Add m-esr52 at 52.6.0

14 files changed, 12985 insertions, 0 deletions

diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.cpp b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
new file mode 100644
index 000000000..0fb507297
--- /dev/null
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
@@ -0,0 +1,1427 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "irregexp/NativeRegExpMacroAssembler.h"
+
+#include "irregexp/RegExpStack.h"
+#include "jit/Linker.h"
+#ifdef JS_ION_PERF
+# include "jit/PerfSpewer.h"
+#endif
+#include "vm/MatchPairs.h"
+
+#include "jit/MacroAssembler-inl.h"
+
+using namespace js;
+using namespace js::irregexp;
+using namespace js::jit;
+
+/*
+ * This assembler uses the following register assignment convention:
+ *
+ * - current_character :
+ *     Must be loaded using LoadCurrentCharacter before using any of the
+ *     dispatch methods. Temporarily stores the index of capture start after a
+ *     matching pass for a global regexp.
+ * - current_position :
+ *     Current position in input, as negative offset from end of string.
+ *     Please notice that this is the byte offset, not the character offset!
+ * - input_end_pointer :
+ *     Points to byte after last character in the input.
+ * - backtrack_stack_pointer :
+ *     Points to tip of the heap allocated backtrack stack
+ * - StackPointer :
+ *     Points to tip of the native stack, used to access arguments, local
+ *     variables and RegExp registers.
+ *
+ * The tempN registers are free to use for computations.
+ */
+
+NativeRegExpMacroAssembler::NativeRegExpMacroAssembler(LifoAlloc* alloc, RegExpShared* shared,
+                                                       JSRuntime* rt, Mode mode, int registers_to_save)
+  : RegExpMacroAssembler(*alloc, shared, registers_to_save),
+    runtime(rt), mode_(mode)
+{
+    // Find physical registers for each compiler register.
+    AllocatableGeneralRegisterSet regs(GeneralRegisterSet::All());
+
+    input_end_pointer = regs.takeAny();
+    current_character = regs.takeAny();
+    current_position = regs.takeAny();
+    backtrack_stack_pointer = regs.takeAny();
+    temp0 = regs.takeAny();
+    temp1 = regs.takeAny();
+    temp2 = regs.takeAny();
+
+    JitSpew(JitSpew_Codegen,
+            "Starting RegExp (input_end_pointer %s) (current_character %s)"
+            " (current_position %s) (backtrack_stack_pointer %s) (temp0 %s) temp1 (%s) temp2 (%s)",
+            input_end_pointer.name(),
+            current_character.name(),
+            current_position.name(),
+            backtrack_stack_pointer.name(),
+            temp0.name(),
+            temp1.name(),
+            temp2.name());
+
+    savedNonVolatileRegisters = SavedNonVolatileRegisters(regs);
+
+    masm.jump(&entry_label_);
+    masm.bind(&start_label_);
+}
+
+#define SPEW_PREFIX JitSpew_Codegen, "!!! "
+
+// The signature of the code which this generates is:
+//
+// void execute(InputOutputData*);
+RegExpCode
+NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
+{
+    if (!cx->compartment()->ensureJitCompartmentExists(cx))
+        return RegExpCode();
+
+    JitSpew(SPEW_PREFIX "GenerateCode");
+
+    // We need an even number of registers, for stack alignment.
+    if (num_registers_ % 2 == 1)
+        num_registers_++;
+
+    Label return_temp0;
+
+    // Finalize code - write the entry point code now we know how many
+    // registers we need.
+    masm.bind(&entry_label_);
+
+#ifdef JS_CODEGEN_ARM64
+    // ARM64 communicates stack address via sp, but uses a pseudo-sp for addressing.
+    masm.initStackPtr();
+#endif
+
+    // Push non-volatile registers which might be modified by jitcode.
+    size_t pushedNonVolatileRegisters = 0;
+    for (GeneralRegisterForwardIterator iter(savedNonVolatileRegisters); iter.more(); ++iter) {
+        masm.Push(*iter);
+        pushedNonVolatileRegisters++;
+    }
+
+#if defined(XP_IOS) && defined(JS_CODEGEN_ARM)
+    // The stack is 4-byte aligned on iOS, force 8-byte alignment.
+    masm.movePtr(StackPointer, temp0);
+    masm.andPtr(Imm32(~7), StackPointer);
+    masm.push(temp0);
+    masm.push(temp0);
+#endif
+
+#ifndef JS_CODEGEN_X86
+    // The InputOutputData* is stored as an argument, save it on the stack
+    // above the frame.
+    masm.Push(IntArgReg0);
+#endif
+
+    size_t frameSize = sizeof(FrameData) + num_registers_ * sizeof(void*);
+    frameSize = JS_ROUNDUP(frameSize + masm.framePushed(), ABIStackAlignment) - masm.framePushed();
+
+    // Actually emit code to start a new stack frame.
+    masm.reserveStack(frameSize);
+    masm.checkStackAlignment();
+
+    // Check if we have space on the stack. Use the *NoInterrupt stack limit to
+    // avoid failing repeatedly when the regex code is called from Ion JIT code,
+    // see bug 1208819.
+    Label stack_ok;
+    void* stack_limit = runtime->addressOfJitStackLimitNoInterrupt();
+    masm.branchStackPtrRhs(Assembler::Below, AbsoluteAddress(stack_limit), &stack_ok);
+
+    // Exit with an exception. There is not enough space on the stack
+    // for our working registers.
+    masm.movePtr(ImmWord(RegExpRunStatus_Error), temp0);
+    masm.jump(&return_temp0);
+
+    masm.bind(&stack_ok);
+
+#ifdef XP_WIN
+    // Ensure that we write to each stack page, in order. Skipping a page
+    // on Windows can cause segmentation faults. Assuming page size is 4k.
+    const int kPageSize = 4096;
+    for (int i = frameSize - sizeof(void*); i >= 0; i -= kPageSize)
+        masm.storePtr(temp0, Address(masm.getStackPointer(), i));
+#endif // XP_WIN
+
+#ifndef JS_CODEGEN_X86
+    // The InputOutputData* is stored on the stack immediately above the frame.
+    Address inputOutputAddress(masm.getStackPointer(), frameSize);
+#else
+    // The InputOutputData* is left in its original on stack location.
+    Address inputOutputAddress(masm.getStackPointer(),
+                               frameSize + (pushedNonVolatileRegisters + 1) * sizeof(void*));
+#endif
+
+    masm.loadPtr(inputOutputAddress, temp0);
+
+    // Copy output registers to FrameData.
+    if (!match_only) {
+        Register matchPairsRegister = input_end_pointer;
+        masm.loadPtr(Address(temp0, offsetof(InputOutputData, matches)), matchPairsRegister);
+        masm.loadPtr(Address(matchPairsRegister, MatchPairs::offsetOfPairs()), temp1);
+        masm.storePtr(temp1, Address(masm.getStackPointer(), offsetof(FrameData, outputRegisters)));
+        masm.load32(Address(matchPairsRegister, MatchPairs::offsetOfPairCount()), temp1);
+        masm.lshiftPtr(Imm32(1), temp1);
+        masm.store32(temp1, Address(masm.getStackPointer(), offsetof(FrameData, numOutputRegisters)));
+
+#ifdef DEBUG
+        // Bounds check numOutputRegisters.
+        Label enoughRegisters;
+        masm.branchPtr(Assembler::GreaterThanOrEqual,
+                       temp1, ImmWord(num_saved_registers_), &enoughRegisters);
+        masm.assumeUnreachable("Not enough output registers for RegExp");
+        masm.bind(&enoughRegisters);
+#endif
+    } else {
+        Register endIndexRegister = input_end_pointer;
+        masm.loadPtr(Address(temp0, offsetof(InputOutputData, endIndex)), endIndexRegister);
+        masm.storePtr(endIndexRegister, Address(masm.getStackPointer(), offsetof(FrameData, endIndex)));
+    }
+
+    // Load string end pointer.
+    masm.loadPtr(Address(temp0, offsetof(InputOutputData, inputEnd)), input_end_pointer);
+
+    // Load input start pointer, and copy to FrameData.
+    masm.loadPtr(Address(temp0, offsetof(InputOutputData, inputStart)), current_position);
+    masm.storePtr(current_position, Address(masm.getStackPointer(), offsetof(FrameData, inputStart)));
+
+    // Load start index, and copy to FrameData.
+    masm.loadPtr(Address(temp0, offsetof(InputOutputData, startIndex)), temp1);
+    masm.storePtr(temp1, Address(masm.getStackPointer(), offsetof(FrameData, startIndex)));
+
+    // Set up input position to be negative offset from string end.
+    masm.subPtr(input_end_pointer, current_position);
+
+    // Set temp0 to address of char before start of the string.
+    // (effectively string position -1).
+    masm.computeEffectiveAddress(Address(current_position, -char_size()), temp0);
+
+    // Store this value on the frame, for use when clearing
+    // position registers.
+    masm.storePtr(temp0, Address(masm.getStackPointer(), offsetof(FrameData, inputStartMinusOne)));
+
+    // Update current position based on start index.
+    masm.computeEffectiveAddress(BaseIndex(current_position, temp1, factor()), current_position);
+
+    Label load_char_start_regexp, start_regexp;
+
+    // Load newline if index is at start, previous character otherwise.
+    masm.branchPtr(Assembler::NotEqual, 
+                   Address(masm.getStackPointer(), offsetof(FrameData, startIndex)), ImmWord(0),
+                   &load_char_start_regexp);
+    masm.movePtr(ImmWord('\n'), current_character);
+    masm.jump(&start_regexp);
+
+    // Global regexp restarts matching here.
+    masm.bind(&load_char_start_regexp);
+
+    // Load previous char as initial value of current character register.
+    LoadCurrentCharacterUnchecked(-1, 1);
+    masm.bind(&start_regexp);
+
+    // Initialize on-stack registers.
+    MOZ_ASSERT(num_saved_registers_ > 0);
+
+    // Fill saved registers with initial value = start offset - 1
+    // Fill in stack push order, to avoid accessing across an unwritten
+    // page (a problem on Windows).
+    if (num_saved_registers_ > 8) {
+        masm.movePtr(ImmWord(register_offset(0)), temp1);
+        Label init_loop;
+        masm.bind(&init_loop);
+        masm.storePtr(temp0, BaseIndex(masm.getStackPointer(), temp1, TimesOne));
+        masm.addPtr(ImmWord(sizeof(void*)), temp1);
+        masm.branchPtr(Assembler::LessThan, temp1,
+                       ImmWord(register_offset(num_saved_registers_)), &init_loop);
+    } else {
+        // Unroll the loop.
+        for (int i = 0; i < num_saved_registers_; i++)
+            masm.storePtr(temp0, register_location(i));
+    }
+
+    // Initialize backtrack stack pointer.
+    masm.loadPtr(AbsoluteAddress(runtime->regexpStack.addressOfBase()), backtrack_stack_pointer);
+    masm.storePtr(backtrack_stack_pointer,
+                  Address(masm.getStackPointer(), offsetof(FrameData, backtrackStackBase)));
+
+    masm.jump(&start_label_);
+
+    // Exit code:
+    if (success_label_.used()) {
+        MOZ_ASSERT(num_saved_registers_ > 0);
+
+        Address outputRegistersAddress(masm.getStackPointer(), offsetof(FrameData, outputRegisters));
+
+        // Save captures when successful.
+        masm.bind(&success_label_);
+
+        if (!match_only) {
+            Register outputRegisters = temp1;
+            Register inputByteLength = backtrack_stack_pointer;
+
+            masm.loadPtr(outputRegistersAddress, outputRegisters);
+
+            masm.loadPtr(inputOutputAddress, temp0);
+            masm.loadPtr(Address(temp0, offsetof(InputOutputData, inputEnd)), inputByteLength);
+            masm.subPtr(Address(temp0, offsetof(InputOutputData, inputStart)), inputByteLength);
+
+            // Copy captures to output. Note that registers on the C stack are pointer width
+            // so that they might hold pointers, but output registers are int32_t.
+            for (int i = 0; i < num_saved_registers_; i++) {
+                masm.loadPtr(register_location(i), temp0);
+                if (i == 0 && global_with_zero_length_check()) {
+                    // Keep capture start in current_character for the zero-length check later.
+                    masm.movePtr(temp0, current_character);
+                }
+
+                // Convert to index from start of string, not end.
+                masm.addPtr(inputByteLength, temp0);
+
+                // Convert byte index to character index.
+                if (mode_ == CHAR16)
+                    masm.rshiftPtrArithmetic(Imm32(1), temp0);
+
+                masm.store32(temp0, Address(outputRegisters, i * sizeof(int32_t)));
+            }
+        }
+
+        // Restart matching if the regular expression is flagged as global.
+        if (global()) {
+            // Increment success counter.
+            masm.add32(Imm32(1), Address(masm.getStackPointer(), offsetof(FrameData, successfulCaptures)));
+
+            Address numOutputRegistersAddress(masm.getStackPointer(), offsetof(FrameData, numOutputRegisters));
+
+            // Capture results have been stored, so the number of remaining global
+            // output registers is reduced by the number of stored captures.
+            masm.load32(numOutputRegistersAddress, temp0);
+
+            masm.sub32(Imm32(num_saved_registers_), temp0);
+
+            // Check whether we have enough room for another set of capture results.
+            masm.branch32(Assembler::LessThan, temp0, Imm32(num_saved_registers_), &exit_label_);
+
+            masm.store32(temp0, numOutputRegistersAddress);
+
+            // Advance the location for output.
+            masm.add32(Imm32(num_saved_registers_ * sizeof(void*)), outputRegistersAddress);
+
+            // Prepare temp0 to initialize registers with its value in the next run.
+            masm.loadPtr(Address(masm.getStackPointer(), offsetof(FrameData, inputStartMinusOne)), temp0);
+
+            if (global_with_zero_length_check()) {
+                // Special case for zero-length matches.
+
+                // The capture start index was loaded into current_character above.
+                masm.branchPtr(Assembler::NotEqual, current_position, current_character,
+                               &load_char_start_regexp);
+
+                // edi (offset from the end) is zero if we already reached the end.
+                masm.branchTestPtr(Assembler::Zero, current_position, current_position,
+                                   &exit_label_);
+
+                // Advance current position after a zero-length match.
+                masm.addPtr(Imm32(char_size()), current_position);
+            }
+
+            masm.jump(&load_char_start_regexp);
+        } else {
+            if (match_only) {
+                // Store endIndex.
+
+                Register endIndexRegister = temp1;
+                Register inputByteLength = backtrack_stack_pointer;
+
+                masm.loadPtr(Address(masm.getStackPointer(), offsetof(FrameData, endIndex)), endIndexRegister);
+
+                masm.loadPtr(inputOutputAddress, temp0);
+                masm.loadPtr(Address(temp0, offsetof(InputOutputData, inputEnd)), inputByteLength);
+                masm.subPtr(Address(temp0, offsetof(InputOutputData, inputStart)), inputByteLength);
+
+                masm.loadPtr(register_location(1), temp0);
+
+                // Convert to index from start of string, not end.
+                masm.addPtr(inputByteLength, temp0);
+
+                // Convert byte index to character index.
+                if (mode_ == CHAR16)
+                    masm.rshiftPtrArithmetic(Imm32(1), temp0);
+
+                masm.store32(temp0, Address(endIndexRegister, 0));
+            }
+
+            masm.movePtr(ImmWord(RegExpRunStatus_Success), temp0);
+        }
+    }
+
+    masm.bind(&exit_label_);
+
+    if (global()) {
+        // Return the number of successful captures.
+        masm.load32(Address(masm.getStackPointer(), offsetof(FrameData, successfulCaptures)), temp0);
+    }
+
+    masm.bind(&return_temp0);
+
+    // Store the result to the input structure.
+    masm.loadPtr(inputOutputAddress, temp1);
+    masm.storePtr(temp0, Address(temp1, offsetof(InputOutputData, result)));
+
+#ifndef JS_CODEGEN_X86
+    // Include the InputOutputData* when adjusting the stack size.
+    masm.freeStack(frameSize + sizeof(void*));
+#else
+    masm.freeStack(frameSize);
+#endif
+
+#if defined(XP_IOS) && defined(JS_CODEGEN_ARM)
+    masm.pop(temp0);
+    masm.movePtr(temp0, StackPointer);
+#endif
+
+    // Restore non-volatile registers which were saved on entry.
+    for (GeneralRegisterBackwardIterator iter(savedNonVolatileRegisters); iter.more(); ++iter)
+        masm.Pop(*iter);
+
+    masm.abiret();
+
+    // Backtrack code (branch target for conditional backtracks).
+    if (backtrack_label_.used()) {
+        masm.bind(&backtrack_label_);
+        Backtrack();
+    }
+
+    // Backtrack stack overflow code.
+    if (stack_overflow_label_.used()) {
+        // Reached if the backtrack-stack limit has been hit. temp2 holds the
+        // StackPointer to use for accessing FrameData.
+        masm.bind(&stack_overflow_label_);
+
+        Label grow_failed;
+
+        masm.movePtr(ImmPtr(runtime), temp1);
+
+        // Save registers before calling C function
+        LiveGeneralRegisterSet volatileRegs(GeneralRegisterSet::Volatile());
+#if defined(JS_CODEGEN_ARM) || defined(JS_CODEGEN_ARM64)
+        volatileRegs.add(Register::FromCode(Registers::lr));
+#elif defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
+        volatileRegs.add(Register::FromCode(Registers::ra));
+#endif
+        volatileRegs.takeUnchecked(temp0);
+        volatileRegs.takeUnchecked(temp1);
+        masm.PushRegsInMask(volatileRegs);
+
+        masm.setupUnalignedABICall(temp0);
+        masm.passABIArg(temp1);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, GrowBacktrackStack));
+        masm.storeCallBoolResult(temp0);
+
+        masm.PopRegsInMask(volatileRegs);
+
+        // If return false, we have failed to grow the stack, and
+        // must exit with a stack-overflow exception. Do this in the caller
+        // so that the stack is adjusted by our return instruction.
+        Label return_from_overflow_handler;
+        masm.branchTest32(Assembler::Zero, temp0, temp0, &return_from_overflow_handler);
+
+        // Otherwise, store the new backtrack stack base and recompute the new
+        // top of the stack.
+        Address backtrackStackBaseAddress(temp2, offsetof(FrameData, backtrackStackBase));
+        masm.subPtr(backtrackStackBaseAddress, backtrack_stack_pointer);
+
+        masm.loadPtr(AbsoluteAddress(runtime->regexpStack.addressOfBase()), temp1);
+        masm.storePtr(temp1, backtrackStackBaseAddress);
+        masm.addPtr(temp1, backtrack_stack_pointer);
+
+        // Resume execution in calling code.
+        masm.bind(&return_from_overflow_handler);
+        masm.abiret();
+    }
+
+    if (exit_with_exception_label_.used()) {
+        // If any of the code above needed to exit with an exception.
+        masm.bind(&exit_with_exception_label_);
+
+        // Exit with an error result to signal thrown exception.
+        masm.movePtr(ImmWord(RegExpRunStatus_Error), temp0);
+        masm.jump(&return_temp0);
+    }
+
+    Linker linker(masm);
+    AutoFlushICache afc("RegExp");
+    JitCode* code = linker.newCode<NoGC>(cx, REGEXP_CODE);
+    if (!code) {
+        ReportOutOfMemory(cx);
+        return RegExpCode();
+    }
+
+#ifdef JS_ION_PERF
+    writePerfSpewerJitCodeProfile(code, "RegExp");
+#endif
+
+    for (size_t i = 0; i < labelPatches.length(); i++) {
+        LabelPatch& v = labelPatches[i];
+        MOZ_ASSERT(!v.label);
+        Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, v.patchOffset),
+                                           ImmPtr(code->raw() + v.labelOffset),
+                                           ImmPtr(0));
+    }
+
+    JitSpew(JitSpew_Codegen, "Created RegExp (raw %p length %d)",
+            (void*) code->raw(), (int) masm.bytesNeeded());
+
+    RegExpCode res;
+    res.jitCode = code;
+    return res;
+}
+
+int
+NativeRegExpMacroAssembler::stack_limit_slack()
+{
+    return RegExpStack::kStackLimitSlack;
+}
+
+void
+NativeRegExpMacroAssembler::AdvanceCurrentPosition(int by)
+{
+    JitSpew(SPEW_PREFIX "AdvanceCurrentPosition(%d)", by);
+
+    if (by != 0)
+        masm.addPtr(Imm32(by * char_size()), current_position);
+}
+
+void
+NativeRegExpMacroAssembler::AdvanceRegister(int reg, int by)
+{
+    JitSpew(SPEW_PREFIX "AdvanceRegister(%d, %d)", reg, by);
+
+    MOZ_ASSERT(reg >= 0);
+    MOZ_ASSERT(reg < num_registers_);
+    if (by != 0)
+        masm.addPtr(Imm32(by), register_location(reg));
+}
+
+void
+NativeRegExpMacroAssembler::Backtrack()
+{
+    JitSpew(SPEW_PREFIX "Backtrack");
+
+    // Check for an interrupt.
+    Label noInterrupt;
+    masm.branch32(Assembler::Equal,
+                  AbsoluteAddress(runtime->addressOfInterruptUint32()), Imm32(0),
+                  &noInterrupt);
+    masm.movePtr(ImmWord(RegExpRunStatus_Error), temp0);
+    masm.jump(&exit_label_);
+    masm.bind(&noInterrupt);
+
+    // Pop code location from backtrack stack and jump to location.
+    PopBacktrack(temp0);
+    masm.jump(temp0);
+}
+
+void
+NativeRegExpMacroAssembler::Bind(Label* label)
+{
+    JitSpew(SPEW_PREFIX "Bind");
+
+    masm.bind(label);
+}
+
+void
+NativeRegExpMacroAssembler::CheckAtStart(Label* on_at_start)
+{
+    JitSpew(SPEW_PREFIX "CheckAtStart");
+
+    Label not_at_start;
+
+    // Did we start the match at the start of the string at all?
+    Address startIndex(masm.getStackPointer(), offsetof(FrameData, startIndex));
+    masm.branchPtr(Assembler::NotEqual, startIndex, ImmWord(0), &not_at_start);
+
+    // If we did, are we still at the start of the input?
+    masm.computeEffectiveAddress(BaseIndex(input_end_pointer, current_position, TimesOne), temp0);
+
+    Address inputStart(masm.getStackPointer(), offsetof(FrameData, inputStart));
+    masm.branchPtr(Assembler::Equal, inputStart, temp0, BranchOrBacktrack(on_at_start));
+
+    masm.bind(&not_at_start);
+}
+
+void
+NativeRegExpMacroAssembler::CheckNotAtStart(Label* on_not_at_start)
+{
+    JitSpew(SPEW_PREFIX "CheckNotAtStart");
+
+    // Did we start the match at the start of the string at all?
+    Address startIndex(masm.getStackPointer(), offsetof(FrameData, startIndex));
+    masm.branchPtr(Assembler::NotEqual, startIndex, ImmWord(0), BranchOrBacktrack(on_not_at_start));
+
+    // If we did, are we still at the start of the input?
+    masm.computeEffectiveAddress(BaseIndex(input_end_pointer, current_position, TimesOne), temp0);
+
+    Address inputStart(masm.getStackPointer(), offsetof(FrameData, inputStart));
+    masm.branchPtr(Assembler::NotEqual, inputStart, temp0, BranchOrBacktrack(on_not_at_start));
+}
+
+void
+NativeRegExpMacroAssembler::CheckCharacter(unsigned c, Label* on_equal)
+{
+    JitSpew(SPEW_PREFIX "CheckCharacter(%d)", (int) c);
+    masm.branch32(Assembler::Equal, current_character, Imm32(c), BranchOrBacktrack(on_equal));
+}
+
+void
+NativeRegExpMacroAssembler::CheckNotCharacter(unsigned c, Label* on_not_equal)
+{
+    JitSpew(SPEW_PREFIX "CheckNotCharacter(%d)", (int) c);
+    masm.branch32(Assembler::NotEqual, current_character, Imm32(c), BranchOrBacktrack(on_not_equal));
+}
+
+void
+NativeRegExpMacroAssembler::CheckCharacterAfterAnd(unsigned c, unsigned and_with,
+                                                   Label* on_equal)
+{
+    JitSpew(SPEW_PREFIX "CheckCharacterAfterAnd(%d, %d)", (int) c, (int) and_with);
+
+    if (c == 0) {
+        masm.branchTest32(Assembler::Zero, current_character, Imm32(and_with),
+                          BranchOrBacktrack(on_equal));
+    } else {
+        masm.move32(Imm32(and_with), temp0);
+        masm.and32(current_character, temp0);
+        masm.branch32(Assembler::Equal, temp0, Imm32(c), BranchOrBacktrack(on_equal));
+    }
+}
+
+void
+NativeRegExpMacroAssembler::CheckNotCharacterAfterAnd(unsigned c, unsigned and_with,
+                                                      Label* on_not_equal)
+{
+    JitSpew(SPEW_PREFIX "CheckNotCharacterAfterAnd(%d, %d)", (int) c, (int) and_with);
+
+    if (c == 0) {
+        masm.branchTest32(Assembler::NonZero, current_character, Imm32(and_with),
+                          BranchOrBacktrack(on_not_equal));
+    } else {
+        masm.move32(Imm32(and_with), temp0);
+        masm.and32(current_character, temp0);
+        masm.branch32(Assembler::NotEqual, temp0, Imm32(c), BranchOrBacktrack(on_not_equal));
+    }
+}
+
+void
+NativeRegExpMacroAssembler::CheckCharacterGT(char16_t c, Label* on_greater)
+{
+    JitSpew(SPEW_PREFIX "CheckCharacterGT(%d)", (int) c);
+    masm.branch32(Assembler::GreaterThan, current_character, Imm32(c),
+                  BranchOrBacktrack(on_greater));
+}
+
+void
+NativeRegExpMacroAssembler::CheckCharacterLT(char16_t c, Label* on_less)
+{
+    JitSpew(SPEW_PREFIX "CheckCharacterLT(%d)", (int) c);
+    masm.branch32(Assembler::LessThan, current_character, Imm32(c), BranchOrBacktrack(on_less));
+}
+
+void
+NativeRegExpMacroAssembler::CheckGreedyLoop(Label* on_tos_equals_current_position)
+{
+    JitSpew(SPEW_PREFIX "CheckGreedyLoop");
+
+    Label fallthrough;
+    masm.branchPtr(Assembler::NotEqual,
+                   Address(backtrack_stack_pointer, -int(sizeof(void*))), current_position,
+                   &fallthrough);
+    masm.subPtr(Imm32(sizeof(void*)), backtrack_stack_pointer);  // Pop.
+    JumpOrBacktrack(on_tos_equals_current_position);
+    masm.bind(&fallthrough);
+}
+
+void
+NativeRegExpMacroAssembler::CheckNotBackReference(int start_reg, Label* on_no_match)
+{
+    JitSpew(SPEW_PREFIX "CheckNotBackReference(%d)", start_reg);
+
+    Label fallthrough;
+    Label success;
+    Label fail;
+
+    // Find length of back-referenced capture.
+    masm.loadPtr(register_location(start_reg), current_character);
+    masm.loadPtr(register_location(start_reg + 1), temp0);
+    masm.subPtr(current_character, temp0);  // Length to check.
+
+    // Fail on partial or illegal capture (start of capture after end of capture).
+    masm.branchPtr(Assembler::LessThan, temp0, ImmWord(0), BranchOrBacktrack(on_no_match));
+
+    // Succeed on empty capture (including no capture).
+    masm.branchPtr(Assembler::Equal, temp0, ImmWord(0), &fallthrough);
+
+    // Check that there are sufficient characters left in the input.
+    masm.movePtr(current_position, temp1);
+    masm.addPtr(temp0, temp1);
+    masm.branchPtr(Assembler::GreaterThan, temp1, ImmWord(0), BranchOrBacktrack(on_no_match));
+
+    // Save register to make it available below.
+    masm.push(backtrack_stack_pointer);
+
+    // Compute pointers to match string and capture string
+    masm.computeEffectiveAddress(BaseIndex(input_end_pointer, current_position, TimesOne), temp1); // Start of match.
+    masm.addPtr(input_end_pointer, current_character); // Start of capture.
+    masm.computeEffectiveAddress(BaseIndex(temp0, temp1, TimesOne), backtrack_stack_pointer); // End of match.
+
+    Label loop;
+    masm.bind(&loop);
+    if (mode_ == ASCII) {
+        masm.load8ZeroExtend(Address(current_character, 0), temp0);
+        masm.load8ZeroExtend(Address(temp1, 0), temp2);
+    } else {
+        MOZ_ASSERT(mode_ == CHAR16);
+        masm.load16ZeroExtend(Address(current_character, 0), temp0);
+        masm.load16ZeroExtend(Address(temp1, 0), temp2);
+    }
+    masm.branch32(Assembler::NotEqual, temp0, temp2, &fail);
+
+    // Increment pointers into capture and match string.
+    masm.addPtr(Imm32(char_size()), current_character);
+    masm.addPtr(Imm32(char_size()), temp1);
+
+    // Check if we have reached end of match area.
+    masm.branchPtr(Assembler::Below, temp1, backtrack_stack_pointer, &loop);
+    masm.jump(&success);
+
+    masm.bind(&fail);
+
+    // Restore backtrack stack pointer.
+    masm.pop(backtrack_stack_pointer);
+    JumpOrBacktrack(on_no_match);
+
+    masm.bind(&success);
+
+    // Move current character position to position after match.
+    masm.movePtr(backtrack_stack_pointer, current_position);
+    masm.subPtr(input_end_pointer, current_position);
+
+    // Restore backtrack stack pointer.
+    masm.pop(backtrack_stack_pointer);
+
+    masm.bind(&fallthrough);
+}
+
+void
+NativeRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg, Label* on_no_match,
+                                                            bool unicode)
+{
+    JitSpew(SPEW_PREFIX "CheckNotBackReferenceIgnoreCase(%d, %d)", start_reg, unicode);
+
+    Label fallthrough;
+
+    masm.loadPtr(register_location(start_reg), current_character);  // Index of start of capture
+    masm.loadPtr(register_location(start_reg + 1), temp1);  // Index of end of capture
+    masm.subPtr(current_character, temp1);  // Length of capture.
+
+    // The length of a capture should not be negative. This can only happen
+    // if the end of the capture is unrecorded, or at a point earlier than
+    // the start of the capture.
+    masm.branchPtr(Assembler::LessThan, temp1, ImmWord(0), BranchOrBacktrack(on_no_match));
+
+    // If length is zero, either the capture is empty or it is completely
+    // uncaptured. In either case succeed immediately.
+    masm.branchPtr(Assembler::Equal, temp1, ImmWord(0), &fallthrough);
+
+    // Check that there are sufficient characters left in the input.
+    masm.movePtr(current_position, temp0);
+    masm.addPtr(temp1, temp0);
+    masm.branchPtr(Assembler::GreaterThan, temp0, ImmWord(0), BranchOrBacktrack(on_no_match));
+
+    if (mode_ == ASCII) {
+        Label success, fail;
+
+        // Save register contents to make the registers available below. After
+        // this, the temp0, temp2, and current_position registers are available.
+        masm.push(current_position);
+
+        masm.addPtr(input_end_pointer, current_character); // Start of capture.
+        masm.addPtr(input_end_pointer, current_position); // Start of text to match against capture.
+        masm.addPtr(current_position, temp1); // End of text to match against capture.
+
+        Label loop, loop_increment;
+        masm.bind(&loop);
+        masm.load8ZeroExtend(Address(current_position, 0), temp0);
+        masm.load8ZeroExtend(Address(current_character, 0), temp2);
+        masm.branch32(Assembler::Equal, temp0, temp2, &loop_increment);
+
+        // Mismatch, try case-insensitive match (converting letters to lower-case).
+        masm.or32(Imm32(0x20), temp0); // Convert match character to lower-case.
+
+        // Is temp0 a lowercase letter?
+        Label convert_capture;
+        masm.computeEffectiveAddress(Address(temp0, -'a'), temp2);
+        masm.branch32(Assembler::BelowOrEqual, temp2, Imm32(static_cast<int32_t>('z' - 'a')),
+                      &convert_capture);
+
+        // Latin-1: Check for values in range [224,254] but not 247.
+        masm.sub32(Imm32(224 - 'a'), temp2);
+        masm.branch32(Assembler::Above, temp2, Imm32(254 - 224), &fail);
+
+        // Check for 247.
+        masm.branch32(Assembler::Equal, temp2, Imm32(247 - 224), &fail);
+
+        masm.bind(&convert_capture);
+
+        // Also convert capture character.
+        masm.load8ZeroExtend(Address(current_character, 0), temp2);
+        masm.or32(Imm32(0x20), temp2);
+
+        masm.branch32(Assembler::NotEqual, temp0, temp2, &fail);
+
+        masm.bind(&loop_increment);
+
+        // Increment pointers into match and capture strings.
+        masm.addPtr(Imm32(1), current_character);
+        masm.addPtr(Imm32(1), current_position);
+
+        // Compare to end of match, and loop if not done.
+        masm.branchPtr(Assembler::Below, current_position, temp1, &loop);
+        masm.jump(&success);
+
+        masm.bind(&fail);
+
+        // Restore original values before failing.
+        masm.pop(current_position);
+        JumpOrBacktrack(on_no_match);
+
+        masm.bind(&success);
+
+        // Drop original character position value.
+        masm.addToStackPtr(Imm32(sizeof(uintptr_t)));
+
+        // Compute new value of character position after the matched part.
+        masm.subPtr(input_end_pointer, current_position);
+    } else {
+        MOZ_ASSERT(mode_ == CHAR16);
+
+        // Note: temp1 needs to be saved/restored if it is volatile, as it is used after the call.
+        LiveGeneralRegisterSet volatileRegs(GeneralRegisterSet::Volatile());
+        volatileRegs.takeUnchecked(temp0);
+        volatileRegs.takeUnchecked(temp2);
+        masm.PushRegsInMask(volatileRegs);
+
+        // Set byte_offset1.
+        // Start of capture, where current_character already holds string-end negative offset.
+        masm.addPtr(input_end_pointer, current_character);
+
+        // Set byte_offset2.
+        // Found by adding negative string-end offset of current position
+        // to end of string.
+        masm.addPtr(input_end_pointer, current_position);
+
+        // Parameters are
+        //   Address byte_offset1 - Address captured substring's start.
+        //   Address byte_offset2 - Address of current character position.
+        //   size_t byte_length - length of capture in bytes(!)
+        masm.setupUnalignedABICall(temp0);
+        masm.passABIArg(current_character);
+        masm.passABIArg(current_position);
+        masm.passABIArg(temp1);
+        if (!unicode) {
+            int (*fun)(const char16_t*, const char16_t*, size_t) = CaseInsensitiveCompareStrings;
+            masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, fun));
+        } else {
+            int (*fun)(const char16_t*, const char16_t*, size_t) = CaseInsensitiveCompareUCStrings;
+            masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, fun));
+        }
+        masm.storeCallInt32Result(temp0);
+
+        masm.PopRegsInMask(volatileRegs);
+
+        // Check if function returned non-zero for success or zero for failure.
+        masm.branchTest32(Assembler::Zero, temp0, temp0, BranchOrBacktrack(on_no_match));
+
+        // On success, increment position by length of capture.
+        masm.addPtr(temp1, current_position);
+    }
+
+    masm.bind(&fallthrough);
+}
+
+void
+NativeRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
+                                                           Label* on_not_equal)
+{
+    JitSpew(SPEW_PREFIX "CheckNotCharacterAfterMinusAnd(%d, %d, %d)", (int) c,
+            (int) minus, (int) and_with);
+
+    masm.computeEffectiveAddress(Address(current_character, -minus), temp0);
+    if (c == 0) {
+        masm.branchTest32(Assembler::NonZero, temp0, Imm32(and_with),
+                          BranchOrBacktrack(on_not_equal));
+    } else {
+        masm.and32(Imm32(and_with), temp0);
+        masm.branch32(Assembler::NotEqual, temp0, Imm32(c), BranchOrBacktrack(on_not_equal));
+    }
+}
+
+void
+NativeRegExpMacroAssembler::CheckCharacterInRange(char16_t from, char16_t to,
+                                                  Label* on_in_range)
+{
+    JitSpew(SPEW_PREFIX "CheckCharacterInRange(%d, %d)", (int) from, (int) to);
+
+    masm.computeEffectiveAddress(Address(current_character, -from), temp0);
+    masm.branch32(Assembler::BelowOrEqual, temp0, Imm32(to - from), BranchOrBacktrack(on_in_range));
+}
+
+void
+NativeRegExpMacroAssembler::CheckCharacterNotInRange(char16_t from, char16_t to,
+                                                     Label* on_not_in_range)
+{
+    JitSpew(SPEW_PREFIX "CheckCharacterNotInRange(%d, %d)", (int) from, (int) to);
+
+    masm.computeEffectiveAddress(Address(current_character, -from), temp0);
+    masm.branch32(Assembler::Above, temp0, Imm32(to - from), BranchOrBacktrack(on_not_in_range));
+}
+
+void
+NativeRegExpMacroAssembler::CheckBitInTable(uint8_t* table, Label* on_bit_set)
+{
+    JitSpew(SPEW_PREFIX "CheckBitInTable");
+
+    masm.movePtr(ImmPtr(table), temp0);
+
+    // kTableMask is currently 127, so we need to mask even if the input is
+    // Latin1. V8 has the same issue.
+    static_assert(JSString::MAX_LATIN1_CHAR > kTableMask,
+                  "No need to mask if MAX_LATIN1_CHAR <= kTableMask");
+    masm.move32(Imm32(kTableSize - 1), temp1);
+    masm.and32(current_character, temp1);
+
+    masm.load8ZeroExtend(BaseIndex(temp0, temp1, TimesOne), temp0);
+    masm.branchTest32(Assembler::NonZero, temp0, temp0, BranchOrBacktrack(on_bit_set));
+}
+
+void
+NativeRegExpMacroAssembler::Fail()
+{
+    JitSpew(SPEW_PREFIX "Fail");
+
+    if (!global())
+        masm.movePtr(ImmWord(RegExpRunStatus_Success_NotFound), temp0);
+    masm.jump(&exit_label_);
+}
+
+void
+NativeRegExpMacroAssembler::IfRegisterGE(int reg, int comparand, Label* if_ge)
+{
+    JitSpew(SPEW_PREFIX "IfRegisterGE(%d, %d)", reg, comparand);
+    masm.branchPtr(Assembler::GreaterThanOrEqual, register_location(reg), ImmWord(comparand),
+                   BranchOrBacktrack(if_ge));
+}
+
+void
+NativeRegExpMacroAssembler::IfRegisterLT(int reg, int comparand, Label* if_lt)
+{
+    JitSpew(SPEW_PREFIX "IfRegisterLT(%d, %d)", reg, comparand);
+    masm.branchPtr(Assembler::LessThan, register_location(reg), ImmWord(comparand),
+                   BranchOrBacktrack(if_lt));
+}
+
+void
+NativeRegExpMacroAssembler::IfRegisterEqPos(int reg, Label* if_eq)
+{
+    JitSpew(SPEW_PREFIX "IfRegisterEqPos(%d)", reg);
+    masm.branchPtr(Assembler::Equal, register_location(reg), current_position,
+                   BranchOrBacktrack(if_eq));
+}
+
+void
+NativeRegExpMacroAssembler::LoadCurrentCharacter(int cp_offset, Label* on_end_of_input,
+                                                 bool check_bounds, int characters)
+{
+    JitSpew(SPEW_PREFIX "LoadCurrentCharacter(%d, %d)", cp_offset, characters);
+
+    MOZ_ASSERT(cp_offset >= -1);      // ^ and \b can look behind one character.
+    MOZ_ASSERT(cp_offset < (1<<30));  // Be sane! (And ensure negation works)
+    if (check_bounds)
+        CheckPosition(cp_offset + characters - 1, on_end_of_input);
+    LoadCurrentCharacterUnchecked(cp_offset, characters);
+}
+
+void
+NativeRegExpMacroAssembler::LoadCurrentCharacterUnchecked(int cp_offset, int characters)
+{
+    JitSpew(SPEW_PREFIX "LoadCurrentCharacterUnchecked(%d, %d)", cp_offset, characters);
+
+    if (mode_ == ASCII) {
+        BaseIndex address(input_end_pointer, current_position, TimesOne, cp_offset);
+        if (characters == 4) {
+            masm.load32(address, current_character);
+        } else if (characters == 2) {
+            masm.load16ZeroExtend(address, current_character);
+        } else {
+            MOZ_ASSERT(characters == 1);
+            masm.load8ZeroExtend(address, current_character);
+        }
+    } else {
+        MOZ_ASSERT(mode_ == CHAR16);
+        MOZ_ASSERT(characters <= 2);
+        BaseIndex address(input_end_pointer, current_position, TimesOne, cp_offset * sizeof(char16_t));
+        if (characters == 2)
+            masm.load32(address, current_character);
+        else
+            masm.load16ZeroExtend(address, current_character);
+    }
+}
+
+void
+NativeRegExpMacroAssembler::PopCurrentPosition()
+{
+    JitSpew(SPEW_PREFIX "PopCurrentPosition");
+
+    PopBacktrack(current_position);
+}
+
+void
+NativeRegExpMacroAssembler::PopRegister(int register_index)
+{
+    JitSpew(SPEW_PREFIX "PopRegister(%d)", register_index);
+
+    PopBacktrack(temp0);
+    masm.storePtr(temp0, register_location(register_index));
+}
+
+void
+NativeRegExpMacroAssembler::PushBacktrack(Label* label)
+{
+    JitSpew(SPEW_PREFIX "PushBacktrack");
+
+    CodeOffset patchOffset = masm.movWithPatch(ImmPtr(nullptr), temp0);
+
+    MOZ_ASSERT(!label->bound());
+
+    {
+        AutoEnterOOMUnsafeRegion oomUnsafe;
+        if (!labelPatches.append(LabelPatch(label, patchOffset)))
+            oomUnsafe.crash("NativeRegExpMacroAssembler::PushBacktrack");
+    }
+
+    PushBacktrack(temp0);
+    CheckBacktrackStackLimit();
+}
+
+void
+NativeRegExpMacroAssembler::BindBacktrack(Label* label)
+{
+    JitSpew(SPEW_PREFIX "BindBacktrack");
+
+    Bind(label);
+
+    for (size_t i = 0; i < labelPatches.length(); i++) {
+        LabelPatch& v = labelPatches[i];
+        if (v.label == label) {
+            v.labelOffset = label->offset();
+            v.label = nullptr;
+            break;
+        }
+    }
+}
+
+void
+NativeRegExpMacroAssembler::PushBacktrack(Register source)
+{
+    JitSpew(SPEW_PREFIX "PushBacktrack");
+
+    MOZ_ASSERT(source != backtrack_stack_pointer);
+
+    // Notice: This updates flags, unlike normal Push.
+    masm.storePtr(source, Address(backtrack_stack_pointer, 0));
+    masm.addPtr(Imm32(sizeof(void*)), backtrack_stack_pointer);
+}
+
+void
+NativeRegExpMacroAssembler::PushBacktrack(int32_t value)
+{
+    JitSpew(SPEW_PREFIX "PushBacktrack(%d)", (int) value);
+
+    // Notice: This updates flags, unlike normal Push.
+    masm.storePtr(ImmWord(value), Address(backtrack_stack_pointer, 0));
+    masm.addPtr(Imm32(sizeof(void*)), backtrack_stack_pointer);
+}
+
+void
+NativeRegExpMacroAssembler::PopBacktrack(Register target)
+{
+    JitSpew(SPEW_PREFIX "PopBacktrack");
+
+    MOZ_ASSERT(target != backtrack_stack_pointer);
+
+    // Notice: This updates flags, unlike normal Pop.
+    masm.subPtr(Imm32(sizeof(void*)), backtrack_stack_pointer);
+    masm.loadPtr(Address(backtrack_stack_pointer, 0), target);
+}
+
+void
+NativeRegExpMacroAssembler::CheckBacktrackStackLimit()
+{
+    JitSpew(SPEW_PREFIX "CheckBacktrackStackLimit");
+
+    const void* limitAddr = runtime->regexpStack.addressOfLimit();
+
+    Label no_stack_overflow;
+    masm.branchPtr(Assembler::AboveOrEqual, AbsoluteAddress(limitAddr),
+                   backtrack_stack_pointer, &no_stack_overflow);
+
+    // Copy the stack pointer before the call() instruction modifies it.
+    masm.moveStackPtrTo(temp2);
+
+    masm.call(&stack_overflow_label_);
+    masm.bind(&no_stack_overflow);
+
+    // Exit with an exception if the call failed.
+    masm.branchTest32(Assembler::Zero, temp0, temp0, &exit_with_exception_label_);
+}
+
+void
+NativeRegExpMacroAssembler::PushCurrentPosition()
+{
+    JitSpew(SPEW_PREFIX "PushCurrentPosition");
+
+    PushBacktrack(current_position);
+}
+
+void
+NativeRegExpMacroAssembler::PushRegister(int register_index, StackCheckFlag check_stack_limit)
+{
+    JitSpew(SPEW_PREFIX "PushRegister(%d)", register_index);
+
+    masm.loadPtr(register_location(register_index), temp0);
+    PushBacktrack(temp0);
+    if (check_stack_limit)
+        CheckBacktrackStackLimit();
+}
+
+void
+NativeRegExpMacroAssembler::ReadCurrentPositionFromRegister(int reg)
+{
+    JitSpew(SPEW_PREFIX "ReadCurrentPositionFromRegister(%d)", reg);
+
+    masm.loadPtr(register_location(reg), current_position);
+}
+
+void
+NativeRegExpMacroAssembler::WriteCurrentPositionToRegister(int reg, int cp_offset)
+{
+    JitSpew(SPEW_PREFIX "WriteCurrentPositionToRegister(%d, %d)", reg, cp_offset);
+
+    if (cp_offset == 0) {
+        masm.storePtr(current_position, register_location(reg));
+    } else {
+        masm.computeEffectiveAddress(Address(current_position, cp_offset * char_size()), temp0);
+        masm.storePtr(temp0, register_location(reg));
+    }
+}
+
+void
+NativeRegExpMacroAssembler::ReadBacktrackStackPointerFromRegister(int reg)
+{
+    JitSpew(SPEW_PREFIX "ReadBacktrackStackPointerFromRegister(%d)", reg);
+
+    masm.loadPtr(register_location(reg), backtrack_stack_pointer);
+    masm.addPtr(Address(masm.getStackPointer(),
+                offsetof(FrameData, backtrackStackBase)), backtrack_stack_pointer);
+}
+
+void
+NativeRegExpMacroAssembler::WriteBacktrackStackPointerToRegister(int reg)
+{
+    JitSpew(SPEW_PREFIX "WriteBacktrackStackPointerToRegister(%d)", reg);
+
+    masm.movePtr(backtrack_stack_pointer, temp0);
+    masm.subPtr(Address(masm.getStackPointer(),
+                offsetof(FrameData, backtrackStackBase)), temp0);
+    masm.storePtr(temp0, register_location(reg));
+}
+
+void
+NativeRegExpMacroAssembler::SetCurrentPositionFromEnd(int by)
+{
+    JitSpew(SPEW_PREFIX "SetCurrentPositionFromEnd(%d)", by);
+
+    Label after_position;
+    masm.branchPtr(Assembler::GreaterThanOrEqual, current_position,
+                   ImmWord(-by * char_size()), &after_position);
+    masm.movePtr(ImmWord(-by * char_size()), current_position);
+
+    // On RegExp code entry (where this operation is used), the character before
+    // the current position is expected to be already loaded.
+    // We have advanced the position, so it's safe to read backwards.
+    LoadCurrentCharacterUnchecked(-1, 1);
+    masm.bind(&after_position);
+}
+
+void
+NativeRegExpMacroAssembler::SetRegister(int register_index, int to)
+{
+    JitSpew(SPEW_PREFIX "SetRegister(%d, %d)", register_index, to);
+
+    MOZ_ASSERT(register_index >= num_saved_registers_);  // Reserved for positions!
+    masm.storePtr(ImmWord(to), register_location(register_index));
+}
+
+bool
+NativeRegExpMacroAssembler::Succeed()
+{
+    JitSpew(SPEW_PREFIX "Succeed");
+
+    masm.jump(&success_label_);
+    return global();
+}
+
+void
+NativeRegExpMacroAssembler::ClearRegisters(int reg_from, int reg_to)
+{
+    JitSpew(SPEW_PREFIX "ClearRegisters(%d, %d)", reg_from, reg_to);
+
+    MOZ_ASSERT(reg_from <= reg_to);
+    masm.loadPtr(Address(masm.getStackPointer(), offsetof(FrameData, inputStartMinusOne)), temp0);
+    for (int reg = reg_from; reg <= reg_to; reg++)
+        masm.storePtr(temp0, register_location(reg));
+}
+
+void
+NativeRegExpMacroAssembler::CheckPosition(int cp_offset, Label* on_outside_input)
+{
+    JitSpew(SPEW_PREFIX "CheckPosition(%d)", cp_offset);
+    masm.branchPtr(Assembler::GreaterThanOrEqual, current_position,
+                   ImmWord(-cp_offset * char_size()), BranchOrBacktrack(on_outside_input));
+}
+
+Label*
+NativeRegExpMacroAssembler::BranchOrBacktrack(Label* branch)
+{
+    if (branch)
+        return branch;
+    return &backtrack_label_;
+}
+
+void
+NativeRegExpMacroAssembler::JumpOrBacktrack(Label* to)
+{
+    JitSpew(SPEW_PREFIX "JumpOrBacktrack");
+
+    if (to)
+        masm.jump(to);
+    else
+        Backtrack();
+}
+
+bool
+NativeRegExpMacroAssembler::CheckSpecialCharacterClass(char16_t type, Label* on_no_match)
+{
+    JitSpew(SPEW_PREFIX "CheckSpecialCharacterClass(%d)", (int) type);
+
+    Label* branch = BranchOrBacktrack(on_no_match);
+
+    // Range checks (c in min..max) are generally implemented by an unsigned
+    // (c - min) <= (max - min) check
+    switch (type) {
+      case 's':
+        // Match space-characters.
