_graph, table), initializationRegs);
 #endif
         m_jit.exceptionCheck();
@@ -9036 +9036 @@
     addSlowPathGenerator(
         slowPathCall(
-            slowPath, this, operationCreateActivationDirect, resultGPR, &vm(), structure, scopeGPR, table, TrustedImm64(JSValue::encode(initializationValue))));
+            slowPath, this, operationCreateActivationDirect, resultGPR, TrustedImmPtr(&vm()), structure, scopeGPR, TrustedImmPtr::weakPointer(m_graph, table), TrustedImm64(JSValue::encode(initializationValue))));
 #else
     addSlowPathGenerator(
         slowPathCall(
-            slowPath, this, operationCreateActivationDirect, resultGPR, &vm(), structure, scopeGPR, table, initializationRegs));
+            slowPath, this, operationCreateActivationDirect, resultGPR, TrustedImmPtr(&vm()), structure, scopeGPR, TrustedImmPtr::weakPointer(m_graph, table), initializationRegs));
 #endif
 
@@ -9062 +9062 @@
     JSValueRegs valueRegs = JSValueRegs::withTwoAvailableRegs(scratch1GPR, scratch2GPR);
         
-    unsigned minCapacity = m_jit.graph().baselineCodeBlockFor(node->origin.semantic)->numParameters() - 1;
+    unsigned minCapacity = m_graph.baselineCodeBlockFor(node->origin.semantic)->numParameters() - 1;
         
     unsigned knownLength;
@@ -9085 +9085 @@
         
     RegisteredStructure structure =
-        m_jit.graph().registerStructure(m_jit.graph().globalObjectFor(node->origin.semantic)->directArgumentsStructure());
+        m_graph.registerStructure(m_graph.globalObjectFor(node->origin.semantic)->directArgumentsStructure());
         
     // Use a different strategy for allocating the object depending on whether we know its
@@ -9135 +9135 @@
         addSlowPathGenerator(
             slowPathCall(
-                slowPath, this, operationCreateDirectArguments, resultGPR, &vm(), structure,
+                slowPath, this, operationCreateDirectArguments, resultGPR, TrustedImmPtr(&vm()), structure,
                 knownLength, minCapacity));
     } else {
@@ -9152 +9152 @@
             m_jit.move(
                 TrustedImmPtr::weakPointer(
-                    m_jit.graph(), inlineCallFrame->calleeRecovery.constant().asCell()),
+                    m_graph, inlineCallFrame->calleeRecovery.constant().asCell()),
                 scratch1GPR);
         }
@@ -9270 +9270 @@
         1, [&] (GPRReg destGPR) {
             m_jit.move(
-                TrustedImmPtr::weakPointer(m_jit.graph(), globalObject->scopedArgumentsStructure()),
+                TrustedImmPtr::weakPointer(m_graph, globalObject->scopedArgumentsStructure()),
                 destGPR);
         });
@@ -9300 +9300 @@
             m_jit.move(
                 TrustedImmPtr::weakPointer(
-                    m_jit.graph(), globalObject->clonedArgumentsStructure()),
+                    m_graph, globalObject->clonedArgumentsStructure()),
                 destGPR);
         });
@@ -9337 +9337 @@
     ASSERT(node->op() == CreateRest);
 
-    if (m_jit.graph().isWatchingHavingABadTimeWatchpoint(node)) {
+    if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
         SpeculateStrictInt32Operand arrayLength(this, node->child1());
         GPRTemporary arrayResult(this);
@@ -9349 +9349 @@
         // arguments to have arrayLength exceed MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.
         bool shouldAllowForArrayStorageStructureForLargeArrays = false;
-        compileAllocateNewArrayWithSize(m_jit.graph().globalObjectFor(node->origin.semantic), arrayResultGPR, arrayLengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
+        compileAllocateNewArrayWithSize(m_graph.globalObjectFor(node->origin.semantic), arrayResultGPR, arrayLengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
 
         GPRTemporary argumentsStart(this);
@@ -9410 +9410 @@
         speculateArray(node->child1(), argument);
 
-    if (m_jit.graph().canDoFastSpread(node, m_state.forNode(node->child1()))) {
+    if (m_graph.canDoFastSpread(node, m_state.forNode(node->child1()))) {
 #if USE(JSVALUE64)
         GPRTemporary result(this);
@@ -9448 +9448 @@
         m_jit.add32(TrustedImm32(JSImmutableButterfly::offsetOfData()), scratch1GPR);
 
-        m_jit.emitAllocateVariableSizedCell<JSImmutableButterfly>(vm(), resultGPR, TrustedImmPtr(m_jit.graph().registerStructure(m_jit.graph().m_vm.immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].get())), scratch1GPR, scratch1GPR, scratch2GPR, slowPath);
+        m_jit.emitAllocateVariableSizedCell<JSImmutableButterfly>(vm(), resultGPR, TrustedImmPtr(m_graph.registerStructure(m_graph.m_vm.immutableButterflyStructures[arrayIndexFromIndexingType(CopyOnWriteArrayWithContiguous) - NumberOfIndexingShapes].get())), scratch1GPR, scratch1GPR, scratch2GPR, slowPath);
         m_jit.store32(lengthGPR, MacroAssembler::Address(resultGPR, JSImmutableButterfly::offsetOfPublicLength()));
         m_jit.store32(lengthGPR, MacroAssembler::Address(resultGPR, JSImmutableButterfly::offsetOfVectorLength()));
@@ -9515 +9515 @@
 void SpeculativeJIT::compileNewArray(Node* node)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
-    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+    RegisteredStructure structure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
     if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
         unsigned numElements = node->numChildren();
@@ -9525 +9525 @@
         // uninitialized contiguous JSArray, which ensures that we will never produce a half-baked JSArray.
         for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex)
-            speculate(node, m_jit.graph().varArgChild(node, operandIndex));
+            speculate(node, m_graph.varArgChild(node, operandIndex));
 
         GPRTemporary result(this);
@@ -9541 +9541 @@
 
         for (unsigned operandIndex = 0; operandIndex < node->numChildren(); ++operandIndex) {
-            Edge use = m_jit.graph().varArgChild(node, operandIndex);
+            Edge use = m_graph.varArgChild(node, operandIndex);
             switch (node->indexingType()) {
             case ALL_BLANK_INDEXING_TYPES:
@@ -9580 +9580 @@
         flushRegisters();
         GPRFlushedCallResult result(this);
-        callOperation(operationNewEmptyArray, result.gpr(), &vm(), structure);
+        callOperation(operationNewEmptyArray, result.gpr(), TrustedImmPtr(&vm()), structure);
         m_jit.exceptionCheck();
         cellResult(result.gpr(), node);
@@ -9595 +9595 @@
         // probably something hilarious going on and we're already failing at all the
         // things, but at least we're going to be sound.
-        Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + operandIdx];
+        Edge use = m_graph.m_varArgChildren[node->firstChild() + operandIdx];
         switch (node->indexingType()) {
         case ALL_BLANK_INDEXING_TYPES:
@@ -9644 +9644 @@
 
     callOperation(
-        operationNewArray, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
-        static_cast<void*>(buffer), size_t(node->numChildren()));
+        operationNewArray, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType())),
+        TrustedImmPtr(buffer), size_t(node->numChildren()));
     m_jit.exceptionCheck();
 
@@ -9654 +9654 @@
 {
     ASSERT(node->op() == NewArrayWithSpread);
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
 
 #if USE(JSVALUE64)
-    if (m_jit.graph().isWatchingHavingABadTimeWatchpoint(node)) {
+    if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
         GPRTemporary result(this);
         GPRReg resultGPR = result.gpr();
@@ -9664 +9664 @@
 
         if (node->numChildren() == 1 && bitVector->get(0)) {
-            Edge use = m_jit.graph().varArgChild(node, 0);
+            Edge use = m_graph.varArgChild(node, 0);
             SpeculateCellOperand immutableButterfly(this, use);
             GPRTemporary result(this);
@@ -9677 +9677 @@
             GPRReg scratch2GPR = scratch2.gpr();
 
-            RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->originalArrayStructureForIndexingType(CopyOnWriteArrayWithContiguous));
+            RegisteredStructure structure = m_graph.registerStructure(globalObject->originalArrayStructureForIndexingType(CopyOnWriteArrayWithContiguous));
 
             MacroAssembler::JumpList slowCases;
@@ -9686 +9686 @@
             emitAllocateJSObject<JSArray>(resultGPR, TrustedImmPtr(structure), butterflyGPR, scratch1GPR, scratch2GPR, slowCases);
 
-            addSlowPathGenerator(slowPathCall(slowCases, this, operationNewArrayBuffer, resultGPR, &vm(), structure, immutableButterflyGPR));
+            addSlowPathGenerator(slowPathCall(slowCases, this, operationNewArrayBuffer, resultGPR, TrustedImmPtr(&vm()), structure, immutableButterflyGPR));
 
             cellResult(resultGPR, node);
@@ -9705 +9705 @@
             for (unsigned i = 0; i < node->numChildren(); ++i) {
                 if (bitVector->get(i)) {
-                    Edge use = m_jit.graph().varArgChild(node, i);
+                    Edge use = m_graph.varArgChild(node, i);
                     SpeculateCellOperand immutableButterfly(this, use);
                     GPRReg immutableButterflyGPR = immutableButterfly.gpr();
@@ -9732 +9732 @@
 
         for (unsigned i = 0; i < node->numChildren(); ++i) {
-            Edge use = m_jit.graph().varArgChild(node, i);
+            Edge use = m_graph.varArgChild(node, i);
             if (bitVector->get(i)) {
                 SpeculateCellOperand immutableButterfly(this, use);
@@ -9780 +9780 @@
     BitVector* bitVector = node->bitVector();
     for (unsigned i = 0; i < node->numChildren(); ++i) {
-        Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + i];
+        Edge use = m_graph.m_varArgChildren[node->firstChild() + i];
         if (bitVector->get(i)) {
             SpeculateCellOperand immutableButterfly(this, use);
@@ -9803 +9803 @@
     GPRReg resultGPR = result.gpr();
 
-    callOperation(operationNewArrayWithSpreadSlow, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), buffer, node->numChildren());
+    callOperation(operationNewArrayWithSpreadSlow, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), TrustedImmPtr(buffer), node->numChildren());
     m_jit.exceptionCheck();
 
@@ -9876 +9876 @@
     ASSERT(node->op() == ArraySlice);
 
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
 
     GPRTemporary temp(this);
-    StorageOperand storage(this, m_jit.graph().varArgChild(node, node->numChildren() - 1));
+    StorageOperand storage(this, m_graph.varArgChild(node, node->numChildren() - 1));
     GPRTemporary result(this);
     
@@ -9895 +9895 @@
 
         if (node->numChildren() == 4)
-            emitPopulateSliceIndex(m_jit.graph().varArgChild(node, 2), std::nullopt, lengthGPR, tempGPR);
+            emitPopulateSliceIndex(m_graph.varArgChild(node, 2), std::nullopt, lengthGPR, tempGPR);
         else
             m_jit.move(lengthGPR, tempGPR);
 
-        if (m_jit.graph().varArgChild(node, 1)->isInt32Constant() && m_jit.graph().varArgChild(node, 1)->asInt32() == 0) {
+        if (m_graph.varArgChild(node, 1)->isInt32Constant() && m_graph.varArgChild(node, 1)->asInt32() == 0) {
             // Do nothing for array.slice(0, end) or array.slice(0) cases.
             // `tempGPR` already points to the size of a newly created array.
@@ -9905 +9905 @@
             GPRTemporary tempStartIndex(this);
             GPRReg startGPR = tempStartIndex.gpr();
-            emitPopulateSliceIndex(m_jit.graph().varArgChild(node, 1), std::nullopt, lengthGPR, startGPR);
+            emitPopulateSliceIndex(m_graph.varArgChild(node, 1), std::nullopt, lengthGPR, startGPR);
 
             auto tooBig = m_jit.branch32(MacroAssembler::Above, startGPR, tempGPR);
@@ -9923 +9923 @@
         // We need to keep the source array alive at least until after we're done
         // with anything that can GC (e.g. allocating the result array below).
-        SpeculateCellOperand cell(this, m_jit.graph().varArgChild(node, 0));
+        SpeculateCellOperand cell(this, m_graph.varArgChild(node, 0));
 
         m_jit.load8(MacroAssembler::Address(cell.gpr(), JSCell::indexingTypeAndMiscOffset()), tempValue);
@@ -9949 +9949 @@
         // with one of the following indexing shapes: Int32, Contiguous, Double. Therefore,
         // we're a double array here.
-        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithDouble))), tempValue);
+        m_jit.move(TrustedImmPtr(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithDouble))), tempValue);
         emitMoveEmptyValue(jsNaN());
         done.append(m_jit.jump());
 
         isContiguous.link(&m_jit);
-        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous))), tempValue);
+        m_jit.move(TrustedImmPtr(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous))), tempValue);
         emitMoveEmptyValue(JSValue());
         done.append(m_jit.jump());
 
         isInt32.link(&m_jit);
-        m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithInt32))), tempValue);
+        m_jit.move(TrustedImmPtr(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithInt32))), tempValue);
         emitMoveEmptyValue(JSValue());
 