+        if (mode_ == ASCII) {
+            // One byte space characters are '\t'..'\r', ' ' and \u00a0.
+            Label success;
+            masm.branch32(Assembler::Equal, current_character, Imm32(' '), &success);
+
+            // Check range 0x09..0x0d.
+            masm.computeEffectiveAddress(Address(current_character, -'\t'), temp0);
+            masm.branch32(Assembler::BelowOrEqual, temp0, Imm32('\r' - '\t'), &success);
+
+            // \u00a0 (NBSP).
+            masm.branch32(Assembler::NotEqual, temp0, Imm32(0x00a0 - '\t'), branch);
+
+            masm.bind(&success);
+            return true;
+        }
+        return false;
+      case 'S':
+        // The emitted code for generic character classes is good enough.
+        return false;
+      case 'd':
+        // Match ASCII digits ('0'..'9')
+        masm.computeEffectiveAddress(Address(current_character, -'0'), temp0);
+        masm.branch32(Assembler::Above, temp0, Imm32('9' - '0'), branch);
+        return true;
+      case 'D':
+        // Match non ASCII-digits
+        masm.computeEffectiveAddress(Address(current_character, -'0'), temp0);
+        masm.branch32(Assembler::BelowOrEqual, temp0, Imm32('9' - '0'), branch);
+        return true;
+      case '.': {
+        // Match non-newlines (not 0x0a('\n'), 0x0d('\r'), 0x2028 and 0x2029)
+        masm.move32(current_character, temp0);
+        masm.xor32(Imm32(0x01), temp0);
+
+        // See if current character is '\n'^1 or '\r'^1, i.e., 0x0b or 0x0c
+        masm.sub32(Imm32(0x0b), temp0);
+        masm.branch32(Assembler::BelowOrEqual, temp0, Imm32(0x0c - 0x0b), branch);
+        if (mode_ == CHAR16) {
+            // Compare original value to 0x2028 and 0x2029, using the already
+            // computed (current_char ^ 0x01 - 0x0b). I.e., check for
+            // 0x201d (0x2028 - 0x0b) or 0x201e.
+            masm.sub32(Imm32(0x2028 - 0x0b), temp0);
+            masm.branch32(Assembler::BelowOrEqual, temp0, Imm32(0x2029 - 0x2028), branch);
+        }
+        return true;
+      }
+      case 'w': {
+        if (mode_ != ASCII) {
+            // Table is 128 entries, so all ASCII characters can be tested.
+            masm.branch32(Assembler::Above, current_character, Imm32('z'), branch);
+        }
+        MOZ_ASSERT(0 == word_character_map[0]);  // Character '\0' is not a word char.
+        masm.movePtr(ImmPtr(word_character_map), temp0);
+        masm.load8ZeroExtend(BaseIndex(temp0, current_character, TimesOne), temp0);
+        masm.branchTest32(Assembler::Zero, temp0, temp0, branch);
+        return true;
+      }
+      case 'W': {
+        Label done;
+        if (mode_ != ASCII) {
+            // Table is 128 entries, so all ASCII characters can be tested.
+            masm.branch32(Assembler::Above, current_character, Imm32('z'), &done);
+        }
+        MOZ_ASSERT(0 == word_character_map[0]);  // Character '\0' is not a word char.
+        masm.movePtr(ImmPtr(word_character_map), temp0);
+        masm.load8ZeroExtend(BaseIndex(temp0, current_character, TimesOne), temp0);
+        masm.branchTest32(Assembler::NonZero, temp0, temp0, branch);
+        if (mode_ != ASCII)
+            masm.bind(&done);
+        return true;
+      }
+        // Non-standard classes (with no syntactic shorthand) used internally.
+      case '*':
+        // Match any character.
+        return true;
+      case 'n': {
+        // Match newlines (0x0a('\n'), 0x0d('\r'), 0x2028 or 0x2029).
+        // The opposite of '.'.
+        masm.move32(current_character, temp0);
+        masm.xor32(Imm32(0x01), temp0);
+
+        // See if current character is '\n'^1 or '\r'^1, i.e., 0x0b or 0x0c
+        masm.sub32(Imm32(0x0b), temp0);
+
+        if (mode_ == ASCII) {
+            masm.branch32(Assembler::Above, temp0, Imm32(0x0c - 0x0b), branch);
+        } else {
+            Label done;
+            masm.branch32(Assembler::BelowOrEqual, temp0, Imm32(0x0c - 0x0b), &done);
+            MOZ_ASSERT(CHAR16 == mode_);
+
+            // Compare original value to 0x2028 and 0x2029, using the already
+            // computed (current_char ^ 0x01 - 0x0b). I.e., check for
+            // 0x201d (0x2028 - 0x0b) or 0x201e.
+            masm.sub32(Imm32(0x2028 - 0x0b), temp0);
+            masm.branch32(Assembler::Above, temp0, Imm32(1), branch);
+
+            masm.bind(&done);
+        }
+        return true;
+      }
+        // No custom implementation (yet):
+      default:
+        return false;
+    }
+}
+
+bool
+NativeRegExpMacroAssembler::CanReadUnaligned()
+{
+#if defined(JS_CODEGEN_ARM)
+    return !jit::HasAlignmentFault();
+#elif defined(JS_CODEGEN_MIPS32) || defined(JS_CODEGEN_MIPS64)
+    return false;
+#else
+    return true;
+#endif
+}
+
+const uint8_t
+NativeRegExpMacroAssembler::word_character_map[] =
+{
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // '0' - '7'
+    0xffu, 0xffu, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,  // '8' - '9'
+
+    0x00u, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // 'A' - 'G'
+    0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // 'H' - 'O'
+    0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // 'P' - 'W'
+    0xffu, 0xffu, 0xffu, 0x00u, 0x00u, 0x00u, 0x00u, 0xffu,  // 'X' - 'Z', '_'
+
+    0x00u, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // 'a' - 'g'
+    0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // 'h' - 'o'
+    0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu, 0xffu,  // 'p' - 'w'
+    0xffu, 0xffu, 0xffu, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,  // 'x' - 'z'
+
+    // Latin-1 range
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+    0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u, 0x00u,
+};
diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.h b/js/src/irregexp/NativeRegExpMacroAssembler.h
new file mode 100644
index 000000000..7a72e252f
--- /dev/null
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.h
@@ -0,0 +1,226 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_NATIVE_REGEXP_MACRO_ASSEMBLER_H_
+#define V8_NATIVE_REGEXP_MACRO_ASSEMBLER_H_
+
+#include "irregexp/RegExpMacroAssembler.h"
+
+namespace js {
+namespace irregexp {
+
+struct InputOutputData
+{
+    const void* inputStart;
+    const void* inputEnd;
+
+    // Index into inputStart (in chars) at which to begin matching.
+    size_t startIndex;
+    size_t* endIndex;
+
+    MatchPairs* matches;
+
+    // RegExpMacroAssembler::Result for non-global regexps, number of captures
+    // for global regexps.
+    int32_t result;
+
+    template <typename CharT>
+    InputOutputData(const CharT* inputStart, const CharT* inputEnd,
+                    size_t startIndex, MatchPairs* matches, size_t* endIndex)
+      : inputStart(inputStart),
+        inputEnd(inputEnd),
+        startIndex(startIndex),
+        endIndex(endIndex),
+        matches(matches),
+        result(0)
+    {}
+};
+
+struct FrameData
+{
+    // Copy of the input/output data's data.
+    char16_t* inputStart;
+    size_t startIndex;
+    size_t* endIndex;
+
+    // Pointer to the character before the input start.
+    char16_t* inputStartMinusOne;
+
+    // Copy of the input MatchPairs registers, may be modified by JIT code.
+    int32_t* outputRegisters;
+    int32_t numOutputRegisters;
+
+    int32_t successfulCaptures;
+
+    void* backtrackStackBase;
+};
+
+class MOZ_STACK_CLASS NativeRegExpMacroAssembler final : public RegExpMacroAssembler
+{
+  public:
+    // Type of input string to generate code for.
+    enum Mode { ASCII = 1, CHAR16 = 2 };
+
+    NativeRegExpMacroAssembler(LifoAlloc* alloc, RegExpShared* shared,
+                               JSRuntime* rt, Mode mode, int registers_to_save);
+
+    // Inherited virtual methods.
+    RegExpCode GenerateCode(JSContext* cx, bool match_only);
+    int stack_limit_slack();
+    bool CanReadUnaligned();
+    void AdvanceCurrentPosition(int by);
+    void AdvanceRegister(int reg, int by);
+    void Backtrack();
+    void Bind(jit::Label* label);
+    void CheckAtStart(jit::Label* on_at_start);
+    void CheckCharacter(unsigned c, jit::Label* on_equal);
+    void CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal);
+    void CheckCharacterGT(char16_t limit, jit::Label* on_greater);
+    void CheckCharacterLT(char16_t limit, jit::Label* on_less);
+    void CheckGreedyLoop(jit::Label* on_tos_equals_current_position);
+    void CheckNotAtStart(jit::Label* on_not_at_start);
+    void CheckNotBackReference(int start_reg, jit::Label* on_no_match);
+    void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match, bool unicode);
+    void CheckNotCharacter(unsigned c, jit::Label* on_not_equal);
+    void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal);
+    void CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
+                                        jit::Label* on_not_equal);
+    void CheckCharacterInRange(char16_t from, char16_t to,
+                               jit::Label* on_in_range);
+    void CheckCharacterNotInRange(char16_t from, char16_t to,
+                                  jit::Label* on_not_in_range);
+    void CheckBitInTable(uint8_t* table, jit::Label* on_bit_set);
+    void CheckPosition(int cp_offset, jit::Label* on_outside_input);
+    void JumpOrBacktrack(jit::Label* to);
+    bool CheckSpecialCharacterClass(char16_t type, jit::Label* on_no_match);
+    void Fail();
+    void IfRegisterGE(int reg, int comparand, jit::Label* if_ge);
+    void IfRegisterLT(int reg, int comparand, jit::Label* if_lt);
+    void IfRegisterEqPos(int reg, jit::Label* if_eq);
+    void LoadCurrentCharacter(int cp_offset, jit::Label* on_end_of_input,
+                              bool check_bounds = true, int characters = 1);
+    void PopCurrentPosition();
+    void PopRegister(int register_index);
+    void PushCurrentPosition();
+    void PushRegister(int register_index, StackCheckFlag check_stack_limit);
+    void ReadCurrentPositionFromRegister(int reg);
+    void ReadBacktrackStackPointerFromRegister(int reg);
+    void SetCurrentPositionFromEnd(int by);
+    void SetRegister(int register_index, int to);
+    bool Succeed();
+    void WriteCurrentPositionToRegister(int reg, int cp_offset);
+    void ClearRegisters(int reg_from, int reg_to);
+    void WriteBacktrackStackPointerToRegister(int reg);
+    void PushBacktrack(jit::Label* label);
+    void BindBacktrack(jit::Label* label);
+
+    // Compares two-byte strings case insensitively.
+    // Called from generated RegExp code.
+    static int CaseInsensitiveCompareUC16(jit::Address byte_offset1,
+                                          jit::Address byte_offset2,
+                                          size_t byte_length);
+
+    // Byte map of one byte characters with a 0xff if the character is a word
+    // character (digit, letter or underscore) and 0x00 otherwise.
+    // Used by generated RegExp code.
+    static const uint8_t word_character_map[256];
+
+    // Byte size of chars in the string to match (decided by the Mode argument)
+    inline int char_size() { return static_cast<int>(mode_); }
+    inline jit::Scale factor() { return mode_ == CHAR16 ? jit::TimesTwo : jit::TimesOne; }
+
+    jit::Label* BranchOrBacktrack(jit::Label* branch);
+
+    // Pushes a register or constant on the backtrack stack. Decrements the
+    // stack pointer by a word size and stores the register's value there.
+    void PushBacktrack(jit::Register value);
+    void PushBacktrack(int32_t value);
+
+    // Pop a value from the backtrack stack.
+    void PopBacktrack(jit::Register target);
+
+    // Check whether we are exceeding the stack limit on the backtrack stack.
+    void CheckBacktrackStackLimit();
+
+    void LoadCurrentCharacterUnchecked(int cp_offset, int characters);
+
+  private:
+    jit::MacroAssembler masm;
+
+    JSRuntime* runtime;
+    Mode mode_;
+    jit::Label entry_label_;
+    jit::Label start_label_;
+    jit::Label backtrack_label_;
+    jit::Label success_label_;
+    jit::Label exit_label_;
+    jit::Label stack_overflow_label_;
+    jit::Label exit_with_exception_label_;
+
+    // Set of registers which are used by the code generator, and as such which
+    // are saved.
+    jit::LiveGeneralRegisterSet savedNonVolatileRegisters;
+
+    struct LabelPatch {
+        // Once it is bound via BindBacktrack, |label| becomes null and
+        // |labelOffset| is set.
+        jit::Label* label;
+        size_t labelOffset;
+
+        jit::CodeOffset patchOffset;
+
+        LabelPatch(jit::Label* label, jit::CodeOffset patchOffset)
+          : label(label), labelOffset(0), patchOffset(patchOffset)
+        {}
+    };
+
+    Vector<LabelPatch, 4, SystemAllocPolicy> labelPatches;
+
+    // See RegExpMacroAssembler.cpp for the meaning of these registers.
+    jit::Register input_end_pointer;
+    jit::Register current_character;
+    jit::Register current_position;
+    jit::Register backtrack_stack_pointer;
+    jit::Register temp0, temp1, temp2;
+
+    // The frame_pointer-relative location of a regexp register.
+    jit::Address register_location(int register_index) {
+        checkRegister(register_index);
+        return jit::Address(masm.getStackPointer(), register_offset(register_index));
+    }
+
+    int32_t register_offset(int register_index) {
+        return sizeof(FrameData) + register_index * sizeof(void*);
+    }
+};
+
+} }  // namespace js::irregexp
+
+#endif  // V8_NATIVE_REGEXP_MACRO_ASSEMBLER_H_
diff --git a/js/src/irregexp/RegExpAST.cpp b/js/src/irregexp/RegExpAST.cpp
new file mode 100644
index 000000000..8dfd99057
--- /dev/null
+++ b/js/src/irregexp/RegExpAST.cpp
@@ -0,0 +1,265 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "irregexp/RegExpAST.h"
+
+using namespace js;
+using namespace js::irregexp;
+
+#define MAKE_ACCEPT(Name)                                            \
+  void* RegExp##Name::Accept(RegExpVisitor* visitor, void* data) {   \
+    return visitor->Visit##Name(this, data);                         \
+  }
+FOR_EACH_REG_EXP_TREE_TYPE(MAKE_ACCEPT)
+#undef MAKE_ACCEPT
+
+#define MAKE_TYPE_CASE(Name)                                         \
+  RegExp##Name* RegExpTree::As##Name() {                             \
+    return nullptr;                                                  \
+  }                                                                  \
+  bool RegExpTree::Is##Name() { return false; }
+FOR_EACH_REG_EXP_TREE_TYPE(MAKE_TYPE_CASE)
+#undef MAKE_TYPE_CASE
+
+#define MAKE_TYPE_CASE(Name)                                        \
+  RegExp##Name* RegExp##Name::As##Name() {                          \
+    return this;                                                    \
+  }                                                                 \
+  bool RegExp##Name::Is##Name() { return true; }
+FOR_EACH_REG_EXP_TREE_TYPE(MAKE_TYPE_CASE)
+#undef MAKE_TYPE_CASE
+
+static Interval
+ListCaptureRegisters(const RegExpTreeVector& children)
+{
+    Interval result = Interval::Empty();
+    for (size_t i = 0; i < children.length(); i++)
+        result = result.Union(children[i]->CaptureRegisters());
+    return result;
+}
+
+// ----------------------------------------------------------------------------
+// RegExpDisjunction
+
+RegExpDisjunction::RegExpDisjunction(RegExpTreeVector* alternatives)
+  : alternatives_(alternatives)
+{
+    MOZ_ASSERT(alternatives->length() > 1);
+    RegExpTree* first_alternative = (*alternatives)[0];
+    min_match_ = first_alternative->min_match();
+    max_match_ = first_alternative->max_match();
+    for (size_t i = 1; i < alternatives->length(); i++) {
+        RegExpTree* alternative = (*alternatives)[i];
+        min_match_ = Min(min_match_, alternative->min_match());
+        max_match_ = Max(max_match_, alternative->max_match());
+    }
+}
+
+Interval
+RegExpDisjunction::CaptureRegisters()
+{
+    return ListCaptureRegisters(alternatives());
+}
+
+bool
+RegExpDisjunction::IsAnchoredAtStart()
+{
+    const RegExpTreeVector& alternatives = this->alternatives();
+    for (size_t i = 0; i < alternatives.length(); i++) {
+        if (!alternatives[i]->IsAnchoredAtStart())
+            return false;
+    }
+    return true;
+}
+
+bool
+RegExpDisjunction::IsAnchoredAtEnd()
+{
+    const RegExpTreeVector& alternatives = this->alternatives();
+    for (size_t i = 0; i < alternatives.length(); i++) {
+        if (!alternatives[i]->IsAnchoredAtEnd())
+            return false;
+    }
+    return true;
+}
+
+// ----------------------------------------------------------------------------
+// RegExpAlternative
+
+static int IncreaseBy(int previous, int increase)
+{
+    if (RegExpTree::kInfinity - previous < increase)
+        return RegExpTree::kInfinity;
+    return previous + increase;
+}
+
+RegExpAlternative::RegExpAlternative(RegExpTreeVector* nodes)
+  : nodes_(nodes),
+    min_match_(0),
+    max_match_(0)
+{
+    MOZ_ASSERT(nodes->length() > 1);
+    for (size_t i = 0; i < nodes->length(); i++) {
+        RegExpTree* node = (*nodes)[i];
+        int node_min_match = node->min_match();
+        min_match_ = IncreaseBy(min_match_, node_min_match);
+        int node_max_match = node->max_match();
+        max_match_ = IncreaseBy(max_match_, node_max_match);
+    }
+}
+
+Interval
+RegExpAlternative::CaptureRegisters()
+{
+    return ListCaptureRegisters(nodes());
+}
+
+bool
+RegExpAlternative::IsAnchoredAtStart()
+{
+    const RegExpTreeVector& nodes = this->nodes();
+    for (size_t i = 0; i < nodes.length(); i++) {
+        RegExpTree* node = nodes[i];
+        if (node->IsAnchoredAtStart()) { return true; }
+        if (node->max_match() > 0) { return false; }
+    }
+    return false;
+}
+
+bool
+RegExpAlternative::IsAnchoredAtEnd()
+{
+    const RegExpTreeVector& nodes = this->nodes();
+    for (int i = nodes.length() - 1; i >= 0; i--) {
+        RegExpTree* node = nodes[i];
+        if (node->IsAnchoredAtEnd()) { return true; }
+        if (node->max_match() > 0) { return false; }
+    }
+    return false;
+}
+
+// ----------------------------------------------------------------------------
+// RegExpAssertion
+
+bool
+RegExpAssertion::IsAnchoredAtStart()
+{
+    return assertion_type() == RegExpAssertion::START_OF_INPUT;
+}
+
+bool
+RegExpAssertion::IsAnchoredAtEnd()
+{
+    return assertion_type() == RegExpAssertion::END_OF_INPUT;
+}
+
+// ----------------------------------------------------------------------------
+// RegExpCharacterClass
+
+void
+RegExpCharacterClass::AppendToText(RegExpText* text)
+{
+    text->AddElement(TextElement::CharClass(this));
+}
+
+CharacterRangeVector&
+CharacterSet::ranges(LifoAlloc* alloc)
+{
+    if (ranges_ == nullptr) {
+        ranges_ = alloc->newInfallible<CharacterRangeVector>(*alloc);
+        CharacterRange::AddClassEscape(alloc, standard_set_type_, ranges_);
+    }
+    return *ranges_;
+}
+
+// ----------------------------------------------------------------------------
+// RegExpAtom
+
+void
+RegExpAtom::AppendToText(RegExpText* text)
+{
+    text->AddElement(TextElement::Atom(this));
+}
+
+// ----------------------------------------------------------------------------
+// RegExpText
+
+void
+RegExpText::AppendToText(RegExpText* text)
+{
+    for (size_t i = 0; i < elements().length(); i++)
+        text->AddElement(elements()[i]);
+}
+
+// ----------------------------------------------------------------------------
+// RegExpQuantifier
+
+Interval
+RegExpQuantifier::CaptureRegisters()
+{
+    return body()->CaptureRegisters();
+}
+
+// ----------------------------------------------------------------------------
+// RegExpCapture
+
+bool
+RegExpCapture::IsAnchoredAtStart()
+{
+    return body()->IsAnchoredAtStart();
+}
+
+bool
+RegExpCapture::IsAnchoredAtEnd()
+{
+    return body()->IsAnchoredAtEnd();
+}
+
+Interval
+RegExpCapture::CaptureRegisters()
+{
+    Interval self(StartRegister(index()), EndRegister(index()));
+    return self.Union(body()->CaptureRegisters());
+}
+
+// ----------------------------------------------------------------------------
+// RegExpLookahead
+
+Interval
+RegExpLookahead::CaptureRegisters()
+{
+    return body()->CaptureRegisters();
+}
+
+bool
+RegExpLookahead::IsAnchoredAtStart()
+{
+    return is_positive() && body()->IsAnchoredAtStart();
+}
diff --git a/js/src/irregexp/RegExpAST.h b/js/src/irregexp/RegExpAST.h
new file mode 100644
index 000000000..7bda6fc7e
--- /dev/null
+++ b/js/src/irregexp/RegExpAST.h
@@ -0,0 +1,449 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_REGEXP_AST_H_
+#define V8_REGEXP_AST_H_
+
+// Prevent msvc build failures as indicated in bug 1205328
+#ifdef min
+# undef min
+#endif
+#ifdef max
+# undef max
+#endif
+
+#include "irregexp/RegExpEngine.h"
+
+namespace js {
+namespace irregexp {
+
+class RegExpCompiler;
+class RegExpNode;
+
+class RegExpVisitor
+{
+  public:
+    virtual ~RegExpVisitor() { }
+#define MAKE_CASE(Name)                                         \
+    virtual void* Visit##Name(RegExp##Name*, void* data) = 0;
+    FOR_EACH_REG_EXP_TREE_TYPE(MAKE_CASE)
+#undef MAKE_CASE
+};
+
+class RegExpTree
+{
+  public:
+    static const int kInfinity = INT32_MAX;
+    virtual ~RegExpTree() {}
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success) = 0;
+    virtual bool IsTextElement() { return false; }
+    virtual bool IsAnchoredAtStart() { return false; }
+    virtual bool IsAnchoredAtEnd() { return false; }
+    virtual int min_match() = 0;
+    virtual int max_match() = 0;
+    // Returns the interval of registers used for captures within this
+    // expression.
+    virtual Interval CaptureRegisters() { return Interval::Empty(); }
+    virtual void AppendToText(RegExpText* text) {
+        MOZ_CRASH("Bad call");
+    }
+#define MAKE_ASTYPE(Name)                                               \
+    virtual RegExp##Name* As##Name();                                   \
+    virtual bool Is##Name();
+    FOR_EACH_REG_EXP_TREE_TYPE(MAKE_ASTYPE)
+#undef MAKE_ASTYPE
+};
+
+typedef InfallibleVector<RegExpTree*, 1> RegExpTreeVector;
+
+class RegExpDisjunction : public RegExpTree
+{
+  public:
+    explicit RegExpDisjunction(RegExpTreeVector* alternatives);
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpDisjunction* AsDisjunction();
+    virtual Interval CaptureRegisters();
+    virtual bool IsDisjunction();
+    virtual bool IsAnchoredAtStart();
+    virtual bool IsAnchoredAtEnd();
+    virtual int min_match() { return min_match_; }
+    virtual int max_match() { return max_match_; }
+
+    const RegExpTreeVector& alternatives() { return *alternatives_; }
+
+  private:
+    RegExpTreeVector* alternatives_;
+    int min_match_;
+    int max_match_;
+};
+
+class RegExpAlternative : public RegExpTree
+{
+  public:
+    explicit RegExpAlternative(RegExpTreeVector* nodes);
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpAlternative* AsAlternative();
+    virtual Interval CaptureRegisters();
+    virtual bool IsAlternative();
+    virtual bool IsAnchoredAtStart();
+    virtual bool IsAnchoredAtEnd();
+    virtual int min_match() { return min_match_; }
+    virtual int max_match() { return max_match_; }
+
+    const RegExpTreeVector& nodes() { return *nodes_; }
+
+  private:
+    RegExpTreeVector* nodes_;
+    int min_match_;
+    int max_match_;
+};
+
+class RegExpAssertion : public RegExpTree {
+ public:
+  enum AssertionType {
+    START_OF_LINE,
+    START_OF_INPUT,
+    END_OF_LINE,
+    END_OF_INPUT,
+    BOUNDARY,
+    NON_BOUNDARY,
+    NOT_AFTER_LEAD_SURROGATE,
+    NOT_IN_SURROGATE_PAIR
+  };
+  explicit RegExpAssertion(AssertionType type) : assertion_type_(type) { }
+  virtual void* Accept(RegExpVisitor* visitor, void* data);
+  virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                             RegExpNode* on_success);
+  virtual RegExpAssertion* AsAssertion();
+  virtual bool IsAssertion();
+  virtual bool IsAnchoredAtStart();
+  virtual bool IsAnchoredAtEnd();
+  virtual int min_match() { return 0; }
+  virtual int max_match() { return 0; }
+  AssertionType assertion_type() { return assertion_type_; }
+ private:
+  AssertionType assertion_type_;
+};
+
+class CharacterSet
+{
+  public:
+    explicit CharacterSet(char16_t standard_set_type)
+      : ranges_(nullptr),
+        standard_set_type_(standard_set_type)
+    {}
+    explicit CharacterSet(CharacterRangeVector* ranges)
+      : ranges_(ranges),
+        standard_set_type_(0)
+    {}
+
+    CharacterRangeVector& ranges(LifoAlloc* alloc);
+    char16_t standard_set_type() { return standard_set_type_; }
+    void set_standard_set_type(char16_t special_set_type) {
+        standard_set_type_ = special_set_type;
+    }
+    bool is_standard() { return standard_set_type_ != 0; }
+    void Canonicalize();
+
+  private:
+    CharacterRangeVector* ranges_;
+
+    // If non-zero, the value represents a standard set (e.g., all whitespace
+    // characters) without having to expand the ranges.
+    char16_t standard_set_type_;
+};
+
+class RegExpCharacterClass : public RegExpTree
+{
+  public:
+    RegExpCharacterClass(CharacterRangeVector* ranges, bool is_negated)
+      : set_(ranges),
+        is_negated_(is_negated)
+    {}
+
+    explicit RegExpCharacterClass(char16_t type)
+      : set_(type),
+        is_negated_(false)
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpCharacterClass* AsCharacterClass();
+    virtual bool IsCharacterClass();
+    virtual bool IsTextElement() { return true; }
+    virtual int min_match() { return 1; }
+    virtual int max_match() { return 1; }
+    virtual void AppendToText(RegExpText* text);
+
+    CharacterSet character_set() { return set_; }
+
+    // TODO(lrn): Remove need for complex version if is_standard that
+    // recognizes a mangled standard set and just do { return set_.is_special(); }
+    bool is_standard(LifoAlloc* alloc);
+
+    // Returns a value representing the standard character set if is_standard()
+    // returns true.
+    // Currently used values are:
+    // s : unicode whitespace
+    // S : unicode non-whitespace
+    // w : ASCII word character (digit, letter, underscore)
+    // W : non-ASCII word character
+    // d : ASCII digit
+    // D : non-ASCII digit
+    // . : non-unicode non-newline
+    // * : All characters
+    char16_t standard_type() { return set_.standard_set_type(); }
+
+    CharacterRangeVector& ranges(LifoAlloc* alloc) { return set_.ranges(alloc); }
+    bool is_negated() { return is_negated_; }
+
+  private:
+    CharacterSet set_;
+    bool is_negated_;
+};
+
+typedef InfallibleVector<char16_t, 10> CharacterVector;
+
+class RegExpAtom : public RegExpTree
+{
+  public:
+    explicit RegExpAtom(CharacterVector* data)
+      : data_(data)
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpAtom* AsAtom();
+    virtual bool IsAtom();
+    virtual bool IsTextElement() { return true; }
+    virtual int min_match() { return data_->length(); }
+    virtual int max_match() { return data_->length(); }
+    virtual void AppendToText(RegExpText* text);
+
+    const CharacterVector& data() { return *data_; }
+    int length() { return data_->length(); }
+
+  private:
+    CharacterVector* data_;
+};
+
+class RegExpText : public RegExpTree
+{
+  public:
+    explicit RegExpText(LifoAlloc* alloc)
+      : elements_(*alloc), length_(0)
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpText* AsText();
+    virtual bool IsText();
+    virtual bool IsTextElement() { return true; }
+    virtual int min_match() { return length_; }
+    virtual int max_match() { return length_; }
+    virtual void AppendToText(RegExpText* text);
+
+    void AddElement(TextElement elm)  {
+        elements_.append(elm);
+        length_ += elm.length();
+    }
+    const TextElementVector& elements() { return elements_; }
+
+  private:
+    TextElementVector elements_;
+    int length_;
+};
+
+class RegExpQuantifier : public RegExpTree
+{
+  public:
+    enum QuantifierType { GREEDY, NON_GREEDY, POSSESSIVE };
+    RegExpQuantifier(int min, int max, QuantifierType type, RegExpTree* body)
+      : body_(body),
+        min_(min),
+        max_(max),
+        min_match_(min * body->min_match()),
+        quantifier_type_(type)
+    {
+        if (max > 0 && body->max_match() > kInfinity / max) {
+            max_match_ = kInfinity;
+        } else {
+            max_match_ = max * body->max_match();
+        }
+    }
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    static RegExpNode* ToNode(int min,
+                              int max,
+                              bool is_greedy,
+                              RegExpTree* body,
+                              RegExpCompiler* compiler,
+                              RegExpNode* on_success,
+                              bool not_at_start = false);
+    virtual RegExpQuantifier* AsQuantifier();
+    virtual Interval CaptureRegisters();
+    virtual bool IsQuantifier();
+    virtual int min_match() { return min_match_; }
+    virtual int max_match() { return max_match_; }
+    int min() { return min_; }
+    int max() { return max_; }
+    bool is_possessive() { return quantifier_type_ == POSSESSIVE; }
+    bool is_non_greedy() { return quantifier_type_ == NON_GREEDY; }
+    bool is_greedy() { return quantifier_type_ == GREEDY; }
+    RegExpTree* body() { return body_; }
+
+  private:
+    RegExpTree* body_;
+    int min_;
+    int max_;
+    int min_match_;
+    int max_match_;
+    QuantifierType quantifier_type_;
+};
+
+class RegExpCapture : public RegExpTree
+{
+  public:
+    explicit RegExpCapture(RegExpTree* body, int index)
+      : body_(body), index_(index)
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    static RegExpNode* ToNode(RegExpTree* body,
+                              int index,
+                              RegExpCompiler* compiler,
+                              RegExpNode* on_success);
+    virtual RegExpCapture* AsCapture();
+    virtual bool IsAnchoredAtStart();
+    virtual bool IsAnchoredAtEnd();
+    virtual Interval CaptureRegisters();
+    virtual bool IsCapture();
+    virtual int min_match() { return body_->min_match(); }
+    virtual int max_match() { return body_->max_match(); }
+    RegExpTree* body() { return body_; }
+    int index() { return index_; }
+    static int StartRegister(int index) { return index * 2; }
+    static int EndRegister(int index) { return index * 2 + 1; }
+
+  private:
+    RegExpTree* body_;
+    int index_;
+};
+
+class RegExpLookahead : public RegExpTree
+{
+  public:
+    RegExpLookahead(RegExpTree* body,
+                    bool is_positive,
+                    int capture_count,
+                    int capture_from)
+      : body_(body),
+        is_positive_(is_positive),
+        capture_count_(capture_count),
+        capture_from_(capture_from)
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpLookahead* AsLookahead();
+    virtual Interval CaptureRegisters();
+    virtual bool IsLookahead();
+    virtual bool IsAnchoredAtStart();
+    virtual int min_match() { return 0; }
+    virtual int max_match() { return 0; }
+    RegExpTree* body() { return body_; }
+    bool is_positive() { return is_positive_; }
+    int capture_count() { return capture_count_; }
+    int capture_from() { return capture_from_; }
+
+  private:
+    RegExpTree* body_;
+    bool is_positive_;
+    int capture_count_;
+    int capture_from_;
+};
+
+typedef InfallibleVector<RegExpCapture*, 1> RegExpCaptureVector;
+
+class RegExpBackReference : public RegExpTree
+{
+  public:
+    explicit RegExpBackReference(RegExpCapture* capture)
+      : capture_(capture)
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpBackReference* AsBackReference();
+    virtual bool IsBackReference();
+    virtual int min_match() { return 0; }
+    virtual int max_match() { return capture_->max_match(); }
+    int index() { return capture_->index(); }
+    RegExpCapture* capture() { return capture_; }
+  private:
+    RegExpCapture* capture_;
+};
+
+class RegExpEmpty : public RegExpTree
+{
+  public:
+    RegExpEmpty()
+    {}
+
+    virtual void* Accept(RegExpVisitor* visitor, void* data);
+    virtual RegExpNode* ToNode(RegExpCompiler* compiler,
+                               RegExpNode* on_success);
+    virtual RegExpEmpty* AsEmpty();
+    virtual bool IsEmpty();
+    virtual int min_match() { return 0; }
+    virtual int max_match() { return 0; }
+    static RegExpEmpty* GetInstance() {
+        static RegExpEmpty instance;
+        return &instance;
+    }
+};
+
+} } // namespace js::irregexp
+
+#endif  // V8_REGEXP_AST_H_
diff --git a/js/src/irregexp/RegExpBytecode.h b/js/src/irregexp/RegExpBytecode.h
new file mode 100644
index 000000000..f31b78c59
--- /dev/null
+++ b/js/src/irregexp/RegExpBytecode.h
@@ -0,0 +1,108 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_BYTECODES_IRREGEXP_H_
+#define V8_BYTECODES_IRREGEXP_H_
+
+namespace js {
+namespace irregexp {
+
+const int BYTECODE_MASK = 0xff;
+
+// The first argument is packed in with the byte code in one word, so it
+// has 24 bits, but it can be positive and negative so only use 23 bits for
+// positive values.
+const unsigned int MAX_FIRST_ARG = 0x7fffffu;
+const int BYTECODE_SHIFT = 8;
+
+#define BYTECODE_ITERATOR(V)                                                   \
+V(BREAK,              0, 4)   /* bc8                                        */ \
+V(PUSH_CP,            1, 4)   /* bc8 pad24                                  */ \
+V(PUSH_BT,            2, 8)   /* bc8 pad24 offset32                         */ \
+V(PUSH_REGISTER,      3, 4)   /* bc8 reg_idx24                              */ \
+V(SET_REGISTER_TO_CP, 4, 8)   /* bc8 reg_idx24 offset32                     */ \
+V(SET_CP_TO_REGISTER, 5, 4)   /* bc8 reg_idx24                              */ \
+V(SET_REGISTER_TO_SP, 6, 4)   /* bc8 reg_idx24                              */ \
+V(SET_SP_TO_REGISTER, 7, 4)   /* bc8 reg_idx24                              */ \
+V(SET_REGISTER,       8, 8)   /* bc8 reg_idx24 value32                      */ \
+V(ADVANCE_REGISTER,   9, 8)   /* bc8 reg_idx24 value32                      */ \
+V(POP_CP,            10, 4)   /* bc8 pad24                                  */ \
+V(POP_BT,            11, 4)   /* bc8 pad24                                  */ \
+V(POP_REGISTER,      12, 4)   /* bc8 reg_idx24                              */ \
+V(FAIL,              13, 4)   /* bc8 pad24                                  */ \
+V(SUCCEED,           14, 4)   /* bc8 pad24                                  */ \
+V(ADVANCE_CP,        15, 4)   /* bc8 offset24                               */ \
+V(GOTO,              16, 8)   /* bc8 pad24 addr32                           */ \
+V(LOAD_CURRENT_CHAR, 17, 8)   /* bc8 offset24 addr32                        */ \
+V(LOAD_CURRENT_CHAR_UNCHECKED, 18, 4) /* bc8 offset24                       */ \
+V(LOAD_2_CURRENT_CHARS, 19, 8) /* bc8 offset24 addr32                       */ \
+V(LOAD_2_CURRENT_CHARS_UNCHECKED, 20, 4) /* bc8 offset24                    */ \
+V(LOAD_4_CURRENT_CHARS, 21, 8) /* bc8 offset24 addr32                       */ \
+V(LOAD_4_CURRENT_CHARS_UNCHECKED, 22, 4) /* bc8 offset24                    */ \
+V(CHECK_4_CHARS,     23, 12)  /* bc8 pad24 uint32 addr32                    */ \
+V(CHECK_CHAR,        24, 8)   /* bc8 pad8 uint16 addr32                     */ \
+V(CHECK_NOT_4_CHARS, 25, 12)  /* bc8 pad24 uint32 addr32                    */ \
+V(CHECK_NOT_CHAR,    26, 8)   /* bc8 pad8 uint16 addr32                     */ \
+V(AND_CHECK_4_CHARS, 27, 16)  /* bc8 pad24 uint32 uint32 addr32             */ \
+V(AND_CHECK_CHAR,    28, 12)  /* bc8 pad8 uint16 uint32 addr32              */ \
+V(AND_CHECK_NOT_4_CHARS, 29, 16) /* bc8 pad24 uint32 uint32 addr32          */ \
+V(AND_CHECK_NOT_CHAR, 30, 12) /* bc8 pad8 uint16 uint32 addr32              */ \
+V(MINUS_AND_CHECK_NOT_CHAR, 31, 12) /* bc8 pad8 uc16 uc16 uc16 addr32       */ \
+V(CHECK_CHAR_IN_RANGE, 32, 12) /* bc8 pad24 uc16 uc16 addr32                */ \
+V(CHECK_CHAR_NOT_IN_RANGE, 33, 12) /* bc8 pad24 uc16 uc16 addr32            */ \
+V(CHECK_BIT_IN_TABLE, 34, 24) /* bc8 pad24 addr32 bits128                   */ \
+V(CHECK_LT,          35, 8)   /* bc8 pad8 uc16 addr32                       */ \
+V(CHECK_GT,          36, 8)   /* bc8 pad8 uc16 addr32                       */ \
+V(CHECK_NOT_BACK_REF, 37, 8)  /* bc8 reg_idx24 addr32                       */ \
+V(CHECK_NOT_BACK_REF_NO_CASE, 38, 8) /* bc8 reg_idx24 addr32                */ \
+V(CHECK_NOT_REGS_EQUAL, 39, 12) /* bc8 regidx24 reg_idx32 addr32            */ \
+V(CHECK_REGISTER_LT, 40, 12)  /* bc8 reg_idx24 value32 addr32               */ \
+V(CHECK_REGISTER_GE, 41, 12)  /* bc8 reg_idx24 value32 addr32               */ \
+V(CHECK_REGISTER_EQ_POS, 42, 8) /* bc8 reg_idx24 addr32                     */ \
+V(CHECK_AT_START,    43, 8)   /* bc8 pad24 addr32                           */ \
+V(CHECK_NOT_AT_START, 44, 8)  /* bc8 pad24 addr32                           */ \
+V(CHECK_GREEDY,      45, 8)   /* bc8 pad24 addr32                           */ \
+V(ADVANCE_CP_AND_GOTO, 46, 8) /* bc8 offset24 addr32                        */ \
+V(SET_CURRENT_POSITION_FROM_END, 47, 4) /* bc8 idx24                        */ \
+V(CHECK_NOT_BACK_REF_NO_CASE_UNICODE, 48, 8) /* bc8 reg_idx24 addr32        */
+
+#define DECLARE_BYTECODES(name, code, length) \
+  static const int BC_##name = code;
+BYTECODE_ITERATOR(DECLARE_BYTECODES)
+#undef DECLARE_BYTECODES
+
+#define DECLARE_BYTECODE_LENGTH(name, code, length) \
+  static const int BC_##name##_LENGTH = length;
+BYTECODE_ITERATOR(DECLARE_BYTECODE_LENGTH)
+#undef DECLARE_BYTECODE_LENGTH
+
+} } // namespace js::irregexp
+
+#endif  // V8_BYTECODES_IRREGEXP_H_
diff --git a/js/src/irregexp/RegExpEngine.cpp b/js/src/irregexp/RegExpEngine.cpp
new file mode 100644
index 000000000..2e19065fd
--- /dev/null
+++ b/js/src/irregexp/RegExpEngine.cpp
@@ -0,0 +1,5135 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "irregexp/RegExpEngine.h"
+
+#include "irregexp/NativeRegExpMacroAssembler.h"
+#include "irregexp/RegExpMacroAssembler.h"
+#include "jit/ExecutableAllocator.h"
+#include "jit/JitCommon.h"
+
+using namespace js;
+using namespace js::irregexp;
+
+using mozilla::ArrayLength;
+using mozilla::DebugOnly;
+using mozilla::Maybe;
+
+#define DEFINE_ACCEPT(Type)                                          \
+    void Type##Node::Accept(NodeVisitor* visitor) {                  \
+        visitor->Visit##Type(this);                                  \
+    }
+FOR_EACH_NODE_TYPE(DEFINE_ACCEPT)
+#undef DEFINE_ACCEPT
+
+void LoopChoiceNode::Accept(NodeVisitor* visitor) {
+    visitor->VisitLoopChoice(this);
+}
+
+static const int kMaxLookaheadForBoyerMoore = 8;
+
+RegExpNode::RegExpNode(LifoAlloc* alloc)
+  : replacement_(nullptr), trace_count_(0), alloc_(alloc)
+{
+    bm_info_[0] = bm_info_[1] = nullptr;
+}
+
+// -------------------------------------------------------------------
+// CharacterRange
+
+// The '2' variant has inclusive from and exclusive to.
+// This covers \s as defined in ECMA-262 5.1, 15.10.2.12,
+// which include WhiteSpace (7.2) or LineTerminator (7.3) values.
+static const int kSpaceRanges[] = { '\t', '\r' + 1, ' ', ' ' + 1,
+    0x00A0, 0x00A1, 0x1680, 0x1681, 0x180E, 0x180F, 0x2000, 0x200B,
+    0x2028, 0x202A, 0x202F, 0x2030, 0x205F, 0x2060, 0x3000, 0x3001,
+    0xFEFF, 0xFF00, 0x10000 };
+static const int kSpaceRangeCount = ArrayLength(kSpaceRanges);
+
+static const int kSpaceAndSurrogateRanges[] = { '\t', '\r' + 1, ' ', ' ' + 1,
+    0x00A0, 0x00A1, 0x1680, 0x1681, 0x180E, 0x180F, 0x2000, 0x200B,
+    0x2028, 0x202A, 0x202F, 0x2030, 0x205F, 0x2060, 0x3000, 0x3001,
+    unicode::LeadSurrogateMin, unicode::TrailSurrogateMax + 1,
+    0xFEFF, 0xFF00, 0x10000 };
+static const int kSpaceAndSurrogateRangeCount = ArrayLength(kSpaceAndSurrogateRanges);
+static const int kWordRanges[] = {
+    '0', '9' + 1, 'A', 'Z' + 1, '_', '_' + 1, 'a', 'z' + 1, 0x10000 };
+static const int kWordRangeCount = ArrayLength(kWordRanges);
+static const int kIgnoreCaseWordRanges[] = {
+    '0', '9' + 1, 'A', 'Z' + 1, '_', '_' + 1, 'a', 'z' + 1,
+    0x017F, 0x017F + 1, 0x212A, 0x212A + 1,
+    0x10000 };
+static const int kIgnoreCaseWordCount = ArrayLength(kIgnoreCaseWordRanges);
+static const int kWordAndSurrogateRanges[] = {
+    '0', '9' + 1, 'A', 'Z' + 1, '_', '_' + 1, 'a', 'z' + 1,
+    unicode::LeadSurrogateMin, unicode::TrailSurrogateMax + 1,
+    0x10000 };
+static const int kWordAndSurrogateRangeCount = ArrayLength(kWordAndSurrogateRanges);
+static const int kNegatedIgnoreCaseWordAndSurrogateRanges[] = {
+    0, '0', '9' + 1, 'A',
+    'Z' + 1, '_', '_' + 1, 'a',
+    'z' + 1, 0x017F,
+    0x017F + 1, 0x212A,
+    0x212A + 1, unicode::LeadSurrogateMin,
+    unicode::TrailSurrogateMax + 1, 0x10000,
+    0x10000 };
+static const int kNegatedIgnoreCaseWordAndSurrogateRangeCount =
+    ArrayLength(kNegatedIgnoreCaseWordAndSurrogateRanges);
+static const int kDigitRanges[] = { '0', '9' + 1, 0x10000 };
+static const int kDigitRangeCount = ArrayLength(kDigitRanges);
+static const int kDigitAndSurrogateRanges[] = {
+    '0', '9' + 1,
+    unicode::LeadSurrogateMin, unicode::TrailSurrogateMax + 1,
+    0x10000 };
+static const int kDigitAndSurrogateRangeCount = ArrayLength(kDigitAndSurrogateRanges);
+static const int kSurrogateRanges[] = {
+    unicode::LeadSurrogateMin, unicode::TrailSurrogateMax + 1,
+    0x10000 };
+static const int kSurrogateRangeCount = ArrayLength(kSurrogateRanges);
+static const int kLineTerminatorRanges[] = { 0x000A, 0x000B, 0x000D, 0x000E,
+    0x2028, 0x202A, 0x10000 };
+static const int kLineTerminatorRangeCount = ArrayLength(kLineTerminatorRanges);
+static const int kMaxOneByteCharCode = 0xff;
+static const int kMaxUtf16CodeUnit = 0xffff;
+
+static char16_t
+MaximumCharacter(bool ascii)
+{
+    return ascii ? kMaxOneByteCharCode : kMaxUtf16CodeUnit;
+}
+
+static void
+AddClass(const int* elmv, int elmc,
+         CharacterRangeVector* ranges)
+{
+    elmc--;
+    MOZ_ASSERT(elmv[elmc] == 0x10000);
+    for (int i = 0; i < elmc; i += 2) {
+        MOZ_ASSERT(elmv[i] < elmv[i + 1]);
+        ranges->append(CharacterRange(elmv[i], elmv[i + 1] - 1));
+    }
+}
+
+static void
+AddClassNegated(const int* elmv,
+                int elmc,
+                CharacterRangeVector* ranges)
+{
+    elmc--;
+    MOZ_ASSERT(elmv[elmc] == 0x10000);
+    MOZ_ASSERT(elmv[0] != 0x0000);
+    MOZ_ASSERT(elmv[elmc-1] != kMaxUtf16CodeUnit);
+    char16_t last = 0x0000;
+    for (int i = 0; i < elmc; i += 2) {
+        MOZ_ASSERT(last <= elmv[i] - 1);
+        MOZ_ASSERT(elmv[i] < elmv[i + 1]);
+        ranges->append(CharacterRange(last, elmv[i] - 1));
+        last = elmv[i + 1];
+    }
+    ranges->append(CharacterRange(last, kMaxUtf16CodeUnit));
+}
+
+void
+CharacterRange::AddClassEscape(LifoAlloc* alloc, char16_t type,
+			       CharacterRangeVector* ranges)
+{
+    switch (type) {
+      case 's':
+        AddClass(kSpaceRanges, kSpaceRangeCount, ranges);
+        break;
+      case 'S':
+        AddClassNegated(kSpaceRanges, kSpaceRangeCount, ranges);
+        break;
+      case 'w':
+        AddClass(kWordRanges, kWordRangeCount, ranges);
+        break;
+      case 'W':
+        AddClassNegated(kWordRanges, kWordRangeCount, ranges);
+        break;
+      case 'd':
+        AddClass(kDigitRanges, kDigitRangeCount, ranges);
+        break;
+      case 'D':
+        AddClassNegated(kDigitRanges, kDigitRangeCount, ranges);
+        break;
+      case '.':
+        AddClassNegated(kLineTerminatorRanges, kLineTerminatorRangeCount, ranges);
+        break;
+        // This is not a character range as defined by the spec but a
+        // convenient shorthand for a character class that matches any
+        // character.
+      case '*':
+        ranges->append(CharacterRange::Everything());
+        break;
+        // This is the set of characters matched by the $ and ^ symbols
+        // in multiline mode.
+      case 'n':
+        AddClass(kLineTerminatorRanges, kLineTerminatorRangeCount, ranges);
+        break;
+      default:
+        MOZ_CRASH("Bad character class escape");
+    }
+}
+
+// Add class escape, excluding surrogate pair range.