@@ -9995 +9995 @@
         m_jit.load32(MacroAssembler::Address(storageGPR, Butterfly::offsetOfPublicLength()), tempValue);
         if (node->numChildren() == 4)
-            emitPopulateSliceIndex(m_jit.graph().varArgChild(node, 2), std::nullopt, tempValue, tempGPR);
+            emitPopulateSliceIndex(m_graph.varArgChild(node, 2), std::nullopt, tempValue, tempGPR);
         else
             m_jit.move(tempValue, tempGPR);
-        emitPopulateSliceIndex(m_jit.graph().varArgChild(node, 1), std::nullopt, tempValue, loadIndex);
+        emitPopulateSliceIndex(m_graph.varArgChild(node, 1), std::nullopt, tempValue, loadIndex);
     }
 
@@ -10041 +10041 @@
     ASSERT(node->op() == ArrayIndexOf);
 
-    StorageOperand storage(this, m_jit.graph().varArgChild(node, node->numChildren() == 3 ? 2 : 3));
+    StorageOperand storage(this, m_graph.varArgChild(node, node->numChildren() == 3 ? 2 : 3));
     GPRTemporary index(this);
     GPRTemporary tempLength(this);
@@ -10052 +10052 @@
 
     if (node->numChildren() == 4)
-        emitPopulateSliceIndex(m_jit.graph().varArgChild(node, 2), std::nullopt, lengthGPR, indexGPR);
+        emitPopulateSliceIndex(m_graph.varArgChild(node, 2), std::nullopt, lengthGPR, indexGPR);
     else
         m_jit.move(TrustedImm32(0), indexGPR);
 
-    Edge& searchElementEdge = m_jit.graph().varArgChild(node, 1);
+    Edge& searchElementEdge = m_graph.varArgChild(node, 1);
     switch (searchElementEdge.useKind()) {
     case Int32Use:
@@ -10243 +10243 @@
     ASSERT(node->arrayMode().isJSArray());
 
-    Edge& storageEdge = m_jit.graph().varArgChild(node, 0);
-    Edge& arrayEdge = m_jit.graph().varArgChild(node, 1);
+    Edge& storageEdge = m_graph.varArgChild(node, 0);
+    Edge& arrayEdge = m_graph.varArgChild(node, 1);
 
     SpeculateCellOperand base(this, arrayEdge);
@@ -10274 +10274 @@
     case Array::Contiguous: {
         if (elementCount == 1) {
-            Edge& element = m_jit.graph().varArgChild(node, elementOffset);
+            Edge& element = m_graph.varArgChild(node, elementOffset);
             if (node->arrayMode().type() == Array::Int32) {
                 ASSERT(element.useKind() == Int32Use);
@@ -10298 +10298 @@
         if (node->arrayMode().type() == Array::Int32) {
             for (unsigned elementIndex = 0; elementIndex < elementCount; ++elementIndex) {
-                Edge element = m_jit.graph().varArgChild(node, elementIndex + elementOffset);
+                Edge element = m_graph.varArgChild(node, elementIndex + elementOffset);
                 ASSERT(element.useKind() == Int32Use);
                 speculateInt32(element);
@@ -10326 +10326 @@
         storageDone.link(&m_jit);
         for (unsigned elementIndex = 0; elementIndex < elementCount; ++elementIndex) {
-            Edge& element = m_jit.graph().varArgChild(node, elementIndex + elementOffset);
+            Edge& element = m_graph.varArgChild(node, elementIndex + elementOffset);
             JSValueOperand value(this, element, ManualOperandSpeculation); // We did type checks above.
             JSValueRegs valueRegs = value.jsValueRegs();
@@ -10348 +10348 @@
     case Array::Double: {
         if (elementCount == 1) {
-            Edge& element = m_jit.graph().varArgChild(node, elementOffset);
+            Edge& element = m_graph.varArgChild(node, elementOffset);
             speculate(node, element);
             SpeculateDoubleOperand value(this, element);
@@ -10368 +10368 @@
 
         for (unsigned elementIndex = 0; elementIndex < elementCount; ++elementIndex) {
-            Edge element = m_jit.graph().varArgChild(node, elementIndex + elementOffset);
+            Edge element = m_graph.varArgChild(node, elementIndex + elementOffset);
             ASSERT(element.useKind() == DoubleRepRealUse);
             speculate(node, element);
@@ -10395 +10395 @@
         storageDone.link(&m_jit);
         for (unsigned elementIndex = 0; elementIndex < elementCount; ++elementIndex) {
-            Edge& element = m_jit.graph().varArgChild(node, elementIndex + elementOffset);
+            Edge& element = m_graph.varArgChild(node, elementIndex + elementOffset);
             SpeculateDoubleOperand value(this, element);
             FPRReg valueFPR = value.fpr();
@@ -10419 +10419 @@
         int32_t largestPositiveInt32Length = 0x7fffffff - elementCount;
         if (elementCount == 1) {
-            Edge& element = m_jit.graph().varArgChild(node, elementOffset);
+            Edge& element = m_graph.varArgChild(node, elementOffset);
             JSValueOperand value(this, element);
             JSValueRegs valueRegs = value.jsValueRegs();
@@ -10471 +10471 @@
         storageDone.link(&m_jit);
         for (unsigned elementIndex = 0; elementIndex < elementCount; ++elementIndex) {
-            Edge& element = m_jit.graph().varArgChild(node, elementIndex + elementOffset);
+            Edge& element = m_graph.varArgChild(node, elementIndex + elementOffset);
             JSValueOperand value(this, element);
             JSValueRegs valueRegs = value.jsValueRegs();
@@ -10507 +10507 @@
     
     addSlowPathGenerator(
-        slowPathCall(slowCase, this, operationNotifyWrite, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, NoResult, &vm(), set));
+        slowPathCall(slowCase, this, operationNotifyWrite, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, NoResult, TrustedImmPtr(&vm()), TrustedImmPtr(set)));
     
     noResult(node);
@@ -10537 +10537 @@
 void SpeculativeJIT::compileTypeOfIsObject(Node* node)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     
     JSValueOperand value(this, node->child1());
@@ -10570 +10570 @@
     addSlowPathGenerator(
         slowPathCall(
-            slowPath, this, operationTypeOfIsObject, resultGPR, globalObject,
+            slowPath, this, operationTypeOfIsObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject),
             valueRegs.payloadGPR()));
     
@@ -10580 +10580 @@
 void SpeculativeJIT::compileIsCallable(Node* node, S_JITOperation_GC slowPathOperation)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     
     JSValueOperand value(this, node->child1());
@@ -10607 +10607 @@
     addSlowPathGenerator(
         slowPathCall(
-            slowPath, this, slowPathOperation, resultGPR, globalObject,
+            slowPath, this, slowPathOperation, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject),
             valueRegs.payloadGPR()));
     