+void
+CharacterRange::AddClassEscapeUnicode(LifoAlloc* alloc, char16_t type,
+                                      CharacterRangeVector* ranges, bool ignore_case)
+{
+    switch (type) {
+      case 's':
+      case 'd':
+        return AddClassEscape(alloc, type, ranges);
+        break;
+      case 'S':
+        AddClassNegated(kSpaceAndSurrogateRanges, kSpaceAndSurrogateRangeCount, ranges);
+        break;
+      case 'w':
+        if (ignore_case)
+            AddClass(kIgnoreCaseWordRanges, kIgnoreCaseWordCount, ranges);
+        else
+            AddClassEscape(alloc, type, ranges);
+        break;
+      case 'W':
+        if (ignore_case) {
+            AddClass(kNegatedIgnoreCaseWordAndSurrogateRanges,
+                     kNegatedIgnoreCaseWordAndSurrogateRangeCount, ranges);
+        } else {
+            AddClassNegated(kWordAndSurrogateRanges, kWordAndSurrogateRangeCount, ranges);
+        }
+        break;
+      case 'D':
+        AddClassNegated(kDigitAndSurrogateRanges, kDigitAndSurrogateRangeCount, ranges);
+        break;
+      default:
+        MOZ_CRASH("Bad type!");
+    }
+}
+
+#define FOR_EACH_NON_ASCII_TO_ASCII_FOLDING(macro)      \
+    /* LATIN CAPITAL LETTER Y WITH DIAERESIS */         \
+    macro(0x0178, 0x00FF)                               \
+    /* LATIN SMALL LETTER LONG S */                     \
+    macro(0x017F, 0x0073)                               \
+    /* LATIN CAPITAL LETTER SHARP S */                  \
+    macro(0x1E9E, 0x00DF)                               \
+    /* KELVIN SIGN */                                   \
+    macro(0x212A, 0x006B)                               \
+    /* ANGSTROM SIGN */                                 \
+    macro(0x212B, 0x00E5)
+
+// We need to check for the following characters: 0x39c 0x3bc 0x178.
+static inline bool
+RangeContainsLatin1Equivalents(CharacterRange range, bool unicode)
+{
+    /* TODO(dcarney): this could be a lot more efficient. */
+    if (unicode) {
+#define CHECK_RANGE(C, F) \
+        if (range.Contains(C)) return true;
+FOR_EACH_NON_ASCII_TO_ASCII_FOLDING(CHECK_RANGE)
+#undef CHECK_RANGE
+    }
+
+    return range.Contains(0x39c) || range.Contains(0x3bc) || range.Contains(0x178);
+}
+
+static bool
+RangesContainLatin1Equivalents(const CharacterRangeVector& ranges, bool unicode)
+{
+    for (size_t i = 0; i < ranges.length(); i++) {
+        // TODO(dcarney): this could be a lot more efficient.
+        if (RangeContainsLatin1Equivalents(ranges[i], unicode))
+            return true;
+    }
+    return false;
+}
+
+static const size_t kEcma262UnCanonicalizeMaxWidth = 4;
+
+// Returns the number of characters in the equivalence class, omitting those
+// that cannot occur in the source string if it is a one byte string.
+static int
+GetCaseIndependentLetters(char16_t character,
+                          bool ascii_subject,
+                          bool unicode,
+                          const char16_t* choices,
+                          size_t choices_length,
+                          char16_t* letters)
+{
+    size_t count = 0;
+    for (size_t i = 0; i < choices_length; i++) {
+        char16_t c = choices[i];
+
+        // Skip characters that can't appear in one byte strings.
+        if (!unicode && ascii_subject && c > kMaxOneByteCharCode)
+            continue;
+
+        // Watch for duplicates.
+        bool found = false;
+        for (size_t j = 0; j < count; j++) {
+            if (letters[j] == c) {
+                found = true;
+                break;
+            }
+        }
+        if (found)
+            continue;
+
+        letters[count++] = c;
+    }
+
+    return count;
+}
+
+static int
+GetCaseIndependentLetters(char16_t character,
+                          bool ascii_subject,
+                          bool unicode,
+                          char16_t* letters)
+{
+    if (unicode) {
+        const char16_t choices[] = {
+            character,
+            unicode::FoldCase(character),
+            unicode::ReverseFoldCase1(character),
+            unicode::ReverseFoldCase2(character),
+            unicode::ReverseFoldCase3(character),
+        };
+        return GetCaseIndependentLetters(character, ascii_subject, unicode,
+                                         choices, ArrayLength(choices), letters);
+    }
+
+    char16_t upper = unicode::ToUpperCase(character);
+    unicode::CodepointsWithSameUpperCase others(character);
+    char16_t other1 = others.other1();
+    char16_t other2 = others.other2();
+    char16_t other3 = others.other3();
+
+    // ES 2017 draft 996af87b7072b3c3dd2b1def856c66f456102215 21.2.4.2
+    // step 3.g.
+    // The standard requires that non-ASCII characters cannot have ASCII
+    // character codes in their equivalence class, even though this
+    // situation occurs multiple times in the unicode tables.
+    static const unsigned kMaxAsciiCharCode = 127;
+    if (upper <= kMaxAsciiCharCode) {
+        if (character > kMaxAsciiCharCode) {
+            // If Canonicalize(character) == character, all other characters
+            // should be ignored.
+            return GetCaseIndependentLetters(character, ascii_subject, unicode,
+                                             &character, 1, letters);
+        }
+
+        if (other1 > kMaxAsciiCharCode)
+            other1 = character;
+        if (other2 > kMaxAsciiCharCode)
+            other2 = character;
+        if (other3 > kMaxAsciiCharCode)
+            other3 = character;
+    }
+
+    const char16_t choices[] = {
+        character,
+        upper,
+        other1,
+        other2,
+        other3
+    };
+    return GetCaseIndependentLetters(character, ascii_subject, unicode,
+                                     choices, ArrayLength(choices), letters);
+}
+
+static char16_t
+ConvertNonLatin1ToLatin1(char16_t c, bool unicode)
+{
+    MOZ_ASSERT(c > kMaxOneByteCharCode);
+    if (unicode) {
+        switch (c) {
+#define CONVERT(C, F) case C: return F;
+FOR_EACH_NON_ASCII_TO_ASCII_FOLDING(CONVERT)
+#undef CONVERT
+        }
+    }
+
+    switch (c) {
+      // This are equivalent characters in unicode.
+      case 0x39c:
+      case 0x3bc:
+        return 0xb5;
+      // This is an uppercase of a Latin-1 character
+      // outside of Latin-1.
+      case 0x178:
+        return 0xff;
+    }
+    return 0;
+}
+
+void
+CharacterRange::AddCaseEquivalents(bool is_ascii, bool unicode, CharacterRangeVector* ranges)
+{
+    char16_t bottom = from();
+    char16_t top = to();
+
+    if (is_ascii && !RangeContainsLatin1Equivalents(*this, unicode)) {
+        if (bottom > kMaxOneByteCharCode)
+            return;
+        if (top > kMaxOneByteCharCode)
+            top = kMaxOneByteCharCode;
+    }
+
+    for (char16_t c = bottom;; c++) {
+        char16_t chars[kEcma262UnCanonicalizeMaxWidth];
+        size_t length = GetCaseIndependentLetters(c, is_ascii, unicode, chars);
+
+        for (size_t i = 0; i < length; i++) {
+            char16_t other = chars[i];
+            if (other == c)
+                continue;
+
+            // Try to combine with an existing range.
+            bool found = false;
+            for (size_t i = 0; i < ranges->length(); i++) {
+                CharacterRange& range = (*ranges)[i];
+                if (range.Contains(other)) {
+                    found = true;
+                    break;
+                } else if (other == range.from() - 1) {
+                    range.set_from(other);
+                    found = true;
+                    break;
+                } else if (other == range.to() + 1) {
+                    range.set_to(other);
+                    found = true;
+                    break;
+                }
+            }
+
+            if (!found)
+                ranges->append(CharacterRange::Singleton(other));
+        }
+
+        if (c == top)
+            break;
+    }
+}
+
+static bool
+CompareInverseRanges(const CharacterRangeVector& ranges, const int* special_class, size_t length)
+{
+    length--;  // Remove final 0x10000.
+    MOZ_ASSERT(special_class[length] == 0x10000);
+    MOZ_ASSERT(ranges.length() != 0);
+    MOZ_ASSERT(length != 0);
+    MOZ_ASSERT(special_class[0] != 0);
+    if (ranges.length() != (length >> 1) + 1)
+        return false;
+    CharacterRange range = ranges[0];
+    if (range.from() != 0)
+        return false;
+    for (size_t i = 0; i < length; i += 2) {
+        if (special_class[i] != (range.to() + 1))
+            return false;
+        range = ranges[(i >> 1) + 1];
+        if (special_class[i+1] != range.from())
+            return false;
+    }
+    if (range.to() != 0xffff)
+        return false;
+    return true;
+}
+
+static bool
+CompareRanges(const CharacterRangeVector& ranges, const int* special_class, size_t length)
+{
+    length--;  // Remove final 0x10000.
+    MOZ_ASSERT(special_class[length] == 0x10000);
+    if (ranges.length() * 2 != length)
+        return false;
+    for (size_t i = 0; i < length; i += 2) {
+        CharacterRange range = ranges[i >> 1];
+        if (range.from() != special_class[i] || range.to() != special_class[i + 1] - 1)
+            return false;
+    }
+    return true;
+}
+
+bool
+RegExpCharacterClass::is_standard(LifoAlloc* alloc)
+{
+    // TODO(lrn): Remove need for this function, by not throwing away information
+    // along the way.
+    if (is_negated_)
+        return false;
+    if (set_.is_standard())
+        return true;
+    if (CompareRanges(set_.ranges(alloc), kSpaceRanges, kSpaceRangeCount)) {
+        set_.set_standard_set_type('s');
+        return true;
+    }
+    if (CompareInverseRanges(set_.ranges(alloc), kSpaceRanges, kSpaceRangeCount)) {
+        set_.set_standard_set_type('S');
+        return true;
+    }
+    if (CompareInverseRanges(set_.ranges(alloc),
+                             kLineTerminatorRanges,
+                             kLineTerminatorRangeCount)) {
+        set_.set_standard_set_type('.');
+        return true;
+    }
+    if (CompareRanges(set_.ranges(alloc),
+                      kLineTerminatorRanges,
+                      kLineTerminatorRangeCount)) {
+        set_.set_standard_set_type('n');
+        return true;
+    }
+    if (CompareRanges(set_.ranges(alloc), kWordRanges, kWordRangeCount)) {
+        set_.set_standard_set_type('w');
+        return true;
+    }
+    if (CompareInverseRanges(set_.ranges(alloc), kWordRanges, kWordRangeCount)) {
+        set_.set_standard_set_type('W');
+        return true;
+    }
+    return false;
+}
+
+bool
+CharacterRange::IsCanonical(const CharacterRangeVector& ranges)
+{
+    int n = ranges.length();
+    if (n <= 1)
+        return true;
+
+    int max = ranges[0].to();
+    for (int i = 1; i < n; i++) {
+        CharacterRange next_range = ranges[i];
+        if (next_range.from() <= max + 1)
+            return false;
+        max = next_range.to();
+    }
+    return true;
+}
+
+// Move a number of elements in a zonelist to another position
+// in the same list. Handles overlapping source and target areas.
+static
+void MoveRanges(CharacterRangeVector& list, int from, int to, int count)
+{
+    // Ranges are potentially overlapping.
+    if (from < to) {
+        for (int i = count - 1; i >= 0; i--)
+            list[to + i] = list[from + i];
+    } else {
+        for (int i = 0; i < count; i++)
+            list[to + i] = list[from + i];
+    }
+}
+
+static int
+InsertRangeInCanonicalList(CharacterRangeVector& list,
+                           int count,
+                           CharacterRange insert)
+{
+    // Inserts a range into list[0..count[, which must be sorted
+    // by from value and non-overlapping and non-adjacent, using at most
+    // list[0..count] for the result. Returns the number of resulting
+    // canonicalized ranges. Inserting a range may collapse existing ranges into
+    // fewer ranges, so the return value can be anything in the range 1..count+1.
+    char16_t from = insert.from();
+    char16_t to = insert.to();
+    int start_pos = 0;
+    int end_pos = count;
+    for (int i = count - 1; i >= 0; i--) {
+        CharacterRange current = list[i];
+        if (current.from() > to + 1) {
+            end_pos = i;
+        } else if (current.to() + 1 < from) {
+            start_pos = i + 1;
+            break;
+        }
+    }
+
+    // Inserted range overlaps, or is adjacent to, ranges at positions
+    // [start_pos..end_pos[. Ranges before start_pos or at or after end_pos are
+    // not affected by the insertion.
+    // If start_pos == end_pos, the range must be inserted before start_pos.
+    // if start_pos < end_pos, the entire range from start_pos to end_pos
+    // must be merged with the insert range.
+
+    if (start_pos == end_pos) {
+        // Insert between existing ranges at position start_pos.
+        if (start_pos < count) {
+            MoveRanges(list, start_pos, start_pos + 1, count - start_pos);
+        }
+        list[start_pos] = insert;
+        return count + 1;
+    }
+    if (start_pos + 1 == end_pos) {
+        // Replace single existing range at position start_pos.
+        CharacterRange to_replace = list[start_pos];
+        int new_from = Min(to_replace.from(), from);
+        int new_to = Max(to_replace.to(), to);
+        list[start_pos] = CharacterRange(new_from, new_to);
+        return count;
+    }
+    // Replace a number of existing ranges from start_pos to end_pos - 1.
+    // Move the remaining ranges down.
+
+    int new_from = Min(list[start_pos].from(), from);
+    int new_to = Max(list[end_pos - 1].to(), to);
+    if (end_pos < count) {
+        MoveRanges(list, end_pos, start_pos + 1, count - end_pos);
+    }
+    list[start_pos] = CharacterRange(new_from, new_to);
+    return count - (end_pos - start_pos) + 1;
+}
+
+void
+CharacterRange::Canonicalize(CharacterRangeVector& character_ranges)
+{
+    if (character_ranges.length() <= 1) return;
+    // Check whether ranges are already canonical (increasing, non-overlapping,
+    // non-adjacent).
+    int n = character_ranges.length();
+    int max = character_ranges[0].to();
+    int i = 1;
+    while (i < n) {
+        CharacterRange current = character_ranges[i];
+        if (current.from() <= max + 1) {
+            break;
+        }
+        max = current.to();
+        i++;
+    }
+    // Canonical until the i'th range. If that's all of them, we are done.
+    if (i == n) return;
+
+    // The ranges at index i and forward are not canonicalized. Make them so by
+    // doing the equivalent of insertion sort (inserting each into the previous
+    // list, in order).
+    // Notice that inserting a range can reduce the number of ranges in the
+    // result due to combining of adjacent and overlapping ranges.
+    int read = i;  // Range to insert.
+    size_t num_canonical = i;  // Length of canonicalized part of list.
+    do {
+        num_canonical = InsertRangeInCanonicalList(character_ranges,
+                                                   num_canonical,
+                                                   character_ranges[read]);
+        read++;
+    } while (read < n);
+
+    while (character_ranges.length() > num_canonical)
+        character_ranges.popBack();
+
+    MOZ_ASSERT(CharacterRange::IsCanonical(character_ranges));
+}
+
+// -------------------------------------------------------------------
+// SeqRegExpNode
+
+class VisitMarker
+{
+  public:
+    explicit VisitMarker(NodeInfo* info)
+      : info_(info)
+    {
+        MOZ_ASSERT(!info->visited);
+        info->visited = true;
+    }
+    ~VisitMarker() {
+        info_->visited = false;
+    }
+  private:
+    NodeInfo* info_;
+};
+
+bool
+SeqRegExpNode::FillInBMInfo(int offset,
+                            int budget,
+                            BoyerMooreLookahead* bm,
+                            bool not_at_start)
+{
+    if (!bm->CheckOverRecursed())
+        return false;
+    if (!on_success_->FillInBMInfo(offset, budget - 1, bm, not_at_start))
+        return false;
+    if (offset == 0)
+        set_bm_info(not_at_start, bm);
+    return true;
+}
+
+RegExpNode*
+SeqRegExpNode::FilterASCII(int depth, bool ignore_case, bool unicode)
+{
+    if (info()->replacement_calculated)
+        return replacement();
+
+    if (depth < 0)
+        return this;
+
+    MOZ_ASSERT(!info()->visited);
+    VisitMarker marker(info());
+    return FilterSuccessor(depth - 1, ignore_case, unicode);
+}
+
+RegExpNode*
+SeqRegExpNode::FilterSuccessor(int depth, bool ignore_case, bool unicode)
+{
+    RegExpNode* next = on_success_->FilterASCII(depth - 1, ignore_case, unicode);
+    if (next == nullptr)
+        return set_replacement(nullptr);
+
+    on_success_ = next;
+    return set_replacement(this);
+}
+
+// -------------------------------------------------------------------
+// ActionNode
+
+int
+ActionNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
+{
+    if (budget <= 0)
+        return 0;
+    if (action_type_ == POSITIVE_SUBMATCH_SUCCESS)
+        return 0;  // Rewinds input!
+    return on_success()->EatsAtLeast(still_to_find,
+                                     budget - 1,
+                                     not_at_start);
+}
+
+bool
+ActionNode::FillInBMInfo(int offset,
+                         int budget,
+                         BoyerMooreLookahead* bm,
+                         bool not_at_start)
+{
+    if (!bm->CheckOverRecursed())
+        return false;
+
+    if (action_type_ == BEGIN_SUBMATCH) {
+        bm->SetRest(offset);
+    } else if (action_type_ != POSITIVE_SUBMATCH_SUCCESS) {
+        if (!on_success()->FillInBMInfo(offset, budget - 1, bm, not_at_start))
+            return false;
+    }
+    SaveBMInfo(bm, not_at_start, offset);
+
+    return true;
+}
+
+/* static */ ActionNode*
+ActionNode::SetRegister(int reg,
+                        int val,
+                        RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(SET_REGISTER, on_success);
+    result->data_.u_store_register.reg = reg;
+    result->data_.u_store_register.value = val;
+    return result;
+}
+
+/* static */ ActionNode*
+ActionNode::IncrementRegister(int reg, RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(INCREMENT_REGISTER, on_success);
+    result->data_.u_increment_register.reg = reg;
+    return result;
+}
+
+/* static */ ActionNode*
+ActionNode::StorePosition(int reg, bool is_capture, RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(STORE_POSITION, on_success);
+    result->data_.u_position_register.reg = reg;
+    result->data_.u_position_register.is_capture = is_capture;
+    return result;
+}
+
+/* static */ ActionNode*
+ActionNode::ClearCaptures(Interval range, RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(CLEAR_CAPTURES, on_success);
+    result->data_.u_clear_captures.range_from = range.from();
+    result->data_.u_clear_captures.range_to = range.to();
+    return result;
+}
+
+/* static */ ActionNode*
+ActionNode::BeginSubmatch(int stack_pointer_reg, int position_reg, RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(BEGIN_SUBMATCH, on_success);
+    result->data_.u_submatch.stack_pointer_register = stack_pointer_reg;
+    result->data_.u_submatch.current_position_register = position_reg;
+    return result;
+}
+
+/* static */ ActionNode*
+ActionNode::PositiveSubmatchSuccess(int stack_pointer_reg,
+                                    int restore_reg,
+                                    int clear_capture_count,
+                                    int clear_capture_from,
+                                    RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(POSITIVE_SUBMATCH_SUCCESS, on_success);
+    result->data_.u_submatch.stack_pointer_register = stack_pointer_reg;
+    result->data_.u_submatch.current_position_register = restore_reg;
+    result->data_.u_submatch.clear_register_count = clear_capture_count;
+    result->data_.u_submatch.clear_register_from = clear_capture_from;
+    return result;
+}
+
+/* static */ ActionNode*
+ActionNode::EmptyMatchCheck(int start_register,
+                            int repetition_register,
+                            int repetition_limit,
+                            RegExpNode* on_success)
+{
+    ActionNode* result = on_success->alloc()->newInfallible<ActionNode>(EMPTY_MATCH_CHECK, on_success);
+    result->data_.u_empty_match_check.start_register = start_register;
+    result->data_.u_empty_match_check.repetition_register = repetition_register;
+    result->data_.u_empty_match_check.repetition_limit = repetition_limit;
+    return result;
+}
+
+// -------------------------------------------------------------------
+// TextNode
+
+int
+TextNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
+{
+    int answer = Length();
+    if (answer >= still_to_find)
+        return answer;
+    if (budget <= 0)
+        return answer;
+
+    // We are not at start after this node so we set the last argument to 'true'.
+    return answer + on_success()->EatsAtLeast(still_to_find - answer,
+                                              budget - 1,
+                                              true);
+}
+
+int
+TextNode::GreedyLoopTextLength()
+{
+    TextElement elm = elements()[elements().length() - 1];
+    return elm.cp_offset() + elm.length();
+}
+
+RegExpNode*
+TextNode::FilterASCII(int depth, bool ignore_case, bool unicode)
+{
+    if (info()->replacement_calculated)
+        return replacement();
+
+    if (depth < 0)
+        return this;
+
+    MOZ_ASSERT(!info()->visited);
+    VisitMarker marker(info());
+    int element_count = elements().length();
+    for (int i = 0; i < element_count; i++) {
+        TextElement elm = elements()[i];
+        if (elm.text_type() == TextElement::ATOM) {
+            CharacterVector& quarks = const_cast<CharacterVector&>(elm.atom()->data());
+            for (size_t j = 0; j < quarks.length(); j++) {
+                uint16_t c = quarks[j];
+                if (c <= kMaxOneByteCharCode)
+                    continue;
+                if (!ignore_case)
+                    return set_replacement(nullptr);
+
+                // Here, we need to check for characters whose upper and lower cases
+                // are outside the Latin-1 range.
+                char16_t converted = ConvertNonLatin1ToLatin1(c, unicode);
+                if (converted == 0) {
+                    // Character is outside Latin-1 completely
+                    return set_replacement(nullptr);
+                }
+
+                // Convert quark to Latin-1 in place.
+                quarks[j] = converted;
+            }
+        } else {
+            MOZ_ASSERT(elm.text_type() == TextElement::CHAR_CLASS);
+            RegExpCharacterClass* cc = elm.char_class();
+
+            CharacterRangeVector& ranges = cc->ranges(alloc());
+            if (!CharacterRange::IsCanonical(ranges))
+                CharacterRange::Canonicalize(ranges);
+
+            // Now they are in order so we only need to look at the first.
+            int range_count = ranges.length();
+            if (cc->is_negated()) {
+                if (range_count != 0 &&
+                    ranges[0].from() == 0 &&
+                    ranges[0].to() >= kMaxOneByteCharCode)
+                {
+                    // This will be handled in a later filter.
+                    if (ignore_case && RangesContainLatin1Equivalents(ranges, unicode))
+                        continue;
+                    return set_replacement(nullptr);
+                }
+            } else {
+                if (range_count == 0 ||
+                    ranges[0].from() > kMaxOneByteCharCode)
+                {
+                    // This will be handled in a later filter.
+                    if (ignore_case && RangesContainLatin1Equivalents(ranges, unicode))
+                        continue;
+                    return set_replacement(nullptr);
+                }
+            }
+        }
+    }
+    return FilterSuccessor(depth - 1, ignore_case, unicode);
+}
+
+void
+TextNode::CalculateOffsets()
+{
+    int element_count = elements().length();
+
+    // Set up the offsets of the elements relative to the start.  This is a fixed
+    // quantity since a TextNode can only contain fixed-width things.
+    int cp_offset = 0;
+    for (int i = 0; i < element_count; i++) {
+        TextElement& elm = elements()[i];
+        elm.set_cp_offset(cp_offset);
+        cp_offset += elm.length();
+    }
+}
+
+void TextNode::MakeCaseIndependent(bool is_ascii, bool unicode)
+{
+    int element_count = elements().length();
+    for (int i = 0; i < element_count; i++) {
+        TextElement elm = elements()[i];
+        if (elm.text_type() == TextElement::CHAR_CLASS) {
+            RegExpCharacterClass* cc = elm.char_class();
+
+            // None of the standard character classes is different in the case
+            // independent case and it slows us down if we don't know that.
+            if (cc->is_standard(alloc()))
+                continue;
+
+            CharacterRangeVector& ranges = cc->ranges(alloc());
+            int range_count = ranges.length();
+            for (int j = 0; j < range_count; j++)
+                ranges[j].AddCaseEquivalents(is_ascii, unicode, &ranges);
+        }
+    }
+}
+
+// -------------------------------------------------------------------
+// AssertionNode
+
+int
+AssertionNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
+{
+    if (budget <= 0)
+        return 0;
+
+    // If we know we are not at the start and we are asked "how many characters
+    // will you match if you succeed?" then we can answer anything since false
+    // implies false.  So lets just return the max answer (still_to_find) since
+    // that won't prevent us from preloading a lot of characters for the other
+    // branches in the node graph.
+    if (assertion_type() == AT_START && not_at_start)
+        return still_to_find;
+
+    return on_success()->EatsAtLeast(still_to_find, budget - 1, not_at_start);
+}
+
+bool
+AssertionNode::FillInBMInfo(int offset, int budget, BoyerMooreLookahead* bm, bool not_at_start)
+{
+    if (!bm->CheckOverRecursed())
+        return false;
+
+    // Match the behaviour of EatsAtLeast on this node.
+    if (assertion_type() == AT_START && not_at_start)
+        return true;
+
+    if (!on_success()->FillInBMInfo(offset, budget - 1, bm, not_at_start))
+        return false;
+    SaveBMInfo(bm, not_at_start, offset);
+    return true;
+}
+
+// -------------------------------------------------------------------
+// BackReferenceNode
+
+int
+BackReferenceNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
+{
+    if (budget <= 0)
+        return 0;
+    return on_success()->EatsAtLeast(still_to_find, budget - 1, not_at_start);
+}
+
+bool
+BackReferenceNode::FillInBMInfo(int offset, int budget, BoyerMooreLookahead* bm, bool not_at_start)
+{
+    // Working out the set of characters that a backreference can match is too
+    // hard, so we just say that any character can match.
+    bm->SetRest(offset);
+    SaveBMInfo(bm, not_at_start, offset);
+    return true;
+}
+
+// -------------------------------------------------------------------
+// ChoiceNode
+
+int
+ChoiceNode::EatsAtLeastHelper(int still_to_find,
+                              int budget,
+                              RegExpNode* ignore_this_node,
+                              bool not_at_start)
+{
+    if (budget <= 0)
+        return 0;
+
+    int min = 100;
+    size_t choice_count = alternatives().length();
+    budget = (budget - 1) / choice_count;
+    for (size_t i = 0; i < choice_count; i++) {
+        RegExpNode* node = alternatives()[i].node();
+        if (node == ignore_this_node) continue;
+        int node_eats_at_least =
+            node->EatsAtLeast(still_to_find, budget, not_at_start);
+        if (node_eats_at_least < min)
+            min = node_eats_at_least;
+        if (min == 0)
+            return 0;
+    }
+    return min;
+}
+
+int
+ChoiceNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
+{
+    return EatsAtLeastHelper(still_to_find,
+                             budget,
+                             nullptr,
+                             not_at_start);
+}
+
+void
+ChoiceNode::GetQuickCheckDetails(QuickCheckDetails* details,
+                                 RegExpCompiler* compiler,
+                                 int characters_filled_in,
+                                 bool not_at_start)
+{
+    not_at_start = (not_at_start || not_at_start_);
+    int choice_count = alternatives().length();
+    MOZ_ASSERT(choice_count > 0);
+    alternatives()[0].node()->GetQuickCheckDetails(details,
+                                                   compiler,
+                                                   characters_filled_in,
+                                                   not_at_start);
+    for (int i = 1; i < choice_count; i++) {
+        QuickCheckDetails new_details(details->characters());
+        RegExpNode* node = alternatives()[i].node();
+        node->GetQuickCheckDetails(&new_details, compiler,
+                                   characters_filled_in,
+                                   not_at_start);
+        // Here we merge the quick match details of the two branches.
+        details->Merge(&new_details, characters_filled_in);
+    }
+}
+
+bool
+ChoiceNode::FillInBMInfo(int offset,
+                         int budget,
+                         BoyerMooreLookahead* bm,
+                         bool not_at_start)
+{
+    if (!bm->CheckOverRecursed())
+        return false;
+
+    const GuardedAlternativeVector& alts = alternatives();
+    budget = (budget - 1) / alts.length();
+    for (size_t i = 0; i < alts.length(); i++) {
+        const GuardedAlternative& alt = alts[i];
+        if (alt.guards() != nullptr && alt.guards()->length() != 0) {
+            bm->SetRest(offset);  // Give up trying to fill in info.
+            SaveBMInfo(bm, not_at_start, offset);
+            return true;
+        }
+        if (!alt.node()->FillInBMInfo(offset, budget, bm, not_at_start))
+            return false;
+    }
+    SaveBMInfo(bm, not_at_start, offset);
+    return true;
+}
+
+RegExpNode*
+ChoiceNode::FilterASCII(int depth, bool ignore_case, bool unicode)
+{
+    if (info()->replacement_calculated)
+        return replacement();
+    if (depth < 0)
+        return this;
+    if (info()->visited)
+        return this;
+    VisitMarker marker(info());
+    int choice_count = alternatives().length();
+
+    for (int i = 0; i < choice_count; i++) {
+        const GuardedAlternative alternative = alternatives()[i];
+        if (alternative.guards() != nullptr && alternative.guards()->length() != 0) {
+            set_replacement(this);
+            return this;
+        }
+    }
+
+    int surviving = 0;
+    RegExpNode* survivor = nullptr;
+    for (int i = 0; i < choice_count; i++) {
+        GuardedAlternative alternative = alternatives()[i];
+        RegExpNode* replacement =
+            alternative.node()->FilterASCII(depth - 1, ignore_case, unicode);
+        MOZ_ASSERT(replacement != this);  // No missing EMPTY_MATCH_CHECK.
+        if (replacement != nullptr) {
+            alternatives()[i].set_node(replacement);
+            surviving++;
+            survivor = replacement;
+        }
+    }
+    if (surviving < 2)
+        return set_replacement(survivor);
+
+    set_replacement(this);
+    if (surviving == choice_count)
+        return this;
+
+    // Only some of the nodes survived the filtering.  We need to rebuild the
+    // alternatives list.
+    GuardedAlternativeVector new_alternatives(*alloc());
+    new_alternatives.reserve(surviving);
+    for (int i = 0; i < choice_count; i++) {
+        RegExpNode* replacement =
+            alternatives()[i].node()->FilterASCII(depth - 1, ignore_case, unicode);
+        if (replacement != nullptr) {
+            alternatives()[i].set_node(replacement);
+            new_alternatives.append(alternatives()[i]);
+        }
+    }
+
+    alternatives_ = Move(new_alternatives);
+    return this;
+}
+
+// -------------------------------------------------------------------
+// NegativeLookaheadChoiceNode
+
+bool
+NegativeLookaheadChoiceNode::FillInBMInfo(int offset,
+                                          int budget,
+                                          BoyerMooreLookahead* bm,
+                                          bool not_at_start)
+{
+    if (!bm->CheckOverRecursed())
+        return false;
+
+    if (!alternatives()[1].node()->FillInBMInfo(offset, budget - 1, bm, not_at_start))
+        return false;
+    if (offset == 0)
+        set_bm_info(not_at_start, bm);
+    return true;
+}
+
+int
+NegativeLookaheadChoiceNode::EatsAtLeast(int still_to_find, int budget, bool not_at_start)
+{
+    if (budget <= 0)
+        return 0;
+
+    // Alternative 0 is the negative lookahead, alternative 1 is what comes
+    // afterwards.
+    RegExpNode* node = alternatives()[1].node();
+    return node->EatsAtLeast(still_to_find, budget - 1, not_at_start);
+}
+
+void
+NegativeLookaheadChoiceNode::GetQuickCheckDetails(QuickCheckDetails* details,
+                                                  RegExpCompiler* compiler,
+                                                  int filled_in,
+                                                  bool not_at_start)
+{
+    // Alternative 0 is the negative lookahead, alternative 1 is what comes
+    // afterwards.
+    RegExpNode* node = alternatives()[1].node();
+    return node->GetQuickCheckDetails(details, compiler, filled_in, not_at_start);
+}
+
+RegExpNode*
+NegativeLookaheadChoiceNode::FilterASCII(int depth, bool ignore_case, bool unicode)
+{
+    if (info()->replacement_calculated)
+        return replacement();
+    if (depth < 0)
+        return this;
+    if (info()->visited)
+        return this;
+
+    VisitMarker marker(info());
+
+    // Alternative 0 is the negative lookahead, alternative 1 is what comes
+    // afterwards.
+    RegExpNode* node = alternatives()[1].node();
+    RegExpNode* replacement = node->FilterASCII(depth - 1, ignore_case, unicode);
+
+    if (replacement == nullptr)
+        return set_replacement(nullptr);
+    alternatives()[1].set_node(replacement);
+
+    RegExpNode* neg_node = alternatives()[0].node();
+    RegExpNode* neg_replacement = neg_node->FilterASCII(depth - 1, ignore_case, unicode);
+
+    // If the negative lookahead is always going to fail then
+    // we don't need to check it.
+    if (neg_replacement == nullptr)
+        return set_replacement(replacement);
+
+    alternatives()[0].set_node(neg_replacement);
+    return set_replacement(this);
+}
+
+// -------------------------------------------------------------------
+// LoopChoiceNode
+
+void
+GuardedAlternative::AddGuard(LifoAlloc* alloc, Guard* guard)
+{
+    if (guards_ == nullptr)
+        guards_ = alloc->newInfallible<GuardVector>(*alloc);
+    guards_->append(guard);
+}
+
+void
+LoopChoiceNode::AddLoopAlternative(GuardedAlternative alt)
+{
+    MOZ_ASSERT(loop_node_ == nullptr);
+    AddAlternative(alt);
+    loop_node_ = alt.node();
+}
+
+
+void
+LoopChoiceNode::AddContinueAlternative(GuardedAlternative alt)
+{
+    MOZ_ASSERT(continue_node_ == nullptr);
+    AddAlternative(alt);
+    continue_node_ = alt.node();
+}
+
+int
+LoopChoiceNode::EatsAtLeast(int still_to_find,  int budget, bool not_at_start)
+{
+    return EatsAtLeastHelper(still_to_find,
+                             budget - 1,
+                             loop_node_,
+                             not_at_start);
+}
+
+void
+LoopChoiceNode::GetQuickCheckDetails(QuickCheckDetails* details,
+                                     RegExpCompiler* compiler,
+                                     int characters_filled_in,
+                                     bool not_at_start)
+{
+    if (body_can_be_zero_length_ || info()->visited)
+        return;
+    VisitMarker marker(info());
+    return ChoiceNode::GetQuickCheckDetails(details,
+                                            compiler,
+                                            characters_filled_in,
+                                            not_at_start);
+}
+
+bool
+LoopChoiceNode::FillInBMInfo(int offset,
+                             int budget,
+                             BoyerMooreLookahead* bm,
+                             bool not_at_start)
+{
+    if (body_can_be_zero_length_ || budget <= 0) {
+        bm->SetRest(offset);
+        SaveBMInfo(bm, not_at_start, offset);
+        return true;
+    }
+    if (!ChoiceNode::FillInBMInfo(offset, budget - 1, bm, not_at_start))
+        return false;
+    SaveBMInfo(bm, not_at_start, offset);
+    return true;
+}
+
+RegExpNode*
+LoopChoiceNode::FilterASCII(int depth, bool ignore_case, bool unicode)
+{
+    if (info()->replacement_calculated)
+        return replacement();
+    if (depth < 0)
+        return this;
+    if (info()->visited)
+        return this;
+
+    {
+        VisitMarker marker(info());
+
+        RegExpNode* continue_replacement =
+            continue_node_->FilterASCII(depth - 1, ignore_case, unicode);
+
+        // If we can't continue after the loop then there is no sense in doing the
+        // loop.
+        if (continue_replacement == nullptr)
+            return set_replacement(nullptr);
+    }
+
+    return ChoiceNode::FilterASCII(depth - 1, ignore_case, unicode);
+}
+
+// -------------------------------------------------------------------
+// Analysis
+
+void
+Analysis::EnsureAnalyzed(RegExpNode* that)
+{
+    JS_CHECK_RECURSION(cx, failASCII("Stack overflow"); return);
+
+    if (that->info()->been_analyzed || that->info()->being_analyzed)
+        return;
+    that->info()->being_analyzed = true;
+    that->Accept(this);
+    that->info()->being_analyzed = false;
+    that->info()->been_analyzed = true;
+}
+
+void
+Analysis::VisitEnd(EndNode* that)
+{
+    // nothing to do
+}
+
+void
+Analysis::VisitText(TextNode* that)
+{
+    if (ignore_case_)
+        that->MakeCaseIndependent(is_ascii_, unicode_);
+    EnsureAnalyzed(that->on_success());
+    if (!has_failed()) {
+        that->CalculateOffsets();
+    }
+}
+
+void
+Analysis::VisitAction(ActionNode* that)
+{
+    RegExpNode* target = that->on_success();
+    EnsureAnalyzed(target);
+
+    if (!has_failed()) {
+        // If the next node is interested in what it follows then this node
+        // has to be interested too so it can pass the information on.
+        that->info()->AddFromFollowing(target->info());
+    }
+}
+
+void
+Analysis::VisitChoice(ChoiceNode* that)
+{
+    NodeInfo* info = that->info();
+
+    for (size_t i = 0; i < that->alternatives().length(); i++) {
+        RegExpNode* node = that->alternatives()[i].node();
+        EnsureAnalyzed(node);
+        if (has_failed()) return;
+
+        // Anything the following nodes need to know has to be known by
+        // this node also, so it can pass it on.
+        info->AddFromFollowing(node->info());
+    }
+}
+
+void
+Analysis::VisitLoopChoice(LoopChoiceNode* that)
+{
+    NodeInfo* info = that->info();
+    for (size_t i = 0; i < that->alternatives().length(); i++) {
+        RegExpNode* node = that->alternatives()[i].node();
+        if (node != that->loop_node()) {
+            EnsureAnalyzed(node);
+            if (has_failed()) return;
+            info->AddFromFollowing(node->info());
+        }
+    }
+
+    // Check the loop last since it may need the value of this node
+    // to get a correct result.
+    EnsureAnalyzed(that->loop_node());
+    if (!has_failed())
+        info->AddFromFollowing(that->loop_node()->info());
+}
+
+void
+Analysis::VisitBackReference(BackReferenceNode* that)
+{
+    EnsureAnalyzed(that->on_success());
+}
+
+void
+Analysis::VisitAssertion(AssertionNode* that)
+{
+    EnsureAnalyzed(that->on_success());
+}
+
+// -------------------------------------------------------------------
+// Implementation of the Irregexp regular expression engine.
+//
+// The Irregexp regular expression engine is intended to be a complete
+// implementation of ECMAScript regular expressions.  It generates either
+// bytecodes or native code.
+
+//   The Irregexp regexp engine is structured in three steps.
+//   1) The parser generates an abstract syntax tree.  See RegExpAST.cpp.
+//   2) From the AST a node network is created.  The nodes are all
+//      subclasses of RegExpNode.  The nodes represent states when
+//      executing a regular expression.  Several optimizations are
+//      performed on the node network.
+//   3) From the nodes we generate either byte codes or native code
+//      that can actually execute the regular expression (perform
+//      the search).  The code generation step is described in more
+//      detail below.
+
+// Code generation.
+//
+//   The nodes are divided into four main categories.
+//   * Choice nodes
+//        These represent places where the regular expression can
+//        match in more than one way.  For example on entry to an
+//        alternation (foo|bar) or a repetition (*, +, ? or {}).
+//   * Action nodes
+//        These represent places where some action should be
+//        performed.  Examples include recording the current position
+//        in the input string to a register (in order to implement
+//        captures) or other actions on register for example in order
+//        to implement the counters needed for {} repetitions.
+//   * Matching nodes
+//        These attempt to match some element part of the input string.
+//        Examples of elements include character classes, plain strings
+//        or back references.
+//   * End nodes
+//        These are used to implement the actions required on finding
+//        a successful match or failing to find a match.
+//
+//   The code generated (whether as byte codes or native code) maintains
+//   some state as it runs.  This consists of the following elements:
+//
+//   * The capture registers.  Used for string captures.
+//   * Other registers.  Used for counters etc.
+//   * The current position.
+//   * The stack of backtracking information.  Used when a matching node
+//     fails to find a match and needs to try an alternative.
+//
+// Conceptual regular expression execution model:
+//
+//   There is a simple conceptual model of regular expression execution
+//   which will be presented first.  The actual code generated is a more
+//   efficient simulation of the simple conceptual model:
+//
+//   * Choice nodes are implemented as follows:
+//     For each choice except the last {
+//       push current position
+//       push backtrack code location
+//       <generate code to test for choice>
+//       backtrack code location:
+//       pop current position
+//     }
+//     <generate code to test for last choice>
+//
+//   * Actions nodes are generated as follows
+//     <push affected registers on backtrack stack>
+//     <generate code to perform action>
+//     push backtrack code location
+//     <generate code to test for following nodes>
+//     backtrack code location:
+//     <pop affected registers to restore their state>
+//     <pop backtrack location from stack and go to it>
+//
+//   * Matching nodes are generated as follows:
+//     if input string matches at current position
+//       update current position
+//       <generate code to test for following nodes>
+//     else
+//       <pop backtrack location from stack and go to it>
+//
+//   Thus it can be seen that the current position is saved and restored
+//   by the choice nodes, whereas the registers are saved and restored by
+//   by the action nodes that manipulate them.
+//
+//   The other interesting aspect of this model is that nodes are generated
+//   at the point where they are needed by a recursive call to Emit().  If
+//   the node has already been code generated then the Emit() call will
+//   generate a jump to the previously generated code instead.  In order to
+//   limit recursion it is possible for the Emit() function to put the node
+//   on a work list for later generation and instead generate a jump.  The
+//   destination of the jump is resolved later when the code is generated.
+//
+// Actual regular expression code generation.
+//
+//   Code generation is actually more complicated than the above.  In order
+//   to improve the efficiency of the generated code some optimizations are
+//   performed
+//
+//   * Choice nodes have 1-character lookahead.
+//     A choice node looks at the following character and eliminates some of
+//     the choices immediately based on that character.  This is not yet
+//     implemented.
+//   * Simple greedy loops store reduced backtracking information.
+//     A quantifier like /.*foo/m will greedily match the whole input.  It will
+//     then need to backtrack to a point where it can match "foo".  The naive
+//     implementation of this would push each character position onto the
+//     backtracking stack, then pop them off one by one.  This would use space
+//     proportional to the length of the input string.  However since the "."
+//     can only match in one way and always has a constant length (in this case
+//     of 1) it suffices to store the current position on the top of the stack
+//     once.  Matching now becomes merely incrementing the current position and
+//     backtracking becomes decrementing the current position and checking the
+//     result against the stored current position.  This is faster and saves
+//     space.
+//   * The current state is virtualized.
+//     This is used to defer expensive operations until it is clear that they
+//     are needed and to generate code for a node more than once, allowing
+//     specialized an efficient versions of the code to be created. This is
+//     explained in the section below.
+//
+// Execution state virtualization.
+//
+//   Instead of emitting code, nodes that manipulate the state can record their
+//   manipulation in an object called the Trace.  The Trace object can record a
+//   current position offset, an optional backtrack code location on the top of
+//   the virtualized backtrack stack and some register changes.  When a node is
+//   to be emitted it can flush the Trace or update it.  Flushing the Trace
+//   will emit code to bring the actual state into line with the virtual state.
+//   Avoiding flushing the state can postpone some work (e.g. updates of capture
+//   registers).  Postponing work can save time when executing the regular
+//   expression since it may be found that the work never has to be done as a
+//   failure to match can occur.  In addition it is much faster to jump to a
+//   known backtrack code location than it is to pop an unknown backtrack
+//   location from the stack and jump there.
+//
+//   The virtual state found in the Trace affects code generation.  For example
+//   the virtual state contains the difference between the actual current
+//   position and the virtual current position, and matching code needs to use
+//   this offset to attempt a match in the correct location of the input
+//   string.  Therefore code generated for a non-trivial trace is specialized
+//   to that trace.  The code generator therefore has the ability to generate
+//   code for each node several times.  In order to limit the size of the
+//   generated code there is an arbitrary limit on how many specialized sets of
+//   code may be generated for a given node.  If the limit is reached, the
+//   trace is flushed and a generic version of the code for a node is emitted.
+//   This is subsequently used for that node.  The code emitted for non-generic
+//   trace is not recorded in the node and so it cannot currently be reused in
+//   the event that code generation is requested for an identical trace.
+
+/* static */ TextElement
+TextElement::Atom(RegExpAtom* atom)
+{
+    return TextElement(ATOM, atom);
+}
+
+/* static */ TextElement
+TextElement::CharClass(RegExpCharacterClass* char_class)
+{
+    return TextElement(CHAR_CLASS, char_class);
+}
+
+int
+TextElement::length() const
+{
+    switch (text_type()) {
+      case ATOM:
+        return atom()->length();
+      case CHAR_CLASS:
+        return 1;
+    }
+    MOZ_CRASH("Bad text type");
+}
+
+class FrequencyCollator
+{
+  public:
+    FrequencyCollator() : total_samples_(0) {
+        for (int i = 0; i < RegExpMacroAssembler::kTableSize; i++) {
+            frequencies_[i] = CharacterFrequency(i);
+        }
+    }
+
+    void CountCharacter(int character) {
+        int index = (character & RegExpMacroAssembler::kTableMask);
+        frequencies_[index].Increment();
+        total_samples_++;
+    }
+
+    // Does not measure in percent, but rather per-128 (the table size from the
+    // regexp macro assembler).
+    int Frequency(int in_character) {
+        MOZ_ASSERT((in_character & RegExpMacroAssembler::kTableMask) == in_character);
+        if (total_samples_ < 1) return 1;  // Division by zero.
+        int freq_in_per128 =
+            (frequencies_[in_character].counter() * 128) / total_samples_;
+        return freq_in_per128;
+    }
+
+  private:
+    class CharacterFrequency {
+      public:
+        CharacterFrequency() : counter_(0), character_(-1) { }
+        explicit CharacterFrequency(int character)
+          : counter_(0), character_(character)
+        {}
+
+        void Increment() { counter_++; }
+        int counter() { return counter_; }
+        int character() { return character_; }
+
+     private:
+        int counter_;
+        int character_;
+    };
+
+  private:
+    CharacterFrequency frequencies_[RegExpMacroAssembler::kTableSize];
+    int total_samples_;
+};
+
+class irregexp::RegExpCompiler
+{
+  public:
+    RegExpCompiler(JSContext* cx, LifoAlloc* alloc, int capture_count,
+                   bool ignore_case, bool is_ascii, bool match_only, bool unicode);
+
+    int AllocateRegister() {
+        if (next_register_ >= RegExpMacroAssembler::kMaxRegister) {
+            reg_exp_too_big_ = true;
+            return next_register_;
+        }
+        return next_register_++;
+    }
+
+    RegExpCode Assemble(JSContext* cx,
+                        RegExpMacroAssembler* assembler,
+                        RegExpNode* start,
+                        int capture_count);
+
+    inline void AddWork(RegExpNode* node) {
+        AutoEnterOOMUnsafeRegion oomUnsafe;
+        if (!work_list_.append(node))
+            oomUnsafe.crash("AddWork");
+    }
+
+    static const int kImplementationOffset = 0;
+    static const int kNumberOfRegistersOffset = 0;
+    static const int kCodeOffset = 1;
+
+    RegExpMacroAssembler* macro_assembler() { return macro_assembler_; }
+    EndNode* accept() { return accept_; }
+
+    static const int kMaxRecursion = 100;
+    inline int recursion_depth() { return recursion_depth_; }
+    inline void IncrementRecursionDepth() { recursion_depth_++; }
+    inline void DecrementRecursionDepth() { recursion_depth_--; }
+
+    void SetRegExpTooBig() { reg_exp_too_big_ = true; }
+
+    inline bool ignore_case() { return ignore_case_; }
+    inline bool ascii() { return ascii_; }
+    inline bool unicode() { return unicode_; }
+    FrequencyCollator* frequency_collator() { return &frequency_collator_; }
+
+    int current_expansion_factor() { return current_expansion_factor_; }
+    void set_current_expansion_factor(int value) {
+        current_expansion_factor_ = value;
+    }
+
+    JSContext* cx() const { return cx_; }
+    LifoAlloc* alloc() const { return alloc_; }
+
+    static const int kNoRegister = -1;
+
+  private:
+    EndNode* accept_;
+    int next_register_;
+    Vector<RegExpNode*, 4, SystemAllocPolicy> work_list_;
+    int recursion_depth_;
+    RegExpMacroAssembler* macro_assembler_;
+    bool ignore_case_;
+    bool ascii_;
+    bool match_only_;
+    bool unicode_;
+    bool reg_exp_too_big_;
+    int current_expansion_factor_;
+    FrequencyCollator frequency_collator_;
+    JSContext* cx_;
+    LifoAlloc* alloc_;
+};
+
+class RecursionCheck
+{
+  public:
+    explicit RecursionCheck(RegExpCompiler* compiler) : compiler_(compiler) {
+        compiler->IncrementRecursionDepth();
+    }
+    ~RecursionCheck() { compiler_->DecrementRecursionDepth(); }
+
+  private:
+    RegExpCompiler* compiler_;
+};
+
+// Attempts to compile the regexp using an Irregexp code generator.  Returns
+// a fixed array or a null handle depending on whether it succeeded.
+RegExpCompiler::RegExpCompiler(JSContext* cx, LifoAlloc* alloc, int capture_count,
+                               bool ignore_case, bool ascii, bool match_only, bool unicode)
+  : next_register_(2 * (capture_count + 1)),
+    recursion_depth_(0),
+    ignore_case_(ignore_case),
+    ascii_(ascii),
+    match_only_(match_only),
+    unicode_(unicode),
+    reg_exp_too_big_(false),
+    current_expansion_factor_(1),
+    frequency_collator_(),
+    cx_(cx),
+    alloc_(alloc)
+{
+    accept_ = alloc->newInfallible<EndNode>(alloc, EndNode::ACCEPT);
+    MOZ_ASSERT(next_register_ - 1 <= RegExpMacroAssembler::kMaxRegister);
+}
+
+RegExpCode
+RegExpCompiler::Assemble(JSContext* cx,
+                         RegExpMacroAssembler* assembler,
+                         RegExpNode* start,
+                         int capture_count)
+{
+    macro_assembler_ = assembler;
+    macro_assembler_->set_slow_safe(false);
+
+    // The LifoAlloc used by the regexp compiler is infallible and is currently
+    // expected to crash on OOM. Thus we have to disable the assertions made to
+    // prevent us from allocating any new chunk in the LifoAlloc. This is needed
+    // because the jit::MacroAssembler turns these assertions on by default.