@@ -10629 +10629 @@
 void SpeculativeJIT::compileTypeOf(Node* node)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     
     JSValueOperand value(this, node->child1());
@@ -10642 +10642 @@
         valueRegs, resultGPR,
         [&] (TypeofType type, bool fallsThrough) {
-            m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), vm().smallStrings.typeString(type)), resultGPR);
+            m_jit.move(TrustedImmPtr::weakPointer(m_graph, vm().smallStrings.typeString(type)), resultGPR);
             if (!fallsThrough)
                 done.append(m_jit.jump());
@@ -10653 +10653 @@
     addSlowPathGenerator(
         slowPathCall(
-            slowPath, this, operationTypeOfObject, resultGPR, globalObject,
+            slowPath, this, operationTypeOfObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject),
             valueRegs.payloadGPR()));
     
@@ -10759 +10759 @@
 
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
         return;
     }
@@ -10781 +10781 @@
 
         GPRFlushedCallResult result(this);
-        callOperation(operationAllocateComplexPropertyStorageWithInitialCapacity, result.gpr(), &vm(), baseGPR);
+        callOperation(operationAllocateComplexPropertyStorageWithInitialCapacity, result.gpr(), TrustedImmPtr(&vm()), baseGPR);
         m_jit.exceptionCheck();
         
@@ -10801 +10801 @@
 
     addSlowPathGenerator(
-        slowPathCall(slowPath, this, operationAllocateSimplePropertyStorageWithInitialCapacity, scratchGPR1, &vm()));
+        slowPathCall(slowPath, this, operationAllocateSimplePropertyStorageWithInitialCapacity, scratchGPR1, TrustedImmPtr(&vm())));
 
     for (ptrdiff_t offset = 0; offset < static_cast<ptrdiff_t>(size); offset += sizeof(void*))
@@ -10825 +10825 @@
 
         GPRFlushedCallResult result(this);
-        callOperation(operationAllocateComplexPropertyStorage, result.gpr(), &vm(), baseGPR, newSize / sizeof(JSValue));
+        callOperation(operationAllocateComplexPropertyStorage, result.gpr(), TrustedImmPtr(&vm()), baseGPR, newSize / sizeof(JSValue));
         m_jit.exceptionCheck();
 
@@ -10848 +10848 @@
 
     addSlowPathGenerator(
-        slowPathCall(slowPath, this, operationAllocateSimplePropertyStorage, scratchGPR1, &vm(), newSize / sizeof(JSValue)));
+        slowPathCall(slowPath, this, operationAllocateSimplePropertyStorage, scratchGPR1, TrustedImmPtr(&vm()), newSize / sizeof(JSValue)));
 
     for (ptrdiff_t offset = oldSize; offset < static_cast<ptrdiff_t>(newSize); offset += sizeof(void*))
@@ -10940 +10940 @@
 
     unsigned index = 0;
-    m_jit.graph().doToChildren(node, [&](Edge edge) {
+    m_graph.doToChildren(node, [&](Edge edge) {
         if (!index)
             appendCell(edge);
@@ -11003 +11003 @@
         flushRegisters();
         if (Options::useJITCage())
-            m_jit.setupArguments<J_JITOperation_GJIP>(TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), identifierUID(node->callDOMGetterData()->identifierNumber), getter.executableAddress());
+            m_jit.setupArguments<J_JITOperation_GJIP>(TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), TrustedImmPtr(identifierUID(node->callDOMGetterData()->identifierNumber)), TrustedImmPtr(getter.executableAddress()));
         else
-            m_jit.setupArguments<J_JITOperation_GJI>(TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), identifierUID(node->callDOMGetterData()->identifierNumber));
+            m_jit.setupArguments<J_JITOperation_GJI>(TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), CCallHelpers::CellValue(baseGPR), TrustedImmPtr(identifierUID(node->callDOMGetterData()->identifierNumber)));
 
         m_jit.storePtr(GPRInfo::callFrameRegister, &vm().topCallFrame);
@@ -11050 +11050 @@
 void SpeculativeJIT::compileCheckJSCast(Node* node)
 {
-    DFG_ASSERT(m_jit.graph(), node, node->op() == CheckJSCast || node->op() == CheckNotJSCast);
+    DFG_ASSERT(m_graph, node, node->op() == CheckJSCast || node->op() == CheckNotJSCast);
     const ClassInfo* classInfo = node->classInfo();
     if (classInfo->inheritsJSTypeRange) {
@@ -11077 +11077 @@
         m_jit.emitLoadStructure(vm(), baseGPR, otherGPR);
         m_jit.loadPtr(CCallHelpers::Address(otherGPR, Structure::classInfoOffset()), otherGPR);
-        m_jit.move(CCallHelpers::TrustedImmPtr(node->classInfo()), specifiedGPR);
+        m_jit.move(TrustedImmPtr(node->classInfo()), specifiedGPR);
 
         CCallHelpers::Label loop = m_jit.label();
@@ -11439 +11439 @@
     
     addSlowPathGenerator(slowPathCall(
-        slowPath, this, operationNewStringObject, resultGPR, &vm(), operandGPR, node->structure()));
+        slowPath, this, operationNewStringObject, resultGPR, TrustedImmPtr(&vm()), operandGPR, node->structure()));
     
     cellResult(resultGPR, node);
@@ -11450 +11450 @@
         GPRFlushedCallResult result(this);
         GPRReg resultGPR = result.gpr();
-        callOperation(operationNewSymbol, resultGPR, &vm());
+        callOperation(operationNewSymbol, resultGPR, TrustedImmPtr(&vm()));
         m_jit.exceptionCheck();
         cellResult(resultGPR, node);
@@ -11483 +11483 @@
 void SpeculativeJIT::compileNewTypedArrayWithSize(Node* node)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     auto typedArrayType = node->typedArrayType();
-    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(typedArrayType));
+    RegisteredStructure structure = m_graph.registerStructure(globalObject->typedArrayStructureConcurrently(typedArrayType));
     RELEASE_ASSERT(structure.get());
 
@@ -11620 +11620 @@
     JITCompiler::JumpList slowPath;
 
-    auto structure = m_jit.graph().registerStructure(m_jit.graph().globalObjectFor(node->origin.semantic)->regExpStructure());
+    auto structure = m_graph.registerStructure(m_graph.globalObjectFor(node->origin.semantic)->regExpStructure());
     auto butterfly = TrustedImmPtr(nullptr);
     emitAllocateJSObject<RegExpObject>(resultGPR, TrustedImmPtr(structure), butterfly, scratch1GPR, scratch2GPR, slowPath);
@@ -11630 +11630 @@
     m_jit.mutatorFence(vm());
 
-    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewRegexpWithLastIndex, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), regexp, lastIndexRegs));
+    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewRegexpWithLastIndex, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), TrustedImmPtr::weakPointer(m_graph, regexp), lastIndexRegs));
 
     cellResult(resultGPR, node);
@@ -12493 +12493 @@
     SwitchData* data, GPRReg value, GPRReg scratch)
 {
-    const UnlinkedSimpleJumpTable& unlinkedTable = m_jit.graph().unlinkedSwitchJumpTable(data->switchTableIndex);
-    SimpleJumpTable& linkedTable = m_jit.graph().switchJumpTable(data->switchTableIndex);
+    const UnlinkedSimpleJumpTable& unlinkedTable = m_graph.unlinkedSwitchJumpTable(data->switchTableIndex);
+    SimpleJumpTable& linkedTable = m_graph.switchJumpTable(data->switchTableIndex);
     linkedTable.ensureCTITable(unlinkedTable);
     m_jit.sub32(Imm32(unlinkedTable.m_min), value);
@@ -12535 +12535 @@
         addBranch(m_jit.branchIfNotNumber(valueRegs, scratch), data->fallThrough.block);
 
-        const UnlinkedSimpleJumpTable& unlinkedTable = m_jit.graph().unlinkedSwitchJumpTable(data->switchTableIndex);
+        const UnlinkedSimpleJumpTable& unlinkedTable = m_graph.unlinkedSwitchJumpTable(data->switchTableIndex);
         silentSpillAllRegisters(scratch);
-        callOperation(operationFindSwitchImmTargetForDouble, scratch, &vm(), valueRegs, data->switchTableIndex, unlinkedTable.m_min);
+        callOperation(operationFindSwitchImmTargetForDouble, scratch, TrustedImmPtr(&vm()), valueRegs, data->switchTableIndex, unlinkedTable.m_min);
         silentFillAllRegisters();
 
@@ -12777 +12777 @@
 
     const UnlinkedStringJumpTable& unlinkedTable = m_graph.unlinkedStringSwitchJumpTable(data->switchTableIndex);
-    StringJumpTable& linkedTable = m_jit.graph().stringSwitchJumpTable(data->switchTableIndex);
+    StringJumpTable& linkedTable = m_graph.stringSwitchJumpTable(data->switchTableIndex);
     linkedTable.ensureCTITable(unlinkedTable);
 
@@ -12798 +12798 @@
     if (!canDoBinarySwitch || totalLength > Options::maximumBinaryStringSwitchTotalLength()) {
         flushRegisters();
-        callOperation(operationSwitchString, string, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), &unlinkedTable, string);
+        callOperation(operationSwitchString, string, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), TrustedImmPtr(&unlinkedTable), string);
         m_jit.exceptionCheck();
         m_jit.farJump(string, JSSwitchPtrTag);
@@ -12835 +12835 @@
     slowCases.link(&m_jit);
     silentSpillAllRegisters(string);
-    callOperation(operationSwitchString, string, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), &unlinkedTable, string);
+    callOperation(operationSwitchString, string, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), static_cast<size_t>(data->switchTableIndex), TrustedImmPtr(&unlinkedTable), string);
     silentFillAllRegisters();
     m_jit.exceptionCheck();
@@ -12922 +12922 @@
     }
     case SwitchCell: {
-        DFG_CRASH(m_jit.graph(), node, "Bad switch kind");
+        DFG_CRASH(m_graph, node, "Bad switch kind");
         return;
     } }
@@ -12965 +12965 @@
 
     silentSpillAllRegisters(InvalidGPRReg);
-    callOperation(operationWriteBarrierSlowPath, &vm(), baseGPR);
+    callOperation(operationWriteBarrierSlowPath, TrustedImmPtr(&vm()), baseGPR);
     silentFillAllRegisters();
 
@@ -12982 +12982 @@
 
     flushRegisters();
-    callOperation(node->op() == PutGetterById ? operationPutGetterById : operationPutSetterById, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), accessorGPR);
+    callOperation(node->op() == PutGetterById ? operationPutGetterById : operationPutSetterById, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, TrustedImmPtr(identifierUID(node->identifierNumber())), node->accessorAttributes(), accessorGPR);
     m_jit.exceptionCheck();
 
@@ -13000 +13000 @@
 
     flushRegisters();
-    callOperation(operationPutGetterSetter, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterGPR, setterGPR);
+    callOperation(operationPutGetterSetter, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, TrustedImmPtr(identifierUID(node->identifierNumber())), node->accessorAttributes(), getterGPR, setterGPR);
 #else
     // These JSValues may be JSUndefined OR JSFunction*.
@@ -13012 +13012 @@
 
     flushRegisters();
-    callOperation(operationPutGetterSetter, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, identifierUID(node->identifierNumber()), node->accessorAttributes(), getterRegs.payloadGPR(), setterRegs.payloadGPR());
+    callOperation(operationPutGetterSetter, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), baseGPR, TrustedImmPtr(identifierUID(node->identifierNumber())), node->accessorAttributes(), getterRegs.payloadGPR(), setterRegs.payloadGPR());
 #endif
     m_jit.exceptionCheck();
@@ -13026 +13026 @@
     GPRReg resultGPR = result.gpr();
     flushRegisters();
-    callOperation(operationResolveScope, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()));
+    callOperation(operationResolveScope, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, TrustedImmPtr(identifierUID(node->identifierNumber())));
     m_jit.exceptionCheck();
     cellResult(resultGPR, node);
@@ -13038 +13038 @@
     JSValueRegsFlushedCallResult result(this);
     JSValueRegs resultRegs = result.regs();
-    callOperation(operationResolveScopeForHoistingFuncDeclInEval, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()));
+    callOperation(operationResolveScopeForHoistingFuncDeclInEval, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, TrustedImmPtr(identifierUID(node->identifierNumber())));
     m_jit.exceptionCheck();
     jsValueResult(resultRegs, node);
@@ -13066 +13066 @@
     JSValueRegsFlushedCallResult result(this);
     JSValueRegs resultRegs = result.regs();
-    callOperation(operationGetDynamicVar, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, identifierUID(node->identifierNumber()), node->getPutInfo());
+    callOperation(operationGetDynamicVar, resultRegs, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, TrustedImmPtr(identifierUID(node->identifierNumber())), node->getPutInfo());
     m_jit.exceptionCheck();
     jsValueResult(resultRegs, node);
@@ -13080 +13080 @@
 
     flushRegisters();
-    callOperation(node->ecmaMode().isStrict() ? operationPutDynamicVarStrict : operationPutDynamicVarNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, valueRegs, identifierUID(node->identifierNumber()), node->getPutInfo());
+    callOperation(node->ecmaMode().isStrict() ? operationPutDynamicVarStrict : operationPutDynamicVarNonStrict, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), scopeGPR, valueRegs, TrustedImmPtr(identifierUID(node->identifierNumber())), node->getPutInfo());
     m_jit.exceptionCheck();
     noResult(node);
@@ -13446 +13446 @@
 {
     RegisteredStructure structure = node->structureSet().at(0);
-    ASSERT(m_jit.graph().varArgChild(node, 0)->dynamicCastConstant<Structure*>(vm()) == structure.get());
+    ASSERT(m_graph.varArgChild(node, 0)->dynamicCastConstant<Structure*>(vm()) == structure.get());
 