+    LifoAlloc::AutoFallibleScope fallibleAllocator(alloc());
+
+    jit::Label fail;
+    macro_assembler_->PushBacktrack(&fail);
+    Trace new_trace;
+    start->Emit(this, &new_trace);
+    macro_assembler_->BindBacktrack(&fail);
+    macro_assembler_->Fail();
+
+    while (!work_list_.empty())
+        work_list_.popCopy()->Emit(this, &new_trace);
+
+    RegExpCode code = macro_assembler_->GenerateCode(cx, match_only_);
+    if (code.empty())
+        return RegExpCode();
+
+    if (reg_exp_too_big_) {
+        code.destroy();
+        JS_ReportErrorASCII(cx, "regexp too big");
+        return RegExpCode();
+    }
+
+    return code;
+}
+
+template <typename CharT>
+static void
+SampleChars(FrequencyCollator* collator, const CharT* chars, size_t length)
+{
+    // Sample some characters from the middle of the string.
+    static const int kSampleSize = 128;
+
+    int chars_sampled = 0;
+    int half_way = (int(length) - kSampleSize) / 2;
+    for (size_t i = Max(0, half_way);
+         i < length && chars_sampled < kSampleSize;
+         i++, chars_sampled++)
+    {
+        collator->CountCharacter(chars[i]);
+    }
+}
+
+static bool
+IsNativeRegExpEnabled(JSContext* cx)
+{
+#ifdef JS_CODEGEN_NONE
+    return false;
+#else
+    return cx->options().nativeRegExp();
+#endif
+}
+
+RegExpCode
+irregexp::CompilePattern(JSContext* cx, RegExpShared* shared, RegExpCompileData* data,
+                         HandleLinearString sample, bool is_global, bool ignore_case,
+                         bool is_ascii, bool match_only, bool force_bytecode, bool sticky,
+                         bool unicode)
+{
+    if ((data->capture_count + 1) * 2 - 1 > RegExpMacroAssembler::kMaxRegister) {
+        JS_ReportErrorASCII(cx, "regexp too big");
+        return RegExpCode();
+    }
+
+    LifoAlloc& alloc = cx->tempLifoAlloc();
+    RegExpCompiler compiler(cx, &alloc, data->capture_count, ignore_case, is_ascii, match_only,
+                            unicode);
+
+    // Sample some characters from the middle of the string.
+    if (sample->hasLatin1Chars()) {
+        JS::AutoCheckCannotGC nogc;
+        SampleChars(compiler.frequency_collator(), sample->latin1Chars(nogc), sample->length());
+    } else {
+        JS::AutoCheckCannotGC nogc;
+        SampleChars(compiler.frequency_collator(), sample->twoByteChars(nogc), sample->length());
+    }
+
+    // Wrap the body of the regexp in capture #0.
+    RegExpNode* captured_body = RegExpCapture::ToNode(data->tree,
+                                                      0,
+                                                      &compiler,
+                                                      compiler.accept());
+    RegExpNode* node = captured_body;
+    bool is_end_anchored = data->tree->IsAnchoredAtEnd();
+    bool is_start_anchored = sticky || data->tree->IsAnchoredAtStart();
+    int max_length = data->tree->max_match();
+    if (!is_start_anchored) {
+        // Add a .*? at the beginning, outside the body capture, unless
+        // this expression is anchored at the beginning.
+        RegExpNode* loop_node =
+            RegExpQuantifier::ToNode(0,
+                                     RegExpTree::kInfinity,
+                                     false,
+                                     alloc.newInfallible<RegExpCharacterClass>('*'),
+                                     &compiler,
+                                     captured_body,
+                                     data->contains_anchor);
+
+        if (data->contains_anchor) {
+            // Unroll loop once, to take care of the case that might start
+            // at the start of input.
+            ChoiceNode* first_step_node = alloc.newInfallible<ChoiceNode>(&alloc, 2);
+            RegExpNode* char_class =
+                alloc.newInfallible<TextNode>(alloc.newInfallible<RegExpCharacterClass>('*'), loop_node);
+            first_step_node->AddAlternative(GuardedAlternative(captured_body));
+            first_step_node->AddAlternative(GuardedAlternative(char_class));
+            node = first_step_node;
+        } else {
+            node = loop_node;
+        }
+    }
+    if (is_ascii) {
+        node = node->FilterASCII(RegExpCompiler::kMaxRecursion, ignore_case, unicode);
+        // Do it again to propagate the new nodes to places where they were not
+        // put because they had not been calculated yet.
+        if (node != nullptr) {
+            node = node->FilterASCII(RegExpCompiler::kMaxRecursion, ignore_case, unicode);
+        }
+    }
+
+    if (node == nullptr)
+        node = alloc.newInfallible<EndNode>(&alloc, EndNode::BACKTRACK);
+
+    Analysis analysis(cx, ignore_case, is_ascii, unicode);
+    analysis.EnsureAnalyzed(node);
+    if (analysis.has_failed()) {
+        JS_ReportErrorASCII(cx, "%s", analysis.errorMessage());
+        return RegExpCode();
+    }
+
+    Maybe<jit::JitContext> ctx;
+    Maybe<NativeRegExpMacroAssembler> native_assembler;
+    Maybe<InterpretedRegExpMacroAssembler> interpreted_assembler;
+
+    RegExpMacroAssembler* assembler;
+    if (IsNativeRegExpEnabled(cx) &&
+        !force_bytecode &&
+        jit::CanLikelyAllocateMoreExecutableMemory() &&
+        shared->getSource()->length() < 32 * 1024)
+    {
+        NativeRegExpMacroAssembler::Mode mode =
+            is_ascii ? NativeRegExpMacroAssembler::ASCII
+                     : NativeRegExpMacroAssembler::CHAR16;
+
+        ctx.emplace(cx, (jit::TempAllocator*) nullptr);
+        native_assembler.emplace(&alloc, shared, cx->runtime(), mode, (data->capture_count + 1) * 2);
+        assembler = native_assembler.ptr();
+    } else {
+        interpreted_assembler.emplace(&alloc, shared, (data->capture_count + 1) * 2);
+        assembler = interpreted_assembler.ptr();
+    }
+
+    // Inserted here, instead of in Assembler, because it depends on information
+    // in the AST that isn't replicated in the Node structure.
+    static const int kMaxBacksearchLimit = 1024;
+    if (is_end_anchored &&
+        !is_start_anchored &&
+        max_length < kMaxBacksearchLimit) {
+        assembler->SetCurrentPositionFromEnd(max_length);
+    }
+
+    if (is_global) {
+        assembler->set_global_mode((data->tree->min_match() > 0)
+                                   ? RegExpMacroAssembler::GLOBAL_NO_ZERO_LENGTH_CHECK
+                                   : RegExpMacroAssembler::GLOBAL);
+    }
+
+    return compiler.Assemble(cx, assembler, node, data->capture_count);
+}
+
+template <typename CharT>
+RegExpRunStatus
+irregexp::ExecuteCode(JSContext* cx, jit::JitCode* codeBlock, const CharT* chars, size_t start,
+                      size_t length, MatchPairs* matches, size_t* endIndex)
+{
+    typedef void (*RegExpCodeSignature)(InputOutputData*);
+
+    InputOutputData data(chars, chars + length, start, matches, endIndex);
+
+    RegExpCodeSignature function = reinterpret_cast<RegExpCodeSignature>(codeBlock->raw());
+
+    {
+        JS::AutoSuppressGCAnalysis nogc;
+        CALL_GENERATED_1(function, &data);
+    }
+
+    return (RegExpRunStatus) data.result;
+}
+
+template RegExpRunStatus
+irregexp::ExecuteCode(JSContext* cx, jit::JitCode* codeBlock, const Latin1Char* chars, size_t start,
+                      size_t length, MatchPairs* matches, size_t* endIndex);
+
+template RegExpRunStatus
+irregexp::ExecuteCode(JSContext* cx, jit::JitCode* codeBlock, const char16_t* chars, size_t start,
+                      size_t length, MatchPairs* matches, size_t* endIndex);
+
+// -------------------------------------------------------------------
+// Tree to graph conversion
+
+RegExpNode*
+RegExpAtom::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    TextElementVector* elms =
+        compiler->alloc()->newInfallible<TextElementVector>(*compiler->alloc());
+    elms->append(TextElement::Atom(this));
+    return compiler->alloc()->newInfallible<TextNode>(elms, on_success);
+}
+
+RegExpNode*
+RegExpText::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    return compiler->alloc()->newInfallible<TextNode>(&elements_, on_success);
+}
+
+RegExpNode*
+RegExpCharacterClass::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    return compiler->alloc()->newInfallible<TextNode>(this, on_success);
+}
+
+RegExpNode*
+RegExpDisjunction::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    const RegExpTreeVector& alternatives = this->alternatives();
+    size_t length = alternatives.length();
+    ChoiceNode* result = compiler->alloc()->newInfallible<ChoiceNode>(compiler->alloc(), length);
+    for (size_t i = 0; i < length; i++) {
+        GuardedAlternative alternative(alternatives[i]->ToNode(compiler, on_success));
+        result->AddAlternative(alternative);
+    }
+    return result;
+}
+
+RegExpNode*
+RegExpQuantifier::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    return ToNode(min(),
+                  max(),
+                  is_greedy(),
+                  body(),
+                  compiler,
+                  on_success);
+}
+
+// Scoped object to keep track of how much we unroll quantifier loops in the
+// regexp graph generator.
+class RegExpExpansionLimiter
+{
+  public:
+    static const int kMaxExpansionFactor = 6;
+    RegExpExpansionLimiter(RegExpCompiler* compiler, int factor)
+      : compiler_(compiler),
+        saved_expansion_factor_(compiler->current_expansion_factor()),
+        ok_to_expand_(saved_expansion_factor_ <= kMaxExpansionFactor)
+    {
+        MOZ_ASSERT(factor > 0);
+        if (ok_to_expand_) {
+            if (factor > kMaxExpansionFactor) {
+                // Avoid integer overflow of the current expansion factor.
+                ok_to_expand_ = false;
+                compiler->set_current_expansion_factor(kMaxExpansionFactor + 1);
+            } else {
+                int new_factor = saved_expansion_factor_ * factor;
+                ok_to_expand_ = (new_factor <= kMaxExpansionFactor);
+                compiler->set_current_expansion_factor(new_factor);
+            }
+        }
+    }
+
+    ~RegExpExpansionLimiter() {
+        compiler_->set_current_expansion_factor(saved_expansion_factor_);
+    }
+
+    bool ok_to_expand() { return ok_to_expand_; }
+
+  private:
+    RegExpCompiler* compiler_;
+    int saved_expansion_factor_;
+    bool ok_to_expand_;
+};
+
+/* static */ RegExpNode*
+RegExpQuantifier::ToNode(int min,
+                         int max,
+                         bool is_greedy,
+                         RegExpTree* body,
+                         RegExpCompiler* compiler,
+                         RegExpNode* on_success,
+                         bool not_at_start /* = false */)
+{
+    // x{f, t} becomes this:
+    //
+    //             (r++)<-.
+    //               |     `
+    //               |     (x)
+    //               v     ^
+    //      (r=0)-->(?)---/ [if r < t]
+    //               |
+    //   [if r >= f] \----> ...
+    //
+
+    // 15.10.2.5 RepeatMatcher algorithm.
+    // The parser has already eliminated the case where max is 0.  In the case
+    // where max_match is zero the parser has removed the quantifier if min was
+    // > 0 and removed the atom if min was 0.  See AddQuantifierToAtom.
+
+    // If we know that we cannot match zero length then things are a little
+    // simpler since we don't need to make the special zero length match check
+    // from step 2.1.  If the min and max are small we can unroll a little in
+    // this case.
+    static const int kMaxUnrolledMinMatches = 3;  // Unroll (foo)+ and (foo){3,}
+    static const int kMaxUnrolledMaxMatches = 3;  // Unroll (foo)? and (foo){x,3}
+
+    if (max == 0)
+        return on_success;  // This can happen due to recursion.
+
+    bool body_can_be_empty = (body->min_match() == 0);
+    int body_start_reg = RegExpCompiler::kNoRegister;
+    Interval capture_registers = body->CaptureRegisters();
+    bool needs_capture_clearing = !capture_registers.is_empty();
+    LifoAlloc* alloc = compiler->alloc();
+
+    if (body_can_be_empty) {
+        body_start_reg = compiler->AllocateRegister();
+    } else if (!needs_capture_clearing) {
+        // Only unroll if there are no captures and the body can't be
+        // empty.
+        {
+            RegExpExpansionLimiter limiter(compiler, min + ((max != min) ? 1 : 0));
+            if (min > 0 && min <= kMaxUnrolledMinMatches && limiter.ok_to_expand()) {
+                int new_max = (max == kInfinity) ? max : max - min;
+                // Recurse once to get the loop or optional matches after the fixed
+                // ones.
+                RegExpNode* answer = ToNode(0, new_max, is_greedy, body, compiler, on_success, true);
+                // Unroll the forced matches from 0 to min.  This can cause chains of
+                // TextNodes (which the parser does not generate).  These should be
+                // combined if it turns out they hinder good code generation.
+                for (int i = 0; i < min; i++)
+                    answer = body->ToNode(compiler, answer);
+                return answer;
+            }
+        }
+        if (max <= kMaxUnrolledMaxMatches && min == 0) {
+            MOZ_ASSERT(max > 0);  // Due to the 'if' above.
+            RegExpExpansionLimiter limiter(compiler, max);
+            if (limiter.ok_to_expand()) {
+                // Unroll the optional matches up to max.
+                RegExpNode* answer = on_success;
+                for (int i = 0; i < max; i++) {
+                    ChoiceNode* alternation = alloc->newInfallible<ChoiceNode>(alloc, 2);
+                    if (is_greedy) {
+                        alternation->AddAlternative(GuardedAlternative(body->ToNode(compiler, answer)));
+                        alternation->AddAlternative(GuardedAlternative(on_success));
+                    } else {
+                        alternation->AddAlternative(GuardedAlternative(on_success));
+                        alternation->AddAlternative(GuardedAlternative(body->ToNode(compiler, answer)));
+                    }
+                    answer = alternation;
+                    if (not_at_start) alternation->set_not_at_start();
+                }
+                return answer;
+            }
+        }
+    }
+    bool has_min = min > 0;
+    bool has_max = max < RegExpTree::kInfinity;
+    bool needs_counter = has_min || has_max;
+    int reg_ctr = needs_counter
+        ? compiler->AllocateRegister()
+        : RegExpCompiler::kNoRegister;
+    LoopChoiceNode* center = alloc->newInfallible<LoopChoiceNode>(alloc, body->min_match() == 0);
+    if (not_at_start)
+        center->set_not_at_start();
+    RegExpNode* loop_return = needs_counter
+        ? static_cast<RegExpNode*>(ActionNode::IncrementRegister(reg_ctr, center))
+        : static_cast<RegExpNode*>(center);
+    if (body_can_be_empty) {
+        // If the body can be empty we need to check if it was and then
+        // backtrack.
+        loop_return = ActionNode::EmptyMatchCheck(body_start_reg,
+                                                  reg_ctr,
+                                                  min,
+                                                  loop_return);
+    }
+    RegExpNode* body_node = body->ToNode(compiler, loop_return);
+    if (body_can_be_empty) {
+        // If the body can be empty we need to store the start position
+        // so we can bail out if it was empty.
+        body_node = ActionNode::StorePosition(body_start_reg, false, body_node);
+    }
+    if (needs_capture_clearing) {
+        // Before entering the body of this loop we need to clear captures.
+        body_node = ActionNode::ClearCaptures(capture_registers, body_node);
+    }
+    GuardedAlternative body_alt(body_node);
+    if (has_max) {
+        Guard* body_guard = alloc->newInfallible<Guard>(reg_ctr, Guard::LT, max);
+        body_alt.AddGuard(alloc, body_guard);
+    }
+    GuardedAlternative rest_alt(on_success);
+    if (has_min) {
+        Guard* rest_guard = alloc->newInfallible<Guard>(reg_ctr, Guard::GEQ, min);
+        rest_alt.AddGuard(alloc, rest_guard);
+    }
+    if (is_greedy) {
+        center->AddLoopAlternative(body_alt);
+        center->AddContinueAlternative(rest_alt);
+    } else {
+        center->AddContinueAlternative(rest_alt);
+        center->AddLoopAlternative(body_alt);
+    }
+    if (needs_counter)
+        return ActionNode::SetRegister(reg_ctr, 0, center);
+    return center;
+}
+
+RegExpNode*
+RegExpAssertion::ToNode(RegExpCompiler* compiler,
+                        RegExpNode* on_success)
+{
+    NodeInfo info;
+    LifoAlloc* alloc = compiler->alloc();
+
+    switch (assertion_type()) {
+      case START_OF_LINE:
+        return AssertionNode::AfterNewline(on_success);
+      case START_OF_INPUT:
+        return AssertionNode::AtStart(on_success);
+      case BOUNDARY:
+        return AssertionNode::AtBoundary(on_success);
+      case NON_BOUNDARY:
+        return AssertionNode::AtNonBoundary(on_success);
+      case END_OF_INPUT:
+        return AssertionNode::AtEnd(on_success);
+      case END_OF_LINE: {
+        // Compile $ in multiline regexps as an alternation with a positive
+        // lookahead in one side and an end-of-input on the other side.
+        // We need two registers for the lookahead.
+        int stack_pointer_register = compiler->AllocateRegister();
+        int position_register = compiler->AllocateRegister();
+        // The ChoiceNode to distinguish between a newline and end-of-input.
+        ChoiceNode* result = alloc->newInfallible<ChoiceNode>(alloc, 2);
+        // Create a newline atom.
+        CharacterRangeVector* newline_ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+        CharacterRange::AddClassEscape(alloc, 'n', newline_ranges);
+        RegExpCharacterClass* newline_atom = alloc->newInfallible<RegExpCharacterClass>('n');
+        TextNode* newline_matcher =
+            alloc->newInfallible<TextNode>(newline_atom,
+                ActionNode::PositiveSubmatchSuccess(stack_pointer_register,
+                                                    position_register,
+                                                    0,  // No captures inside.
+                                                    -1,  // Ignored if no captures.
+                                                    on_success));
+        // Create an end-of-input matcher.
+        RegExpNode* end_of_line =
+            ActionNode::BeginSubmatch(stack_pointer_register, position_register, newline_matcher);
+
+        // Add the two alternatives to the ChoiceNode.
+        GuardedAlternative eol_alternative(end_of_line);
+        result->AddAlternative(eol_alternative);
+        GuardedAlternative end_alternative(AssertionNode::AtEnd(on_success));
+        result->AddAlternative(end_alternative);
+        return result;
+      }
+      case NOT_AFTER_LEAD_SURROGATE:
+        return AssertionNode::NotAfterLeadSurrogate(on_success);
+      case NOT_IN_SURROGATE_PAIR:
+        return AssertionNode::NotInSurrogatePair(on_success);
+      default:
+        MOZ_CRASH("Bad assertion type");
+    }
+    return on_success;
+}
+
+RegExpNode*
+RegExpBackReference::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    return compiler->alloc()->newInfallible<BackReferenceNode>(RegExpCapture::StartRegister(index()),
+                                                               RegExpCapture::EndRegister(index()),
+                                                               on_success);
+}
+
+RegExpNode*
+RegExpEmpty::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    return on_success;
+}
+
+RegExpNode*
+RegExpLookahead::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    int stack_pointer_register = compiler->AllocateRegister();
+    int position_register = compiler->AllocateRegister();
+
+    const int registers_per_capture = 2;
+    const int register_of_first_capture = 2;
+    int register_count = capture_count_ * registers_per_capture;
+    int register_start =
+        register_of_first_capture + capture_from_ * registers_per_capture;
+
+    if (is_positive()) {
+        RegExpNode* bodyNode =
+            body()->ToNode(compiler,
+                           ActionNode::PositiveSubmatchSuccess(stack_pointer_register,
+                                                               position_register,
+                                                               register_count,
+                                                               register_start,
+                                                               on_success));
+        return ActionNode::BeginSubmatch(stack_pointer_register,
+                                         position_register,
+                                         bodyNode);
+    }
+
+    // We use a ChoiceNode for a negative lookahead because it has most of
+    // the characteristics we need.  It has the body of the lookahead as its
+    // first alternative and the expression after the lookahead of the second
+    // alternative.  If the first alternative succeeds then the
+    // NegativeSubmatchSuccess will unwind the stack including everything the
+    // choice node set up and backtrack.  If the first alternative fails then
+    // the second alternative is tried, which is exactly the desired result
+    // for a negative lookahead.  The NegativeLookaheadChoiceNode is a special
+    // ChoiceNode that knows to ignore the first exit when calculating quick
+    // checks.
+    LifoAlloc* alloc = compiler->alloc();
+
+    RegExpNode* success =
+        alloc->newInfallible<NegativeSubmatchSuccess>(alloc,
+                                                      stack_pointer_register,
+                                                      position_register,
+                                                      register_count,
+                                                      register_start);
+    GuardedAlternative body_alt(body()->ToNode(compiler, success));
+
+    ChoiceNode* choice_node =
+        alloc->newInfallible<NegativeLookaheadChoiceNode>(alloc, body_alt, GuardedAlternative(on_success));
+
+    return ActionNode::BeginSubmatch(stack_pointer_register,
+                                     position_register,
+                                     choice_node);
+}
+
+RegExpNode*
+RegExpCapture::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    return ToNode(body(), index(), compiler, on_success);
+}
+
+/* static */ RegExpNode*
+RegExpCapture::ToNode(RegExpTree* body,
+                      int index,
+                      RegExpCompiler* compiler,
+                      RegExpNode* on_success)
+{
+    int start_reg = RegExpCapture::StartRegister(index);
+    int end_reg = RegExpCapture::EndRegister(index);
+    RegExpNode* store_end = ActionNode::StorePosition(end_reg, true, on_success);
+    RegExpNode* body_node = body->ToNode(compiler, store_end);
+    return ActionNode::StorePosition(start_reg, true, body_node);
+}
+
+RegExpNode*
+RegExpAlternative::ToNode(RegExpCompiler* compiler, RegExpNode* on_success)
+{
+    const RegExpTreeVector& children = nodes();
+    RegExpNode* current = on_success;
+    for (int i = children.length() - 1; i >= 0; i--)
+        current = children[i]->ToNode(compiler, current);
+    return current;
+}
+
+// -------------------------------------------------------------------
+// BoyerMooreLookahead
+
+ContainedInLattice
+irregexp::AddRange(ContainedInLattice containment,
+                   const int* ranges,
+                   int ranges_length,
+                   Interval new_range)
+{
+    MOZ_ASSERT((ranges_length & 1) == 1);
+    MOZ_ASSERT(ranges[ranges_length - 1] == kMaxUtf16CodeUnit + 1);
+    if (containment == kLatticeUnknown) return containment;
+    bool inside = false;
+    int last = 0;
+    for (int i = 0; i < ranges_length; inside = !inside, last = ranges[i], i++) {
+        // Consider the range from last to ranges[i].
+        // We haven't got to the new range yet.
+        if (ranges[i] <= new_range.from())
+            continue;
+
+        // New range is wholly inside last-ranges[i].  Note that new_range.to() is
+        // inclusive, but the values in ranges are not.
+        if (last <= new_range.from() && new_range.to() < ranges[i])
+            return Combine(containment, inside ? kLatticeIn : kLatticeOut);
+
+        return kLatticeUnknown;
+    }
+    return containment;
+}
+
+void
+BoyerMoorePositionInfo::Set(int character)
+{
+    SetInterval(Interval(character, character));
+}
+
+void
+BoyerMoorePositionInfo::SetInterval(const Interval& interval)
+{
+    s_ = AddRange(s_, kSpaceRanges, kSpaceRangeCount, interval);
+    w_ = AddRange(w_, kWordRanges, kWordRangeCount, interval);
+    d_ = AddRange(d_, kDigitRanges, kDigitRangeCount, interval);
+    surrogate_ =
+        AddRange(surrogate_, kSurrogateRanges, kSurrogateRangeCount, interval);
+    if (interval.to() - interval.from() >= kMapSize - 1) {
+        if (map_count_ != kMapSize) {
+            map_count_ = kMapSize;
+            for (int i = 0; i < kMapSize; i++)
+                map_[i] = true;
+        }
+        return;
+    }
+    for (int i = interval.from(); i <= interval.to(); i++) {
+        int mod_character = (i & kMask);
+        if (!map_[mod_character]) {
+            map_count_++;
+            map_[mod_character] = true;
+        }
+        if (map_count_ == kMapSize)
+            return;
+    }
+}
+
+void
+BoyerMoorePositionInfo::SetAll()
+{
+    s_ = w_ = d_ = kLatticeUnknown;
+    if (map_count_ != kMapSize) {
+        map_count_ = kMapSize;
+        for (int i = 0; i < kMapSize; i++)
+            map_[i] = true;
+    }
+}
+
+BoyerMooreLookahead::BoyerMooreLookahead(LifoAlloc* alloc, size_t length, RegExpCompiler* compiler)
+  : length_(length), compiler_(compiler), bitmaps_(*alloc)
+{
+    max_char_ = MaximumCharacter(compiler->ascii());
+
+    bitmaps_.reserve(length);
+    for (size_t i = 0; i < length; i++)
+        bitmaps_.append(alloc->newInfallible<BoyerMoorePositionInfo>(alloc));
+}
+
+// Find the longest range of lookahead that has the fewest number of different
+// characters that can occur at a given position.  Since we are optimizing two
+// different parameters at once this is a tradeoff.
+bool BoyerMooreLookahead::FindWorthwhileInterval(int* from, int* to) {
+  int biggest_points = 0;
+  // If more than 32 characters out of 128 can occur it is unlikely that we can
+  // be lucky enough to step forwards much of the time.
+  const int kMaxMax = 32;
+  for (int max_number_of_chars = 4;
+       max_number_of_chars < kMaxMax;
+       max_number_of_chars *= 2) {
+    biggest_points =
+        FindBestInterval(max_number_of_chars, biggest_points, from, to);
+  }
+  if (biggest_points == 0) return false;
+  return true;
+}
+
+// Find the highest-points range between 0 and length_ where the character
+// information is not too vague.  'Too vague' means that there are more than
+// max_number_of_chars that can occur at this position.  Calculates the number
+// of points as the product of width-of-the-range and
+// probability-of-finding-one-of-the-characters, where the probability is
+// calculated using the frequency distribution of the sample subject string.
+int
+BoyerMooreLookahead::FindBestInterval(int max_number_of_chars, int old_biggest_points,
+                                      int* from, int* to)
+{
+    int biggest_points = old_biggest_points;
+    static const int kSize = RegExpMacroAssembler::kTableSize;
+    for (int i = 0; i < length_; ) {
+        while (i < length_ && Count(i) > max_number_of_chars) i++;
+        if (i == length_) break;
+        int remembered_from = i;
+        bool union_map[kSize];
+        for (int j = 0; j < kSize; j++) union_map[j] = false;
+        while (i < length_ && Count(i) <= max_number_of_chars) {
+            BoyerMoorePositionInfo* map = bitmaps_[i];
+            for (int j = 0; j < kSize; j++) union_map[j] |= map->at(j);
+            i++;
+        }
+        int frequency = 0;
+        for (int j = 0; j < kSize; j++) {
+            if (union_map[j]) {
+                // Add 1 to the frequency to give a small per-character boost for
+                // the cases where our sampling is not good enough and many
+                // characters have a frequency of zero.  This means the frequency
+                // can theoretically be up to 2*kSize though we treat it mostly as
+                // a fraction of kSize.
+                frequency += compiler_->frequency_collator()->Frequency(j) + 1;
+            }
+        }
+        // We use the probability of skipping times the distance we are skipping to
+        // judge the effectiveness of this.  Actually we have a cut-off:  By
+        // dividing by 2 we switch off the skipping if the probability of skipping
+        // is less than 50%.  This is because the multibyte mask-and-compare
+        // skipping in quickcheck is more likely to do well on this case.
+        bool in_quickcheck_range = ((i - remembered_from < 4) ||
+                                    (compiler_->ascii() ? remembered_from <= 4 : remembered_from <= 2));
+        // Called 'probability' but it is only a rough estimate and can actually
+        // be outside the 0-kSize range.
+        int probability = (in_quickcheck_range ? kSize / 2 : kSize) - frequency;
+        int points = (i - remembered_from) * probability;
+        if (points > biggest_points) {
+            *from = remembered_from;
+            *to = i - 1;
+            biggest_points = points;
+        }
+    }
+    return biggest_points;
+}
+
+// Take all the characters that will not prevent a successful match if they
+// occur in the subject string in the range between min_lookahead and
+// max_lookahead (inclusive) measured from the current position.  If the
+// character at max_lookahead offset is not one of these characters, then we
+// can safely skip forwards by the number of characters in the range.
+int BoyerMooreLookahead::GetSkipTable(int min_lookahead,
+                                      int max_lookahead,
+                                      uint8_t* boolean_skip_table)
+{
+    const int kSize = RegExpMacroAssembler::kTableSize;
+
+    const int kSkipArrayEntry = 0;
+    const int kDontSkipArrayEntry = 1;
+
+    for (int i = 0; i < kSize; i++)
+        boolean_skip_table[i] = kSkipArrayEntry;
+    int skip = max_lookahead + 1 - min_lookahead;
+
+    for (int i = max_lookahead; i >= min_lookahead; i--) {
+        BoyerMoorePositionInfo* map = bitmaps_[i];
+        for (int j = 0; j < kSize; j++) {
+            if (map->at(j))
+                boolean_skip_table[j] = kDontSkipArrayEntry;
+        }
+    }
+
+    return skip;
+}
+
+// See comment on the implementation of GetSkipTable.
+bool
+BoyerMooreLookahead::EmitSkipInstructions(RegExpMacroAssembler* masm)
+{
+    const int kSize = RegExpMacroAssembler::kTableSize;
+
+    int min_lookahead = 0;
+    int max_lookahead = 0;
+
+    if (!FindWorthwhileInterval(&min_lookahead, &max_lookahead))
+        return false;
+
+    bool found_single_character = false;
+    int single_character = 0;
+    for (int i = max_lookahead; i >= min_lookahead; i--) {
+        BoyerMoorePositionInfo* map = bitmaps_[i];
+        if (map->map_count() > 1 ||
+            (found_single_character && map->map_count() != 0)) {
+            found_single_character = false;
+            break;
+        }
+        for (int j = 0; j < kSize; j++) {
+            if (map->at(j)) {
+                found_single_character = true;
+                single_character = j;
+                break;
+            }
+        }
+    }
+
+    int lookahead_width = max_lookahead + 1 - min_lookahead;
+
+    if (found_single_character && lookahead_width == 1 && max_lookahead < 3) {
+        // The mask-compare can probably handle this better.
+        return false;
+    }
+
+    if (found_single_character) {
+        jit::Label cont, again;
+        masm->Bind(&again);
+        masm->LoadCurrentCharacter(max_lookahead, &cont, true);
+        if (max_char_ > kSize) {
+            masm->CheckCharacterAfterAnd(single_character,
+                                         RegExpMacroAssembler::kTableMask,
+                                         &cont);
+        } else {
+            masm->CheckCharacter(single_character, &cont);
+        }
+        masm->AdvanceCurrentPosition(lookahead_width);
+        masm->JumpOrBacktrack(&again);
+        masm->Bind(&cont);
+        return true;
+    }
+
+    uint8_t* boolean_skip_table;
+    {
+        AutoEnterOOMUnsafeRegion oomUnsafe;
+        boolean_skip_table = static_cast<uint8_t*>(js_malloc(kSize));
+        if (!boolean_skip_table || !masm->shared->addTable(boolean_skip_table))
+            oomUnsafe.crash("Table malloc");
+    }
+
+    int skip_distance = GetSkipTable(min_lookahead, max_lookahead, boolean_skip_table);
+    MOZ_ASSERT(skip_distance != 0);
+
+    jit::Label cont, again;
+    masm->Bind(&again);
+    masm->LoadCurrentCharacter(max_lookahead, &cont, true);
+    masm->CheckBitInTable(boolean_skip_table, &cont);
+    masm->AdvanceCurrentPosition(skip_distance);
+    masm->JumpOrBacktrack(&again);
+    masm->Bind(&cont);
+
+    return true;
+}
+
+bool
+BoyerMooreLookahead::CheckOverRecursed()
+{
+    JS_CHECK_RECURSION(compiler()->cx(), compiler()->SetRegExpTooBig(); return false);
+    return true;
+}
+
+// -------------------------------------------------------------------
+// Trace
+
+bool Trace::DeferredAction::Mentions(int that)
+{
+    if (action_type() == ActionNode::CLEAR_CAPTURES) {
+        Interval range = static_cast<DeferredClearCaptures*>(this)->range();
+        return range.Contains(that);
+    }
+    return reg() == that;
+}
+
+bool Trace::mentions_reg(int reg)
+{
+    for (DeferredAction* action = actions_; action != nullptr; action = action->next()) {
+        if (action->Mentions(reg))
+            return true;
+    }
+    return false;
+}
+
+bool
+Trace::GetStoredPosition(int reg, int* cp_offset)
+{
+    MOZ_ASSERT(0 == *cp_offset);
+    for (DeferredAction* action = actions_; action != nullptr; action = action->next()) {
+        if (action->Mentions(reg)) {
+            if (action->action_type() == ActionNode::STORE_POSITION) {
+                *cp_offset = static_cast<DeferredCapture*>(action)->cp_offset();
+                return true;
+            }
+            return false;
+        }
+    }
+    return false;
+}
+
+int
+Trace::FindAffectedRegisters(LifoAlloc* alloc, OutSet* affected_registers)
+{
+    int max_register = RegExpCompiler::kNoRegister;
+    for (DeferredAction* action = actions_; action != nullptr; action = action->next()) {
+        if (action->action_type() == ActionNode::CLEAR_CAPTURES) {
+            Interval range = static_cast<DeferredClearCaptures*>(action)->range();
+            for (int i = range.from(); i <= range.to(); i++)
+                affected_registers->Set(alloc, i);
+            if (range.to() > max_register) max_register = range.to();
+        } else {
+            affected_registers->Set(alloc, action->reg());
+            if (action->reg() > max_register) max_register = action->reg();
+        }
+    }
+    return max_register;
+}
+
+void
+Trace::RestoreAffectedRegisters(RegExpMacroAssembler* assembler,
+                                int max_register,
+                                OutSet& registers_to_pop,
+                                OutSet& registers_to_clear)
+{
+    for (int reg = max_register; reg >= 0; reg--) {
+        if (registers_to_pop.Get(reg)) assembler->PopRegister(reg);
+        else if (registers_to_clear.Get(reg)) {
+            int clear_to = reg;
+            while (reg > 0 && registers_to_clear.Get(reg - 1))
+                reg--;
+            assembler->ClearRegisters(reg, clear_to);
+        }
+    }
+}
+
+enum DeferredActionUndoType {
+    DEFER_IGNORE,
+    DEFER_RESTORE,
+    DEFER_CLEAR
+};
+
+void
+Trace::PerformDeferredActions(LifoAlloc* alloc,
+                              RegExpMacroAssembler* assembler,
+                              int max_register,
+                              OutSet& affected_registers,
+                              OutSet* registers_to_pop,
+                              OutSet* registers_to_clear)
+{
+    // The "+1" is to avoid a push_limit of zero if stack_limit_slack() is 1.
+    const int push_limit = (assembler->stack_limit_slack() + 1) / 2;
+
+    // Count pushes performed to force a stack limit check occasionally.
+    int pushes = 0;
+
+    for (int reg = 0; reg <= max_register; reg++) {
+        if (!affected_registers.Get(reg))
+            continue;
+
+        // The chronologically first deferred action in the trace
+        // is used to infer the action needed to restore a register
+        // to its previous state (or not, if it's safe to ignore it).
+        DeferredActionUndoType undo_action = DEFER_IGNORE;
+
+        int value = 0;
+        bool absolute = false;
+        bool clear = false;
+        int store_position = -1;
+        // This is a little tricky because we are scanning the actions in reverse
+        // historical order (newest first).
+        for (DeferredAction* action = actions_;
+             action != nullptr;
+             action = action->next()) {
+            if (action->Mentions(reg)) {
+                switch (action->action_type()) {
+                  case ActionNode::SET_REGISTER: {
+                    Trace::DeferredSetRegister* psr =
+                        static_cast<Trace::DeferredSetRegister*>(action);
+                    if (!absolute) {
+                        value += psr->value();
+                        absolute = true;
+                    }
+                    // SET_REGISTER is currently only used for newly introduced loop
+                    // counters. They can have a significant previous value if they
+                    // occour in a loop. TODO(lrn): Propagate this information, so
+                    // we can set undo_action to IGNORE if we know there is no value to
+                    // restore.
+                    undo_action = DEFER_RESTORE;
+                    MOZ_ASSERT(store_position == -1);
+                    MOZ_ASSERT(!clear);
+                    break;
+                  }
+                  case ActionNode::INCREMENT_REGISTER:
+                    if (!absolute) {
+                        value++;
+                    }
+                    MOZ_ASSERT(store_position == -1);
+                    MOZ_ASSERT(!clear);
+                    undo_action = DEFER_RESTORE;
+                    break;
+                  case ActionNode::STORE_POSITION: {
+                    Trace::DeferredCapture* pc =
+                        static_cast<Trace::DeferredCapture*>(action);
+                    if (!clear && store_position == -1) {
+                        store_position = pc->cp_offset();
+                    }
+
+                    // For captures we know that stores and clears alternate.
+                    // Other register, are never cleared, and if the occur
+                    // inside a loop, they might be assigned more than once.
+                    if (reg <= 1) {
+                        // Registers zero and one, aka "capture zero", is
+                        // always set correctly if we succeed. There is no
+                        // need to undo a setting on backtrack, because we
+                        // will set it again or fail.
+                        undo_action = DEFER_IGNORE;
+                    } else {
+                        undo_action = pc->is_capture() ? DEFER_CLEAR : DEFER_RESTORE;
+                    }
+                    MOZ_ASSERT(!absolute);
+                    MOZ_ASSERT(value == 0);
+                    break;
+                  }
+                  case ActionNode::CLEAR_CAPTURES: {
+                    // Since we're scanning in reverse order, if we've already
+                    // set the position we have to ignore historically earlier
+                    // clearing operations.
+                    if (store_position == -1) {
+                        clear = true;
+                    }
+                    undo_action = DEFER_RESTORE;
+                    MOZ_ASSERT(!absolute);
+                    MOZ_ASSERT(value == 0);
+                    break;
+                  }
+                  default:
+                    MOZ_CRASH("Bad action");
+                }
+            }
+        }
+        // Prepare for the undo-action (e.g., push if it's going to be popped).
+        if (undo_action == DEFER_RESTORE) {
+            pushes++;
+            RegExpMacroAssembler::StackCheckFlag stack_check =
+                RegExpMacroAssembler::kNoStackLimitCheck;
+            if (pushes == push_limit) {
+                stack_check = RegExpMacroAssembler::kCheckStackLimit;
+                pushes = 0;
+            }
+
+            assembler->PushRegister(reg, stack_check);
+            registers_to_pop->Set(alloc, reg);
+        } else if (undo_action == DEFER_CLEAR) {
+            registers_to_clear->Set(alloc, reg);
+        }
+        // Perform the chronologically last action (or accumulated increment)
+        // for the register.
+        if (store_position != -1) {
+            assembler->WriteCurrentPositionToRegister(reg, store_position);
+        } else if (clear) {
+            assembler->ClearRegisters(reg, reg);
+        } else if (absolute) {
+            assembler->SetRegister(reg, value);
+        } else if (value != 0) {
+            assembler->AdvanceRegister(reg, value);
+        }
+    }
+}
+
+// This is called as we come into a loop choice node and some other tricky
+// nodes.  It normalizes the state of the code generator to ensure we can
+// generate generic code.
+void Trace::Flush(RegExpCompiler* compiler, RegExpNode* successor)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+
+    MOZ_ASSERT(!is_trivial());
+
+    if (actions_ == nullptr && backtrack() == nullptr) {
+        // Here we just have some deferred cp advances to fix and we are back to
+        // a normal situation.  We may also have to forget some information gained
+        // through a quick check that was already performed.
+        if (cp_offset_ != 0) assembler->AdvanceCurrentPosition(cp_offset_);
+        // Create a new trivial state and generate the node with that.
+        Trace new_state;
+        successor->Emit(compiler, &new_state);
+        return;
+    }
+
+    // Generate deferred actions here along with code to undo them again.
+    OutSet affected_registers;
+
+    if (backtrack() != nullptr) {
+        // Here we have a concrete backtrack location.  These are set up by choice
+        // nodes and so they indicate that we have a deferred save of the current
+        // position which we may need to emit here.
+        assembler->PushCurrentPosition();
+    }
+
+    int max_register = FindAffectedRegisters(compiler->alloc(), &affected_registers);
+    OutSet registers_to_pop;
+    OutSet registers_to_clear;
+    PerformDeferredActions(compiler->alloc(),
+                           assembler,
+                           max_register,
+                           affected_registers,
+                           &registers_to_pop,
+                           &registers_to_clear);
+    if (cp_offset_ != 0)
+        assembler->AdvanceCurrentPosition(cp_offset_);
+
+    // Create a new trivial state and generate the node with that.
+    jit::Label undo;
+    assembler->PushBacktrack(&undo);
+    Trace new_state;
+    successor->Emit(compiler, &new_state);
+
+    // On backtrack we need to restore state.
+    assembler->BindBacktrack(&undo);
+    RestoreAffectedRegisters(assembler,
+                             max_register,
+                             registers_to_pop,
+                             registers_to_clear);
+    if (backtrack() == nullptr) {
+        assembler->Backtrack();
+    } else {
+        assembler->PopCurrentPosition();
+        assembler->JumpOrBacktrack(backtrack());
+    }
+}
+
+void
+Trace::InvalidateCurrentCharacter()
+{
+    characters_preloaded_ = 0;
+}
+
+void
+Trace::AdvanceCurrentPositionInTrace(int by, RegExpCompiler* compiler)
+{
+    MOZ_ASSERT(by > 0);
+    // We don't have an instruction for shifting the current character register
+    // down or for using a shifted value for anything so lets just forget that
+    // we preloaded any characters into it.
+    characters_preloaded_ = 0;
+    // Adjust the offsets of the quick check performed information.  This
+    // information is used to find out what we already determined about the
+    // characters by means of mask and compare.
+    quick_check_performed_.Advance(by, compiler->ascii());
+    cp_offset_ += by;
+    if (cp_offset_ > RegExpMacroAssembler::kMaxCPOffset) {
+        compiler->SetRegExpTooBig();
+        cp_offset_ = 0;
+    }
+    bound_checked_up_to_ = Max(0, bound_checked_up_to_ - by);
+}
+
+void
+OutSet::Set(LifoAlloc* alloc, unsigned value)
+{
+    if (value < kFirstLimit) {
+        first_ |= (1 << value);
+    } else {
+        if (remaining_ == nullptr)
+            remaining_ = alloc->newInfallible<RemainingVector>(*alloc);
+
+        for (size_t i = 0; i < remaining().length(); i++) {
+            if (remaining()[i] == value)
+                return;
+        }
+        remaining().append(value);
+    }
+}
+
+bool
+OutSet::Get(unsigned value)
+{
+    if (value < kFirstLimit)
+        return (first_ & (1 << value)) != 0;
+    if (remaining_ == nullptr)
+        return false;
+    for (size_t i = 0; i < remaining().length(); i++) {
+        if (remaining()[i] == value)
+            return true;
+    }
+    return false;
+}
+
+// -------------------------------------------------------------------
+// Graph emitting
+
+void
+NegativeSubmatchSuccess::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+
+    // Omit flushing the trace. We discard the entire stack frame anyway.
+
+    if (!label()->bound()) {
+        // We are completely independent of the trace, since we ignore it,
+        // so this code can be used as the generic version.
+        assembler->Bind(label());
+    }
+
+    // Throw away everything on the backtrack stack since the start
+    // of the negative submatch and restore the character position.
+    assembler->ReadCurrentPositionFromRegister(current_position_register_);
+    assembler->ReadBacktrackStackPointerFromRegister(stack_pointer_register_);
+
+    if (clear_capture_count_ > 0) {
+        // Clear any captures that might have been performed during the success
+        // of the body of the negative look-ahead.
+        int clear_capture_end = clear_capture_start_ + clear_capture_count_ - 1;
+        assembler->ClearRegisters(clear_capture_start_, clear_capture_end);
+    }
+
+    // Now that we have unwound the stack we find at the top of the stack the
+    // backtrack that the BeginSubmatch node got.
+    assembler->Backtrack();
+}
+
+void
+EndNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    if (!trace->is_trivial()) {
+        trace->Flush(compiler, this);
+        return;
+    }
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    if (!label()->bound()) {
+        assembler->Bind(label());
+    }
+    switch (action_) {
+    case ACCEPT:
+        assembler->Succeed();
+        return;
+    case BACKTRACK:
+        assembler->JumpOrBacktrack(trace->backtrack());
+        return;
+    case NEGATIVE_SUBMATCH_SUCCESS:
+        // This case is handled in a different virtual method.
+        MOZ_CRASH("Bad action: NEGATIVE_SUBMATCH_SUCCESS");
+    }
+    MOZ_CRASH("Bad action");
+}
+
+// Emit the code to check for a ^ in multiline mode (1-character lookbehind
+// that matches newline or the start of input).
+static void
+EmitHat(RegExpCompiler* compiler, RegExpNode* on_success, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+
+    // We will be loading the previous character into the current character
+    // register.
+    Trace new_trace(*trace);
+    new_trace.InvalidateCurrentCharacter();
+
+    jit::Label ok;
+    if (new_trace.cp_offset() == 0) {
+        // The start of input counts as a newline in this context, so skip to
+        // ok if we are at the start.
+        assembler->CheckAtStart(&ok);
+    }
+
+    // We already checked that we are not at the start of input so it must be
+    // OK to load the previous character.
+    assembler->LoadCurrentCharacter(new_trace.cp_offset() -1, new_trace.backtrack(), false);
+
+    if (!assembler->CheckSpecialCharacterClass('n', new_trace.backtrack())) {
+        // Newline means \n, \r, 0x2028 or 0x2029.
+        if (!compiler->ascii())
+            assembler->CheckCharacterAfterAnd(0x2028, 0xfffe, &ok);
+        assembler->CheckCharacter('\n', &ok);
+        assembler->CheckNotCharacter('\r', new_trace.backtrack());
+    }
+    assembler->Bind(&ok);
+    on_success->Emit(compiler, &new_trace);
+}
+
+// Assert that the next character cannot be a part of a surrogate pair.
+static void
+EmitNotAfterLeadSurrogate(RegExpCompiler* compiler, RegExpNode* on_success, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+
+    // We will be loading the previous character into the current character
+    // register.
+    Trace new_trace(*trace);
+    new_trace.InvalidateCurrentCharacter();
+
+    jit::Label ok;
+    if (new_trace.cp_offset() == 0)
+        assembler->CheckAtStart(&ok);
+
+    // We already checked that we are not at the start of input so it must be
+    // OK to load the previous character.
+    assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, new_trace.backtrack(), false);
+    assembler->CheckCharacterInRange(unicode::LeadSurrogateMin, unicode::LeadSurrogateMax,
+                                     new_trace.backtrack());
+
+    assembler->Bind(&ok);
+    on_success->Emit(compiler, &new_trace);
+}
+
+// Assert that the next character is not a trail surrogate that has a
+// corresponding lead surrogate.
+static void
+EmitNotInSurrogatePair(RegExpCompiler* compiler, RegExpNode* on_success, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+
+    jit::Label ok;
+    assembler->CheckPosition(trace->cp_offset(), &ok);
+
+    // We will be loading the next and previous characters into the current
+    // character register.
+    Trace new_trace(*trace);
+    new_trace.InvalidateCurrentCharacter();
+
+    if (new_trace.cp_offset() == 0)
+        assembler->CheckAtStart(&ok);
+
+    // First check if next character is a trail surrogate.
+    assembler->LoadCurrentCharacter(new_trace.cp_offset(), new_trace.backtrack(), false);
+    assembler->CheckCharacterNotInRange(unicode::TrailSurrogateMin, unicode::TrailSurrogateMax,
+                                        &ok);
+
+    // Next check if previous character is a lead surrogate.
+    // We already checked that we are not at the start of input so it must be
+    // OK to load the previous character.
+    assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, new_trace.backtrack(), false);
+    assembler->CheckCharacterInRange(unicode::LeadSurrogateMin, unicode::LeadSurrogateMax,
+                                     new_trace.backtrack());
+
+    assembler->Bind(&ok);
+    on_success->Emit(compiler, &new_trace);
+}
+
+// Check for [0-9A-Z_a-z].
+static void
+EmitWordCheck(RegExpMacroAssembler* assembler,
+              jit::Label* word, jit::Label* non_word, bool fall_through_on_word)
+{
+    if (assembler->CheckSpecialCharacterClass(fall_through_on_word ? 'w' : 'W',
+                                              fall_through_on_word ? non_word : word))
+    {
+        // Optimized implementation available.
+        return;
+    }
+
+    assembler->CheckCharacterGT('z', non_word);
+    assembler->CheckCharacterLT('0', non_word);
+    assembler->CheckCharacterGT('a' - 1, word);
+    assembler->CheckCharacterLT('9' + 1, word);
+    assembler->CheckCharacterLT('A', non_word);
+    assembler->CheckCharacterLT('Z' + 1, word);
+
+    if (fall_through_on_word)
+        assembler->CheckNotCharacter('_', non_word);
+    else
+        assembler->CheckCharacter('_', word);
+}
+
+// Emit the code to handle \b and \B (word-boundary or non-word-boundary).
+void
+AssertionNode::EmitBoundaryCheck(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    Trace::TriBool next_is_word_character = Trace::UNKNOWN;
+    bool not_at_start = (trace->at_start() == Trace::FALSE_VALUE);
+    BoyerMooreLookahead* lookahead = bm_info(not_at_start);
+    if (lookahead == nullptr) {
+        int eats_at_least =
+            Min(kMaxLookaheadForBoyerMoore, EatsAtLeast(kMaxLookaheadForBoyerMoore,
+                                                        kRecursionBudget,
+                                                        not_at_start));
+        if (eats_at_least >= 1) {
+            BoyerMooreLookahead* bm =
+                alloc()->newInfallible<BoyerMooreLookahead>(alloc(), eats_at_least, compiler);
+            FillInBMInfo(0, kRecursionBudget, bm, not_at_start);
+            if (bm->at(0)->is_non_word())
+                next_is_word_character = Trace::FALSE_VALUE;
+            if (bm->at(0)->is_word()) next_is_word_character = Trace::TRUE_VALUE;
+        }
+    } else {
+        if (lookahead->at(0)->is_non_word())
+            next_is_word_character = Trace::FALSE_VALUE;
+        if (lookahead->at(0)->is_word())
+            next_is_word_character = Trace::TRUE_VALUE;
+    }
+    bool at_boundary = (assertion_type_ == AssertionNode::AT_BOUNDARY);
+    if (next_is_word_character == Trace::UNKNOWN) {
+        jit::Label before_non_word;
+        jit::Label before_word;
+        if (trace->characters_preloaded() != 1) {
+            assembler->LoadCurrentCharacter(trace->cp_offset(), &before_non_word);
+        }
+        // Fall through on non-word.
+        EmitWordCheck(assembler, &before_word, &before_non_word, false);
+        // Next character is not a word character.
+        assembler->Bind(&before_non_word);
+        jit::Label ok;
+        BacktrackIfPrevious(compiler, trace, at_boundary ? kIsNonWord : kIsWord);
+        assembler->JumpOrBacktrack(&ok);
+
+        assembler->Bind(&before_word);
+        BacktrackIfPrevious(compiler, trace, at_boundary ? kIsWord : kIsNonWord);
+        assembler->Bind(&ok);
+    } else if (next_is_word_character == Trace::TRUE_VALUE) {
+        BacktrackIfPrevious(compiler, trace, at_boundary ? kIsWord : kIsNonWord);
+    } else {
+        MOZ_ASSERT(next_is_word_character == Trace::FALSE_VALUE);
+        BacktrackIfPrevious(compiler, trace, at_boundary ? kIsNonWord : kIsWord);
+    }
+}
+
+void
+AssertionNode::BacktrackIfPrevious(RegExpCompiler* compiler,
+                                   Trace* trace,
+                                   AssertionNode::IfPrevious backtrack_if_previous)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    Trace new_trace(*trace);
+    new_trace.InvalidateCurrentCharacter();
+
+    jit::Label fall_through, dummy;
+
+    jit::Label* non_word = backtrack_if_previous == kIsNonWord ? new_trace.backtrack() : &fall_through;
+    jit::Label* word     = backtrack_if_previous == kIsNonWord ? &fall_through : new_trace.backtrack();
+
+    if (new_trace.cp_offset() == 0) {
+        // The start of input counts as a non-word character, so the question is
+        // decided if we are at the start.
+        assembler->CheckAtStart(non_word);
+    }
+    // We already checked that we are not at the start of input so it must be
+    // OK to load the previous character.
+    assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, &dummy, false);
+    EmitWordCheck(assembler, word, non_word, backtrack_if_previous == kIsNonWord);
+
+    assembler->Bind(&fall_through);
+    on_success()->Emit(compiler, &new_trace);
+}
+
+void
+AssertionNode::GetQuickCheckDetails(QuickCheckDetails* details,
+                                    RegExpCompiler* compiler,
+                                    int filled_in,
+                                    bool not_at_start)
+{
+    if (assertion_type_ == AT_START && not_at_start) {
+        details->set_cannot_match();
+        return;
+    }
+    return on_success()->GetQuickCheckDetails(details, compiler, filled_in, not_at_start);
+}
+
+void
+AssertionNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    switch (assertion_type_) {
+      case AT_END: {
+        jit::Label ok;
+        assembler->CheckPosition(trace->cp_offset(), &ok);
+        assembler->JumpOrBacktrack(trace->backtrack());
+        assembler->Bind(&ok);
+        break;
+      }
+      case AT_START: {
+        if (trace->at_start() == Trace::FALSE_VALUE) {
+            assembler->JumpOrBacktrack(trace->backtrack());
+            return;
+        }
+        if (trace->at_start() == Trace::UNKNOWN) {
+            assembler->CheckNotAtStart(trace->backtrack());
+            Trace at_start_trace = *trace;
+            at_start_trace.set_at_start(true);
+            on_success()->Emit(compiler, &at_start_trace);
+            return;
+        }
+      }
+        break;
+      case AFTER_NEWLINE:
+        EmitHat(compiler, on_success(), trace);
+        return;
+      case AT_BOUNDARY:
+      case AT_NON_BOUNDARY: {
+        EmitBoundaryCheck(compiler, trace);
+        return;
+      }
+      case NOT_AFTER_LEAD_SURROGATE:
+        EmitNotAfterLeadSurrogate(compiler, on_success(), trace);
+        return;
+      case NOT_IN_SURROGATE_PAIR:
+        EmitNotInSurrogatePair(compiler, on_success(), trace);
+        return;
+    }
+    on_success()->Emit(compiler, trace);
+}
+
+static bool
+DeterminedAlready(QuickCheckDetails* quick_check, int offset)
+{
+    if (quick_check == nullptr)
+        return false;
+    if (offset >= quick_check->characters())
+        return false;
+    return quick_check->positions(offset)->determines_perfectly;
+}
+
+static void
+UpdateBoundsCheck(int index, int* checked_up_to)
+{
+    if (index > *checked_up_to)
+        *checked_up_to = index;
+}
+
+static void
+EmitBoundaryTest(RegExpMacroAssembler* masm,
+                 int border,
+                 jit::Label* fall_through,
+                 jit::Label* above_or_equal,
+                 jit::Label* below)
+{
+    if (below != fall_through) {
+        masm->CheckCharacterLT(border, below);
+        if (above_or_equal != fall_through)
+            masm->JumpOrBacktrack(above_or_equal);
+    } else {
+        masm->CheckCharacterGT(border - 1, above_or_equal);
+    }
+}
+
+static void
+EmitDoubleBoundaryTest(RegExpMacroAssembler* masm,
+                       int first,
+                       int last,
+                       jit::Label* fall_through,
+                       jit::Label* in_range,
+                       jit::Label* out_of_range)
+{
+    if (in_range == fall_through) {
+        if (first == last)
+            masm->CheckNotCharacter(first, out_of_range);
+        else
+            masm->CheckCharacterNotInRange(first, last, out_of_range);
+    } else {
+        if (first == last)
+            masm->CheckCharacter(first, in_range);
+        else
+            masm->CheckCharacterInRange(first, last, in_range);
+        if (out_of_range != fall_through)
+            masm->JumpOrBacktrack(out_of_range);
+    }
+}
+
+typedef InfallibleVector<int, 4> RangeBoundaryVector;
+
+// even_label is for ranges[i] to ranges[i + 1] where i - start_index is even.
+// odd_label is for ranges[i] to ranges[i + 1] where i - start_index is odd.
+static void
+EmitUseLookupTable(RegExpMacroAssembler* masm,
+                   RangeBoundaryVector& ranges,
+                   int start_index,
+                   int end_index,
+                   int min_char,
+                   jit::Label* fall_through,
+                   jit::Label* even_label,
+                   jit::Label* odd_label)
+{
+    static const int kSize = RegExpMacroAssembler::kTableSize;
+    static const int kMask = RegExpMacroAssembler::kTableMask;
+
+    DebugOnly<int> base = (min_char & ~kMask);
+
+    // Assert that everything is on one kTableSize page.
+    for (int i = start_index; i <= end_index; i++)
+        MOZ_ASSERT((ranges[i] & ~kMask) == base);
+    MOZ_ASSERT(start_index == 0 || (ranges[start_index - 1] & ~kMask) <= base);
+
+    char templ[kSize];
+    jit::Label* on_bit_set;
+    jit::Label* on_bit_clear;
+    int bit;
+    if (even_label == fall_through) {
+        on_bit_set = odd_label;
+        on_bit_clear = even_label;
+        bit = 1;
+    } else {
+        on_bit_set = even_label;
+        on_bit_clear = odd_label;
+        bit = 0;
+    }
+    for (int i = 0; i < (ranges[start_index] & kMask) && i < kSize; i++)
+        templ[i] = bit;
+    int j = 0;
+    bit ^= 1;
+    for (int i = start_index; i < end_index; i++) {
+        for (j = (ranges[i] & kMask); j < (ranges[i + 1] & kMask); j++) {
+            templ[j] = bit;
+        }
+        bit ^= 1;
+    }
+    for (int i = j; i < kSize; i++) {
+        templ[i] = bit;
+    }
+
+    // TODO(erikcorry): Cache these.
+    uint8_t* ba;
+    {
+        AutoEnterOOMUnsafeRegion oomUnsafe;
+        ba = static_cast<uint8_t*>(js_malloc(kSize));
+        if (!ba || !masm->shared->addTable(ba))
+            oomUnsafe.crash("Table malloc");
+    }
+
+    for (int i = 0; i < kSize; i++)
+        ba[i] = templ[i];
+
+    masm->CheckBitInTable(ba, on_bit_set);
+    if (on_bit_clear != fall_through)
+        masm->JumpOrBacktrack(on_bit_clear);
+}
+
+static void
+CutOutRange(RegExpMacroAssembler* masm,
+            RangeBoundaryVector& ranges,
+            int start_index,
+            int end_index,
+            int cut_index,
+            jit::Label* even_label,
+            jit::Label* odd_label)
+{
+    bool odd = (((cut_index - start_index) & 1) == 1);
+    jit::Label* in_range_label = odd ? odd_label : even_label;
+    jit::Label dummy;
+    EmitDoubleBoundaryTest(masm,
+                           ranges[cut_index],
+                           ranges[cut_index + 1] - 1,
+                           &dummy,
+                           in_range_label,
+                           &dummy);
+    MOZ_ASSERT(!dummy.used());
+    // Cut out the single range by rewriting the array.  This creates a new
+    // range that is a merger of the two ranges on either side of the one we
+    // are cutting out.  The oddity of the labels is preserved.
+    for (int j = cut_index; j > start_index; j--)
+        ranges[j] = ranges[j - 1];
+    for (int j = cut_index + 1; j < end_index; j++)
+        ranges[j] = ranges[j + 1];
+}
+
+// Unicode case.  Split the search space into kSize spaces that are handled
+// with recursion.
+static void
+SplitSearchSpace(RangeBoundaryVector& ranges,
+                 int start_index,
+                 int end_index,
+                 int* new_start_index,
+                 int* new_end_index,
+                 int* border)
+{
+    static const int kSize = RegExpMacroAssembler::kTableSize;
+    static const int kMask = RegExpMacroAssembler::kTableMask;
+
+    int first = ranges[start_index];
+    int last = ranges[end_index] - 1;
+
+    *new_start_index = start_index;
+    *border = (ranges[start_index] & ~kMask) + kSize;
+    while (*new_start_index < end_index) {
+        if (ranges[*new_start_index] > *border)
+            break;
+        (*new_start_index)++;
+    }
+    // new_start_index is the index of the first edge that is beyond the
+    // current kSize space.
+
+    // For very large search spaces we do a binary chop search of the non-ASCII
+    // space instead of just going to the end of the current kSize space.  The
+    // heuristics are complicated a little by the fact that any 128-character
+    // encoding space can be quickly tested with a table lookup, so we don't
+    // wish to do binary chop search at a smaller granularity than that.  A
+    // 128-character space can take up a lot of space in the ranges array if,
+    // for example, we only want to match every second character (eg. the lower
+    // case characters on some Unicode pages).
+    int binary_chop_index = (end_index + start_index) / 2;
+    // The first test ensures that we get to the code that handles the ASCII
+    // range with a single not-taken branch, speeding up this important
+    // character range (even non-ASCII charset-based text has spaces and
+    // punctuation).
+    if (*border - 1 > kMaxOneByteCharCode &&  // ASCII case.
+        end_index - start_index > (*new_start_index - start_index) * 2 &&
+        last - first > kSize * 2 &&
+        binary_chop_index > *new_start_index &&
+        ranges[binary_chop_index] >= first + 2 * kSize)
+    {
+        int scan_forward_for_section_border = binary_chop_index;;
+        int new_border = (ranges[binary_chop_index] | kMask) + 1;
+
+        while (scan_forward_for_section_border < end_index) {
+            if (ranges[scan_forward_for_section_border] > new_border) {
+                *new_start_index = scan_forward_for_section_border;
+                *border = new_border;
+                break;
+            }
+            scan_forward_for_section_border++;
+        }
+    }
+
+    MOZ_ASSERT(*new_start_index > start_index);
+    *new_end_index = *new_start_index - 1;
+    if (ranges[*new_end_index] == *border)
+        (*new_end_index)--;
+    if (*border >= ranges[end_index]) {
+        *border = ranges[end_index];
+        *new_start_index = end_index;  // Won't be used.
+        *new_end_index = end_index - 1;
+    }
+}
+
+// Gets a series of segment boundaries representing a character class.  If the
+// character is in the range between an even and an odd boundary (counting from
+// start_index) then go to even_label, otherwise go to odd_label.  We already
+// know that the character is in the range of min_char to max_char inclusive.
+// Either label can be nullptr indicating backtracking.  Either label can also be
+// equal to the fall_through label.
+static void
+GenerateBranches(RegExpMacroAssembler* masm,
+                 RangeBoundaryVector& ranges,
+                 int start_index,
+                 int end_index,
+                 char16_t min_char,
+                 char16_t max_char,
+                 jit::Label* fall_through,
+                 jit::Label* even_label,
+                 jit::Label* odd_label)
+{
+    int first = ranges[start_index];
+    int last = ranges[end_index] - 1;
+
+    MOZ_ASSERT(min_char < first);
+
+    // Just need to test if the character is before or on-or-after
+    // a particular character.
+    if (start_index == end_index) {
+        EmitBoundaryTest(masm, first, fall_through, even_label, odd_label);
+        return;
+    }
+
+    // Another almost trivial case:  There is one interval in the middle that is
+    // different from the end intervals.
+    if (start_index + 1 == end_index) {
+        EmitDoubleBoundaryTest(masm, first, last, fall_through, even_label, odd_label);
+        return;
+    }
+
+    // It's not worth using table lookup if there are very few intervals in the
+    // character class.
+    if (end_index - start_index <= 6) {
+        // It is faster to test for individual characters, so we look for those
+        // first, then try arbitrary ranges in the second round.
+        static int kNoCutIndex = -1;
+        int cut = kNoCutIndex;
+        for (int i = start_index; i < end_index; i++) {
+            if (ranges[i] == ranges[i + 1] - 1) {
+                cut = i;
+                break;
+            }
+        }
+        if (cut == kNoCutIndex) cut = start_index;
+        CutOutRange(masm, ranges, start_index, end_index, cut, even_label, odd_label);
+        MOZ_ASSERT(end_index - start_index >= 2);
+        GenerateBranches(masm,
+                         ranges,
+                         start_index + 1,
+                         end_index - 1,
+                         min_char,
+                         max_char,
+                         fall_through,
+                         even_label,
+                         odd_label);
+        return;
+    }
+
+    // If there are a lot of intervals in the regexp, then we will use tables to
+    // determine whether the character is inside or outside the character class.
+    static const int kBits = RegExpMacroAssembler::kTableSizeBits;
+
+    if ((max_char >> kBits) == (min_char >> kBits)) {
+        EmitUseLookupTable(masm,
+                           ranges,
+                           start_index,
+                           end_index,
+                           min_char,
+                           fall_through,
+                           even_label,
+                           odd_label);
+        return;
+    }
+
+    if ((min_char >> kBits) != (first >> kBits)) {
+        masm->CheckCharacterLT(first, odd_label);
+        GenerateBranches(masm,
+                         ranges,
+                         start_index + 1,
+                         end_index,
+                         first,
+                         max_char,
+                         fall_through,
+                         odd_label,
+                         even_label);
+        return;
+    }
+
+    int new_start_index = 0;
+    int new_end_index = 0;
+    int border = 0;
+
+    SplitSearchSpace(ranges,
+                     start_index,
+                     end_index,
+                     &new_start_index,
+                     &new_end_index,
+                     &border);
+
+    jit::Label handle_rest;
+    jit::Label* above = &handle_rest;
+    if (border == last + 1) {
+        // We didn't find any section that started after the limit, so everything
+        // above the border is one of the terminal labels.
+        above = (end_index & 1) != (start_index & 1) ? odd_label : even_label;
+        MOZ_ASSERT(new_end_index == end_index - 1);
+    }
+
+    MOZ_ASSERT(start_index <= new_end_index);
+    MOZ_ASSERT(new_start_index <= end_index);
+    MOZ_ASSERT(start_index < new_start_index);
+    MOZ_ASSERT(new_end_index < end_index);
+    MOZ_ASSERT(new_end_index + 1 == new_start_index ||
+               (new_end_index + 2 == new_start_index &&
+                border == ranges[new_end_index + 1]));
+    MOZ_ASSERT(min_char < border - 1);
+    MOZ_ASSERT(border < max_char);
+    MOZ_ASSERT(ranges[new_end_index] < border);
+    MOZ_ASSERT(border < ranges[new_start_index] ||
+               (border == ranges[new_start_index] &&
+                new_start_index == end_index &&
+                new_end_index == end_index - 1 &&
+                border == last + 1));
+    MOZ_ASSERT(new_start_index == 0 || border >= ranges[new_start_index - 1]);
+
+    masm->CheckCharacterGT(border - 1, above);
+    jit::Label dummy;
+    GenerateBranches(masm,
+                     ranges,
+                     start_index,
+                     new_end_index,
+                     min_char,
+                     border - 1,
+                     &dummy,
+                     even_label,
+                     odd_label);
+    if (handle_rest.used()) {
+        masm->Bind(&handle_rest);
+        bool flip = (new_start_index & 1) != (start_index & 1);
+        GenerateBranches(masm,
+                         ranges,
+                         new_start_index,
+                         end_index,
+                         border,
+                         max_char,
+                         &dummy,
+                         flip ? odd_label : even_label,
+                         flip ? even_label : odd_label);
+    }
+}
+
+static void
+EmitCharClass(LifoAlloc* alloc,
+              RegExpMacroAssembler* macro_assembler,
+              RegExpCharacterClass* cc,
+              bool ascii,
+              jit::Label* on_failure,
+              int cp_offset,
+              bool check_offset,
+              bool preloaded)
+{
+    CharacterRangeVector& ranges = cc->ranges(alloc);
+    if (!CharacterRange::IsCanonical(ranges)) {
+        CharacterRange::Canonicalize(ranges);
+    }
+
+    int max_char = MaximumCharacter(ascii);
+    int range_count = ranges.length();
+
+    int last_valid_range = range_count - 1;
+    while (last_valid_range >= 0) {
+        CharacterRange& range = ranges[last_valid_range];
+        if (range.from() <= max_char) {
+            break;
+        }
+        last_valid_range--;
+    }
+
+    if (last_valid_range < 0) {
+        if (!cc->is_negated()) {
+            macro_assembler->JumpOrBacktrack(on_failure);
+        }
+        if (check_offset) {
+            macro_assembler->CheckPosition(cp_offset, on_failure);
+        }
+        return;
+    }
+
+    if (last_valid_range == 0 &&
+        ranges[0].IsEverything(max_char)) {
+        if (cc->is_negated()) {
+            macro_assembler->JumpOrBacktrack(on_failure);
+        } else {
+            // This is a common case hit by non-anchored expressions.
+            if (check_offset) {
+                macro_assembler->CheckPosition(cp_offset, on_failure);
+            }
+        }
+        return;
+    }
+    if (last_valid_range == 0 &&
+        !cc->is_negated() &&
+        ranges[0].IsEverything(max_char)) {
+        // This is a common case hit by non-anchored expressions.
+        if (check_offset) {
+            macro_assembler->CheckPosition(cp_offset, on_failure);
+        }
+        return;
+    }
+
+    if (!preloaded) {
+        macro_assembler->LoadCurrentCharacter(cp_offset, on_failure, check_offset);
+    }
+
+    if (cc->is_standard(alloc) &&
+        macro_assembler->CheckSpecialCharacterClass(cc->standard_type(),
+                                                    on_failure)) {
+        return;
+    }
+
+    // A new list with ascending entries.  Each entry is a code unit
+    // where there is a boundary between code units that are part of
+    // the class and code units that are not.  Normally we insert an
+    // entry at zero which goes to the failure label, but if there
+    // was already one there we fall through for success on that entry.
+    // Subsequent entries have alternating meaning (success/failure).
+    RangeBoundaryVector* range_boundaries =
+        alloc->newInfallible<RangeBoundaryVector>(*alloc);
+
+    bool zeroth_entry_is_failure = !cc->is_negated();
+
+    range_boundaries->reserve(last_valid_range);
+    for (int i = 0; i <= last_valid_range; i++) {
+        CharacterRange& range = ranges[i];
+        if (range.from() == 0) {
+            MOZ_ASSERT(i == 0);
+            zeroth_entry_is_failure = !zeroth_entry_is_failure;
+        } else {
+            range_boundaries->append(range.from());
+        }
+        range_boundaries->append(range.to() + 1);
+    }
+    int end_index = range_boundaries->length() - 1;
+    if ((*range_boundaries)[end_index] > max_char)
+        end_index--;
+
+    jit::Label fall_through;
+    GenerateBranches(macro_assembler,
+                     *range_boundaries,
+                     0,  // start_index.
+                     end_index,
+                     0,  // min_char.
+                     max_char,
+                     &fall_through,
+                     zeroth_entry_is_failure ? &fall_through : on_failure,
+                     zeroth_entry_is_failure ? on_failure : &fall_through);
+    macro_assembler->Bind(&fall_through);
+}
+
+typedef bool EmitCharacterFunction(RegExpCompiler* compiler,
+                                   char16_t c,
+                                   jit::Label* on_failure,
+                                   int cp_offset,
+                                   bool check,
+                                   bool preloaded);
+
+static inline bool
+EmitSimpleCharacter(RegExpCompiler* compiler,
+                    char16_t c,
+                    jit::Label* on_failure,
+                    int cp_offset,
+                    bool check,
+                    bool preloaded)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    bool bound_checked = false;
+    if (!preloaded) {
+        assembler->LoadCurrentCharacter(cp_offset, on_failure, check);
+        bound_checked = true;
+    }
+    assembler->CheckNotCharacter(c, on_failure);
+    return bound_checked;
+}
+
+// Only emits non-letters (things that don't have case).  Only used for case
+// independent matches.
+static inline bool
+EmitAtomNonLetter(RegExpCompiler* compiler,
+                  char16_t c,
+                  jit::Label* on_failure,
+                  int cp_offset,
+                  bool check,
+                  bool preloaded)
+{
+    RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
+    bool ascii = compiler->ascii();
+    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
+    int length = GetCaseIndependentLetters(c, ascii, compiler->unicode(), chars);
+    if (length < 1) {
+        // This can't match.  Must be an ASCII subject and a non-ASCII character.
+        // We do not need to do anything since the ASCII pass already handled this.
+        return false;  // Bounds not checked.
+    }
+    bool checked = false;
+    // We handle the length > 1 case in a later pass.
+    if (length == 1) {
+        if (ascii && c > kMaxOneByteCharCode) {
+            // Can't match - see above.
+            return false;  // Bounds not checked.
+        }
+        if (!preloaded) {
+            macro_assembler->LoadCurrentCharacter(cp_offset, on_failure, check);
+            checked = check;
+        }
+        macro_assembler->CheckNotCharacter(c, on_failure);
+    }
+    return checked;
+}
+
+static bool
+ShortCutEmitCharacterPair(RegExpMacroAssembler* macro_assembler,
+                          bool ascii,
+                          char16_t c1,
+                          char16_t c2,
+                          jit::Label* on_failure)
+{
+    char16_t char_mask = MaximumCharacter(ascii);
+
+    MOZ_ASSERT(c1 != c2);
+    if (c1 > c2) {
+        char16_t tmp = c1;
+        c1 = c2;
+        c2 = tmp;
+    }
+
+    char16_t exor = c1 ^ c2;
+    // Check whether exor has only one bit set.
+    if (((exor - 1) & exor) == 0) {
+        // If c1 and c2 differ only by one bit.
+        char16_t mask = char_mask ^ exor;
+        macro_assembler->CheckNotCharacterAfterAnd(c1, mask, on_failure);
+        return true;
+    }
+
+    char16_t diff = c2 - c1;
+    if (((diff - 1) & diff) == 0 && c1 >= diff) {
+        // If the characters differ by 2^n but don't differ by one bit then
+        // subtract the difference from the found character, then do the or
+        // trick.  We avoid the theoretical case where negative numbers are
+        // involved in order to simplify code generation.
+        char16_t mask = char_mask ^ diff;
+        macro_assembler->CheckNotCharacterAfterMinusAnd(c1 - diff,
+                                                        diff,
+                                                        mask,
+                                                        on_failure);
+        return true;
+    }
+    return false;
+}
+
+// Only emits letters (things that have case).  Only used for case independent
+// matches.
+static inline bool
+EmitAtomLetter(RegExpCompiler* compiler,
+               char16_t c,
+               jit::Label* on_failure,
+               int cp_offset,
+               bool check,
+               bool preloaded)
+{
+    RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
+    bool ascii = compiler->ascii();
+    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
+    int length = GetCaseIndependentLetters(c, ascii, compiler->unicode(), chars);
+    if (length <= 1) return false;
+    // We may not need to check against the end of the input string
+    // if this character lies before a character that matched.
+    if (!preloaded)
+        macro_assembler->LoadCurrentCharacter(cp_offset, on_failure, check);
+    jit::Label ok;
+    MOZ_ASSERT(kEcma262UnCanonicalizeMaxWidth == 4);
+    switch (length) {
+      case 2: {
+        if (ShortCutEmitCharacterPair(macro_assembler,
+                                      ascii,
+                                      chars[0],
+                                      chars[1],
+                                      on_failure)) {
+        } else {
+            macro_assembler->CheckCharacter(chars[0], &ok);
+            macro_assembler->CheckNotCharacter(chars[1], on_failure);
+            macro_assembler->Bind(&ok);
+        }
+        break;
+      }
+      case 4:
+        macro_assembler->CheckCharacter(chars[3], &ok);
+        MOZ_FALLTHROUGH;
+      case 3:
+        macro_assembler->CheckCharacter(chars[0], &ok);
+        macro_assembler->CheckCharacter(chars[1], &ok);
+        macro_assembler->CheckNotCharacter(chars[2], on_failure);
+        macro_assembler->Bind(&ok);
+        break;
+      default:
+        MOZ_CRASH("Bad length");
+    }
+    return true;
+}
+
+// We call this repeatedly to generate code for each pass over the text node.
+// The passes are in increasing order of difficulty because we hope one
+// of the first passes will fail in which case we are saved the work of the
+// later passes.  for example for the case independent regexp /%[asdfghjkl]a/
+// we will check the '%' in the first pass, the case independent 'a' in the
+// second pass and the character class in the last pass.
+//
+// The passes are done from right to left, so for example to test for /bar/
+// we will first test for an 'r' with offset 2, then an 'a' with offset 1
+// and then a 'b' with offset 0.  This means we can avoid the end-of-input
+// bounds check most of the time.  In the example we only need to check for
+// end-of-input when loading the putative 'r'.
+//
+// A slight complication involves the fact that the first character may already
+// be fetched into a register by the previous node.  In this case we want to
+// do the test for that character first.  We do this in separate passes.  The
+// 'preloaded' argument indicates that we are doing such a 'pass'.  If such a
+// pass has been performed then subsequent passes will have true in
+// first_element_checked to indicate that that character does not need to be
+// checked again.
+//
+// In addition to all this we are passed a Trace, which can
+// contain an AlternativeGeneration object.  In this AlternativeGeneration
+// object we can see details of any quick check that was already passed in
+// order to get to the code we are now generating.  The quick check can involve
+// loading characters, which means we do not need to recheck the bounds
+// up to the limit the quick check already checked.  In addition the quick
+// check can have involved a mask and compare operation which may simplify
+// or obviate the need for further checks at some character positions.
+void
+TextNode::TextEmitPass(RegExpCompiler* compiler,
+                       TextEmitPassType pass,
+                       bool preloaded,
+                       Trace* trace,
+                       bool first_element_checked,
+                       int* checked_up_to)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    bool ascii = compiler->ascii();
+    jit::Label* backtrack = trace->backtrack();
+    QuickCheckDetails* quick_check = trace->quick_check_performed();
+    int element_count = elements().length();
+    for (int i = preloaded ? 0 : element_count - 1; i >= 0; i--) {
+        TextElement elm = elements()[i];
+        int cp_offset = trace->cp_offset() + elm.cp_offset();
+        if (elm.text_type() == TextElement::ATOM) {
+            const CharacterVector& quarks = elm.atom()->data();
+            for (int j = preloaded ? 0 : quarks.length() - 1; j >= 0; j--) {
+                if (first_element_checked && i == 0 && j == 0) continue;
+                if (DeterminedAlready(quick_check, elm.cp_offset() + j)) continue;
+                EmitCharacterFunction* emit_function = nullptr;
+                switch (pass) {
+                  case NON_ASCII_MATCH:
+                    MOZ_ASSERT(ascii);
+                    if (quarks[j] > kMaxOneByteCharCode) {
+                        assembler->JumpOrBacktrack(backtrack);
+                        return;
+                    }
+                    break;
+                  case NON_LETTER_CHARACTER_MATCH:
+                    emit_function = &EmitAtomNonLetter;
+                    break;
+                  case SIMPLE_CHARACTER_MATCH:
+                    emit_function = &EmitSimpleCharacter;
+                    break;
+                  case CASE_CHARACTER_MATCH:
+                    emit_function = &EmitAtomLetter;
+                    break;
+                  default:
+                    break;
+                }
+                if (emit_function != nullptr) {
+                    bool bound_checked = emit_function(compiler,
+                                                       quarks[j],
+                                                       backtrack,
+                                                       cp_offset + j,
+                                                       *checked_up_to < cp_offset + j,
+                                                       preloaded);
+                    if (bound_checked) UpdateBoundsCheck(cp_offset + j, checked_up_to);
+                }
+            }
+        } else {
+            MOZ_ASSERT(TextElement::CHAR_CLASS == elm.text_type());
+            if (pass == CHARACTER_CLASS_MATCH) {
+                if (first_element_checked && i == 0) continue;
+                if (DeterminedAlready(quick_check, elm.cp_offset())) continue;
+                RegExpCharacterClass* cc = elm.char_class();
+                EmitCharClass(alloc(),
+                              assembler,
+                              cc,
+                              ascii,
+                              backtrack,
+                              cp_offset,
+                              *checked_up_to < cp_offset,
+                              preloaded);
+                UpdateBoundsCheck(cp_offset, checked_up_to);
+            }
+        }
+    }
+}
+
+int
+TextNode::Length()
+{
+    TextElement elm = elements()[elements().length() - 1];
+    MOZ_ASSERT(elm.cp_offset() >= 0);
+    return elm.cp_offset() + elm.length();
+}
+
+bool
+TextNode::SkipPass(int int_pass, bool ignore_case)
+{
+    TextEmitPassType pass = static_cast<TextEmitPassType>(int_pass);
+    if (ignore_case)
+        return pass == SIMPLE_CHARACTER_MATCH;
+    return pass == NON_LETTER_CHARACTER_MATCH || pass == CASE_CHARACTER_MATCH;
+}
+
+// This generates the code to match a text node.  A text node can contain
+// straight character sequences (possibly to be matched in a case-independent
+// way) and character classes.  For efficiency we do not do this in a single
+// pass from left to right.  Instead we pass over the text node several times,
+// emitting code for some character positions every time.  See the comment on
+// TextEmitPass for details.
+void
+TextNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    LimitResult limit_result = LimitVersions(compiler, trace);
+    if (limit_result == DONE) return;
+    MOZ_ASSERT(limit_result == CONTINUE);
+
+    if (trace->cp_offset() + Length() > RegExpMacroAssembler::kMaxCPOffset) {
+        compiler->SetRegExpTooBig();
+        return;
+    }
+
+    if (compiler->ascii()) {
+        int dummy = 0;
+        TextEmitPass(compiler, NON_ASCII_MATCH, false, trace, false, &dummy);
+    }
+
+    bool first_elt_done = false;
+    int bound_checked_to = trace->cp_offset() - 1;
+    bound_checked_to += trace->bound_checked_up_to();
+
+    // If a character is preloaded into the current character register then
+    // check that now.
+    if (trace->characters_preloaded() == 1) {
+        for (int pass = kFirstRealPass; pass <= kLastPass; pass++) {
+            if (!SkipPass(pass, compiler->ignore_case())) {
+                TextEmitPass(compiler,
+                             static_cast<TextEmitPassType>(pass),
+                             true,
+                             trace,
+                             false,
+                             &bound_checked_to);
+            }
+        }
+        first_elt_done = true;
+    }
+
+    for (int pass = kFirstRealPass; pass <= kLastPass; pass++) {
+        if (!SkipPass(pass, compiler->ignore_case())) {
+            TextEmitPass(compiler,
+                         static_cast<TextEmitPassType>(pass),
+                         false,
+                         trace,
+                         first_elt_done,
+                         &bound_checked_to);
+        }
+    }
+
+    Trace successor_trace(*trace);
+    successor_trace.set_at_start(false);
+    successor_trace.AdvanceCurrentPositionInTrace(Length(), compiler);
+    RecursionCheck rc(compiler);
+    on_success()->Emit(compiler, &successor_trace);
+}
+
+void
+LoopChoiceNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
+    if (trace->stop_node() == this) {
+        int text_length =
+            GreedyLoopTextLengthForAlternative(&alternatives()[0]);
+        MOZ_ASSERT(text_length != kNodeIsTooComplexForGreedyLoops);
+        // Update the counter-based backtracking info on the stack.  This is an
+        // optimization for greedy loops (see below).
+        MOZ_ASSERT(trace->cp_offset() == text_length);
+        macro_assembler->AdvanceCurrentPosition(text_length);
+        macro_assembler->JumpOrBacktrack(trace->loop_label());
+        return;
+    }
+    MOZ_ASSERT(trace->stop_node() == nullptr);
+    if (!trace->is_trivial()) {
+        trace->Flush(compiler, this);
+        return;
+    }
+    ChoiceNode::Emit(compiler, trace);
+}
+
+/* Code generation for choice nodes.
+ *
+ * We generate quick checks that do a mask and compare to eliminate a
+ * choice.  If the quick check succeeds then it jumps to the continuation to
+ * do slow checks and check subsequent nodes.  If it fails (the common case)
+ * it falls through to the next choice.
+ *
+ * Here is the desired flow graph.  Nodes directly below each other imply
+ * fallthrough.  Alternatives 1 and 2 have quick checks.  Alternative
+ * 3 doesn't have a quick check so we have to call the slow check.
+ * Nodes are marked Qn for quick checks and Sn for slow checks.  The entire
+ * regexp continuation is generated directly after the Sn node, up to the
+ * next JumpOrBacktrack if we decide to reuse some already generated code.  Some
+ * nodes expect preload_characters to be preloaded into the current
+ * character register.  R nodes do this preloading.  Vertices are marked
+ * F for failures and S for success (possible success in the case of quick
+ * nodes).  L, V, < and > are used as arrow heads.
+ *
+ * ----------> R
+ *             |
+ *             V
+ *            Q1 -----> S1
+ *             |   S   /
+ *            F|      /
+ *             |    F/
+ *             |    /
+ *             |   R
+ *             |  /
+ *             V L
+ *            Q2 -----> S2
+ *             |   S   /
+ *            F|      /
+ *             |    F/
+ *             |    /
+ *             |   R
+ *             |  /
+ *             V L
+ *            S3
+ *             |
+ *            F|
+ *             |
+ *             R
+ *             |
+ * backtrack   V
+ * <----------Q4
+ *   \    F    |
+ *    \        |S
+ *     \   F   V
+ *      \-----S4
+ *
+ * For greedy loops we reverse our expectation and expect to match rather
+ * than fail. Therefore we want the loop code to look like this (U is the
+ * unwind code that steps back in the greedy loop).  The following alternatives
+ * look the same as above.
+ *              _____
+ *             /     \
+ *             V     |
+ * ----------> S1    |
+ *            /|     |
+ *           / |S    |
+ *         F/  \_____/
+ *         /
+ *        |<-----------
+ *        |            \
+ *        V             \
+ *        Q2 ---> S2     \
+ *        |  S   /       |
+ *       F|     /        |
+ *        |   F/         |
+ *        |   /          |
+ *        |  R           |
+ *        | /            |
+ *   F    VL             |
+ * <------U              |
+ * back   |S             |
+ *        \______________/
+ */
+
+// This class is used when generating the alternatives in a choice node.  It
+// records the way the alternative is being code generated.
+class irregexp::AlternativeGeneration
+{
+  public:
+    AlternativeGeneration()
+      : possible_success(),
+        expects_preload(false),
+        after(),
+        quick_check_details()
+    {}
+
+    jit::Label possible_success;
+    bool expects_preload;
+    jit::Label after;
+    QuickCheckDetails quick_check_details;
+};
+
+void
+ChoiceNode::GenerateGuard(RegExpMacroAssembler* macro_assembler,
+                          Guard* guard, Trace* trace)
+{
+    switch (guard->op()) {
+      case Guard::LT:
+        MOZ_ASSERT(!trace->mentions_reg(guard->reg()));
+        macro_assembler->IfRegisterGE(guard->reg(),
+                                      guard->value(),
+                                      trace->backtrack());
+        break;
+      case Guard::GEQ:
+        MOZ_ASSERT(!trace->mentions_reg(guard->reg()));
+        macro_assembler->IfRegisterLT(guard->reg(),
+                                      guard->value(),
+                                      trace->backtrack());
+        break;
+    }
+}
+
+int
+ChoiceNode::CalculatePreloadCharacters(RegExpCompiler* compiler, int eats_at_least)
+{
+    int preload_characters = Min(4, eats_at_least);
+    if (compiler->macro_assembler()->CanReadUnaligned()) {
+        bool ascii = compiler->ascii();
+        if (ascii) {
+            if (preload_characters > 4)
+                preload_characters = 4;
+            // We can't preload 3 characters because there is no machine instruction
+            // to do that.  We can't just load 4 because we could be reading
+            // beyond the end of the string, which could cause a memory fault.
+            if (preload_characters == 3)
+                preload_characters = 2;
+        } else {
+            if (preload_characters > 2)
+                preload_characters = 2;
+        }
+    } else {
+        if (preload_characters > 1)
+            preload_characters = 1;
+    }
+    return preload_characters;
+}
+
+RegExpNode*
+TextNode::GetSuccessorOfOmnivorousTextNode(RegExpCompiler* compiler)
+{
+    if (elements().length() != 1)
+        return nullptr;
+
+    TextElement elm = elements()[0];
+    if (elm.text_type() != TextElement::CHAR_CLASS)
+        return nullptr;
+
+    RegExpCharacterClass* node = elm.char_class();
+    CharacterRangeVector& ranges = node->ranges(alloc());
+
+    if (!CharacterRange::IsCanonical(ranges))
+        CharacterRange::Canonicalize(ranges);
+
+    if (node->is_negated())
+        return ranges.length() == 0 ? on_success() : nullptr;
+
+    if (ranges.length() != 1)
+        return nullptr;
+
+    uint32_t max_char = MaximumCharacter(compiler->ascii());
+    return ranges[0].IsEverything(max_char) ? on_success() : nullptr;
+}
+
+// Finds the fixed match length of a sequence of nodes that goes from
+// this alternative and back to this choice node.  If there are variable
+// length nodes or other complications in the way then return a sentinel
+// value indicating that a greedy loop cannot be constructed.
+int
+ChoiceNode::GreedyLoopTextLengthForAlternative(GuardedAlternative* alternative)
+{
+    int length = 0;
+    RegExpNode* node = alternative->node();
+    // Later we will generate code for all these text nodes using recursion
+    // so we have to limit the max number.
+    int recursion_depth = 0;
+    while (node != this) {
+        if (recursion_depth++ > RegExpCompiler::kMaxRecursion) {
+            return kNodeIsTooComplexForGreedyLoops;
+        }
+        int node_length = node->GreedyLoopTextLength();
+        if (node_length == kNodeIsTooComplexForGreedyLoops) {
+            return kNodeIsTooComplexForGreedyLoops;
+        }
+        length += node_length;
+        SeqRegExpNode* seq_node = static_cast<SeqRegExpNode*>(node);
+        node = seq_node->on_success();
+    }
+    return length;
+}
+
+// Creates a list of AlternativeGenerations.  If the list has a reasonable
+// size then it is on the stack, otherwise the excess is on the heap.
+class AlternativeGenerationList
+{
+  public:
+    AlternativeGenerationList(LifoAlloc* alloc, size_t count)
+      : alt_gens_(*alloc)
+    {
+        alt_gens_.reserve(count);
+        for (size_t i = 0; i < count && i < kAFew; i++)
+            alt_gens_.append(a_few_alt_gens_ + i);
+        for (size_t i = kAFew; i < count; i++) {
+            AutoEnterOOMUnsafeRegion oomUnsafe;
+            AlternativeGeneration* gen = js_new<AlternativeGeneration>();
+            if (!gen)
+                oomUnsafe.crash("AlternativeGenerationList js_new");
+            alt_gens_.append(gen);
+        }
+    }
+
+    ~AlternativeGenerationList() {
+        for (size_t i = kAFew; i < alt_gens_.length(); i++) {
+            js_delete(alt_gens_[i]);
+            alt_gens_[i] = nullptr;
+        }
+    }
+
+    AlternativeGeneration* at(int i) {
+        return alt_gens_[i];
+    }
+
+  private:
+    static const size_t kAFew = 10;
+    InfallibleVector<AlternativeGeneration*, 1> alt_gens_;
+    AlternativeGeneration a_few_alt_gens_[kAFew];
+};
+
+void
+ChoiceNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
+    size_t choice_count = alternatives().length();
+#ifdef DEBUG
+    for (size_t i = 0; i < choice_count - 1; i++) {
+        const GuardedAlternative& alternative = alternatives()[i];
+        const GuardVector* guards = alternative.guards();
+        if (guards) {
+            for (size_t j = 0; j < guards->length(); j++)
+                MOZ_ASSERT(!trace->mentions_reg((*guards)[j]->reg()));
+        }
+    }
+#endif
+
+    LimitResult limit_result = LimitVersions(compiler, trace);
+    if (limit_result == DONE) return;
+    MOZ_ASSERT(limit_result == CONTINUE);
+
+    int new_flush_budget = trace->flush_budget() / choice_count;
+    if (trace->flush_budget() == 0 && trace->actions() != nullptr) {
+        trace->Flush(compiler, this);
+        return;
+    }
+
+    RecursionCheck rc(compiler);
+
+    Trace* current_trace = trace;
+
+    int text_length = GreedyLoopTextLengthForAlternative(&alternatives()[0]);
+    bool greedy_loop = false;
+    jit::Label greedy_loop_label;
+    Trace counter_backtrack_trace;
+    counter_backtrack_trace.set_backtrack(&greedy_loop_label);
+    if (not_at_start()) counter_backtrack_trace.set_at_start(false);
+
+    if (choice_count > 1 && text_length != kNodeIsTooComplexForGreedyLoops) {
+        // Here we have special handling for greedy loops containing only text nodes
+        // and other simple nodes.  These are handled by pushing the current
+        // position on the stack and then incrementing the current position each
+        // time around the switch.  On backtrack we decrement the current position
+        // and check it against the pushed value.  This avoids pushing backtrack
+        // information for each iteration of the loop, which could take up a lot of
+        // space.
+        greedy_loop = true;
+        MOZ_ASSERT(trace->stop_node() == nullptr);
+        macro_assembler->PushCurrentPosition();
+        current_trace = &counter_backtrack_trace;
+        jit::Label greedy_match_failed;
+        Trace greedy_match_trace;
+        if (not_at_start()) greedy_match_trace.set_at_start(false);
+        greedy_match_trace.set_backtrack(&greedy_match_failed);
+        jit::Label loop_label;
+        macro_assembler->Bind(&loop_label);
+        greedy_match_trace.set_stop_node(this);
+        greedy_match_trace.set_loop_label(&loop_label);
+        alternatives()[0].node()->Emit(compiler, &greedy_match_trace);
+        macro_assembler->Bind(&greedy_match_failed);
+    }
+
+    jit::Label second_choice;  // For use in greedy matches.
+    macro_assembler->Bind(&second_choice);
+
+    size_t first_normal_choice = greedy_loop ? 1 : 0;
+
+    bool not_at_start = current_trace->at_start() == Trace::FALSE_VALUE;
+    const int kEatsAtLeastNotYetInitialized = -1;
+    int eats_at_least = kEatsAtLeastNotYetInitialized;
+
+    bool skip_was_emitted = false;
+
+    if (!greedy_loop && choice_count == 2) {
+        GuardedAlternative alt1 = alternatives()[1];
+        if (!alt1.guards() || alt1.guards()->length() == 0) {
+            RegExpNode* eats_anything_node = alt1.node();
+            if (eats_anything_node->GetSuccessorOfOmnivorousTextNode(compiler) == this) {
+                // At this point we know that we are at a non-greedy loop that will eat
+                // any character one at a time.  Any non-anchored regexp has such a
+                // loop prepended to it in order to find where it starts.  We look for
+                // a pattern of the form ...abc... where we can look 6 characters ahead
+                // and step forwards 3 if the character is not one of abc.  Abc need
+                // not be atoms, they can be any reasonably limited character class or
+                // small alternation.
+                MOZ_ASSERT(trace->is_trivial());  // This is the case on LoopChoiceNodes.
+                BoyerMooreLookahead* lookahead = bm_info(not_at_start);
+                if (lookahead == nullptr) {
+                    eats_at_least = Min(kMaxLookaheadForBoyerMoore,
+                                        EatsAtLeast(kMaxLookaheadForBoyerMoore,
+                                                    kRecursionBudget,
+                                                    not_at_start));
+                    if (eats_at_least >= 1) {
+                        BoyerMooreLookahead* bm =
+                            alloc()->newInfallible<BoyerMooreLookahead>(alloc(), eats_at_least, compiler);
+                        GuardedAlternative alt0 = alternatives()[0];
+                        alt0.node()->FillInBMInfo(0, kRecursionBudget, bm, not_at_start);
+                        skip_was_emitted = bm->EmitSkipInstructions(macro_assembler);
+                    }
+                } else {
+                    skip_was_emitted = lookahead->EmitSkipInstructions(macro_assembler);
+                }
+            }
+        }
+    }
+
+    if (eats_at_least == kEatsAtLeastNotYetInitialized) {
+        // Save some time by looking at most one machine word ahead.
+        eats_at_least =
+            EatsAtLeast(compiler->ascii() ? 4 : 2, kRecursionBudget, not_at_start);
+    }
+    int preload_characters = CalculatePreloadCharacters(compiler, eats_at_least);
+
+    bool preload_is_current = !skip_was_emitted &&
+        (current_trace->characters_preloaded() == preload_characters);
+    bool preload_has_checked_bounds = preload_is_current;
+
+    AlternativeGenerationList alt_gens(alloc(), choice_count);
+
+    // For now we just call all choices one after the other.  The idea ultimately
+    // is to use the Dispatch table to try only the relevant ones.
+    for (size_t i = first_normal_choice; i < choice_count; i++) {
+        GuardedAlternative alternative = alternatives()[i];
+        AlternativeGeneration* alt_gen = alt_gens.at(i);
+        alt_gen->quick_check_details.set_characters(preload_characters);
+        const GuardVector* guards = alternative.guards();
+        Trace new_trace(*current_trace);
+        new_trace.set_characters_preloaded(preload_is_current ?
+                                           preload_characters :
+                                           0);
+        if (preload_has_checked_bounds) {
+            new_trace.set_bound_checked_up_to(preload_characters);
+        }
+        new_trace.quick_check_performed()->Clear();
+        if (not_at_start_) new_trace.set_at_start(Trace::FALSE_VALUE);
+        alt_gen->expects_preload = preload_is_current;
+        bool generate_full_check_inline = false;
+        if (try_to_emit_quick_check_for_alternative(i) &&
+            alternative.node()->EmitQuickCheck(compiler,
+                                               &new_trace,
+                                               preload_has_checked_bounds,
+                                               &alt_gen->possible_success,
+                                               &alt_gen->quick_check_details,
+                                               i < choice_count - 1)) {
+            // Quick check was generated for this choice.
+            preload_is_current = true;
+            preload_has_checked_bounds = true;
+            // On the last choice in the ChoiceNode we generated the quick
+            // check to fall through on possible success.  So now we need to
+            // generate the full check inline.