     ObjectMaterializationData& data = node->objectMaterializationData();
@@ -13457 +13457 @@
     if (hasIndexingHeader) {
         for (unsigned i = data.m_properties.size(); i--;) {
-            Edge edge = m_jit.graph().varArgChild(node, 1 + i);
+            Edge edge = m_graph.varArgChild(node, 1 + i);
             switch (data.m_properties[i].kind()) {
             case PublicLengthPLoc:
@@ -13485 +13485 @@
 
     for (unsigned i = data.m_properties.size(); i--;) {
-        Edge edge = m_jit.graph().varArgChild(node, 1 + i);
+        Edge edge = m_graph.varArgChild(node, 1 + i);
         PromotedLocationDescriptor descriptor = data.m_properties[i];
         switch (descriptor.kind()) {
@@ -13497 +13497 @@
 
         case NamedPropertyPLoc: {
-            StringImpl* uid = m_jit.graph().identifiers()[descriptor.info()];
+            StringImpl* uid = m_graph.identifiers()[descriptor.info()];
             for (PropertyMapEntry entry : structure->getPropertiesConcurrently()) {
                 if (uid != entry.key)
@@ -13521 +13521 @@
 void SpeculativeJIT::compileRecordRegExpCachedResult(Node* node)
 {
-    Edge globalObjectEdge = m_jit.graph().varArgChild(node, 0);
-    Edge regExpEdge = m_jit.graph().varArgChild(node, 1);
-    Edge stringEdge = m_jit.graph().varArgChild(node, 2);
-    Edge startEdge = m_jit.graph().varArgChild(node, 3);
-    Edge endEdge = m_jit.graph().varArgChild(node, 4);
+    Edge globalObjectEdge = m_graph.varArgChild(node, 0);
+    Edge regExpEdge = m_graph.varArgChild(node, 1);
+    Edge stringEdge = m_graph.varArgChild(node, 2);
+    Edge startEdge = m_graph.varArgChild(node, 3);
+    Edge endEdge = m_graph.varArgChild(node, 4);
 
     SpeculateCellOperand globalObject(this, globalObjectEdge);
@@ -13572 +13572 @@
 #endif
 
-    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
+    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
     GPRReg baseGPR = base.gpr();
 
-    JSValueOperand value(this, m_jit.graph().varArgChild(node, 2));
+    JSValueOperand value(this, m_graph.varArgChild(node, 2));
     JSValueRegs valueRegs = value.jsValueRegs();
 
-    SpeculateInt32Operand attributes(this, m_jit.graph().varArgChild(node, 3));
+    SpeculateInt32Operand attributes(this, m_graph.varArgChild(node, 3));
     GPRReg attributesGPR = attributes.gpr();
 
-    Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+    Edge& propertyEdge = m_graph.varArgChild(node, 1);
     switch (propertyEdge.useKind()) {
     case StringUse: {
@@ -13650 +13650 @@
 #endif
 
-    SpeculateCellOperand base(this, m_jit.graph().varArgChild(node, 0));
+    SpeculateCellOperand base(this, m_graph.varArgChild(node, 0));
     GPRReg baseGPR = base.gpr();
 
-    SpeculateCellOperand getter(this, m_jit.graph().varArgChild(node, 2));
+    SpeculateCellOperand getter(this, m_graph.varArgChild(node, 2));
     GPRReg getterGPR = getter.gpr();
 
-    SpeculateCellOperand setter(this, m_jit.graph().varArgChild(node, 3));
+    SpeculateCellOperand setter(this, m_graph.varArgChild(node, 3));
     GPRReg setterGPR = setter.gpr();
 
-    SpeculateInt32Operand attributes(this, m_jit.graph().varArgChild(node, 4));
+    SpeculateInt32Operand attributes(this, m_graph.varArgChild(node, 4));
     GPRReg attributesGPR = attributes.gpr();
 
-    Edge& propertyEdge = m_jit.graph().varArgChild(node, 1);
+    Edge& propertyEdge = m_graph.varArgChild(node, 1);
     switch (propertyEdge.useKind()) {
     case StringUse: {
@@ -13788 +13788 @@
     passThroughCases.link(&m_jit);
     m_jit.moveValueRegs(keyRegs, resultRegs);
-    addSlowPathGenerator(slowPathCall(slowPath, this, operationNormalizeMapKeyHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultRegs, &vm(), keyRegs.payloadGPR()));
+    addSlowPathGenerator(slowPathCall(slowPath, this, operationNormalizeMapKeyHeapBigInt, NeedToSpill, ExceptionCheckRequirement::CheckNotNeeded, resultRegs, TrustedImmPtr(&vm()), keyRegs.payloadGPR()));
 
     doneCases.link(&m_jit);
@@ -13844 +13844 @@
         sentinel = vm().sentinelSetBucket();
     }
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), sentinel), resultGPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, sentinel), resultGPR);
     done.link(&m_jit);
 
@@ -14499 +14499 @@
 void SpeculativeJIT::compileNewArrayBuffer(Node* node)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     auto* array = node->castOperand<JSImmutableButterfly*>();
 
     IndexingType indexingMode = node->indexingMode();
-    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingMode));
+    RegisteredStructure structure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingMode));
 
     if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(indexingMode)) {
@@ -14518 +14518 @@
         emitAllocateJSObject<JSArray>(resultGPR, TrustedImmPtr(structure), TrustedImmPtr(array->toButterfly()), scratch1GPR, scratch2GPR, slowCases);
 
-        addSlowPathGenerator(slowPathCall(slowCases, this, operationNewArrayBuffer, result.gpr(), &vm(), structure, array));
-
-        DFG_ASSERT(m_jit.graph(), node, indexingMode & IsArray, indexingMode);
+        addSlowPathGenerator(slowPathCall(slowCases, this, operationNewArrayBuffer, result.gpr(), TrustedImmPtr(&vm()), structure, TrustedImmPtr::weakPointer(m_graph, array)));
+
+        DFG_ASSERT(m_graph, node, indexingMode & IsArray, indexingMode);
         cellResult(resultGPR, node);
         return;
@@ -14528 +14528 @@
     GPRFlushedCallResult result(this);
 
-    callOperation(operationNewArrayBuffer, result.gpr(), &vm(), structure, TrustedImmPtr(node->cellOperand()));
+    callOperation(operationNewArrayBuffer, result.gpr(), TrustedImmPtr(&vm()), structure, TrustedImmPtr(node->cellOperand()));
     m_jit.exceptionCheck();
 