+            if (i == choice_count - 1) {
+                macro_assembler->Bind(&alt_gen->possible_success);
+                new_trace.set_quick_check_performed(&alt_gen->quick_check_details);
+                new_trace.set_characters_preloaded(preload_characters);
+                new_trace.set_bound_checked_up_to(preload_characters);
+                generate_full_check_inline = true;
+            }
+        } else if (alt_gen->quick_check_details.cannot_match()) {
+            if (i == choice_count - 1 && !greedy_loop) {
+                macro_assembler->JumpOrBacktrack(trace->backtrack());
+            }
+            continue;
+        } else {
+            // No quick check was generated.  Put the full code here.
+            // If this is not the first choice then there could be slow checks from
+            // previous cases that go here when they fail.  There's no reason to
+            // insist that they preload characters since the slow check we are about
+            // to generate probably can't use it.
+            if (i != first_normal_choice) {
+                alt_gen->expects_preload = false;
+                new_trace.InvalidateCurrentCharacter();
+            }
+            if (i < choice_count - 1) {
+                new_trace.set_backtrack(&alt_gen->after);
+            }
+            generate_full_check_inline = true;
+        }
+        if (generate_full_check_inline) {
+            if (new_trace.actions() != nullptr)
+                new_trace.set_flush_budget(new_flush_budget);
+            if (guards) {
+                for (size_t j = 0; j < guards->length(); j++)
+                    GenerateGuard(macro_assembler, (*guards)[j], &new_trace);
+            }
+            alternative.node()->Emit(compiler, &new_trace);
+            preload_is_current = false;
+        }
+        macro_assembler->Bind(&alt_gen->after);
+    }
+    if (greedy_loop) {
+        macro_assembler->Bind(&greedy_loop_label);
+        // If we have unwound to the bottom then backtrack.
+        macro_assembler->CheckGreedyLoop(trace->backtrack());
+        // Otherwise try the second priority at an earlier position.
+        macro_assembler->AdvanceCurrentPosition(-text_length);
+        macro_assembler->JumpOrBacktrack(&second_choice);
+    }
+
+    // At this point we need to generate slow checks for the alternatives where
+    // the quick check was inlined.  We can recognize these because the associated
+    // label was bound.
+    for (size_t i = first_normal_choice; i < choice_count - 1; i++) {
+        AlternativeGeneration* alt_gen = alt_gens.at(i);
+        Trace new_trace(*current_trace);
+        // If there are actions to be flushed we have to limit how many times
+        // they are flushed.  Take the budget of the parent trace and distribute
+        // it fairly amongst the children.
+        if (new_trace.actions() != nullptr) {
+            new_trace.set_flush_budget(new_flush_budget);
+        }
+        EmitOutOfLineContinuation(compiler,
+                                  &new_trace,
+                                  alternatives()[i],
+                                  alt_gen,
+                                  preload_characters,
+                                  alt_gens.at(i + 1)->expects_preload);
+    }
+}
+
+void
+ChoiceNode::EmitOutOfLineContinuation(RegExpCompiler* compiler,
+                                      Trace* trace,
+                                      GuardedAlternative alternative,
+                                      AlternativeGeneration* alt_gen,
+                                      int preload_characters,
+                                      bool next_expects_preload)
+{
+    if (!alt_gen->possible_success.used())
+        return;
+
+    RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
+    macro_assembler->Bind(&alt_gen->possible_success);
+    Trace out_of_line_trace(*trace);
+    out_of_line_trace.set_characters_preloaded(preload_characters);
+    out_of_line_trace.set_quick_check_performed(&alt_gen->quick_check_details);
+    if (not_at_start_) out_of_line_trace.set_at_start(Trace::FALSE_VALUE);
+    const GuardVector* guards = alternative.guards();
+    if (next_expects_preload) {
+        jit::Label reload_current_char;
+        out_of_line_trace.set_backtrack(&reload_current_char);
+        if (guards) {
+            for (size_t j = 0; j < guards->length(); j++)
+                GenerateGuard(macro_assembler, (*guards)[j], &out_of_line_trace);
+        }
+        alternative.node()->Emit(compiler, &out_of_line_trace);
+        macro_assembler->Bind(&reload_current_char);
+        // Reload the current character, since the next quick check expects that.
+        // We don't need to check bounds here because we only get into this
+        // code through a quick check which already did the checked load.
+        macro_assembler->LoadCurrentCharacter(trace->cp_offset(),
+                                              nullptr,
+                                              false,
+                                              preload_characters);
+        macro_assembler->JumpOrBacktrack(&(alt_gen->after));
+    } else {
+        out_of_line_trace.set_backtrack(&(alt_gen->after));
+        if (guards) {
+            for (size_t j = 0; j < guards->length(); j++)
+                GenerateGuard(macro_assembler, (*guards)[j], &out_of_line_trace);
+        }
+        alternative.node()->Emit(compiler, &out_of_line_trace);
+    }
+}
+
+void
+ActionNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    LimitResult limit_result = LimitVersions(compiler, trace);
+    if (limit_result == DONE) return;
+    MOZ_ASSERT(limit_result == CONTINUE);
+
+    RecursionCheck rc(compiler);
+
+    switch (action_type_) {
+      case STORE_POSITION: {
+        Trace::DeferredCapture
+            new_capture(data_.u_position_register.reg,
+                        data_.u_position_register.is_capture,
+                        trace);
+        Trace new_trace = *trace;
+        new_trace.add_action(&new_capture);
+        on_success()->Emit(compiler, &new_trace);
+        break;
+      }
+      case INCREMENT_REGISTER: {
+        Trace::DeferredIncrementRegister
+            new_increment(data_.u_increment_register.reg);
+        Trace new_trace = *trace;
+        new_trace.add_action(&new_increment);
+        on_success()->Emit(compiler, &new_trace);
+        break;
+      }
+      case SET_REGISTER: {
+        Trace::DeferredSetRegister
+            new_set(data_.u_store_register.reg, data_.u_store_register.value);
+        Trace new_trace = *trace;
+        new_trace.add_action(&new_set);
+        on_success()->Emit(compiler, &new_trace);
+        break;
+      }
+      case CLEAR_CAPTURES: {
+        Trace::DeferredClearCaptures
+            new_capture(Interval(data_.u_clear_captures.range_from,
+                                 data_.u_clear_captures.range_to));
+        Trace new_trace = *trace;
+        new_trace.add_action(&new_capture);
+        on_success()->Emit(compiler, &new_trace);
+        break;
+      }
+      case BEGIN_SUBMATCH:
+        if (!trace->is_trivial()) {
+            trace->Flush(compiler, this);
+        } else {
+            assembler->WriteCurrentPositionToRegister(data_.u_submatch.current_position_register, 0);
+            assembler->WriteBacktrackStackPointerToRegister(data_.u_submatch.stack_pointer_register);
+            on_success()->Emit(compiler, trace);
+        }
+        break;
+      case EMPTY_MATCH_CHECK: {
+        int start_pos_reg = data_.u_empty_match_check.start_register;
+        int stored_pos = 0;
+        int rep_reg = data_.u_empty_match_check.repetition_register;
+        bool has_minimum = (rep_reg != RegExpCompiler::kNoRegister);
+        bool know_dist = trace->GetStoredPosition(start_pos_reg, &stored_pos);
+        if (know_dist && !has_minimum && stored_pos == trace->cp_offset()) {
+            // If we know we haven't advanced and there is no minimum we
+            // can just backtrack immediately.
+            assembler->JumpOrBacktrack(trace->backtrack());
+        } else if (know_dist && stored_pos < trace->cp_offset()) {
+            // If we know we've advanced we can generate the continuation
+            // immediately.
+            on_success()->Emit(compiler, trace);
+        } else if (!trace->is_trivial()) {
+            trace->Flush(compiler, this);
+        } else {
+            jit::Label skip_empty_check;
+            // If we have a minimum number of repetitions we check the current
+            // number first and skip the empty check if it's not enough.
+            if (has_minimum) {
+                int limit = data_.u_empty_match_check.repetition_limit;
+                assembler->IfRegisterLT(rep_reg, limit, &skip_empty_check);
+            }
+            // If the match is empty we bail out, otherwise we fall through
+            // to the on-success continuation.
+            assembler->IfRegisterEqPos(data_.u_empty_match_check.start_register,
+                                       trace->backtrack());
+            assembler->Bind(&skip_empty_check);
+            on_success()->Emit(compiler, trace);
+        }
+        break;
+      }
+      case POSITIVE_SUBMATCH_SUCCESS: {
+        if (!trace->is_trivial()) {
+            trace->Flush(compiler, this);
+            return;
+        }
+        assembler->ReadCurrentPositionFromRegister(data_.u_submatch.current_position_register);
+        assembler->ReadBacktrackStackPointerFromRegister(data_.u_submatch.stack_pointer_register);
+        int clear_register_count = data_.u_submatch.clear_register_count;
+        if (clear_register_count == 0) {
+            on_success()->Emit(compiler, trace);
+            return;
+        }
+        int clear_registers_from = data_.u_submatch.clear_register_from;
+        jit::Label clear_registers_backtrack;
+        Trace new_trace = *trace;
+        new_trace.set_backtrack(&clear_registers_backtrack);
+        on_success()->Emit(compiler, &new_trace);
+
+        assembler->Bind(&clear_registers_backtrack);
+        int clear_registers_to = clear_registers_from + clear_register_count - 1;
+        assembler->ClearRegisters(clear_registers_from, clear_registers_to);
+
+        MOZ_ASSERT(trace->backtrack() == nullptr);
+        assembler->Backtrack();
+        return;
+      }
+      default:
+        MOZ_CRASH("Bad action");
+    }
+}
+
+void
+BackReferenceNode::Emit(RegExpCompiler* compiler, Trace* trace)
+{
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+    if (!trace->is_trivial()) {
+        trace->Flush(compiler, this);
+        return;
+    }
+
+    LimitResult limit_result = LimitVersions(compiler, trace);
+    if (limit_result == DONE) return;
+    MOZ_ASSERT(limit_result == CONTINUE);
+
+    RecursionCheck rc(compiler);
+
+    MOZ_ASSERT(start_reg_ + 1 == end_reg_);
+    if (compiler->ignore_case()) {
+        assembler->CheckNotBackReferenceIgnoreCase(start_reg_,
+                                                   trace->backtrack(),
+                                                   compiler->unicode());
+    } else {
+        assembler->CheckNotBackReference(start_reg_, trace->backtrack());
+    }
+    on_success()->Emit(compiler, trace);
+}
+
+RegExpNode::LimitResult
+RegExpNode::LimitVersions(RegExpCompiler* compiler, Trace* trace)
+{
+    // If we are generating a greedy loop then don't stop and don't reuse code.
+    if (trace->stop_node() != nullptr)
+        return CONTINUE;
+
+    RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
+    if (trace->is_trivial()) {
+        if (label()->bound()) {
+            // We are being asked to generate a generic version, but that's already
+            // been done so just go to it.
+            macro_assembler->JumpOrBacktrack(label());
+            return DONE;
+        }
+        if (compiler->recursion_depth() >= RegExpCompiler::kMaxRecursion) {
+            // To avoid too deep recursion we push the node to the work queue and just
+            // generate a goto here.
+            compiler->AddWork(this);
+            macro_assembler->JumpOrBacktrack(label());
+            return DONE;
+        }
+        // Generate generic version of the node and bind the label for later use.
+        macro_assembler->Bind(label());
+        return CONTINUE;
+    }
+
+    // We are being asked to make a non-generic version.  Keep track of how many
+    // non-generic versions we generate so as not to overdo it.
+    trace_count_++;
+    if (trace_count_ < kMaxCopiesCodeGenerated &&
+        compiler->recursion_depth() <= RegExpCompiler::kMaxRecursion) {
+        return CONTINUE;
+    }
+
+    // If we get here code has been generated for this node too many times or
+    // recursion is too deep.  Time to switch to a generic version.  The code for
+    // generic versions above can handle deep recursion properly.
+    trace->Flush(compiler, this);
+    return DONE;
+}
+
+bool
+RegExpNode::EmitQuickCheck(RegExpCompiler* compiler,
+                           Trace* trace,
+                           bool preload_has_checked_bounds,
+                           jit::Label* on_possible_success,
+                           QuickCheckDetails* details,
+                           bool fall_through_on_failure)
+{
+    if (details->characters() == 0) return false;
+    GetQuickCheckDetails(
+                         details, compiler, 0, trace->at_start() == Trace::FALSE_VALUE);
+    if (details->cannot_match()) return false;
+    if (!details->Rationalize(compiler->ascii())) return false;
+    MOZ_ASSERT(details->characters() == 1 ||
+               compiler->macro_assembler()->CanReadUnaligned());
+    uint32_t mask = details->mask();
+    uint32_t value = details->value();
+
+    RegExpMacroAssembler* assembler = compiler->macro_assembler();
+
+    if (trace->characters_preloaded() != details->characters()) {
+        assembler->LoadCurrentCharacter(trace->cp_offset(),
+                                        trace->backtrack(),
+                                        !preload_has_checked_bounds,
+                                        details->characters());
+    }
+
+    bool need_mask = true;
+
+    if (details->characters() == 1) {
+        // If number of characters preloaded is 1 then we used a byte or 16 bit
+        // load so the value is already masked down.
+        uint32_t char_mask = MaximumCharacter(compiler->ascii());
+        if ((mask & char_mask) == char_mask) need_mask = false;
+        mask &= char_mask;
+    } else {
+        // For 2-character preloads in ASCII mode or 1-character preloads in
+        // TWO_BYTE mode we also use a 16 bit load with zero extend.
+        if (details->characters() == 2 && compiler->ascii()) {
+            if ((mask & 0xffff) == 0xffff) need_mask = false;
+        } else if (details->characters() == 1 && !compiler->ascii()) {
+            if ((mask & 0xffff) == 0xffff) need_mask = false;
+        } else {
+            if (mask == 0xffffffff) need_mask = false;
+        }
+    }
+
+    if (fall_through_on_failure) {
+        if (need_mask) {
+            assembler->CheckCharacterAfterAnd(value, mask, on_possible_success);
+        } else {
+            assembler->CheckCharacter(value, on_possible_success);
+        }
+    } else {
+        if (need_mask) {
+            assembler->CheckNotCharacterAfterAnd(value, mask, trace->backtrack());
+        } else {
+            assembler->CheckNotCharacter(value, trace->backtrack());
+        }
+    }
+    return true;
+}
+
+bool
+TextNode::FillInBMInfo(int initial_offset,
+                       int budget,
+                       BoyerMooreLookahead* bm,
+                       bool not_at_start)
+{
+    if (!bm->CheckOverRecursed())
+        return false;
+
+    if (initial_offset >= bm->length())
+        return true;
+
+    int offset = initial_offset;
+    int max_char = bm->max_char();
+    for (size_t i = 0; i < elements().length(); i++) {
+        if (offset >= bm->length()) {
+            if (initial_offset == 0)
+                set_bm_info(not_at_start, bm);
+            return true;
+        }
+        TextElement text = elements()[i];
+        if (text.text_type() == TextElement::ATOM) {
+            RegExpAtom* atom = text.atom();
+            for (int j = 0; j < atom->length(); j++, offset++) {
+                if (offset >= bm->length()) {
+                    if (initial_offset == 0)
+                        set_bm_info(not_at_start, bm);
+                    return true;
+                }
+                char16_t character = atom->data()[j];
+                if (bm->compiler()->ignore_case()) {
+                    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
+                    int length = GetCaseIndependentLetters(character,
+                                                           bm->max_char() == kMaxOneByteCharCode,
+                                                           bm->compiler()->unicode(),
+                                                           chars);
+                    for (int j = 0; j < length; j++)
+                        bm->Set(offset, chars[j]);
+                } else {
+                    if (character <= max_char) bm->Set(offset, character);
+                }
+            }
+        } else {
+            MOZ_ASSERT(TextElement::CHAR_CLASS == text.text_type());
+            RegExpCharacterClass* char_class = text.char_class();
+            const CharacterRangeVector& ranges = char_class->ranges(alloc());
+            if (char_class->is_negated()) {
+                bm->SetAll(offset);
+            } else {
+                for (size_t k = 0; k < ranges.length(); k++) {
+                    const CharacterRange& range = ranges[k];
+                    if (range.from() > max_char)
+                        continue;
+                    int to = Min(max_char, static_cast<int>(range.to()));
+                    bm->SetInterval(offset, Interval(range.from(), to));
+                }
+            }
+            offset++;
+        }
+    }
+    if (offset >= bm->length()) {
+        if (initial_offset == 0) set_bm_info(not_at_start, bm);
+        return true;
+    }
+    if (!on_success()->FillInBMInfo(offset,
+                                    budget - 1,
+                                    bm,
+                                    true))   // Not at start after a text node.
+        return false;
+    if (initial_offset == 0)
+        set_bm_info(not_at_start, bm);
+    return true;
+}
+
+// -------------------------------------------------------------------
+// QuickCheckDetails
+
+// Takes the left-most 1-bit and smears it out, setting all bits to its right.
+static inline uint32_t
+SmearBitsRight(uint32_t v)
+{
+    v |= v >> 1;
+    v |= v >> 2;
+    v |= v >> 4;
+    v |= v >> 8;
+    v |= v >> 16;
+    return v;
+}
+
+// Here is the meat of GetQuickCheckDetails (see also the comment on the
+// super-class in the .h file).
+//
+// We iterate along the text object, building up for each character a
+// mask and value that can be used to test for a quick failure to match.
+// The masks and values for the positions will be combined into a single
+// machine word for the current character width in order to be used in
+// generating a quick check.
+void
+TextNode::GetQuickCheckDetails(QuickCheckDetails* details,
+                               RegExpCompiler* compiler,
+                               int characters_filled_in,
+                               bool not_at_start)
+{
+    MOZ_ASSERT(characters_filled_in < details->characters());
+    int characters = details->characters();
+    int char_mask = MaximumCharacter(compiler->ascii());
+
+    for (size_t k = 0; k < elements().length(); k++) {
+        TextElement elm = elements()[k];
+        if (elm.text_type() == TextElement::ATOM) {
+            const CharacterVector& quarks = elm.atom()->data();
+            for (size_t i = 0; i < (size_t) characters && i < quarks.length(); i++) {
+                QuickCheckDetails::Position* pos =
+                    details->positions(characters_filled_in);
+                char16_t c = quarks[i];
+                if (c > char_mask) {
+                    // If we expect a non-ASCII character from an ASCII string,
+                    // there is no way we can match. Not even case independent
+                    // matching can turn an ASCII character into non-ASCII or
+                    // vice versa.
+                    details->set_cannot_match();
+                    pos->determines_perfectly = false;
+                    return;
+                }
+                if (compiler->ignore_case()) {
+                    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
+                    size_t length = GetCaseIndependentLetters(c, compiler->ascii(),
+                                                              compiler->unicode(), chars);
+                    MOZ_ASSERT(length != 0);  // Can only happen if c > char_mask (see above).
+                    if (length == 1) {
+                        // This letter has no case equivalents, so it's nice and simple
+                        // and the mask-compare will determine definitely whether we have
+                        // a match at this character position.
+                        pos->mask = char_mask;
+                        pos->value = c;
+                        pos->determines_perfectly = true;
+                    } else {
+                        uint32_t common_bits = char_mask;
+                        uint32_t bits = chars[0];
+                        for (size_t j = 1; j < length; j++) {
+                            uint32_t differing_bits = ((chars[j] & common_bits) ^ bits);
+                            common_bits ^= differing_bits;
+                            bits &= common_bits;
+                        }
+                        // If length is 2 and common bits has only one zero in it then
+                        // our mask and compare instruction will determine definitely
+                        // whether we have a match at this character position.  Otherwise
+                        // it can only be an approximate check.
+                        uint32_t one_zero = (common_bits | ~char_mask);
+                        if (length == 2 && ((~one_zero) & ((~one_zero) - 1)) == 0) {
+                            pos->determines_perfectly = true;
+                        }
+                        pos->mask = common_bits;
+                        pos->value = bits;
+                    }
+                } else {
+                    // Don't ignore case.  Nice simple case where the mask-compare will
+                    // determine definitely whether we have a match at this character
+                    // position.
+                    pos->mask = char_mask;
+                    pos->value = c;
+                    pos->determines_perfectly = true;
+                }
+                characters_filled_in++;
+                MOZ_ASSERT(characters_filled_in <= details->characters());
+                if (characters_filled_in == details->characters()) {
+                    return;
+                }
+            }
+        } else {
+            QuickCheckDetails::Position* pos =
+                details->positions(characters_filled_in);
+            RegExpCharacterClass* tree = elm.char_class();
+            const CharacterRangeVector& ranges = tree->ranges(alloc());
+            if (tree->is_negated()) {
+                // A quick check uses multi-character mask and compare.  There is no
+                // useful way to incorporate a negative char class into this scheme
+                // so we just conservatively create a mask and value that will always
+                // succeed.
+                pos->mask = 0;
+                pos->value = 0;
+            } else {
+                size_t first_range = 0;
+                while (ranges[first_range].from() > char_mask) {
+                    first_range++;
+                    if (first_range == ranges.length()) {
+                        details->set_cannot_match();
+                        pos->determines_perfectly = false;
+                        return;
+                    }
+                }
+                CharacterRange range = ranges[first_range];
+                char16_t from = range.from();
+                char16_t to = range.to();
+                if (to > char_mask) {
+                    to = char_mask;
+                }
+                uint32_t differing_bits = (from ^ to);
+                // A mask and compare is only perfect if the differing bits form a
+                // number like 00011111 with one single block of trailing 1s.
+                if ((differing_bits & (differing_bits + 1)) == 0 &&
+                    from + differing_bits == to) {
+                    pos->determines_perfectly = true;
+                }
+                uint32_t common_bits = ~SmearBitsRight(differing_bits);
+                uint32_t bits = (from & common_bits);
+                for (size_t i = first_range + 1; i < ranges.length(); i++) {
+                    CharacterRange range = ranges[i];
+                    char16_t from = range.from();
+                    char16_t to = range.to();
+                    if (from > char_mask) continue;
+                    if (to > char_mask) to = char_mask;
+                    // Here we are combining more ranges into the mask and compare
+                    // value.  With each new range the mask becomes more sparse and
+                    // so the chances of a false positive rise.  A character class
+                    // with multiple ranges is assumed never to be equivalent to a
+                    // mask and compare operation.
+                    pos->determines_perfectly = false;
+                    uint32_t new_common_bits = (from ^ to);
+                    new_common_bits = ~SmearBitsRight(new_common_bits);
+                    common_bits &= new_common_bits;
+                    bits &= new_common_bits;
+                    uint32_t differing_bits = (from & common_bits) ^ bits;
+                    common_bits ^= differing_bits;
+                    bits &= common_bits;
+                }
+                pos->mask = common_bits;
+                pos->value = bits;
+            }
+            characters_filled_in++;
+            MOZ_ASSERT(characters_filled_in <= details->characters());
+            if (characters_filled_in == details->characters()) {
+                return;
+            }
+        }
+    }
+    MOZ_ASSERT(characters_filled_in != details->characters());
+    if (!details->cannot_match()) {
+        on_success()-> GetQuickCheckDetails(details,
+                                            compiler,
+                                            characters_filled_in,
+                                            true);
+    }
+}
+
+void
+QuickCheckDetails::Clear()
+{
+    for (int i = 0; i < characters_; i++) {
+        positions_[i].mask = 0;
+        positions_[i].value = 0;
+        positions_[i].determines_perfectly = false;
+    }
+    characters_ = 0;
+}
+
+void
+QuickCheckDetails::Advance(int by, bool ascii)
+{
+    MOZ_ASSERT(by >= 0);
+    if (by >= characters_) {
+        Clear();
+        return;
+    }
+    for (int i = 0; i < characters_ - by; i++) {
+        positions_[i] = positions_[by + i];
+    }
+    for (int i = characters_ - by; i < characters_; i++) {
+        positions_[i].mask = 0;
+        positions_[i].value = 0;
+        positions_[i].determines_perfectly = false;
+    }
+    characters_ -= by;
+    // We could change mask_ and value_ here but we would never advance unless
+    // they had already been used in a check and they won't be used again because
+    // it would gain us nothing.  So there's no point.
+}
+
+bool
+QuickCheckDetails::Rationalize(bool is_ascii)
+{
+    bool found_useful_op = false;
+    uint32_t char_mask = MaximumCharacter(is_ascii);
+
+    mask_ = 0;
+    value_ = 0;
+    int char_shift = 0;
+    for (int i = 0; i < characters_; i++) {
+        Position* pos = &positions_[i];
+        if ((pos->mask & kMaxOneByteCharCode) != 0)
+            found_useful_op = true;
+        mask_ |= (pos->mask & char_mask) << char_shift;
+        value_ |= (pos->value & char_mask) << char_shift;
+        char_shift += is_ascii ? 8 : 16;
+    }
+    return found_useful_op;
+}
+
+void QuickCheckDetails::Merge(QuickCheckDetails* other, int from_index)
+{
+    MOZ_ASSERT(characters_ == other->characters_);
+    if (other->cannot_match_)
+        return;
+    if (cannot_match_) {
+        *this = *other;
+        return;
+    }
+    for (int i = from_index; i < characters_; i++) {
+        QuickCheckDetails::Position* pos = positions(i);
+        QuickCheckDetails::Position* other_pos = other->positions(i);
+        if (pos->mask != other_pos->mask ||
+            pos->value != other_pos->value ||
+            !other_pos->determines_perfectly) {
+            // Our mask-compare operation will be approximate unless we have the
+            // exact same operation on both sides of the alternation.
+            pos->determines_perfectly = false;
+        }
+        pos->mask &= other_pos->mask;
+        pos->value &= pos->mask;
+        other_pos->value &= pos->mask;
+        char16_t differing_bits = (pos->value ^ other_pos->value);
+        pos->mask &= ~differing_bits;
+        pos->value &= pos->mask;
+    }
+}
diff --git a/js/src/irregexp/RegExpEngine.h b/js/src/irregexp/RegExpEngine.h
new file mode 100644
index 000000000..78c784aaf
--- /dev/null
+++ b/js/src/irregexp/RegExpEngine.h
@@ -0,0 +1,1546 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_JSREGEXP_H_
+#define V8_JSREGEXP_H_
+
+#include "jscntxt.h"
+
+#include "ds/SplayTree.h"
+#include "jit/Label.h"
+#include "vm/RegExpObject.h"
+
+namespace js {
+
+class MatchPairs;
+class RegExpShared;
+
+namespace jit {
+    class Label;
+    class JitCode;
+}
+
+namespace irregexp {
+
+class RegExpTree;
+class RegExpMacroAssembler;
+
+struct RegExpCompileData
+{
+    RegExpCompileData()
+      : tree(nullptr),
+        simple(true),
+        contains_anchor(false),
+        capture_count(0)
+    {}
+
+    RegExpTree* tree;
+    bool simple;
+    bool contains_anchor;
+    int capture_count;
+};
+
+struct RegExpCode
+{
+    jit::JitCode* jitCode;
+    uint8_t* byteCode;
+
+    RegExpCode()
+      : jitCode(nullptr), byteCode(nullptr)
+    {}
+
+    bool empty() {
+        return !jitCode && !byteCode;
+    }
+
+    void destroy() {
+        js_free(byteCode);
+    }
+};
+
+RegExpCode
+CompilePattern(JSContext* cx, RegExpShared* shared, RegExpCompileData* data,
+               HandleLinearString sample,  bool is_global, bool ignore_case,
+               bool is_ascii, bool match_only, bool force_bytecode, bool sticky,
+               bool unicode);
+
+// Note: this may return RegExpRunStatus_Error if an interrupt was requested
+// while the code was executing.
+template <typename CharT>
+RegExpRunStatus
+ExecuteCode(JSContext* cx, jit::JitCode* codeBlock, const CharT* chars, size_t start,
+            size_t length, MatchPairs* matches, size_t* endIndex);
+
+template <typename CharT>
+RegExpRunStatus
+InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* chars, size_t start,
+              size_t length, MatchPairs* matches, size_t* endIndex);
+
+#define FOR_EACH_NODE_TYPE(VISIT)                                    \
+  VISIT(End)                                                         \
+  VISIT(Action)                                                      \
+  VISIT(Choice)                                                      \
+  VISIT(BackReference)                                               \
+  VISIT(Assertion)                                                   \
+  VISIT(Text)
+
+#define FOR_EACH_REG_EXP_TREE_TYPE(VISIT)                            \
+  VISIT(Disjunction)                                                 \
+  VISIT(Alternative)                                                 \
+  VISIT(Assertion)                                                   \
+  VISIT(CharacterClass)                                              \
+  VISIT(Atom)                                                        \
+  VISIT(Quantifier)                                                  \
+  VISIT(Capture)                                                     \
+  VISIT(Lookahead)                                                   \
+  VISIT(BackReference)                                               \
+  VISIT(Empty)                                                       \
+  VISIT(Text)
+
+#define FORWARD_DECLARE(Name) class RegExp##Name;
+FOR_EACH_REG_EXP_TREE_TYPE(FORWARD_DECLARE)
+#undef FORWARD_DECLARE
+
+// InfallibleVector is like Vector, but all its methods are infallible (they
+// crash on OOM). We use this class instead of Vector to avoid a ton of
+// MOZ_MUST_USE warnings in irregexp code (imported from V8).
+template<typename T, size_t N>
+class InfallibleVector
+{
+    Vector<T, N, LifoAllocPolicy<Infallible>> vector_;
+
+    InfallibleVector(const InfallibleVector&) = delete;
+    void operator=(const InfallibleVector&) = delete;
+
+  public:
+    explicit InfallibleVector(const LifoAllocPolicy<Infallible>& alloc) : vector_(alloc) {}
+
+    void append(const T& t) { MOZ_ALWAYS_TRUE(vector_.append(t)); }
+    void append(const T* begin, size_t length) { MOZ_ALWAYS_TRUE(vector_.append(begin, length)); }
+
+    void clear() { vector_.clear(); }
+    void popBack() { vector_.popBack(); }
+    void reserve(size_t n) { MOZ_ALWAYS_TRUE(vector_.reserve(n)); }
+
+    size_t length() const { return vector_.length(); }
+    T popCopy() { return vector_.popCopy(); }
+
+    T* begin() { return vector_.begin(); }
+    const T* begin() const { return vector_.begin(); }
+
+    T& operator[](size_t index) { return vector_[index]; }
+    const T& operator[](size_t index) const { return vector_[index]; }
+
+    InfallibleVector& operator=(InfallibleVector&& rhs) { vector_ = Move(rhs.vector_); return *this; }
+};
+
+class CharacterRange;
+typedef InfallibleVector<CharacterRange, 1> CharacterRangeVector;
+
+// Represents code units in the range from from_ to to_, both ends are
+// inclusive.
+class CharacterRange
+{
+  public:
+    CharacterRange()
+      : from_(0), to_(0)
+    {}
+
+    CharacterRange(char16_t from, char16_t to)
+      : from_(from), to_(to)
+    {}
+
+    static void AddClassEscape(LifoAlloc* alloc, char16_t type, CharacterRangeVector* ranges);
+    static void AddClassEscapeUnicode(LifoAlloc* alloc, char16_t type,
+                                      CharacterRangeVector* ranges, bool ignoreCase);
+
+    static inline CharacterRange Singleton(char16_t value) {
+        return CharacterRange(value, value);
+    }
+    static inline CharacterRange Range(char16_t from, char16_t to) {
+        MOZ_ASSERT(from <= to);
+        return CharacterRange(from, to);
+    }
+    static inline CharacterRange Everything() {
+        return CharacterRange(0, 0xFFFF);
+    }
+    bool Contains(char16_t i) { return from_ <= i && i <= to_; }
+    char16_t from() const { return from_; }
+    void set_from(char16_t value) { from_ = value; }
+    char16_t to() const { return to_; }
+    void set_to(char16_t value) { to_ = value; }
+    bool is_valid() { return from_ <= to_; }
+    bool IsEverything(char16_t max) { return from_ == 0 && to_ >= max; }
+    bool IsSingleton() { return (from_ == to_); }
+    void AddCaseEquivalents(bool is_ascii, bool unicode, CharacterRangeVector* ranges);
+
+    static void Split(const LifoAlloc* alloc,
+                      CharacterRangeVector base,
+                      const Vector<int>& overlay,
+                      CharacterRangeVector* included,
+                      CharacterRangeVector* excluded);
+
+    // Whether a range list is in canonical form: Ranges ordered by from value,
+    // and ranges non-overlapping and non-adjacent.
+    static bool IsCanonical(const CharacterRangeVector& ranges);
+
+    // Convert range list to canonical form. The characters covered by the ranges
+    // will still be the same, but no character is in more than one range, and
+    // adjacent ranges are merged. The resulting list may be shorter than the
+    // original, but cannot be longer.
+    static void Canonicalize(CharacterRangeVector& ranges);
+
+    // Negate the contents of a character range in canonical form.
+    static void Negate(const LifoAlloc* alloc,
+                       CharacterRangeVector src,
+                       CharacterRangeVector* dst);
+
+    static const int kStartMarker = (1 << 24);
+    static const int kPayloadMask = (1 << 24) - 1;
+
+  private:
+    char16_t from_;
+    char16_t to_;
+};
+
+// A set of unsigned integers that behaves especially well on small
+// integers (< 32).
+class OutSet
+{
+  public:
+    OutSet()
+      : first_(0), remaining_(nullptr), successors_(nullptr)
+    {}
+
+    OutSet* Extend(LifoAlloc* alloc, unsigned value);
+    bool Get(unsigned value);
+    static const unsigned kFirstLimit = 32;
+
+  private:
+    typedef InfallibleVector<OutSet*, 1> OutSetVector;
+    typedef InfallibleVector<unsigned, 1> RemainingVector;
+
+    // Destructively set a value in this set.  In most cases you want
+    // to use Extend instead to ensure that only one instance exists
+    // that contains the same values.
+    void Set(LifoAlloc* alloc, unsigned value);
+
+    // The successors are a list of sets that contain the same values
+    // as this set and the one more value that is not present in this
+    // set.
+    OutSetVector* successors() { return successors_; }
+
+    OutSet(uint32_t first, RemainingVector* remaining)
+      : first_(first), remaining_(remaining), successors_(nullptr)
+    {}
+
+    RemainingVector& remaining() { return *remaining_; }
+
+    uint32_t first_;
+    RemainingVector* remaining_;
+    OutSetVector* successors_;
+    friend class Trace;
+};
+
+// A mapping from integers, specified as ranges, to a set of integers.
+// Used for mapping character ranges to choices.
+class DispatchTable
+{
+  public:
+    explicit DispatchTable(LifoAlloc* alloc)
+    {}
+
+    class Entry {
+      public:
+        Entry()
+          : from_(0), to_(0), out_set_(nullptr)
+        {}
+
+        Entry(char16_t from, char16_t to, OutSet* out_set)
+          : from_(from), to_(to), out_set_(out_set)
+        {}
+
+        char16_t from() { return from_; }
+        char16_t to() { return to_; }
+        void set_to(char16_t value) { to_ = value; }
+        void AddValue(LifoAlloc* alloc, int value) {
+            out_set_ = out_set_->Extend(alloc, value);
+        }
+        OutSet* out_set() { return out_set_; }
+      private:
+        char16_t from_;
+        char16_t to_;
+        OutSet* out_set_;
+    };
+
+    void AddRange(LifoAlloc* alloc, CharacterRange range, int value);
+    OutSet* Get(char16_t value);
+    void Dump();
+
+  private:
+    // There can't be a static empty set since it allocates its
+    // successors in a LifoAlloc and caches them.
+    OutSet* empty() { return &empty_; }
+    OutSet empty_;
+};
+
+class TextElement
+{
+  public:
+    enum TextType {
+        ATOM,
+        CHAR_CLASS
+    };
+
+    static TextElement Atom(RegExpAtom* atom);
+    static TextElement CharClass(RegExpCharacterClass* char_class);
+
+    int cp_offset() const { return cp_offset_; }
+    void set_cp_offset(int cp_offset) { cp_offset_ = cp_offset; }
+    int length() const;
+
+    TextType text_type() const { return text_type_; }
+
+    RegExpTree* tree() const { return tree_; }
+
+    RegExpAtom* atom() const {
+        MOZ_ASSERT(text_type() == ATOM);
+        return reinterpret_cast<RegExpAtom*>(tree());
+    }
+
+    RegExpCharacterClass* char_class() const {
+        MOZ_ASSERT(text_type() == CHAR_CLASS);
+        return reinterpret_cast<RegExpCharacterClass*>(tree());
+    }
+
+  private:
+    TextElement(TextType text_type, RegExpTree* tree)
+      : cp_offset_(-1), text_type_(text_type), tree_(tree)
+    {}
+
+    int cp_offset_;
+    TextType text_type_;
+    RegExpTree* tree_;
+};
+
+typedef InfallibleVector<TextElement, 1> TextElementVector;
+
+class NodeVisitor;
+class RegExpCompiler;
+class Trace;
+class BoyerMooreLookahead;
+
+struct NodeInfo
+{
+    NodeInfo()
+      : being_analyzed(false),
+        been_analyzed(false),
+        follows_word_interest(false),
+        follows_newline_interest(false),
+        follows_start_interest(false),
+        at_end(false),
+        visited(false),
+        replacement_calculated(false)
+    {}
+
+    // Returns true if the interests and assumptions of this node
+    // matches the given one.
+    bool Matches(NodeInfo* that) {
+        return (at_end == that->at_end) &&
+            (follows_word_interest == that->follows_word_interest) &&
+            (follows_newline_interest == that->follows_newline_interest) &&
+            (follows_start_interest == that->follows_start_interest);
+    }
+
+    // Updates the interests of this node given the interests of the
+    // node preceding it.
+    void AddFromPreceding(NodeInfo* that) {
+        at_end |= that->at_end;
+        follows_word_interest |= that->follows_word_interest;
+        follows_newline_interest |= that->follows_newline_interest;
+        follows_start_interest |= that->follows_start_interest;
+    }
+
+    bool HasLookbehind() {
+        return follows_word_interest ||
+            follows_newline_interest ||
+            follows_start_interest;
+    }
+
+    // Sets the interests of this node to include the interests of the
+    // following node.
+    void AddFromFollowing(NodeInfo* that) {
+        follows_word_interest |= that->follows_word_interest;
+        follows_newline_interest |= that->follows_newline_interest;
+        follows_start_interest |= that->follows_start_interest;
+    }
+
+    void ResetCompilationState() {
+        being_analyzed = false;
+        been_analyzed = false;
+    }
+
+    bool being_analyzed: 1;
+    bool been_analyzed: 1;
+
+    // These bits are set of this node has to know what the preceding
+    // character was.
+    bool follows_word_interest: 1;
+    bool follows_newline_interest: 1;
+    bool follows_start_interest: 1;
+
+    bool at_end: 1;
+    bool visited: 1;
+    bool replacement_calculated: 1;
+};
+
+// Details of a quick mask-compare check that can look ahead in the
+// input stream.
+class QuickCheckDetails
+{
+  public:
+    QuickCheckDetails()
+      : characters_(0),
+        mask_(0),
+        value_(0),
+        cannot_match_(false)
+    {}
+
+    explicit QuickCheckDetails(int characters)
+      : characters_(characters),
+        mask_(0),
+        value_(0),
+        cannot_match_(false)
+    {}
+
+    bool Rationalize(bool ascii);
+
+    // Merge in the information from another branch of an alternation.
+    void Merge(QuickCheckDetails* other, int from_index);
+
+    // Advance the current position by some amount.
+    void Advance(int by, bool ascii);
+
+    void Clear();
+
+    bool cannot_match() { return cannot_match_; }
+    void set_cannot_match() { cannot_match_ = true; }
+
+    int characters() { return characters_; }
+    void set_characters(int characters) { characters_ = characters; }
+
+    struct Position {
+        Position() : mask(0), value(0), determines_perfectly(false) { }
+        char16_t mask;
+        char16_t value;
+        bool determines_perfectly;
+    };
+
+    Position* positions(int index) {
+        MOZ_ASSERT(index >= 0);
+        MOZ_ASSERT(index < characters_);
+        return positions_ + index;
+    }
+
+    uint32_t mask() { return mask_; }
+    uint32_t value() { return value_; }
+
+  private:
+    // How many characters do we have quick check information from.  This is
+    // the same for all branches of a choice node.
+    int characters_;
+    Position positions_[4];
+
+    // These values are the condensate of the above array after Rationalize().
+    uint32_t mask_;
+    uint32_t value_;
+
+    // If set to true, there is no way this quick check can match at all.
+    // E.g., if it requires to be at the start of the input, and isn't.
+    bool cannot_match_;
+};
+
+class RegExpNode
+{
+  public:
+    explicit RegExpNode(LifoAlloc* alloc);
+    virtual ~RegExpNode() {}
+    virtual void Accept(NodeVisitor* visitor) = 0;
+
+    // Generates a goto to this node or actually generates the code at this point.
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace) = 0;
+
+    // How many characters must this node consume at a minimum in order to
+    // succeed.  If we have found at least 'still_to_find' characters that
+    // must be consumed there is no need to ask any following nodes whether
+    // they are sure to eat any more characters.  The not_at_start argument is
+    // used to indicate that we know we are not at the start of the input.  In
+    // this case anchored branches will always fail and can be ignored when
+    // determining how many characters are consumed on success.
+    virtual int EatsAtLeast(int still_to_find, int budget, bool not_at_start) = 0;
+
+    // Emits some quick code that checks whether the preloaded characters match.
+    // Falls through on certain failure, jumps to the label on possible success.
+    // If the node cannot make a quick check it does nothing and returns false.
+    bool EmitQuickCheck(RegExpCompiler* compiler,
+                        Trace* trace,
+                        bool preload_has_checked_bounds,
+                        jit::Label* on_possible_success,
+                        QuickCheckDetails* details_return,
+                        bool fall_through_on_failure);
+
+    // For a given number of characters this returns a mask and a value.  The
+    // next n characters are anded with the mask and compared with the value.
+    // A comparison failure indicates the node cannot match the next n characters.
+    // A comparison success indicates the node may match.
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start) = 0;
+
+    static const int kNodeIsTooComplexForGreedyLoops = -1;
+
+    virtual int GreedyLoopTextLength() { return kNodeIsTooComplexForGreedyLoops; }
+
+    // Only returns the successor for a text node of length 1 that matches any
+    // character and that has no guards on it.
+    virtual RegExpNode* GetSuccessorOfOmnivorousTextNode(RegExpCompiler* compiler) {
+        return nullptr;
+    }
+
+    static const int kRecursionBudget = 200;
+
+    // Collects information on the possible code units (mod 128) that can match if
+    // we look forward.  This is used for a Boyer-Moore-like string searching
+    // implementation.  TODO(erikcorry):  This should share more code with
+    // EatsAtLeast, GetQuickCheckDetails.  The budget argument is used to limit
+    // the number of nodes we are willing to look at in order to create this data.
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start) {
+        MOZ_CRASH("Bad call");
+    }
+
+    // If we know that the input is ASCII then there are some nodes that can
+    // never match.  This method returns a node that can be substituted for
+    // itself, or nullptr if the node can never match.
+    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode) { return this; }
+
+    // Helper for FilterASCII.
+    RegExpNode* replacement() {
+        MOZ_ASSERT(info()->replacement_calculated);
+        return replacement_;
+    }
+    RegExpNode* set_replacement(RegExpNode* replacement) {
+        info()->replacement_calculated = true;
+        replacement_ =  replacement;
+        return replacement;  // For convenience.
+    }
+
+    // We want to avoid recalculating the lookahead info, so we store it on the
+    // node.  Only info that is for this node is stored.  We can tell that the
+    // info is for this node when offset == 0, so the information is calculated
+    // relative to this node.
+    void SaveBMInfo(BoyerMooreLookahead* bm, bool not_at_start, int offset) {
+        if (offset == 0) set_bm_info(not_at_start, bm);
+    }
+
+    jit::Label* label() { return &label_; }
+
+    // If non-generic code is generated for a node (i.e. the node is not at the
+    // start of the trace) then it cannot be reused.  This variable sets a limit
+    // on how often we allow that to happen before we insist on starting a new
+    // trace and generating generic code for a node that can be reused by flushing
+    // the deferred actions in the current trace and generating a goto.
+    static const int kMaxCopiesCodeGenerated = 10;
+
+    NodeInfo* info() { return &info_; }
+
+    BoyerMooreLookahead* bm_info(bool not_at_start) {
+        return bm_info_[not_at_start ? 1 : 0];
+    }
+
+    LifoAlloc* alloc() const { return alloc_; }
+
+  protected:
+    enum LimitResult { DONE, CONTINUE };
+    RegExpNode* replacement_;
+
+    LimitResult LimitVersions(RegExpCompiler* compiler, Trace* trace);
+
+    void set_bm_info(bool not_at_start, BoyerMooreLookahead* bm) {
+        bm_info_[not_at_start ? 1 : 0] = bm;
+    }
+
+  private:
+    static const int kFirstCharBudget = 10;
+    jit::Label label_;
+    NodeInfo info_;
+
+    // This variable keeps track of how many times code has been generated for
+    // this node (in different traces).  We don't keep track of where the
+    // generated code is located unless the code is generated at the start of
+    // a trace, in which case it is generic and can be reused by flushing the
+    // deferred operations in the current trace and generating a goto.
+    int trace_count_;
+    BoyerMooreLookahead* bm_info_[2];
+
+    LifoAlloc* alloc_;
+};
+
+// A simple closed interval.
+class Interval
+{
+  public:
+    Interval() : from_(kNone), to_(kNone) { }
+
+    Interval(int from, int to) : from_(from), to_(to) { }
+
+    Interval Union(Interval that) {
+        if (that.from_ == kNone)
+            return *this;
+        else if (from_ == kNone)
+            return that;
+        else
+            return Interval(Min(from_, that.from_), Max(to_, that.to_));
+    }
+
+    bool Contains(int value) {
+        return (from_ <= value) && (value <= to_);
+    }
+
+    bool is_empty() { return from_ == kNone; }
+
+    int from() const { return from_; }
+    int to() const { return to_; }
+
+    static Interval Empty() { return Interval(); }
+    static const int kNone = -1;
+
+  private:
+    int from_;
+    int to_;
+};
+
+class SeqRegExpNode : public RegExpNode
+{
+  public:
+    explicit SeqRegExpNode(RegExpNode* on_success)
+      : RegExpNode(on_success->alloc()), on_success_(on_success)
+    {}
+
+    RegExpNode* on_success() { return on_success_; }
+    void set_on_success(RegExpNode* node) { on_success_ = node; }
+    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+
+  protected:
+    RegExpNode* FilterSuccessor(int depth, bool ignore_case, bool unicode);
+
+  private:
+    RegExpNode* on_success_;
+};
+
+class ActionNode : public SeqRegExpNode
+{
+  public:
+    enum ActionType {
+        SET_REGISTER,
+        INCREMENT_REGISTER,
+        STORE_POSITION,
+        BEGIN_SUBMATCH,
+        POSITIVE_SUBMATCH_SUCCESS,
+        EMPTY_MATCH_CHECK,
+        CLEAR_CAPTURES
+    };
+
+    ActionNode(ActionType action_type, RegExpNode* on_success)
+      : SeqRegExpNode(on_success),
+        action_type_(action_type)
+    {}
+
+    static ActionNode* SetRegister(int reg, int val, RegExpNode* on_success);
+    static ActionNode* IncrementRegister(int reg, RegExpNode* on_success);
+    static ActionNode* StorePosition(int reg,
+                                     bool is_capture,
+                                     RegExpNode* on_success);
+    static ActionNode* ClearCaptures(Interval range, RegExpNode* on_success);
+    static ActionNode* BeginSubmatch(int stack_pointer_reg,
+                                     int position_reg,
+                                     RegExpNode* on_success);
+    static ActionNode* PositiveSubmatchSuccess(int stack_pointer_reg,
+                                               int restore_reg,
+                                               int clear_capture_count,
+                                               int clear_capture_from,
+                                               RegExpNode* on_success);
+    static ActionNode* EmptyMatchCheck(int start_register,
+                                       int repetition_register,
+                                       int repetition_limit,
+                                       RegExpNode* on_success);
+    virtual void Accept(NodeVisitor* visitor);
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find, int budget, bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int filled_in,
+                                      bool not_at_start) {
+        return on_success()->GetQuickCheckDetails(
+                                                  details, compiler, filled_in, not_at_start);
+    }
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+    ActionType action_type() { return action_type_; }
+    // TODO(erikcorry): We should allow some action nodes in greedy loops.
+    virtual int GreedyLoopTextLength() { return kNodeIsTooComplexForGreedyLoops; }
+
+  private:
+    union {
+        struct {
+            int reg;
+            int value;
+        } u_store_register;
+        struct {
+            int reg;
+        } u_increment_register;
+        struct {
+            int reg;
+            bool is_capture;
+        } u_position_register;
+        struct {
+            int stack_pointer_register;
+            int current_position_register;
+            int clear_register_count;
+            int clear_register_from;
+        } u_submatch;
+        struct {
+            int start_register;
+            int repetition_register;
+            int repetition_limit;
+        } u_empty_match_check;
+        struct {
+            int range_from;
+            int range_to;
+        } u_clear_captures;
+    } data_;
+    ActionType action_type_;
+    friend class DotPrinter;
+};
+
+class TextNode : public SeqRegExpNode
+{
+  public:
+    TextNode(TextElementVector* elements,
+             RegExpNode* on_success)
+      : SeqRegExpNode(on_success),
+        elements_(elements)
+    {}
+
+    TextNode(RegExpCharacterClass* that,
+             RegExpNode* on_success)
+      : SeqRegExpNode(on_success),
+        elements_(alloc()->newInfallible<TextElementVector>(*alloc()))
+    {
+        elements_->append(TextElement::CharClass(that));
+    }
+
+    virtual void Accept(NodeVisitor* visitor);
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find, int budget, bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start);
+    TextElementVector& elements() { return *elements_; }
+    void MakeCaseIndependent(bool is_ascii, bool unicode);
+    virtual int GreedyLoopTextLength();
+    virtual RegExpNode* GetSuccessorOfOmnivorousTextNode(
+                                                         RegExpCompiler* compiler);
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+    void CalculateOffsets();
+    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);
+
+  private:
+    enum TextEmitPassType {
+        NON_ASCII_MATCH,             // Check for characters that can't match.
+        SIMPLE_CHARACTER_MATCH,      // Case-dependent single character check.
+        NON_LETTER_CHARACTER_MATCH,  // Check characters that have no case equivs.
+        CASE_CHARACTER_MATCH,        // Case-independent single character check.
+        CHARACTER_CLASS_MATCH        // Character class.
+    };
+    static bool SkipPass(int pass, bool ignore_case);
+    static const int kFirstRealPass = SIMPLE_CHARACTER_MATCH;
+    static const int kLastPass = CHARACTER_CLASS_MATCH;
+    void TextEmitPass(RegExpCompiler* compiler,
+                      TextEmitPassType pass,
+                      bool preloaded,
+                      Trace* trace,
+                      bool first_element_checked,
+                      int* checked_up_to);
+    int Length();
+    TextElementVector* elements_;
+};
+
+class AssertionNode : public SeqRegExpNode
+{
+  public:
+    enum AssertionType {
+        AT_END,
+        AT_START,
+        AT_BOUNDARY,
+        AT_NON_BOUNDARY,
+        AFTER_NEWLINE,
+        NOT_AFTER_LEAD_SURROGATE,
+        NOT_IN_SURROGATE_PAIR
+    };
+    AssertionNode(AssertionType t, RegExpNode* on_success)
+      : SeqRegExpNode(on_success), assertion_type_(t)
+    {}
+
+    static AssertionNode* AtEnd(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(AT_END, on_success);
+    }
+    static AssertionNode* AtStart(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(AT_START, on_success);
+    }
+    static AssertionNode* AtBoundary(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(AT_BOUNDARY, on_success);
+    }
+    static AssertionNode* AtNonBoundary(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(AT_NON_BOUNDARY, on_success);
+    }
+    static AssertionNode* AfterNewline(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(AFTER_NEWLINE, on_success);
+    }
+    static AssertionNode* NotAfterLeadSurrogate(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(NOT_AFTER_LEAD_SURROGATE,
+                                                                 on_success);
+    }
+    static AssertionNode* NotInSurrogatePair(RegExpNode* on_success) {
+        return on_success->alloc()->newInfallible<AssertionNode>(NOT_IN_SURROGATE_PAIR,
+                                                                 on_success);
+    }
+    virtual void Accept(NodeVisitor* visitor);
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find, int budget, bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int filled_in,
+                                      bool not_at_start);
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+    AssertionType assertion_type() { return assertion_type_; }
+
+  private:
+    void EmitBoundaryCheck(RegExpCompiler* compiler, Trace* trace);
+    enum IfPrevious { kIsNonWord, kIsWord };
+    void BacktrackIfPrevious(RegExpCompiler* compiler,
+                             Trace* trace,
+                             IfPrevious backtrack_if_previous);
+    AssertionType assertion_type_;
+};
+
+class BackReferenceNode : public SeqRegExpNode
+{
+  public:
+    BackReferenceNode(int start_reg,
+                      int end_reg,
+                      RegExpNode* on_success)
+      : SeqRegExpNode(on_success),
+        start_reg_(start_reg),
+        end_reg_(end_reg)
+    {}
+
+    virtual void Accept(NodeVisitor* visitor);
+    int start_register() { return start_reg_; }
+    int end_register() { return end_reg_; }
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find,
+                            int recursion_depth,
+                            bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start) {
+        return;
+    }
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+
+  private:
+    int start_reg_;
+    int end_reg_;
+};
+
+class EndNode : public RegExpNode
+{
+  public:
+    enum Action { ACCEPT, BACKTRACK, NEGATIVE_SUBMATCH_SUCCESS };
+
+    explicit EndNode(LifoAlloc* alloc, Action action)
+      : RegExpNode(alloc), action_(action)
+    {}
+
+    virtual void Accept(NodeVisitor* visitor);
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find,
+                            int recursion_depth,
+                            bool not_at_start) { return 0; }
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start)
+    {
+        // Returning 0 from EatsAtLeast should ensure we never get here.
+        MOZ_CRASH("Bad call");
+    }
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start) {
+        // Returning 0 from EatsAtLeast should ensure we never get here.
+        MOZ_CRASH("Bad call");
+    }
+
+  private:
+    Action action_;
+};
+
+class NegativeSubmatchSuccess : public EndNode
+{
+  public:
+    NegativeSubmatchSuccess(LifoAlloc* alloc,
+                            int stack_pointer_reg,
+                            int position_reg,
+                            int clear_capture_count,
+                            int clear_capture_start)
+      : EndNode(alloc, NEGATIVE_SUBMATCH_SUCCESS),
+        stack_pointer_register_(stack_pointer_reg),
+        current_position_register_(position_reg),
+        clear_capture_count_(clear_capture_count),
+        clear_capture_start_(clear_capture_start)
+    {}
+
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+
+  private:
+    int stack_pointer_register_;
+    int current_position_register_;
+    int clear_capture_count_;
+    int clear_capture_start_;
+};
+
+class Guard
+{
+  public:
+    enum Relation { LT, GEQ };
+    Guard(int reg, Relation op, int value)
+        : reg_(reg),
+          op_(op),
+          value_(value)
+    {}
+
+    int reg() { return reg_; }
+    Relation op() { return op_; }
+    int value() { return value_; }
+
+  private:
+    int reg_;
+    Relation op_;
+    int value_;
+};
+
+typedef InfallibleVector<Guard*, 1> GuardVector;
+
+class GuardedAlternative
+{
+  public:
+    explicit GuardedAlternative(RegExpNode* node)
+      : node_(node), guards_(nullptr)
+    {}
+
+    void AddGuard(LifoAlloc* alloc, Guard* guard);
+    RegExpNode* node() const { return node_; }
+    void set_node(RegExpNode* node) { node_ = node; }
+    const GuardVector* guards() const { return guards_; }
+
+  private:
+    RegExpNode* node_;
+    GuardVector* guards_;
+};
+
+typedef InfallibleVector<GuardedAlternative, 0> GuardedAlternativeVector;
+
+class AlternativeGeneration;
+
+class ChoiceNode : public RegExpNode
+{
+  public:
+    explicit ChoiceNode(LifoAlloc* alloc, int expected_size)
+      : RegExpNode(alloc),
+        alternatives_(*alloc),
+        table_(nullptr),
+        not_at_start_(false),
+        being_calculated_(false)
+    {
+        alternatives_.reserve(expected_size);
+    }
+
+    virtual void Accept(NodeVisitor* visitor);
+    void AddAlternative(GuardedAlternative node) {
+        alternatives_.append(node);
+    }
+
+    GuardedAlternativeVector& alternatives() { return alternatives_; }
+    DispatchTable* GetTable(bool ignore_case);
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find, int budget, bool not_at_start);
+    int EatsAtLeastHelper(int still_to_find,
+                          int budget,
+                          RegExpNode* ignore_this_node,
+                          bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start);
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+
+    bool being_calculated() { return being_calculated_; }
+    bool not_at_start() { return not_at_start_; }
+    void set_not_at_start() { not_at_start_ = true; }
+    void set_being_calculated(bool b) { being_calculated_ = b; }
+    virtual bool try_to_emit_quick_check_for_alternative(int i) { return true; }
+    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);
+
+  protected:
+    int GreedyLoopTextLengthForAlternative(GuardedAlternative* alternative);
+    GuardedAlternativeVector alternatives_;
+
+  private:
+    friend class Analysis;
+    void GenerateGuard(RegExpMacroAssembler* macro_assembler,
+                       Guard* guard,
+                       Trace* trace);
+    int CalculatePreloadCharacters(RegExpCompiler* compiler, int eats_at_least);
+    void EmitOutOfLineContinuation(RegExpCompiler* compiler,
+                                   Trace* trace,
+                                   GuardedAlternative alternative,
+                                   AlternativeGeneration* alt_gen,
+                                   int preload_characters,
+                                   bool next_expects_preload);
+    DispatchTable* table_;
+
+    // If true, this node is never checked at the start of the input.
+    // Allows a new trace to start with at_start() set to false.
+    bool not_at_start_;
+    bool being_calculated_;
+};
+
+class NegativeLookaheadChoiceNode : public ChoiceNode
+{
+  public:
+    explicit NegativeLookaheadChoiceNode(LifoAlloc* alloc,
+                                         GuardedAlternative this_must_fail,
+                                         GuardedAlternative then_do_this)
+      : ChoiceNode(alloc, 2)
+    {
+        AddAlternative(this_must_fail);
+        AddAlternative(then_do_this);
+    }
+    virtual int EatsAtLeast(int still_to_find, int budget, bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start);
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+
+    // For a negative lookahead we don't emit the quick check for the
+    // alternative that is expected to fail.  This is because quick check code
+    // starts by loading enough characters for the alternative that takes fewest
+    // characters, but on a negative lookahead the negative branch did not take
+    // part in that calculation (EatsAtLeast) so the assumptions don't hold.
+    virtual bool try_to_emit_quick_check_for_alternative(int i) { return i != 0; }
+    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);
+};
+
+class LoopChoiceNode : public ChoiceNode
+{
+  public:
+    explicit LoopChoiceNode(LifoAlloc* alloc, bool body_can_be_zero_length)
+      : ChoiceNode(alloc, 2),
+        loop_node_(nullptr),
+        continue_node_(nullptr),
+        body_can_be_zero_length_(body_can_be_zero_length)
+    {}
+
+    void AddLoopAlternative(GuardedAlternative alt);
+    void AddContinueAlternative(GuardedAlternative alt);
+    virtual void Emit(RegExpCompiler* compiler, Trace* trace);
+    virtual int EatsAtLeast(int still_to_find,  int budget, bool not_at_start);
+    virtual void GetQuickCheckDetails(QuickCheckDetails* details,
+                                      RegExpCompiler* compiler,
+                                      int characters_filled_in,
+                                      bool not_at_start);
+    virtual bool FillInBMInfo(int offset,
+                              int budget,
+                              BoyerMooreLookahead* bm,
+                              bool not_at_start);
+    RegExpNode* loop_node() { return loop_node_; }
+    RegExpNode* continue_node() { return continue_node_; }
+    bool body_can_be_zero_length() { return body_can_be_zero_length_; }
+    virtual void Accept(NodeVisitor* visitor);
+    virtual RegExpNode* FilterASCII(int depth, bool ignore_case, bool unicode);
+
+  private:
+    // AddAlternative is made private for loop nodes because alternatives
+    // should not be added freely, we need to keep track of which node
+    // goes back to the node itself.
+    void AddAlternative(GuardedAlternative node) {
+        ChoiceNode::AddAlternative(node);
+    }
+
+    RegExpNode* loop_node_;
+    RegExpNode* continue_node_;
+    bool body_can_be_zero_length_;
+};
+
+// Improve the speed that we scan for an initial point where a non-anchored
+// regexp can match by using a Boyer-Moore-like table. This is done by
+// identifying non-greedy non-capturing loops in the nodes that eat any
+// character one at a time.  For example in the middle of the regexp
+// /foo[\s\S]*?bar/ we find such a loop.  There is also such a loop implicitly
+// inserted at the start of any non-anchored regexp.
+//
+// When we have found such a loop we look ahead in the nodes to find the set of
+// characters that can come at given distances. For example for the regexp
+// /.?foo/ we know that there are at least 3 characters ahead of us, and the
+// sets of characters that can occur are [any, [f, o], [o]]. We find a range in
+// the lookahead info where the set of characters is reasonably constrained. In
+// our example this is from index 1 to 2 (0 is not constrained). We can now
+// look 3 characters ahead and if we don't find one of [f, o] (the union of
+// [f, o] and [o]) then we can skip forwards by the range size (in this case 2).
+//
+// For Unicode input strings we do the same, but modulo 128.
+//
+// We also look at the first string fed to the regexp and use that to get a hint
+// of the character frequencies in the inputs. This affects the assessment of
+// whether the set of characters is 'reasonably constrained'.
+//
+// We also have another lookahead mechanism (called quick check in the code),
+// which uses a wide load of multiple characters followed by a mask and compare
+// to determine whether a match is possible at this point.
+enum ContainedInLattice {
+  kNotYet = 0,
+  kLatticeIn = 1,
+  kLatticeOut = 2,
+  kLatticeUnknown = 3  // Can also mean both in and out.
+};
+
+inline ContainedInLattice
+Combine(ContainedInLattice a, ContainedInLattice b) {
+    return static_cast<ContainedInLattice>(a | b);
+}
+
+ContainedInLattice
+AddRange(ContainedInLattice a,
+         const int* ranges,
+         int ranges_size,
+         Interval new_range);
+
+class BoyerMoorePositionInfo
+{
+  public:
+    explicit BoyerMoorePositionInfo(LifoAlloc* alloc)
+      : map_(*alloc),
+        map_count_(0),
+        w_(kNotYet),
+        s_(kNotYet),
+        d_(kNotYet),
+        surrogate_(kNotYet)
+    {
+        map_.reserve(kMapSize);
+        for (int i = 0; i < kMapSize; i++)
+            map_.append(false);
+    }
+
+    bool& at(int i) { return map_[i]; }
+
+    static const int kMapSize = 128;
+    static const int kMask = kMapSize - 1;
+
+    int map_count() const { return map_count_; }
+
+    void Set(int character);
+    void SetInterval(const Interval& interval);
+    void SetAll();
+    bool is_non_word() { return w_ == kLatticeOut; }
+    bool is_word() { return w_ == kLatticeIn; }
+
+  private:
+    InfallibleVector<bool, 0> map_;
+    int map_count_;  // Number of set bits in the map.
+    ContainedInLattice w_;  // The \w character class.
+    ContainedInLattice s_;  // The \s character class.
+    ContainedInLattice d_;  // The \d character class.
+    ContainedInLattice surrogate_;  // Surrogate UTF-16 code units.
+};
+
+typedef InfallibleVector<BoyerMoorePositionInfo*, 1> BoyerMoorePositionInfoVector;
+
+class BoyerMooreLookahead
+{
+  public:
+    BoyerMooreLookahead(LifoAlloc* alloc, size_t length, RegExpCompiler* compiler);
+
+    int length() { return length_; }
+    int max_char() { return max_char_; }
+    RegExpCompiler* compiler() { return compiler_; }
+
+    int Count(int map_number) {
+        return bitmaps_[map_number]->map_count();
+    }
+
+    BoyerMoorePositionInfo* at(int i) { return bitmaps_[i]; }
+
+    void Set(int map_number, int character) {
+        if (character > max_char_) return;
+        BoyerMoorePositionInfo* info = bitmaps_[map_number];
+        info->Set(character);
+    }
+
+    void SetInterval(int map_number, const Interval& interval) {
+        if (interval.from() > max_char_) return;
+        BoyerMoorePositionInfo* info = bitmaps_[map_number];
+        if (interval.to() > max_char_) {
+            info->SetInterval(Interval(interval.from(), max_char_));
+        } else {
+            info->SetInterval(interval);
+        }
+    }
+
+    void SetAll(int map_number) {
+        bitmaps_[map_number]->SetAll();
+    }
+
+    void SetRest(int from_map) {
+        for (int i = from_map; i < length_; i++) SetAll(i);
+    }
+    bool EmitSkipInstructions(RegExpMacroAssembler* masm);
+
+    bool CheckOverRecursed();
+
+  private:
+    // This is the value obtained by EatsAtLeast.  If we do not have at least this
+    // many characters left in the sample string then the match is bound to fail.
+    // Therefore it is OK to read a character this far ahead of the current match
+    // point.
+    int length_;
+    RegExpCompiler* compiler_;
+
+    // 0x7f for ASCII, 0xffff for UTF-16.
+    int max_char_;
+    BoyerMoorePositionInfoVector bitmaps_;
+
+    int GetSkipTable(int min_lookahead,
+                     int max_lookahead,
+                     uint8_t* boolean_skip_table);
+    bool FindWorthwhileInterval(int* from, int* to);
+    int FindBestInterval(int max_number_of_chars, int old_biggest_points, int* from, int* to);
+};
+
+// There are many ways to generate code for a node.  This class encapsulates
+// the current way we should be generating.  In other words it encapsulates
+// the current state of the code generator.  The effect of this is that we
+// generate code for paths that the matcher can take through the regular
+// expression.  A given node in the regexp can be code-generated several times
+// as it can be part of several traces.  For example for the regexp:
+// /foo(bar|ip)baz/ the code to match baz will be generated twice, once as part
+// of the foo-bar-baz trace and once as part of the foo-ip-baz trace.  The code
+// to match foo is generated only once (the traces have a common prefix).  The
+// code to store the capture is deferred and generated (twice) after the places
+// where baz has been matched.
+class Trace
+{
+  public:
+    // A value for a property that is either known to be true, know to be false,
+    // or not known.
+    enum TriBool {
+        UNKNOWN = -1, FALSE_VALUE = 0, TRUE_VALUE = 1
+    };
+
+    class DeferredAction {
+      public:
+        DeferredAction(ActionNode::ActionType action_type, int reg)
+          : action_type_(action_type), reg_(reg), next_(nullptr)
+        {}
+
+        DeferredAction* next() { return next_; }
+        bool Mentions(int reg);
+        int reg() { return reg_; }
+        ActionNode::ActionType action_type() { return action_type_; }
+      private:
+        ActionNode::ActionType action_type_;
+        int reg_;
+        DeferredAction* next_;
+        friend class Trace;
+    };
+
+    class DeferredCapture : public DeferredAction {
+      public:
+        DeferredCapture(int reg, bool is_capture, Trace* trace)
+          : DeferredAction(ActionNode::STORE_POSITION, reg),
+            cp_offset_(trace->cp_offset()),
+            is_capture_(is_capture)
+        {}
+
+        int cp_offset() { return cp_offset_; }
+        bool is_capture() { return is_capture_; }
+      private:
+        int cp_offset_;
+        bool is_capture_;
+        void set_cp_offset(int cp_offset) { cp_offset_ = cp_offset; }
+    };
+
+    class DeferredSetRegister : public DeferredAction {
+      public:
+        DeferredSetRegister(int reg, int value)
+          : DeferredAction(ActionNode::SET_REGISTER, reg),
+            value_(value)
+        {}
+        int value() { return value_; }
+      private:
+        int value_;
+    };
+
+    class DeferredClearCaptures : public DeferredAction {
+      public:
+        explicit DeferredClearCaptures(Interval range)
+          : DeferredAction(ActionNode::CLEAR_CAPTURES, -1),
+            range_(range)
+        {}
+
+        Interval range() { return range_; }
+      private:
+        Interval range_;
+    };
+
+    class DeferredIncrementRegister : public DeferredAction {
+      public:
+        explicit DeferredIncrementRegister(int reg)
+          : DeferredAction(ActionNode::INCREMENT_REGISTER, reg)
+        {}
+    };
+
+    Trace()
+      : cp_offset_(0),
+        actions_(nullptr),
+        backtrack_(nullptr),
+        stop_node_(nullptr),
+        loop_label_(nullptr),
+        characters_preloaded_(0),
+        bound_checked_up_to_(0),
+        flush_budget_(100),
+        at_start_(UNKNOWN)
+    {}
+
+    // End the trace.  This involves flushing the deferred actions in the trace
+    // and pushing a backtrack location onto the backtrack stack.  Once this is
+    // done we can start a new trace or go to one that has already been
+    // generated.
+    void Flush(RegExpCompiler* compiler, RegExpNode* successor);
+
+    int cp_offset() { return cp_offset_; }
+    DeferredAction* actions() { return actions_; }
+
+    // A trivial trace is one that has no deferred actions or other state that
+    // affects the assumptions used when generating code.  There is no recorded
+    // backtrack location in a trivial trace, so with a trivial trace we will
+    // generate code that, on a failure to match, gets the backtrack location
+    // from the backtrack stack rather than using a direct jump instruction.  We
+    // always start code generation with a trivial trace and non-trivial traces
+    // are created as we emit code for nodes or add to the list of deferred
+    // actions in the trace.  The location of the code generated for a node using
+    // a trivial trace is recorded in a label in the node so that gotos can be
+    // generated to that code.
+    bool is_trivial() {
+        return backtrack_ == nullptr &&
+            actions_ == nullptr &&
+            cp_offset_ == 0 &&
+            characters_preloaded_ == 0 &&
+            bound_checked_up_to_ == 0 &&
+            quick_check_performed_.characters() == 0 &&
+            at_start_ == UNKNOWN;
+    }
+
+    TriBool at_start() { return at_start_; }
+    void set_at_start(bool at_start) {
+        at_start_ = at_start ? TRUE_VALUE : FALSE_VALUE;
+    }
+    jit::Label* backtrack() { return backtrack_; }
+    jit::Label* loop_label() { return loop_label_; }
+    RegExpNode* stop_node() { return stop_node_; }
+    int characters_preloaded() { return characters_preloaded_; }
+    int bound_checked_up_to() { return bound_checked_up_to_; }
+    int flush_budget() { return flush_budget_; }
+    QuickCheckDetails* quick_check_performed() { return &quick_check_performed_; }
+    bool mentions_reg(int reg);
+
+    // Returns true if a deferred position store exists to the specified
+    // register and stores the offset in the out-parameter.  Otherwise
+    // returns false.
+    bool GetStoredPosition(int reg, int* cp_offset);
+
+    // These set methods and AdvanceCurrentPositionInTrace should be used only on
+    // new traces - the intention is that traces are immutable after creation.
+    void add_action(DeferredAction* new_action) {
+        MOZ_ASSERT(new_action->next_ == nullptr);
+        new_action->next_ = actions_;
+        actions_ = new_action;
+    }
+
+    void set_backtrack(jit::Label* backtrack) { backtrack_ = backtrack; }
+    void set_stop_node(RegExpNode* node) { stop_node_ = node; }
+    void set_loop_label(jit::Label* label) { loop_label_ = label; }
+    void set_characters_preloaded(int count) { characters_preloaded_ = count; }
+    void set_bound_checked_up_to(int to) { bound_checked_up_to_ = to; }
+    void set_flush_budget(int to) { flush_budget_ = to; }
+    void set_quick_check_performed(QuickCheckDetails* d) {
+        quick_check_performed_ = *d;
+    }
+    void InvalidateCurrentCharacter();
+    void AdvanceCurrentPositionInTrace(int by, RegExpCompiler* compiler);
+
+  private:
+    int FindAffectedRegisters(LifoAlloc* alloc, OutSet* affected_registers);
+    void PerformDeferredActions(LifoAlloc* alloc,
+                                RegExpMacroAssembler* macro,
+                                int max_register,
+                                OutSet& affected_registers,
+                                OutSet* registers_to_pop,
+                                OutSet* registers_to_clear);
+    void RestoreAffectedRegisters(RegExpMacroAssembler* macro,
+                                  int max_register,
+                                  OutSet& registers_to_pop,
+                                  OutSet& registers_to_clear);
+    int cp_offset_;
+    DeferredAction* actions_;
+    jit::Label* backtrack_;
+    RegExpNode* stop_node_;
+    jit::Label* loop_label_;
+    int characters_preloaded_;
+    int bound_checked_up_to_;
+    QuickCheckDetails quick_check_performed_;
+    int flush_budget_;
+    TriBool at_start_;
+};
+
+class NodeVisitor
+{
+  public:
+    virtual ~NodeVisitor() { }
+#define DECLARE_VISIT(Type)                                          \
+    virtual void Visit##Type(Type##Node* that) = 0;
+    FOR_EACH_NODE_TYPE(DECLARE_VISIT)
+#undef DECLARE_VISIT
+    virtual void VisitLoopChoice(LoopChoiceNode* that) { VisitChoice(that); }
+};
+
+// Assertion propagation moves information about assertions such as
+// \b to the affected nodes.  For instance, in /.\b./ information must
+// be propagated to the first '.' that whatever follows needs to know
+// if it matched a word or a non-word, and to the second '.' that it
+// has to check if it succeeds a word or non-word.  In this case the
+// result will be something like:
+//
+//   +-------+        +------------+
+//   |   .   |        |      .     |
+//   +-------+  --->  +------------+
+//   | word? |        | check word |
+//   +-------+        +------------+
+class Analysis : public NodeVisitor
+{
+  public:
+    Analysis(JSContext* cx, bool ignore_case, bool is_ascii, bool unicode)
+      : cx(cx),
+        ignore_case_(ignore_case),
+        is_ascii_(is_ascii),
+        unicode_(unicode),
+        error_message_(nullptr)
+    {}
+
+    void EnsureAnalyzed(RegExpNode* node);
+
+#define DECLARE_VISIT(Type)                     \
+    virtual void Visit##Type(Type##Node* that);
+    FOR_EACH_NODE_TYPE(DECLARE_VISIT)
+#undef DECLARE_VISIT
+    virtual void VisitLoopChoice(LoopChoiceNode* that);
+
+    bool has_failed() { return error_message_ != nullptr; }
+    const char* errorMessage() {
+        MOZ_ASSERT(error_message_ != nullptr);
+        return error_message_;
+    }
+    void failASCII(const char* error_message) {
+        error_message_ = error_message;
+    }
+
+  private:
+    JSContext* cx;
+    bool ignore_case_;
+    bool is_ascii_;
+    bool unicode_;
+    const char* error_message_;
+
+    Analysis(Analysis&) = delete;
+    void operator=(Analysis&) = delete;
+};
+
+} }  // namespace js::irregexp
+
+#endif  // V8_JSREGEXP_H_
diff --git a/js/src/irregexp/RegExpInterpreter.cpp b/js/src/irregexp/RegExpInterpreter.cpp
new file mode 100644
index 000000000..7fd2d983a
--- /dev/null
+++ b/js/src/irregexp/RegExpInterpreter.cpp
@@ -0,0 +1,501 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// A simple interpreter for the Irregexp byte code.
+
+#include "irregexp/RegExpBytecode.h"
+#include "irregexp/RegExpMacroAssembler.h"
+#include "vm/MatchPairs.h"
+
+using namespace js;
+using namespace js::irregexp;
+
+static const size_t kBitsPerByte = 8;
+static const size_t kBitsPerByteLog2 = 3;
+
+class MOZ_STACK_CLASS RegExpStackCursor
+{
+  public:
+    explicit RegExpStackCursor(JSContext* cx)
+      : cx(cx), cursor(nullptr)
+    {}
+
+    bool init() {
+        if (!stack.init()) {
+            ReportOutOfMemory(cx);
+            return false;
+        }
+        cursor = base();
+        return true;
+    }
+
+    bool push(int32_t value) {
+        *cursor++ = value;
+        if (cursor >= stack.limit()) {
+            int32_t pos = position();
+            if (!stack.grow()) {
+                ReportOverRecursed(cx);
+                return false;
+            }
+            setPosition(pos);
+        }
+        return true;
+    }
+
+    int32_t pop() {
+        MOZ_ASSERT(cursor > base());
+        return *--cursor;
+    }
+
+    int32_t peek() {
+        MOZ_ASSERT(cursor > base());
+        return *(cursor - 1);
+    }
+
+    int32_t position() {
+        MOZ_ASSERT(cursor >= base());
+        return cursor - base();
+    }
+
+    void setPosition(int32_t position) {
+        cursor = base() + position;
+        MOZ_ASSERT(cursor < stack.limit());
+    }
+
+  private:
+    JSContext* cx;
+    RegExpStack stack;
+
+    int32_t* cursor;
+
+    int32_t* base() { return (int32_t*) stack.base(); }
+};
+
+static int32_t
+Load32Aligned(const uint8_t* pc)
+{
+    MOZ_ASSERT((reinterpret_cast<uintptr_t>(pc) & 3) == 0);
+    return *reinterpret_cast<const int32_t*>(pc);
+}
+
+static int32_t
+Load16Aligned(const uint8_t* pc)
+{
+    MOZ_ASSERT((reinterpret_cast<uintptr_t>(pc) & 1) == 0);
+    return *reinterpret_cast<const uint16_t*>(pc);
+}
+
+#define BYTECODE(name)  case BC_##name:
+
+template <typename CharT>
+RegExpRunStatus
+irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const CharT* chars, size_t current,
+                        size_t length, MatchPairs* matches, size_t* endIndex)
+{
+    const uint8_t* pc = byteCode;
+
+    uint32_t current_char = current ? chars[current - 1] : '\n';
+
+    RegExpStackCursor stack(cx);
+
+    if (!stack.init())
+        return RegExpRunStatus_Error;
+
+    int32_t numRegisters = Load32Aligned(pc);
+    pc += 4;
+
+    Vector<int32_t, 0, SystemAllocPolicy> registers;
+    if (!registers.growByUninitialized(numRegisters))
+        return RegExpRunStatus_Error;
+    for (size_t i = 0; i < (size_t) numRegisters; i++)
+        registers[i] = -1;
+
+    while (true) {
+        int32_t insn = Load32Aligned(pc);
+        switch (insn & BYTECODE_MASK) {
+          BYTECODE(BREAK)
+            MOZ_CRASH("Bad bytecode: BREAK");
+          BYTECODE(PUSH_CP)
+            if (!stack.push(current))
+                return RegExpRunStatus_Error;
+            pc += BC_PUSH_CP_LENGTH;
+            break;
+          BYTECODE(PUSH_BT)
+            if (!stack.push(Load32Aligned(pc + 4)))
+                return RegExpRunStatus_Error;
+            pc += BC_PUSH_BT_LENGTH;
+            break;
+          BYTECODE(PUSH_REGISTER)
+            if (!stack.push(registers[insn >> BYTECODE_SHIFT]))
+                return RegExpRunStatus_Error;
+            pc += BC_PUSH_REGISTER_LENGTH;
+            break;
+          BYTECODE(SET_REGISTER)
+            registers[insn >> BYTECODE_SHIFT] = Load32Aligned(pc + 4);
+            pc += BC_SET_REGISTER_LENGTH;
+            break;
+          BYTECODE(ADVANCE_REGISTER)
+            registers[insn >> BYTECODE_SHIFT] += Load32Aligned(pc + 4);
+            pc += BC_ADVANCE_REGISTER_LENGTH;
+            break;
+          BYTECODE(SET_REGISTER_TO_CP)
+            registers[insn >> BYTECODE_SHIFT] = current + Load32Aligned(pc + 4);
+            pc += BC_SET_REGISTER_TO_CP_LENGTH;
+            break;
+          BYTECODE(SET_CP_TO_REGISTER)
+            current = registers[insn >> BYTECODE_SHIFT];
+            pc += BC_SET_CP_TO_REGISTER_LENGTH;
+            break;
+          BYTECODE(SET_REGISTER_TO_SP)
+            registers[insn >> BYTECODE_SHIFT] = stack.position();
+            pc += BC_SET_REGISTER_TO_SP_LENGTH;
+            break;
+          BYTECODE(SET_SP_TO_REGISTER)
+            stack.setPosition(registers[insn >> BYTECODE_SHIFT]);
+            pc += BC_SET_SP_TO_REGISTER_LENGTH;
+            break;
+          BYTECODE(POP_CP)
+            current = stack.pop();
+            pc += BC_POP_CP_LENGTH;
+            break;
+          BYTECODE(POP_BT)
+            if (!CheckForInterrupt(cx))
+                return RegExpRunStatus_Error;
+            pc = byteCode + stack.pop();
+            break;
+          BYTECODE(POP_REGISTER)
+            registers[insn >> BYTECODE_SHIFT] = stack.pop();
+            pc += BC_POP_REGISTER_LENGTH;
+            break;
+          BYTECODE(FAIL)
+            return RegExpRunStatus_Success_NotFound;
+          BYTECODE(SUCCEED)
+            if (matches)
+                memcpy(matches->pairsRaw(), registers.begin(), matches->length() * 2 * sizeof(int32_t));
+            else if (endIndex)
+                *endIndex = registers[1];
+            return RegExpRunStatus_Success;
+          BYTECODE(ADVANCE_CP)
+            current += insn >> BYTECODE_SHIFT;
+            pc += BC_ADVANCE_CP_LENGTH;
+            break;
+          BYTECODE(GOTO)
+            pc = byteCode + Load32Aligned(pc + 4);
+            break;
+          BYTECODE(ADVANCE_CP_AND_GOTO)
+            current += insn >> BYTECODE_SHIFT;
+            pc = byteCode + Load32Aligned(pc + 4);
+            break;
+          BYTECODE(CHECK_GREEDY)
+            if ((int32_t)current == stack.peek()) {
+                stack.pop();
+                pc = byteCode + Load32Aligned(pc + 4);
+            } else {
+                pc += BC_CHECK_GREEDY_LENGTH;
+            }
+            break;
+          BYTECODE(LOAD_CURRENT_CHAR) {
+            size_t pos = current + (insn >> BYTECODE_SHIFT);
+            if (pos >= length) {
+                pc = byteCode + Load32Aligned(pc + 4);
+            } else {
+                current_char = chars[pos];
+                pc += BC_LOAD_CURRENT_CHAR_LENGTH;
+            }
+            break;
+          }
+          BYTECODE(LOAD_CURRENT_CHAR_UNCHECKED) {
+            int pos = current + (insn >> BYTECODE_SHIFT);
+            current_char = chars[pos];
+            pc += BC_LOAD_CURRENT_CHAR_UNCHECKED_LENGTH;
+            break;
+          }
+          BYTECODE(LOAD_2_CURRENT_CHARS) {
+            size_t pos = current + (insn >> BYTECODE_SHIFT);
+            if (pos + 2 > length) {
+                pc = byteCode + Load32Aligned(pc + 4);
+            } else {
+                CharT next = chars[pos + 1];
+                current_char = (chars[pos] | (next << (kBitsPerByte * sizeof(CharT))));
+                pc += BC_LOAD_2_CURRENT_CHARS_LENGTH;
+            }
+            break;
+          }
+          BYTECODE(LOAD_2_CURRENT_CHARS_UNCHECKED) {
+            int pos = current + (insn >> BYTECODE_SHIFT);
+            char16_t next = chars[pos + 1];
+            current_char = (chars[pos] | (next << (kBitsPerByte * sizeof(char16_t))));
+            pc += BC_LOAD_2_CURRENT_CHARS_UNCHECKED_LENGTH;
+            break;
+          }
+          BYTECODE(LOAD_4_CURRENT_CHARS)
+            MOZ_CRASH("ASCII handling implemented");
+          BYTECODE(LOAD_4_CURRENT_CHARS_UNCHECKED)
+            MOZ_CRASH("ASCII handling implemented");
+          BYTECODE(CHECK_4_CHARS) {
+            uint32_t c = Load32Aligned(pc + 4);
+            if (c == current_char)
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_CHECK_4_CHARS_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_CHAR) {
+            uint32_t c = (insn >> BYTECODE_SHIFT);
+            if (c == current_char)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_CHAR_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_NOT_4_CHARS) {
+            uint32_t c = Load32Aligned(pc + 4);
+            if (c != current_char)
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_CHECK_NOT_4_CHARS_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_NOT_CHAR) {
+            uint32_t c = (insn >> BYTECODE_SHIFT);
+            if (c != current_char)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_NOT_CHAR_LENGTH;
+            break;
+          }
+          BYTECODE(AND_CHECK_4_CHARS) {
+            uint32_t c = Load32Aligned(pc + 4);
+            if (c == (current_char & Load32Aligned(pc + 8)))
+                pc = byteCode + Load32Aligned(pc + 12);
+            else
+                pc += BC_AND_CHECK_4_CHARS_LENGTH;
+            break;
+          }
+          BYTECODE(AND_CHECK_CHAR) {
+            uint32_t c = (insn >> BYTECODE_SHIFT);
+            if (c == (current_char & Load32Aligned(pc + 4)))
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_AND_CHECK_CHAR_LENGTH;
+            break;
+          }
+          BYTECODE(AND_CHECK_NOT_4_CHARS) {
+            uint32_t c = Load32Aligned(pc + 4);
+            if (c != (current_char & Load32Aligned(pc + 8)))
+                pc = byteCode + Load32Aligned(pc + 12);
+            else
+                pc += BC_AND_CHECK_NOT_4_CHARS_LENGTH;
+            break;
+          }
+          BYTECODE(AND_CHECK_NOT_CHAR) {
+            uint32_t c = (insn >> BYTECODE_SHIFT);
+            if (c != (current_char & Load32Aligned(pc + 4)))
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_AND_CHECK_NOT_CHAR_LENGTH;
+            break;
+          }
+          BYTECODE(MINUS_AND_CHECK_NOT_CHAR) {
+            uint32_t c = (insn >> BYTECODE_SHIFT);
+            uint32_t minus = Load16Aligned(pc + 4);
+            uint32_t mask = Load16Aligned(pc + 6);
+            if (c != ((current_char - minus) & mask))
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_MINUS_AND_CHECK_NOT_CHAR_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_CHAR_IN_RANGE) {
+            uint32_t from = Load16Aligned(pc + 4);
+            uint32_t to = Load16Aligned(pc + 6);
+            if (from <= current_char && current_char <= to)
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_CHECK_CHAR_IN_RANGE_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_CHAR_NOT_IN_RANGE) {
+            uint32_t from = Load16Aligned(pc + 4);
+            uint32_t to = Load16Aligned(pc + 6);
+            if (from > current_char || current_char > to)
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_CHECK_CHAR_NOT_IN_RANGE_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_BIT_IN_TABLE) {
+            int mask = RegExpMacroAssembler::kTableMask;
+            uint8_t b = pc[8 + ((current_char & mask) >> kBitsPerByteLog2)];
+            int bit = (current_char & (kBitsPerByte - 1));
+            if ((b & (1 << bit)) != 0)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_BIT_IN_TABLE_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_LT) {
+            uint32_t limit = (insn >> BYTECODE_SHIFT);
+            if (current_char < limit)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_LT_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_GT) {
+            uint32_t limit = (insn >> BYTECODE_SHIFT);
+            if (current_char > limit)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_GT_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_REGISTER_LT)
+            if (registers[insn >> BYTECODE_SHIFT] < Load32Aligned(pc + 4))
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_CHECK_REGISTER_LT_LENGTH;
+            break;
+          BYTECODE(CHECK_REGISTER_GE)
+            if (registers[insn >> BYTECODE_SHIFT] >= Load32Aligned(pc + 4))
+                pc = byteCode + Load32Aligned(pc + 8);
+            else
+                pc += BC_CHECK_REGISTER_GE_LENGTH;
+            break;
+          BYTECODE(CHECK_REGISTER_EQ_POS)
+            if (registers[insn >> BYTECODE_SHIFT] == (int32_t) current)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_REGISTER_EQ_POS_LENGTH;
+            break;
+          BYTECODE(CHECK_NOT_REGS_EQUAL)
+            if (registers[insn >> BYTECODE_SHIFT] == registers[Load32Aligned(pc + 4)])
+                pc += BC_CHECK_NOT_REGS_EQUAL_LENGTH;
+            else
+                pc = byteCode + Load32Aligned(pc + 8);
+            break;
+          BYTECODE(CHECK_NOT_BACK_REF) {
+            int from = registers[insn >> BYTECODE_SHIFT];
+            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+            if (from < 0 || len <= 0) {
+                pc += BC_CHECK_NOT_BACK_REF_LENGTH;
+                break;
+            }
+            if (current + len > length) {
+                pc = byteCode + Load32Aligned(pc + 4);
+                break;
+            } else {
+                int i;
+                for (i = 0; i < len; i++) {
+                    if (chars[from + i] != chars[current + i]) {
+                        pc = byteCode + Load32Aligned(pc + 4);
+                        break;
+                    }
+                }
+                if (i < len) break;
+                current += len;
+            }
+            pc += BC_CHECK_NOT_BACK_REF_LENGTH;
+            break;
+          }
+          BYTECODE(CHECK_NOT_BACK_REF_NO_CASE) {
+            int from = registers[insn >> BYTECODE_SHIFT];
+            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+            if (from < 0 || len <= 0) {
+                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_LENGTH;
+                break;
+            }
+            if (current + len > length) {
+                pc = byteCode + Load32Aligned(pc + 4);
+                break;
+            }
+            if (CaseInsensitiveCompareStrings(chars + from, chars + current, len * sizeof(CharT))) {
+                current += len;
+                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_LENGTH;
+            } else {
+                pc = byteCode + Load32Aligned(pc + 4);
+            }
+            break;
+          }
+          BYTECODE(CHECK_NOT_BACK_REF_NO_CASE_UNICODE) {
+            int from = registers[insn >> BYTECODE_SHIFT];
+            int len = registers[(insn >> BYTECODE_SHIFT) + 1] - from;
+            if (from < 0 || len <= 0) {
+                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE_LENGTH;
+                break;
+            }
+            if (current + len > length) {
+                pc = byteCode + Load32Aligned(pc + 4);
+                break;
+            }
+            if (CaseInsensitiveCompareUCStrings(chars + from, chars + current,
+                                                len * sizeof(CharT)))
+            {
+                current += len;
+                pc += BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE_LENGTH;
+            } else {
+                pc = byteCode + Load32Aligned(pc + 4);
+            }
+            break;
+          }
+          BYTECODE(CHECK_AT_START)
+            if (current == 0)
+                pc = byteCode + Load32Aligned(pc + 4);
+            else
+                pc += BC_CHECK_AT_START_LENGTH;
+            break;
+          BYTECODE(CHECK_NOT_AT_START)
+            if (current == 0)
+                pc += BC_CHECK_NOT_AT_START_LENGTH;
+            else
+                pc = byteCode + Load32Aligned(pc + 4);
+            break;
+          BYTECODE(SET_CURRENT_POSITION_FROM_END) {
+            size_t by = static_cast<uint32_t>(insn) >> BYTECODE_SHIFT;
+            if (length - current > by) {
+                current = length - by;
+                current_char = chars[current - 1];
+            }
+            pc += BC_SET_CURRENT_POSITION_FROM_END_LENGTH;
+            break;
+          }
+          default:
+            MOZ_CRASH("Bad bytecode");
+        }
+    }
+}
+
+template RegExpRunStatus
+irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const Latin1Char* chars, size_t current,
+                        size_t length, MatchPairs* matches, size_t* endIndex);
+
+template RegExpRunStatus
+irregexp::InterpretCode(JSContext* cx, const uint8_t* byteCode, const char16_t* chars, size_t current,
+                        size_t length, MatchPairs* matches, size_t* endIndex);
diff --git a/js/src/irregexp/RegExpMacroAssembler.cpp b/js/src/irregexp/RegExpMacroAssembler.cpp
new file mode 100644
index 000000000..d66d0d204
--- /dev/null
+++ b/js/src/irregexp/RegExpMacroAssembler.cpp
@@ -0,0 +1,573 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "irregexp/RegExpMacroAssembler.h"
+
+#include "irregexp/RegExpBytecode.h"
+
+using namespace js;
+using namespace js::irregexp;
+
+template <typename CharT>
+int
+irregexp::CaseInsensitiveCompareStrings(const CharT* substring1, const CharT* substring2,
+					size_t byteLength)
+{
+    MOZ_ASSERT(byteLength % sizeof(CharT) == 0);
+    size_t length = byteLength / sizeof(CharT);
+
+    for (size_t i = 0; i < length; i++) {
+        char16_t c1 = substring1[i];
+        char16_t c2 = substring2[i];
+        if (c1 != c2) {
+            c1 = unicode::ToLowerCase(c1);
+            c2 = unicode::ToLowerCase(c2);
+            if (c1 != c2)
+                return 0;
+        }
+    }
+
+    return 1;
+}
+
+template int
+irregexp::CaseInsensitiveCompareStrings(const Latin1Char* substring1, const Latin1Char* substring2,
+					size_t byteLength);
+
+template int
+irregexp::CaseInsensitiveCompareStrings(const char16_t* substring1, const char16_t* substring2,
+					size_t byteLength);
+
+template <typename CharT>
+int
+irregexp::CaseInsensitiveCompareUCStrings(const CharT* substring1, const CharT* substring2,
+                                          size_t byteLength)
+{
+    MOZ_ASSERT(byteLength % sizeof(CharT) == 0);
+    size_t length = byteLength / sizeof(CharT);
+
+    for (size_t i = 0; i < length; i++) {
+        char16_t c1 = substring1[i];
+        char16_t c2 = substring2[i];
+        if (c1 != c2) {
+            c1 = unicode::FoldCase(c1);
+            c2 = unicode::FoldCase(c2);
+            if (c1 != c2)
+                return 0;
+        }
+    }
+
+    return 1;
+}
+
+template int
+irregexp::CaseInsensitiveCompareUCStrings(const Latin1Char* substring1,
+                                          const Latin1Char* substring2,
+                                          size_t byteLength);
+
+template int
+irregexp::CaseInsensitiveCompareUCStrings(const char16_t* substring1,
+                                          const char16_t* substring2,
+                                          size_t byteLength);
+
+InterpretedRegExpMacroAssembler::InterpretedRegExpMacroAssembler(LifoAlloc* alloc, RegExpShared* shared,
+                                                                 size_t numSavedRegisters)
+  : RegExpMacroAssembler(*alloc, shared, numSavedRegisters),
+    pc_(0),
+    advance_current_start_(0),
+    advance_current_offset_(0),
+    advance_current_end_(kInvalidPC),
+    buffer_(nullptr),
+    length_(0)
+{
+    // The first int32 word is the number of registers.
+    Emit32(0);
+}
+
+InterpretedRegExpMacroAssembler::~InterpretedRegExpMacroAssembler()
+{
+    js_free(buffer_);
+}
+
+RegExpCode
+InterpretedRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
+{
+    Bind(&backtrack_);
+    Emit(BC_POP_BT, 0);
+
+    // Update the number of registers.
+    *(int32_t*)buffer_ = num_registers_;
+
+    RegExpCode res;
+    res.byteCode = buffer_;
+    buffer_ = nullptr;
+    return res;
+}
+
+void
+InterpretedRegExpMacroAssembler::AdvanceCurrentPosition(int by)
+{
+    MOZ_ASSERT(by >= kMinCPOffset);
+    MOZ_ASSERT(by <= kMaxCPOffset);
+    advance_current_start_ = pc_;
+    advance_current_offset_ = by;
+    Emit(BC_ADVANCE_CP, by);
+    advance_current_end_ = pc_;
+}
+
+void
+InterpretedRegExpMacroAssembler::AdvanceRegister(int reg, int by)
+{
+    checkRegister(reg);
+    Emit(BC_ADVANCE_REGISTER, reg);
+    Emit32(by);
+}
+
+void
+InterpretedRegExpMacroAssembler::Backtrack()
+{
+    Emit(BC_POP_BT, 0);
+}
+
+void
+InterpretedRegExpMacroAssembler::Bind(jit::Label* label)
+{
+    advance_current_end_ = kInvalidPC;
+    MOZ_ASSERT(!label->bound());
+    if (label->used()) {
+        int pos = label->offset();
+        while (pos != jit::Label::INVALID_OFFSET) {
+            int fixup = pos;
+            pos = *reinterpret_cast<int32_t*>(buffer_ + fixup);
+            *reinterpret_cast<uint32_t*>(buffer_ + fixup) = pc_;
+        }
+    }
+    label->bind(pc_);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckAtStart(jit::Label* on_at_start)
+{
+    Emit(BC_CHECK_AT_START, 0);
+    EmitOrLink(on_at_start);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckCharacter(unsigned c, jit::Label* on_equal)
+{
+    if (c > MAX_FIRST_ARG) {
+        Emit(BC_CHECK_4_CHARS, 0);
+        Emit32(c);
+    } else {
+        Emit(BC_CHECK_CHAR, c);
+    }
+    EmitOrLink(on_equal);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal)
+{
+    if (c > MAX_FIRST_ARG) {
+        Emit(BC_AND_CHECK_4_CHARS, 0);
+        Emit32(c);
+    } else {
+        Emit(BC_AND_CHECK_CHAR, c);
+    }
+    Emit32(and_with);
+    EmitOrLink(on_equal);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckCharacterGT(char16_t limit, jit::Label* on_greater)
+{
+    Emit(BC_CHECK_GT, limit);
+    EmitOrLink(on_greater);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckCharacterLT(char16_t limit, jit::Label* on_less)
+{
+    Emit(BC_CHECK_LT, limit);
+    EmitOrLink(on_less);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckGreedyLoop(jit::Label* on_tos_equals_current_position)
+{
+    Emit(BC_CHECK_GREEDY, 0);
+    EmitOrLink(on_tos_equals_current_position);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckNotAtStart(jit::Label* on_not_at_start)
+{
+    Emit(BC_CHECK_NOT_AT_START, 0);
+    EmitOrLink(on_not_at_start);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckNotBackReference(int start_reg, jit::Label* on_no_match)
+{
+    MOZ_ASSERT(start_reg >= 0);
+    MOZ_ASSERT(start_reg <= kMaxRegister);
+    Emit(BC_CHECK_NOT_BACK_REF, start_reg);
+    EmitOrLink(on_no_match);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg,
+                                                                 jit::Label* on_no_match,
+                                                                 bool unicode)
+{
+    MOZ_ASSERT(start_reg >= 0);
+    MOZ_ASSERT(start_reg <= kMaxRegister);
+    if (unicode)
+        Emit(BC_CHECK_NOT_BACK_REF_NO_CASE_UNICODE, start_reg);
+    else
+        Emit(BC_CHECK_NOT_BACK_REF_NO_CASE, start_reg);
+    EmitOrLink(on_no_match);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckNotCharacter(unsigned c, jit::Label* on_not_equal)
+{
+    if (c > MAX_FIRST_ARG) {
+        Emit(BC_CHECK_NOT_4_CHARS, 0);
+        Emit32(c);
+    } else {
+        Emit(BC_CHECK_NOT_CHAR, c);
+    }
+    EmitOrLink(on_not_equal);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckNotCharacterAfterAnd(unsigned c, unsigned and_with,
+                                                           jit::Label* on_not_equal)
+{
+    if (c > MAX_FIRST_ARG) {
+        Emit(BC_AND_CHECK_NOT_4_CHARS, 0);
+        Emit32(c);
+    } else {
+        Emit(BC_AND_CHECK_NOT_CHAR, c);
+    }
+    Emit32(and_with);
+    EmitOrLink(on_not_equal);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
+                                                                jit::Label* on_not_equal)
+{
+    Emit(BC_MINUS_AND_CHECK_NOT_CHAR, c);
+    Emit16(minus);
+    Emit16(and_with);
+    EmitOrLink(on_not_equal);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckCharacterInRange(char16_t from, char16_t to,
+                                                       jit::Label* on_in_range)
+{
+    Emit(BC_CHECK_CHAR_IN_RANGE, 0);
+    Emit16(from);
+    Emit16(to);
+    EmitOrLink(on_in_range);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckCharacterNotInRange(char16_t from, char16_t to,
+                                                          jit::Label* on_not_in_range)
+{
+    Emit(BC_CHECK_CHAR_NOT_IN_RANGE, 0);
+    Emit16(from);
+    Emit16(to);
+    EmitOrLink(on_not_in_range);
+}
+
+void
+InterpretedRegExpMacroAssembler::CheckBitInTable(uint8_t* table, jit::Label* on_bit_set)
+{
+    static const int kBitsPerByte = 8;
+
+    Emit(BC_CHECK_BIT_IN_TABLE, 0);
+    EmitOrLink(on_bit_set);
+    for (int i = 0; i < kTableSize; i += kBitsPerByte) {
+        int byte = 0;
+        for (int j = 0; j < kBitsPerByte; j++) {
+            if (table[i + j] != 0)
+                byte |= 1 << j;
+        }
+        Emit8(byte);
+    }
+}
+
+void
+InterpretedRegExpMacroAssembler::JumpOrBacktrack(jit::Label* to)
+{
+    if (advance_current_end_ == pc_) {
+        // Combine advance current and goto.