@@ -14536 +14536 @@
 void SpeculativeJIT::compileNewArrayWithSize(Node* node)
 {
-    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+    JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
     if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
         SpeculateStrictInt32Operand size(this, node->child1());
@@ -14556 +14556 @@
     GPRReg structureGPR = AssemblyHelpers::selectScratchGPR(sizeGPR);
     MacroAssembler::Jump bigLength = m_jit.branch32(MacroAssembler::AboveOrEqual, sizeGPR, TrustedImm32(MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH));
-    m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
+    m_jit.move(TrustedImmPtr(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()))), structureGPR);
     MacroAssembler::Jump done = m_jit.jump();
     bigLength.link(&m_jit);
-    m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
+    m_jit.move(TrustedImmPtr(m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage))), structureGPR);
     done.link(&m_jit);
     callOperation(operationNewArrayWithSize, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), structureGPR, sizeGPR, nullptr);
@@ -14586 +14586 @@
         GPRReg resultGPR = result.gpr();
 
-        JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
+        JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
         callOperation(
             operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
-            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), m_jit.graph().registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
+            resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), m_graph.registerStructure(globalObject->typedArrayStructureConcurrently(node->typedArrayType())), argumentRegs);
         m_jit.exceptionCheck();
 
@@ -14664 +14664 @@
             MacroAssembler::JumpList slowButArrayBufferCases;
 
-            JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
-            RegisteredStructure arrayStructure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(CopyOnWriteArrayWithContiguous));
+            JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
+            RegisteredStructure arrayStructure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(CopyOnWriteArrayWithContiguous));
 
             m_jit.move(scratchGPR, scratch3GPR);
@@ -14672 +14672 @@
             emitAllocateJSObject<JSArray>(resultGPR, TrustedImmPtr(arrayStructure), scratchGPR, structureGPR, scratch2GPR, slowButArrayBufferCases);
 
-            addSlowPathGenerator(slowPathCall(slowButArrayBufferCases, this, operationNewArrayBuffer, resultGPR, &vm(), arrayStructure, scratch3GPR));
+            addSlowPathGenerator(slowPathCall(slowButArrayBufferCases, this, operationNewArrayBuffer, resultGPR, TrustedImmPtr(&vm()), arrayStructure, scratch3GPR));
 
             addSlowPathGenerator(slowPathCall(slowCases, this, node->op() == ObjectKeys ? operationObjectKeysObject : operationObjectGetOwnPropertyNamesObject, resultGPR, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(node->origin.semantic)), objectGPR));
@@ -14751 +14751 @@
     }
     default:
-        DFG_CRASH(m_jit.graph(), node, "Bad use kind");
+        DFG_CRASH(m_graph, node, "Bad use kind");
         return;
     }
@@ -14860 +14860 @@
     GPRReg rareDataGPR = structureGPR;
 
-    m_jit.move(TrustedImmPtr(m_jit.graph().registerStructure(node->isInternalPromise() ? globalObject->internalPromiseStructure() : globalObject->promiseStructure())), structureGPR);
-    auto fastPromisePath = m_jit.branchPtr(CCallHelpers::Equal, calleeGPR, TrustedImmPtr::weakPointer(m_jit.graph(), node->isInternalPromise() ? globalObject->internalPromiseConstructor() : globalObject->promiseConstructor()));
+    m_jit.move(TrustedImmPtr(m_graph.registerStructure(node->isInternalPromise() ? globalObject->internalPromiseStructure() : globalObject->promiseStructure())), structureGPR);
+    auto fastPromisePath = m_jit.branchPtr(CCallHelpers::Equal, calleeGPR, TrustedImmPtr::weakPointer(m_graph, node->isInternalPromise() ? globalObject->internalPromiseConstructor() : globalObject->promiseConstructor()));
 
     MacroAssembler::JumpList slowCases;
@@ -14873 +14873 @@
     m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);
     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, globalObject), scratch1GPR);
     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::globalObjectOffset())));
 
@@ -14884 +14884 @@
     m_jit.storeTrustedValue(jsNumber(static_cast<unsigned>(JSPromise::Status::Pending)), CCallHelpers::Address(resultGPR, JSInternalFieldObjectImpl<>::offsetOfInternalField(static_cast<unsigned>(JSPromise::Field::Flags))));
     m_jit.storeTrustedValue(jsUndefined(), CCallHelpers::Address(resultGPR, JSInternalFieldObjectImpl<>::offsetOfInternalField(static_cast<unsigned>(JSPromise::Field::ReactionsOrResult))));
-    m_jit.mutatorFence(m_jit.vm());
-
-    addSlowPathGenerator(slowPathCall(slowCases, this, node->isInternalPromise() ? operationCreateInternalPromise : operationCreatePromise, resultGPR, TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), calleeGPR));
+    m_jit.mutatorFence(vm());
+
+    addSlowPathGenerator(slowPathCall(slowCases, this, node->isInternalPromise() ? operationCreateInternalPromise : operationCreatePromise, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), calleeGPR));
 
     cellResult(resultGPR, node);
@@ -14922 +14922 @@
     m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);
     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), scratch1GPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, globalObject), scratch1GPR);
     slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::globalObjectOffset())));
 
@@ -14931 +14931 @@
     for (unsigned index = 0; index < initialValues.size(); ++index)
         m_jit.storeTrustedValue(initialValues[index], CCallHelpers::Address(resultGPR, JSInternalFieldObjectImpl<>::offsetOfInternalField(index)));
-    m_jit.mutatorFence(m_jit.vm());
-
-    addSlowPathGenerator(slowPathCall(slowCases, this, operation, resultGPR, TrustedImmPtr::weakPointer(m_jit.graph(), globalObject), calleeGPR));
+    m_jit.mutatorFence(vm());
+
+    addSlowPathGenerator(slowPathCall(slowCases, this, operation, resultGPR, TrustedImmPtr::weakPointer(m_graph, globalObject), calleeGPR));
 
     cellResult(resultGPR, node);
@@ -14972 +14972 @@
     }
 
-    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, &vm(), structure));
+    addSlowPathGenerator(slowPathCall(slowPath, this, operationNewObject, resultGPR, TrustedImmPtr(&vm()), structure));
 
     cellResult(resultGPR, node);
@@ -14997 +14997 @@
     for (unsigned index = 0; index < initialValues.size(); ++index)
         m_jit.storeTrustedValue(initialValues[index], CCallHelpers::Address(resultGPR, JSInternalFieldObjectImpl<>::offsetOfInternalField(index)));
-    m_jit.mutatorFence(m_jit.vm());
-
-    addSlowPathGenerator(slowPathCall(slowCases, this, operation, resultGPR, &vm(), TrustedImmPtr(structure)));
+    m_jit.mutatorFence(vm());
+
+    addSlowPathGenerator(slowPathCall(slowCases, this, operation, resultGPR, TrustedImmPtr(&vm()), TrustedImmPtr(structure)));
 
     cellResult(resultGPR, node);
@@ -15042 +15042 @@
 void SpeculativeJIT::compileToPrimitive(Node* node)
 {
-    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse, node->child1().useKind());
+    DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
     JSValueOperand argument(this, node->child1());
     JSValueRegsTemporary result(this, Reuse, argument);
@@ -15064 +15064 @@
 void SpeculativeJIT::compileToPropertyKey(Node* node)
 {
-    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse, node->child1().useKind());
+    DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
     JSValueOperand argument(this, node->child1());
     JSValueRegsTemporary result(this, Reuse, argument);
@@ -15088 +15088 @@
 void SpeculativeJIT::compileToNumeric(Node* node)
 {
-    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse, node->child1().useKind());
+    DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
     JSValueOperand argument(this, node->child1());
     JSValueRegsTemporary result(this);
@@ -15132 +15132 @@
 #endif
 
-    DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse, node->child1().useKind());
+    DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind());
     JSValueOperand argument(this, node->child1());
     JSValueRegsTemporary result(this);
@@ -15193 +15193 @@
     GPRReg scopeReg = scope.gpr();
 
-    m_jit.logShadowChickenTailPacket(shadowPacketReg, thisRegs, scopeReg, CCallHelpers::TrustedImmPtr(m_jit.codeBlock()), callSiteIndex);
+    m_jit.emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, scratch1Reg);
+    m_jit.logShadowChickenTailPacket(shadowPacketReg, thisRegs, scopeReg, scratch1Reg, callSiteIndex);
     noResult(node);
 }
@@ -15219 +15220 @@
 void SpeculativeJIT::compileMapSet(Node* node)
 {
-    SpeculateCellOperand map(this, m_jit.graph().varArgChild(node, 0));
-    JSValueOperand key(this, m_jit.graph().varArgChild(node, 1));
-    JSValueOperand value(this, m_jit.graph().varArgChild(node, 2));
-    SpeculateInt32Operand hash(this, m_jit.graph().varArgChild(node, 3));
+    SpeculateCellOperand map(this, m_graph.varArgChild(node, 0));
+    JSValueOperand key(this, m_graph.varArgChild(node, 1));
+    JSValueOperand value(this, m_graph.varArgChild(node, 2));
+    SpeculateInt32Operand hash(this, m_graph.varArgChild(node, 3));
 
     GPRReg mapGPR = map.gpr();
@@ -15229 +15230 @@
     GPRReg hashGPR = hash.gpr();
 
-    speculateMapObject(m_jit.graph().varArgChild(node, 0), mapGPR);
+    speculateMapObject(m_graph.varArgChild(node, 0), mapGPR);
 
     flushRegisters();
@@ -15351 +15352 @@
 
     flushRegisters();
-    callOperation(operationWeakSetAdd, &vm(), setGPR, keyGPR, hashGPR);
+    callOperation(operationWeakSetAdd, TrustedImmPtr(&vm()), setGPR, keyGPR, hashGPR);
     m_jit.exceptionCheck();
     noResult(node);
@@ -15358 +15359 @@
 void SpeculativeJIT::compileWeakMapSet(Node* node)
 {
-    SpeculateCellOperand map(this, m_jit.graph().varArgChild(node, 0));
-    SpeculateCellOperand key(this, m_jit.graph().varArgChild(node, 1));
-    JSValueOperand value(this, m_jit.graph().varArgChild(node, 2));
-    SpeculateInt32Operand hash(this, m_jit.graph().varArgChild(node, 3));
+    SpeculateCellOperand map(this, m_graph.varArgChild(node, 0));
+    SpeculateCellOperand key(this, m_graph.varArgChild(node, 1));
+    JSValueOperand value(this, m_graph.varArgChild(node, 2));
+    SpeculateInt32Operand hash(this, m_graph.varArgChild(node, 3));
 
     GPRReg mapGPR = map.gpr();
@@ -15368 +15369 @@
     GPRReg hashGPR = hash.gpr();
 
-    speculateWeakMapObject(m_jit.graph().varArgChild(node, 0), mapGPR);
-    speculateObject(m_jit.graph().varArgChild(node, 1), keyGPR);
+    speculateWeakMapObject(m_graph.varArgChild(node, 0), mapGPR);
+    speculateObject(m_graph.varArgChild(node, 1), keyGPR);
 
     flushRegisters();
-    callOperation(operationWeakMapSet, &vm(), mapGPR, keyGPR, valueRegs, hashGPR);
+    callOperation(operationWeakMapSet, TrustedImmPtr(&vm()), mapGPR, keyGPR, valueRegs, hashGPR);
     m_jit.exceptionCheck();
     noResult(node);
@@ -15589 +15590 @@
     emitInitializeButterfly(storageGPR, sizeGPR, emptyValueRegs, resultGPR);
 
-    RegisteredStructure structure = m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType));
+    RegisteredStructure structure = m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType));
 
     emitAllocateJSObject<JSArray>(resultGPR, TrustedImmPtr(structure), storageGPR, scratchGPR, scratch2GPR, slowCases);
@@ -15599 +15600 @@
         TrustedImmPtr::weakPointer(m_graph, globalObject),
         structure,
-        shouldConvertLargeSizeToArrayStorage ? m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)) : structure,
+        shouldConvertLargeSizeToArrayStorage ? m_graph.registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage)) : structure,
         sizeGPR, storageGPR));
 }
@@ -15859 +15860 @@
     } else {
         slowPath = slowPathCall(
-            slowCases, this, gen.slowPathFunction(), NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), gen.stubInfo(), valueRegs,
+            slowCases, this, gen.slowPathFunction(), NoResult, TrustedImmPtr::weakPointer(m_graph, m_graph.globalObjectFor(codeOrigin)), TrustedImmPtr(gen.stubInfo()), valueRegs,
             CCallHelpers::CellValue(baseGPR), identifier.rawBits());
     }
@@ -16060 +16061 @@
     CCallHelpers::JumpList slowPath;
     Allocator allocatorValue = allocatorForConcurrently<JSRopeString>(vm(), sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists);
-    emitAllocateJSCell(resultGPR, JITAllocator::constant(allocatorValue), allocatorGPR, TrustedImmPtr(m_jit.graph().registerStructure(vm().stringStructure.get())), scratchGPR, slowPath);
+    emitAllocateJSCell(resultGPR, JITAllocator::constant(allocatorValue), allocatorGPR, TrustedImmPtr(m_graph.registerStructure(vm().stringStructure.get())), scratchGPR, slowPath);
 
     // This puts nullptr for the first fiber. It makes visitChildren safe even if this JSRopeString is discarded due to the speculation failure in the following path.
@@ -16166 +16167 @@
     auto isNonEmptyString = m_jit.branchTest32(CCallHelpers::NonZero, allocatorGPR);
 
-    m_jit.move(TrustedImmPtr::weakPointer(m_jit.graph(), jsEmptyString(m_jit.graph().m_vm)), resultGPR);
+    m_jit.move(TrustedImmPtr::weakPointer(m_graph, jsEmptyString(m_graph.m_vm)), resultGPR);
 
     isNonEmptyString.link(&m_jit);