+        pc_ = advance_current_start_;
+        Emit(BC_ADVANCE_CP_AND_GOTO, advance_current_offset_);
+        EmitOrLink(to);
+        advance_current_end_ = kInvalidPC;
+    } else {
+        // Regular goto.
+        Emit(BC_GOTO, 0);
+        EmitOrLink(to);
+    }
+}
+
+void
+InterpretedRegExpMacroAssembler::Fail()
+{
+    Emit(BC_FAIL, 0);
+}
+
+void
+InterpretedRegExpMacroAssembler::IfRegisterGE(int reg, int comparand, jit::Label* if_ge)
+{
+    checkRegister(reg);
+    Emit(BC_CHECK_REGISTER_GE, reg);
+    Emit32(comparand);
+    EmitOrLink(if_ge);
+}
+
+void
+InterpretedRegExpMacroAssembler::IfRegisterLT(int reg, int comparand, jit::Label* if_lt)
+{
+    checkRegister(reg);
+    Emit(BC_CHECK_REGISTER_LT, reg);
+    Emit32(comparand);
+    EmitOrLink(if_lt);
+}
+
+void
+InterpretedRegExpMacroAssembler::IfRegisterEqPos(int reg, jit::Label* if_eq)
+{
+    checkRegister(reg);
+    Emit(BC_CHECK_REGISTER_EQ_POS, reg);
+    EmitOrLink(if_eq);
+}
+
+void
+InterpretedRegExpMacroAssembler::LoadCurrentCharacter(int cp_offset, jit::Label* on_end_of_input,
+                                                      bool check_bounds, int characters)
+{
+    MOZ_ASSERT(cp_offset >= kMinCPOffset);
+    MOZ_ASSERT(cp_offset <= kMaxCPOffset);
+    int bytecode;
+    if (check_bounds) {
+        if (characters == 4) {
+            bytecode = BC_LOAD_4_CURRENT_CHARS;
+        } else if (characters == 2) {
+            bytecode = BC_LOAD_2_CURRENT_CHARS;
+        } else {
+            MOZ_ASSERT(characters == 1);
+            bytecode = BC_LOAD_CURRENT_CHAR;
+        }
+    } else {
+        if (characters == 4) {
+            bytecode = BC_LOAD_4_CURRENT_CHARS_UNCHECKED;
+        } else if (characters == 2) {
+            bytecode = BC_LOAD_2_CURRENT_CHARS_UNCHECKED;
+        } else {
+            MOZ_ASSERT(characters == 1);
+            bytecode = BC_LOAD_CURRENT_CHAR_UNCHECKED;
+        }
+    }
+    Emit(bytecode, cp_offset);
+    if (check_bounds)
+        EmitOrLink(on_end_of_input);
+}
+
+void
+InterpretedRegExpMacroAssembler::PopCurrentPosition()
+{
+    Emit(BC_POP_CP, 0);
+}
+
+void
+InterpretedRegExpMacroAssembler::PopRegister(int reg)
+{
+    checkRegister(reg);
+    Emit(BC_POP_REGISTER, reg);
+}
+
+void
+InterpretedRegExpMacroAssembler::PushCurrentPosition()
+{
+    Emit(BC_PUSH_CP, 0);
+}
+
+void
+InterpretedRegExpMacroAssembler::PushRegister(int reg, StackCheckFlag check_stack_limit)
+{
+    checkRegister(reg);
+    Emit(BC_PUSH_REGISTER, reg);
+}
+
+void
+InterpretedRegExpMacroAssembler::ReadCurrentPositionFromRegister(int reg)
+{
+    checkRegister(reg);
+    Emit(BC_SET_CP_TO_REGISTER, reg);
+}
+
+void
+InterpretedRegExpMacroAssembler::ReadBacktrackStackPointerFromRegister(int reg)
+{
+    checkRegister(reg);
+    Emit(BC_SET_SP_TO_REGISTER, reg);
+}
+
+void
+InterpretedRegExpMacroAssembler::SetCurrentPositionFromEnd(int by)
+{
+    MOZ_ASSERT(by >= 0 && by < (1 << 24));
+    Emit(BC_SET_CURRENT_POSITION_FROM_END, by);
+}
+
+void
+InterpretedRegExpMacroAssembler::SetRegister(int reg, int to)
+{
+    checkRegister(reg);
+    Emit(BC_SET_REGISTER, reg);
+    Emit32(to);
+}
+
+bool
+InterpretedRegExpMacroAssembler::Succeed()
+{
+    Emit(BC_SUCCEED, 0);
+
+    // Restart matching for global regexp not supported.
+    return false;
+}
+
+void
+InterpretedRegExpMacroAssembler::WriteCurrentPositionToRegister(int reg, int cp_offset)
+{
+    checkRegister(reg);
+    Emit(BC_SET_REGISTER_TO_CP, reg);
+    Emit32(cp_offset);  // Current position offset.
+}
+
+void
+InterpretedRegExpMacroAssembler::ClearRegisters(int reg_from, int reg_to)
+{
+    MOZ_ASSERT(reg_from <= reg_to);
+    for (int reg = reg_from; reg <= reg_to; reg++)
+        SetRegister(reg, -1);
+}
+
+void
+InterpretedRegExpMacroAssembler::WriteBacktrackStackPointerToRegister(int reg)
+{
+    checkRegister(reg);
+    Emit(BC_SET_REGISTER_TO_SP, reg);
+}
+
+void
+InterpretedRegExpMacroAssembler::PushBacktrack(jit::Label* label)
+{
+    Emit(BC_PUSH_BT, 0);
+    EmitOrLink(label);
+}
+
+void
+InterpretedRegExpMacroAssembler::BindBacktrack(jit::Label* label)
+{
+    Bind(label);
+}
+
+void
+InterpretedRegExpMacroAssembler::EmitOrLink(jit::Label* label)
+{
+    if (label == nullptr)
+        label = &backtrack_;
+    if (label->bound()) {
+        Emit32(label->offset());
+    } else {
+        int pos = label->use(pc_);
+        Emit32(pos);
+    }
+}
+
+void
+InterpretedRegExpMacroAssembler::Emit(uint32_t byte, uint32_t twenty_four_bits)
+{
+    uint32_t word = ((twenty_four_bits << BYTECODE_SHIFT) | byte);
+    Emit32(word);
+}
+
+void
+InterpretedRegExpMacroAssembler::Emit32(uint32_t word)
+{
+    MOZ_ASSERT(pc_ <= length_);
+    if (pc_  + 3 >= length_)
+        Expand();
+    *reinterpret_cast<uint32_t*>(buffer_ + pc_) = word;
+    pc_ += 4;
+}
+
+void
+InterpretedRegExpMacroAssembler::Emit16(uint32_t word)
+{
+    MOZ_ASSERT(pc_ <= length_);
+    if (pc_ + 1 >= length_)
+        Expand();
+    *reinterpret_cast<uint16_t*>(buffer_ + pc_) = word;
+    pc_ += 2;
+}
+
+void
+InterpretedRegExpMacroAssembler::Emit8(uint32_t word)
+{
+    MOZ_ASSERT(pc_ <= length_);
+    if (pc_ == length_)
+        Expand();
+    *reinterpret_cast<unsigned char*>(buffer_ + pc_) = word;
+    pc_ += 1;
+}
+
+void
+InterpretedRegExpMacroAssembler::Expand()
+{
+    AutoEnterOOMUnsafeRegion oomUnsafe;
+
+    int newLength = Max(100, length_ * 2);
+    if (newLength < length_ + 4)
+        oomUnsafe.crash("InterpretedRegExpMacroAssembler::Expand");
+
+    buffer_ = (uint8_t*) js_realloc(buffer_, newLength);
+    if (!buffer_)
+        oomUnsafe.crash("InterpretedRegExpMacroAssembler::Expand");
+    length_ = newLength;
+}
diff --git a/js/src/irregexp/RegExpMacroAssembler.h b/js/src/irregexp/RegExpMacroAssembler.h
new file mode 100644
index 000000000..dca2edf90
--- /dev/null
+++ b/js/src/irregexp/RegExpMacroAssembler.h
@@ -0,0 +1,312 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_REGEXP_MACRO_ASSEMBLER_H_
+#define V8_REGEXP_MACRO_ASSEMBLER_H_
+
+#include "irregexp/RegExpAST.h"
+#include "irregexp/RegExpEngine.h"
+#include "jit/MacroAssembler.h"
+
+namespace js {
+namespace irregexp {
+
+class MOZ_STACK_CLASS RegExpMacroAssembler
+{
+  public:
+    RegExpMacroAssembler(LifoAlloc& alloc, RegExpShared* shared, size_t numSavedRegisters)
+      : slow_safe_compiler_(false),
+        global_mode_(NOT_GLOBAL),
+        alloc_(alloc),
+        num_registers_(numSavedRegisters),
+        num_saved_registers_(numSavedRegisters),
+        shared(shared)
+    {}
+
+    enum StackCheckFlag {
+        kNoStackLimitCheck = false,
+        kCheckStackLimit = true
+    };
+
+    // The implementation must be able to handle at least:
+    static const int kMaxRegister = (1 << 16) - 1;
+    static const int kMaxCPOffset = (1 << 15) - 1;
+    static const int kMinCPOffset = -(1 << 15);
+
+    static const int kTableSizeBits = 7;
+    static const int kTableSize = 1 << kTableSizeBits;
+    static const int kTableMask = kTableSize - 1;
+
+    // Controls the generation of large inlined constants in the code.
+    void set_slow_safe(bool ssc) { slow_safe_compiler_ = ssc; }
+    bool slow_safe() { return slow_safe_compiler_; }
+
+    enum GlobalMode { NOT_GLOBAL, GLOBAL, GLOBAL_NO_ZERO_LENGTH_CHECK };
+
+    // Set whether the regular expression has the global flag.  Exiting due to
+    // a failure in a global regexp may still mean success overall.
+    inline void set_global_mode(GlobalMode mode) { global_mode_ = mode; }
+    inline bool global() { return global_mode_ != NOT_GLOBAL; }
+    inline bool global_with_zero_length_check() {
+        return global_mode_ == GLOBAL;
+    }
+
+    LifoAlloc& alloc() { return alloc_; }
+
+    virtual RegExpCode GenerateCode(JSContext* cx, bool match_only) = 0;
+
+    // The maximal number of pushes between stack checks. Users must supply
+    // kCheckStackLimit flag to push operations (instead of kNoStackLimitCheck)
+    // at least once for every stack_limit() pushes that are executed.
+    virtual int stack_limit_slack() = 0;
+
+    virtual bool CanReadUnaligned() { return false; }
+
+    virtual void AdvanceCurrentPosition(int by) = 0;  // Signed cp change.
+    virtual void AdvanceRegister(int reg, int by) = 0;  // r[reg] += by.
+
+    // Continues execution from the position pushed on the top of the backtrack
+    // stack by an earlier PushBacktrack.
+    virtual void Backtrack() = 0;
+
+    virtual void Bind(jit::Label* label) = 0;
+    virtual void CheckAtStart(jit::Label* on_at_start) = 0;
+
+    // Dispatch after looking the current character up in a 2-bits-per-entry
+    // map.  The destinations vector has up to 4 labels.
+    virtual void CheckCharacter(unsigned c, jit::Label* on_equal) = 0;
+
+    // Bitwise and the current character with the given constant and then
+    // check for a match with c.
+    virtual void CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal) = 0;
+
+    virtual void CheckCharacterGT(char16_t limit, jit::Label* on_greater) = 0;
+    virtual void CheckCharacterLT(char16_t limit, jit::Label* on_less) = 0;
+    virtual void CheckGreedyLoop(jit::Label* on_tos_equals_current_position) = 0;
+    virtual void CheckNotAtStart(jit::Label* on_not_at_start) = 0;
+    virtual void CheckNotBackReference(int start_reg, jit::Label* on_no_match) = 0;
+    virtual void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match,
+                                                 bool unicode) = 0;
+
+    // Check the current character for a match with a literal character.  If we
+    // fail to match then goto the on_failure label.  End of input always
+    // matches.  If the label is nullptr then we should pop a backtrack address off
+    // the stack and go to that.
+    virtual void CheckNotCharacter(unsigned c, jit::Label* on_not_equal) = 0;
+    virtual void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal) = 0;
+
+    // Subtract a constant from the current character, then and with the given
+    // constant and then check for a match with c.
+    virtual void CheckNotCharacterAfterMinusAnd(char16_t c,
+                                        char16_t minus,
+                                        char16_t and_with,
+                                        jit::Label* on_not_equal) = 0;
+
+    virtual void CheckCharacterInRange(char16_t from, char16_t to,  // Both inclusive.
+                               jit::Label* on_in_range) = 0;
+
+    virtual void CheckCharacterNotInRange(char16_t from, char16_t to,  // Both inclusive.
+                                  jit::Label* on_not_in_range) = 0;
+
+    // The current character (modulus the kTableSize) is looked up in the byte
+    // array, and if the found byte is non-zero, we jump to the on_bit_set label.
+    virtual void CheckBitInTable(uint8_t* table, jit::Label* on_bit_set) = 0;
+
+    // Checks whether the given offset from the current position is before
+    // the end of the string. May overwrite the current character.
+    virtual void CheckPosition(int cp_offset, jit::Label* on_outside_input) {
+        LoadCurrentCharacter(cp_offset, on_outside_input, true);
+    }
+
+    // Jump to either the target label or the top of the backtrack stack.
+    virtual void JumpOrBacktrack(jit::Label* to) = 0;
+
+    // Check whether a standard/default character class matches the current
+    // character. Returns false if the type of special character class does
+    // not have custom support.
+    // May clobber the current loaded character.
+    virtual bool CheckSpecialCharacterClass(char16_t type, jit::Label* on_no_match) {
+        return false;
+    }
+
+    virtual void Fail() = 0;
+
+    // Check whether a register is >= a given constant and go to a label if it
+    // is.  Backtracks instead if the label is nullptr.
+    virtual void IfRegisterGE(int reg, int comparand, jit::Label* if_ge) = 0;
+
+    // Check whether a register is < a given constant and go to a label if it is.
+    // Backtracks instead if the label is nullptr.
+    virtual void IfRegisterLT(int reg, int comparand, jit::Label* if_lt) = 0;
+
+    // Check whether a register is == to the current position and go to a
+    // label if it is.
+    virtual void IfRegisterEqPos(int reg, jit::Label* if_eq) = 0;
+
+    virtual void LoadCurrentCharacter(int cp_offset,
+                                      jit::Label* on_end_of_input,
+                                      bool check_bounds = true,
+                                      int characters = 1) = 0;
+    virtual void PopCurrentPosition() = 0;
+    virtual void PopRegister(int register_index) = 0;
+
+    virtual void PushCurrentPosition() = 0;
+    virtual void PushRegister(int register_index, StackCheckFlag check_stack_limit) = 0;
+    virtual void ReadCurrentPositionFromRegister(int reg) = 0;
+    virtual void ReadBacktrackStackPointerFromRegister(int reg) = 0;
+    virtual void SetCurrentPositionFromEnd(int by) = 0;
+    virtual void SetRegister(int register_index, int to) = 0;
+
+    // Return whether the matching (with a global regexp) will be restarted.
+    virtual bool Succeed() = 0;
+
+    virtual void WriteCurrentPositionToRegister(int reg, int cp_offset) = 0;
+    virtual void ClearRegisters(int reg_from, int reg_to) = 0;
+    virtual void WriteBacktrackStackPointerToRegister(int reg) = 0;
+
+    // Pushes the label on the backtrack stack, so that a following Backtrack
+    // will go to this label. Always checks the backtrack stack limit.
+    virtual void PushBacktrack(jit::Label* label) = 0;
+
+    // Bind a label that was previously used by PushBacktrack.
+    virtual void BindBacktrack(jit::Label* label) = 0;
+
+  private:
+    bool slow_safe_compiler_;
+    GlobalMode global_mode_;
+    LifoAlloc& alloc_;
+
+  protected:
+    int num_registers_;
+    int num_saved_registers_;
+
+    void checkRegister(int reg) {
+        MOZ_ASSERT(reg >= 0);
+        MOZ_ASSERT(reg <= kMaxRegister);
+        if (num_registers_ <= reg)
+            num_registers_ = reg + 1;
+    }
+
+  public:
+    RegExpShared* shared;
+};
+
+template <typename CharT>
+int
+CaseInsensitiveCompareStrings(const CharT* substring1, const CharT* substring2, size_t byteLength);
+
+template <typename CharT>
+int
+CaseInsensitiveCompareUCStrings(const CharT* substring1, const CharT* substring2,
+                                size_t byteLength);
+
+class MOZ_STACK_CLASS InterpretedRegExpMacroAssembler final : public RegExpMacroAssembler
+{
+  public:
+    InterpretedRegExpMacroAssembler(LifoAlloc* alloc, RegExpShared* shared, size_t numSavedRegisters);
+    ~InterpretedRegExpMacroAssembler();
+
+    // Inherited virtual methods.
+    RegExpCode GenerateCode(JSContext* cx, bool match_only);
+    void AdvanceCurrentPosition(int by);
+    void AdvanceRegister(int reg, int by);
+    void Backtrack();
+    void Bind(jit::Label* label);
+    void CheckAtStart(jit::Label* on_at_start);
+    void CheckCharacter(unsigned c, jit::Label* on_equal);
+    void CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal);
+    void CheckCharacterGT(char16_t limit, jit::Label* on_greater);
+    void CheckCharacterLT(char16_t limit, jit::Label* on_less);
+    void CheckGreedyLoop(jit::Label* on_tos_equals_current_position);
+    void CheckNotAtStart(jit::Label* on_not_at_start);
+    void CheckNotBackReference(int start_reg, jit::Label* on_no_match);
+    void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match, bool unicode);
+    void CheckNotCharacter(unsigned c, jit::Label* on_not_equal);
+    void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal);
+    void CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
+                                        jit::Label* on_not_equal);
+    void CheckCharacterInRange(char16_t from, char16_t to,
+                               jit::Label* on_in_range);
+    void CheckCharacterNotInRange(char16_t from, char16_t to,
+                                  jit::Label* on_not_in_range);
+    void CheckBitInTable(uint8_t* table, jit::Label* on_bit_set);
+    void JumpOrBacktrack(jit::Label* to);
+    void Fail();
+    void IfRegisterGE(int reg, int comparand, jit::Label* if_ge);
+    void IfRegisterLT(int reg, int comparand, jit::Label* if_lt);
+    void IfRegisterEqPos(int reg, jit::Label* if_eq);
+    void LoadCurrentCharacter(int cp_offset, jit::Label* on_end_of_input,
+                              bool check_bounds = true, int characters = 1);
+    void PopCurrentPosition();
+    void PopRegister(int register_index);
+    void PushCurrentPosition();
+    void PushRegister(int register_index, StackCheckFlag check_stack_limit);
+    void ReadCurrentPositionFromRegister(int reg);
+    void ReadBacktrackStackPointerFromRegister(int reg);
+    void SetCurrentPositionFromEnd(int by);
+    void SetRegister(int register_index, int to);
+    bool Succeed();
+    void WriteCurrentPositionToRegister(int reg, int cp_offset);
+    void ClearRegisters(int reg_from, int reg_to);
+    void WriteBacktrackStackPointerToRegister(int reg);
+    void PushBacktrack(jit::Label* label);
+    void BindBacktrack(jit::Label* label);
+
+    // The byte-code interpreter checks on each push anyway.
+    int stack_limit_slack() { return 1; }
+
+  private:
+    void Expand();
+
+    // Code and bitmap emission.
+    void EmitOrLink(jit::Label* label);
+    void Emit32(uint32_t x);
+    void Emit16(uint32_t x);
+    void Emit8(uint32_t x);
+    void Emit(uint32_t bc, uint32_t arg);
+
+    jit::Label backtrack_;
+
+    // The program counter.
+    int pc_;
+
+    int advance_current_start_;
+    int advance_current_offset_;
+    int advance_current_end_;
+
+    static const int kInvalidPC = -1;
+
+    uint8_t* buffer_;
+    int length_;
+};
+
+} }  // namespace js::irregexp
+
+#endif  // V8_REGEXP_MACRO_ASSEMBLER_H_
diff --git a/js/src/irregexp/RegExpParser.cpp b/js/src/irregexp/RegExpParser.cpp
new file mode 100644
index 000000000..ccc6ae3eb
--- /dev/null
+++ b/js/src/irregexp/RegExpParser.cpp
@@ -0,0 +1,1905 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "irregexp/RegExpParser.h"
+
+#include "frontend/TokenStream.h"
+
+using namespace js;
+using namespace js::irregexp;
+
+// ----------------------------------------------------------------------------
+// RegExpBuilder
+
+RegExpBuilder::RegExpBuilder(LifoAlloc* alloc)
+  : alloc(alloc),
+    pending_empty_(false),
+    characters_(nullptr)
+#ifdef DEBUG
+  , last_added_(ADD_NONE)
+#endif
+{}
+
+void
+RegExpBuilder::FlushCharacters()
+{
+    pending_empty_ = false;
+    if (characters_ != nullptr) {
+        RegExpTree* atom = alloc->newInfallible<RegExpAtom>(characters_);
+        characters_ = nullptr;
+        text_.Add(alloc, atom);
+#ifdef DEBUG
+        last_added_ = ADD_ATOM;
+#endif
+    }
+}
+
+void
+RegExpBuilder::FlushText()
+{
+    FlushCharacters();
+    int num_text = text_.length();
+    if (num_text == 0)
+        return;
+    if (num_text == 1) {
+        terms_.Add(alloc, text_.last());
+    } else {
+        RegExpText* text = alloc->newInfallible<RegExpText>(alloc);
+        for (int i = 0; i < num_text; i++)
+            text_.Get(i)->AppendToText(text);
+        terms_.Add(alloc, text);
+    }
+    text_.Clear();
+}
+
+void
+RegExpBuilder::AddCharacter(char16_t c)
+{
+    pending_empty_ = false;
+    if (characters_ == nullptr)
+        characters_ = alloc->newInfallible<CharacterVector>(*alloc);
+    characters_->append(c);
+#ifdef DEBUG
+    last_added_ = ADD_CHAR;
+#endif
+}
+
+void
+RegExpBuilder::AddEmpty()
+{
+    pending_empty_ = true;
+}
+
+void
+RegExpBuilder::AddAtom(RegExpTree* term)
+{
+    if (term->IsEmpty()) {
+        AddEmpty();
+        return;
+    }
+    if (term->IsTextElement()) {
+        FlushCharacters();
+        text_.Add(alloc, term);
+    } else {
+        FlushText();
+        terms_.Add(alloc, term);
+    }
+#ifdef DEBUG
+    last_added_ = ADD_ATOM;
+#endif
+}
+
+void
+RegExpBuilder::AddAssertion(RegExpTree* assert)
+{
+    FlushText();
+    terms_.Add(alloc, assert);
+#ifdef DEBUG
+    last_added_ = ADD_ASSERT;
+#endif
+}
+
+void
+RegExpBuilder::NewAlternative()
+{
+    FlushTerms();
+}
+
+void
+RegExpBuilder::FlushTerms()
+{
+    FlushText();
+    int num_terms = terms_.length();
+    RegExpTree* alternative;
+    if (num_terms == 0)
+        alternative = RegExpEmpty::GetInstance();
+    else if (num_terms == 1)
+        alternative = terms_.last();
+    else
+        alternative = alloc->newInfallible<RegExpAlternative>(terms_.GetList(alloc));
+    alternatives_.Add(alloc, alternative);
+    terms_.Clear();
+#ifdef DEBUG
+    last_added_ = ADD_NONE;
+#endif
+}
+
+RegExpTree*
+RegExpBuilder::ToRegExp()
+{
+    FlushTerms();
+    int num_alternatives = alternatives_.length();
+    if (num_alternatives == 0) {
+        return RegExpEmpty::GetInstance();
+    }
+    if (num_alternatives == 1) {
+        return alternatives_.last();
+    }
+    return alloc->newInfallible<RegExpDisjunction>(alternatives_.GetList(alloc));
+}
+
+void
+RegExpBuilder::AddQuantifierToAtom(int min, int max,
+                                   RegExpQuantifier::QuantifierType quantifier_type)
+{
+    if (pending_empty_) {
+        pending_empty_ = false;
+        return;
+    }
+    RegExpTree* atom;
+    if (characters_ != nullptr) {
+        MOZ_ASSERT(last_added_ == ADD_CHAR);
+        // Last atom was character.
+        CharacterVector* char_vector = characters_;
+        int num_chars = char_vector->length();
+        if (num_chars > 1) {
+            CharacterVector* prefix = alloc->newInfallible<CharacterVector>(*alloc);
+            prefix->append(char_vector->begin(), num_chars - 1);
+            text_.Add(alloc, alloc->newInfallible<RegExpAtom>(prefix));
+            char_vector = alloc->newInfallible<CharacterVector>(*alloc);
+            char_vector->append((*characters_)[num_chars - 1]);
+        }
+        characters_ = nullptr;
+        atom = alloc->newInfallible<RegExpAtom>(char_vector);
+        FlushText();
+    } else if (text_.length() > 0) {
+        MOZ_ASSERT(last_added_ == ADD_ATOM);
+        atom = text_.RemoveLast();
+        FlushText();
+    } else if (terms_.length() > 0) {
+        MOZ_ASSERT(last_added_ == ADD_ATOM);
+        atom = terms_.RemoveLast();
+        if (atom->max_match() == 0) {
+            // Guaranteed to only match an empty string.
+#ifdef DEBUG
+            last_added_ = ADD_TERM;
+#endif
+            if (min == 0)
+                return;
+            terms_.Add(alloc, atom);
+            return;
+        }
+    } else {
+        // Only call immediately after adding an atom or character!
+        MOZ_CRASH("Bad call");
+    }
+    terms_.Add(alloc, alloc->newInfallible<RegExpQuantifier>(min, max, quantifier_type, atom));
+#ifdef DEBUG
+    last_added_ = ADD_TERM;
+#endif
+}
+
+// ----------------------------------------------------------------------------
+// RegExpParser
+
+template <typename CharT>
+RegExpParser<CharT>::RegExpParser(frontend::TokenStream& ts, LifoAlloc* alloc,
+                                  const CharT* chars, const CharT* end, bool multiline_mode,
+                                  bool unicode, bool ignore_case)
+  : ts(ts),
+    alloc(alloc),
+    captures_(nullptr),
+    next_pos_(chars),
+    end_(end),
+    current_(kEndMarker),
+    capture_count_(0),
+    has_more_(true),
+    multiline_(multiline_mode),
+    unicode_(unicode),
+    ignore_case_(ignore_case),
+    simple_(false),
+    contains_anchor_(false),
+    is_scanned_for_captures_(false)
+{
+    Advance();
+}
+
+template <typename CharT>
+RegExpTree*
+RegExpParser<CharT>::ReportError(unsigned errorNumber)
+{
+    gc::AutoSuppressGC suppressGC(ts.context());
+    ts.reportError(errorNumber);
+    return nullptr;
+}
+
+template <typename CharT>
+void
+RegExpParser<CharT>::Advance()
+{
+    if (next_pos_ < end_) {
+        current_ = *next_pos_;
+        next_pos_++;
+    } else {
+        current_ = kEndMarker;
+        has_more_ = false;
+    }
+}
+
+// Returns the value (0 .. 15) of a hexadecimal character c.
+// If c is not a legal hexadecimal character, returns a value < 0.
+inline int
+HexValue(uint32_t c)
+{
+    c -= '0';
+    if (static_cast<unsigned>(c) <= 9) return c;
+    c = (c | 0x20) - ('a' - '0');  // detect 0x11..0x16 and 0x31..0x36.
+    if (static_cast<unsigned>(c) <= 5) return c + 10;
+    return -1;
+}
+
+template <typename CharT>
+widechar
+RegExpParser<CharT>::ParseOctalLiteral()
+{
+    MOZ_ASSERT('0' <= current() && current() <= '7');
+    // For compatibility with some other browsers (not all), we parse
+    // up to three octal digits with a value below 256.
+    widechar value = current() - '0';
+    Advance();
+    if ('0' <= current() && current() <= '7') {
+        value = value * 8 + current() - '0';
+        Advance();
+        if (value < 32 && '0' <= current() && current() <= '7') {
+            value = value * 8 + current() - '0';
+            Advance();
+        }
+    }
+    return value;
+}
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseHexEscape(int length, widechar* value)
+{
+    const CharT* start = position();
+    uint32_t val = 0;
+    bool done = false;
+    for (int i = 0; !done; i++) {
+        widechar c = current();
+        int d = HexValue(c);
+        if (d < 0) {
+            Reset(start);
+            return false;
+        }
+        val = val * 16 + d;
+        Advance();
+        if (i == length - 1) {
+            done = true;
+        }
+    }
+    *value = val;
+    return true;
+}
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseBracedHexEscape(widechar* value)
+{
+    MOZ_ASSERT(current() == '{');
+    Advance();
+
+    bool first = true;
+    uint32_t code = 0;
+    while (true) {
+        widechar c = current();
+        if (c == kEndMarker) {
+            ReportError(JSMSG_INVALID_UNICODE_ESCAPE);
+            return false;
+        }
+        if (c == '}') {
+            if (first) {
+                ReportError(JSMSG_INVALID_UNICODE_ESCAPE);
+                return false;
+            }
+            Advance();
+            break;
+        }
+
+        int d = HexValue(c);
+        if (d < 0) {
+            ReportError(JSMSG_INVALID_UNICODE_ESCAPE);
+            return false;
+        }
+        code = (code << 4) | d;
+        if (code > unicode::NonBMPMax) {
+            ReportError(JSMSG_UNICODE_OVERFLOW);
+            return false;
+        }
+        Advance();
+        first = false;
+    }
+
+    *value = code;
+    return true;
+}
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseTrailSurrogate(widechar* value)
+{
+    if (current() != '\\')
+        return false;
+
+    const CharT* start = position();
+    Advance();
+    if (current() != 'u') {
+        Reset(start);
+        return false;
+    }
+    Advance();
+    if (!ParseHexEscape(4, value)) {
+        Reset(start);
+        return false;
+    }
+    if (!unicode::IsTrailSurrogate(*value)) {
+        Reset(start);
+        return false;
+    }
+    return true;
+}
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseRawSurrogatePair(char16_t* lead, char16_t* trail)
+{
+    widechar c1 = current();
+    if (!unicode::IsLeadSurrogate(c1))
+        return false;
+
+    const CharT* start = position();
+    Advance();
+    widechar c2 = current();
+    if (!unicode::IsTrailSurrogate(c2)) {
+        Reset(start);
+        return false;
+    }
+    Advance();
+    *lead = c1;
+    *trail = c2;
+    return true;
+}
+
+static inline RegExpTree*
+RangeAtom(LifoAlloc* alloc, char16_t from, char16_t to)
+{
+    CharacterRangeVector* ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    ranges->append(CharacterRange::Range(from, to));
+    return alloc->newInfallible<RegExpCharacterClass>(ranges, false);
+}
+
+static inline RegExpTree*
+NegativeLookahead(LifoAlloc* alloc, char16_t from, char16_t to)
+{
+    return alloc->newInfallible<RegExpLookahead>(RangeAtom(alloc, from, to), false, 0, 0);
+}
+
+static bool
+IsSyntaxCharacter(widechar c)
+{
+  switch (c) {
+    case '^':
+    case '$':
+    case '\\':
+    case '.':
+    case '*':
+    case '+':
+    case '?':
+    case '(':
+    case ')':
+    case '[':
+    case ']':
+    case '{':
+    case '}':
+    case '|':
+    case '/':
+      return true;
+    default:
+      return false;
+  }
+}
+
+#ifdef DEBUG
+// Currently only used in an assert.kASSERT.
+static bool
+IsSpecialClassEscape(widechar c)
+{
+  switch (c) {
+    case 'd': case 'D':
+    case 's': case 'S':
+    case 'w': case 'W':
+      return true;
+    default:
+      return false;
+  }
+}
+#endif
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseClassCharacterEscape(widechar* code)
+{
+    MOZ_ASSERT(current() == '\\');
+    MOZ_ASSERT(has_next() && !IsSpecialClassEscape(Next()));
+    Advance();
+    switch (current()) {
+      case 'b':
+        Advance();
+        *code = '\b';
+        return true;
+      // ControlEscape :: one of
+      //   f n r t v
+      case 'f':
+        Advance();
+        *code = '\f';
+        return true;
+      case 'n':
+        Advance();
+        *code = '\n';
+        return true;
+      case 'r':
+        Advance();
+        *code = '\r';
+        return true;
+      case 't':
+        Advance();
+        *code = '\t';
+        return true;
+      case 'v':
+        Advance();
+        *code = '\v';
+        return true;
+      case 'c': {
+        widechar controlLetter = Next();
+        widechar letter = controlLetter & ~('A' ^ 'a');
+        // For compatibility with JSC, inside a character class
+        // we also accept digits and underscore as control characters,
+        // but only in non-unicode mode
+        if ((!unicode_ &&
+             ((controlLetter >= '0' && controlLetter <= '9') ||
+              controlLetter == '_')) ||
+            (letter >= 'A' && letter <= 'Z'))
+        {
+            Advance(2);
+            // Control letters mapped to ASCII control characters in the range
+            // 0x00-0x1f.
+            *code = controlLetter & 0x1f;
+            return true;
+        }
+        if (unicode_) {
+            ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+            return false;
+        }
+        // We match JSC in reading the backslash as a literal
+        // character instead of as starting an escape.
+        *code = '\\';
+        return true;
+      }
+      case '0': case '1': case '2': case '3': case '4': case '5':
+      case '6': case '7':
+        if (unicode_) {
+            if (current() == '0') {
+                Advance();
+                *code = 0;
+                return true;
+            }
+            ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+            return false;
+        }
+        // For compatibility, outside of unicode mode, we interpret a decimal
+        // escape that isn't a back reference (and therefore either \0 or not
+        // valid according to the specification) as a 1..3 digit octal
+        // character code.
+        *code = ParseOctalLiteral();
+        return true;
+      case 'x': {
+        Advance();
+        widechar value;
+        if (ParseHexEscape(2, &value)) {
+            *code = value;
+            return true;
+        }
+        if (unicode_) {
+            ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+            return false;
+        }
+        // If \x is not followed by a two-digit hexadecimal, treat it
+        // as an identity escape in non-unicode mode.
+        *code = 'x';
+        return true;
+      }
+      case 'u': {
+        Advance();
+        widechar value;
+        if (unicode_) {
+            if (current() == '{') {
+                if (!ParseBracedHexEscape(&value))
+                    return false;
+                *code = value;
+                return true;
+            }
+            if (ParseHexEscape(4, &value)) {
+                if (unicode::IsLeadSurrogate(value)) {
+                    widechar trail;
+                    if (ParseTrailSurrogate(&trail)) {
+                        *code = unicode::UTF16Decode(value, trail);
+                        return true;
+                    }
+                }
+                *code = value;
+                return true;
+            }
+            ReportError(JSMSG_INVALID_UNICODE_ESCAPE);
+            return false;
+        }
+        if (ParseHexEscape(4, &value)) {
+            *code = value;
+            return true;
+        }
+        // If \u is not followed by a four-digit or braced hexadecimal, treat it
+        // as an identity escape.
+        *code = 'u';
+        return true;
+      }
+      default: {
+        // Extended identity escape (non-unicode only). We accept any character
+        // that hasn't been matched by a more specific case, not just the subset
+        // required by the ECMAScript specification.
+        widechar result = current();
+        if (unicode_ && result != '-' && !IsSyntaxCharacter(result)) {
+            ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+            return false;
+        }
+        Advance();
+        *code = result;
+        return true;
+      }
+    }
+    return true;
+}
+
+class WideCharRange
+{
+  public:
+    WideCharRange()
+      : from_(0), to_(0)
+    {}
+
+    WideCharRange(widechar from, widechar to)
+      : from_(from), to_(to)
+    {}
+
+    static inline WideCharRange Singleton(widechar value) {
+        return WideCharRange(value, value);
+    }
+    static inline WideCharRange Range(widechar from, widechar to) {
+        MOZ_ASSERT(from <= to);
+        return WideCharRange(from, to);
+    }
+
+    bool Contains(widechar i) const { return from_ <= i && i <= to_; }
+    widechar from() const { return from_; }
+    widechar to() const { return to_; }
+
+  private:
+    widechar from_;
+    widechar to_;
+};
+
+typedef InfallibleVector<WideCharRange, 1> WideCharRangeVector;
+
+static inline CharacterRange
+LeadSurrogateRange()
+{
+    return CharacterRange::Range(unicode::LeadSurrogateMin, unicode::LeadSurrogateMax);
+}
+
+static inline CharacterRange
+TrailSurrogateRange()
+{
+    return CharacterRange::Range(unicode::TrailSurrogateMin, unicode::TrailSurrogateMax);
+}
+
+static inline WideCharRange
+NonBMPRange()
+{
+    return WideCharRange::Range(unicode::NonBMPMin, unicode::NonBMPMax);
+}
+
+static const char16_t kNoCharClass = 0;
+
+// Adds a character or pre-defined character class to character ranges.
+// If char_class is not kInvalidClass, it's interpreted as a class
+// escape (i.e., 's' means whitespace, from '\s').
+static inline void
+AddCharOrEscape(LifoAlloc* alloc,
+                CharacterRangeVector* ranges,
+                char16_t char_class,
+                widechar c)
+{
+    if (char_class != kNoCharClass)
+        CharacterRange::AddClassEscape(alloc, char_class, ranges);
+    else
+        ranges->append(CharacterRange::Singleton(c));
+}
+
+static inline void
+AddCharOrEscapeUnicode(LifoAlloc* alloc,
+                       CharacterRangeVector* ranges,
+                       CharacterRangeVector* lead_ranges,
+                       CharacterRangeVector* trail_ranges,
+                       WideCharRangeVector* wide_ranges,
+                       char16_t char_class,
+                       widechar c,
+                       bool ignore_case)
+{
+    if (char_class != kNoCharClass) {
+        CharacterRange::AddClassEscapeUnicode(alloc, char_class, ranges, ignore_case);
+        switch (char_class) {
+          case 'S':
+          case 'W':
+          case 'D':
+            lead_ranges->append(LeadSurrogateRange());
+            trail_ranges->append(TrailSurrogateRange());
+            wide_ranges->append(NonBMPRange());
+            break;
+          case '.':
+            MOZ_CRASH("Bad char_class!");
+        }
+        return;
+    }
+
+    if (unicode::IsLeadSurrogate(c))
+        lead_ranges->append(CharacterRange::Singleton(c));
+    else if (unicode::IsTrailSurrogate(c))
+        trail_ranges->append(CharacterRange::Singleton(c));
+    else if (c >= unicode::NonBMPMin)
+        wide_ranges->append(WideCharRange::Singleton(c));
+    else
+        ranges->append(CharacterRange::Singleton(c));
+}
+
+static inline void
+AddUnicodeRange(LifoAlloc* alloc,
+                CharacterRangeVector* ranges,
+                CharacterRangeVector* lead_ranges,
+                CharacterRangeVector* trail_ranges,
+                WideCharRangeVector* wide_ranges,
+                widechar first,
+                widechar next)
+{
+    MOZ_ASSERT(first <= next);
+    if (first < unicode::LeadSurrogateMin) {
+        if (next < unicode::LeadSurrogateMin) {
+            ranges->append(CharacterRange::Range(first, next));
+            return;
+        }
+        ranges->append(CharacterRange::Range(first, unicode::LeadSurrogateMin - 1));
+        first = unicode::LeadSurrogateMin;
+    }
+    if (first <= unicode::LeadSurrogateMax) {
+        if (next <= unicode::LeadSurrogateMax) {
+            lead_ranges->append(CharacterRange::Range(first, next));
+            return;
+        }
+        lead_ranges->append(CharacterRange::Range(first, unicode::LeadSurrogateMax));
+        first = unicode::LeadSurrogateMax + 1;
+    }
+    MOZ_ASSERT(unicode::LeadSurrogateMax + 1 == unicode::TrailSurrogateMin);
+    if (first <= unicode::TrailSurrogateMax) {
+        if (next <= unicode::TrailSurrogateMax) {
+            trail_ranges->append(CharacterRange::Range(first, next));
+            return;
+        }
+        trail_ranges->append(CharacterRange::Range(first, unicode::TrailSurrogateMax));
+        first = unicode::TrailSurrogateMax + 1;
+    }
+    if (first <= unicode::UTF16Max) {
+        if (next <= unicode::UTF16Max) {
+            ranges->append(CharacterRange::Range(first, next));
+            return;
+        }
+        ranges->append(CharacterRange::Range(first, unicode::UTF16Max));
+        first = unicode::NonBMPMin;
+    }
+    MOZ_ASSERT(unicode::UTF16Max + 1 == unicode::NonBMPMin);
+    wide_ranges->append(WideCharRange::Range(first, next));
+}
+
+// Negate a vector of ranges by subtracting its ranges from a range
+// encompassing the full range of possible values.
+template <typename RangeType>
+static inline void
+NegateUnicodeRanges(LifoAlloc* alloc, InfallibleVector<RangeType, 1>** ranges,
+                    RangeType full_range)
+{
+    typedef InfallibleVector<RangeType, 1> RangeVector;
+    RangeVector* tmp_ranges = alloc->newInfallible<RangeVector>(*alloc);
+    tmp_ranges->append(full_range);
+    RangeVector* result_ranges = alloc->newInfallible<RangeVector>(*alloc);
+
+    // Perform the following calculation:
+    //   result_ranges = tmp_ranges - ranges
+    // with the following steps:
+    //   result_ranges = tmp_ranges - ranges[0]
+    //   SWAP(result_ranges, tmp_ranges)
+    //   result_ranges = tmp_ranges - ranges[1]
+    //   SWAP(result_ranges, tmp_ranges)
+    //   ...
+    //   result_ranges = tmp_ranges - ranges[N-1]
+    //   SWAP(result_ranges, tmp_ranges)
+    // The last SWAP is just for simplicity of the loop.
+    for (size_t i = 0; i < (*ranges)->length(); i++) {
+        result_ranges->clear();
+
+        const RangeType& range = (**ranges)[i];
+        for (size_t j = 0; j < tmp_ranges->length(); j++) {
+            const RangeType& tmpRange = (*tmp_ranges)[j];
+            auto from1 = tmpRange.from();
+            auto to1 = tmpRange.to();
+            auto from2 = range.from();
+            auto to2 = range.to();
+
+            if (from1 < from2) {
+                if (to1 < from2) {
+                    result_ranges->append(tmpRange);
+                } else if (to1 <= to2) {
+                    result_ranges->append(RangeType::Range(from1, from2 - 1));
+                } else {
+                    result_ranges->append(RangeType::Range(from1, from2 - 1));
+                    result_ranges->append(RangeType::Range(to2 + 1, to1));
+                }
+            } else if (from1 <= to2) {
+                if (to1 > to2)
+                    result_ranges->append(RangeType::Range(to2 + 1, to1));
+            } else {
+                result_ranges->append(tmpRange);
+            }
+        }
+
+        auto tmp = tmp_ranges;
+        tmp_ranges = result_ranges;
+        result_ranges = tmp;
+    }
+
+    // After the loop, result is pointed at by tmp_ranges, instead of
+    // result_ranges.
+    *ranges = tmp_ranges;
+}
+
+static bool
+WideCharRangesContain(WideCharRangeVector* wide_ranges, widechar c)
+{
+    for (size_t i = 0; i < wide_ranges->length(); i++) {
+        const WideCharRange& range = (*wide_ranges)[i];
+        if (range.Contains(c))
+            return true;
+    }
+    return false;
+}
+
+static void
+CalculateCaseInsensitiveRanges(LifoAlloc* alloc, widechar from, widechar to, int32_t diff,
+                               WideCharRangeVector* wide_ranges,
+                               WideCharRangeVector** tmp_wide_ranges)
+{
+    widechar contains_from = 0;
+    widechar contains_to = 0;
+    for (widechar c = from; c <= to; c++) {
+        if (WideCharRangesContain(wide_ranges, c) &&
+            !WideCharRangesContain(wide_ranges, c + diff))
+        {
+            if (contains_from == 0)
+                contains_from = c;
+            contains_to = c;
+        } else if (contains_from != 0) {
+            if (!*tmp_wide_ranges)
+                *tmp_wide_ranges = alloc->newInfallible<WideCharRangeVector>(*alloc);
+
+            (*tmp_wide_ranges)->append(WideCharRange::Range(contains_from + diff,
+                                                            contains_to + diff));
+            contains_from = 0;
+        }
+    }
+
+    if (contains_from != 0) {
+        if (!*tmp_wide_ranges)
+            *tmp_wide_ranges = alloc->newInfallible<WideCharRangeVector>(*alloc);
+
+        (*tmp_wide_ranges)->append(WideCharRange::Range(contains_from + diff,
+                                                        contains_to + diff));
+    }
+}
+
+static RegExpTree*
+UnicodeRangesAtom(LifoAlloc* alloc,
+                  CharacterRangeVector* ranges,
+                  CharacterRangeVector* lead_ranges,
+                  CharacterRangeVector* trail_ranges,
+                  WideCharRangeVector* wide_ranges,
+                  bool is_negated,
+                  bool ignore_case)
+{
+    // Calculate case folding for non-BMP first and negate the range if needed.
+    if (ignore_case) {
+        WideCharRangeVector* tmp_wide_ranges = nullptr;
+#define CALL_CALC(FROM, TO, LEAD, TRAIL_FROM, TRAIL_TO, DIFF) \
+        CalculateCaseInsensitiveRanges(alloc, FROM, TO, DIFF, wide_ranges, &tmp_wide_ranges);
+        FOR_EACH_NON_BMP_CASE_FOLDING(CALL_CALC)
+        FOR_EACH_NON_BMP_REV_CASE_FOLDING(CALL_CALC)
+#undef CALL_CALC
+
+        if (tmp_wide_ranges) {
+            for (size_t i = 0; i < tmp_wide_ranges->length(); i++)
+                wide_ranges->append((*tmp_wide_ranges)[i]);
+        }
+    }
+
+    if (is_negated) {
+        NegateUnicodeRanges(alloc, &lead_ranges, LeadSurrogateRange());
+        NegateUnicodeRanges(alloc, &trail_ranges, TrailSurrogateRange());
+        NegateUnicodeRanges(alloc, &wide_ranges, NonBMPRange());
+    }
+
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+
+    bool added = false;
+
+    if (is_negated) {
+        ranges->append(LeadSurrogateRange());
+        ranges->append(TrailSurrogateRange());
+    }
+    if (ranges->length() > 0) {
+        builder->AddAtom(alloc->newInfallible<RegExpCharacterClass>(ranges, is_negated));
+        added = true;
+    }
+
+    if (lead_ranges->length() > 0) {
+        if (added)
+            builder->NewAlternative();
+        builder->AddAtom(alloc->newInfallible<RegExpCharacterClass>(lead_ranges, false));
+        builder->AddAtom(NegativeLookahead(alloc, unicode::TrailSurrogateMin,
+                                           unicode::TrailSurrogateMax));
+        added = true;
+    }
+
+    if (trail_ranges->length() > 0) {
+        if (added)
+            builder->NewAlternative();
+        builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(
+            RegExpAssertion::NOT_AFTER_LEAD_SURROGATE));
+        builder->AddAtom(alloc->newInfallible<RegExpCharacterClass>(trail_ranges, false));
+        added = true;
+    }
+
+    for (size_t i = 0; i < wide_ranges->length(); i++) {
+        if (added)
+            builder->NewAlternative();
+
+        const WideCharRange& range = (*wide_ranges)[i];
+        widechar from = range.from();
+        widechar to = range.to();
+        char16_t from_lead, from_trail;
+        char16_t to_lead, to_trail;
+
+        unicode::UTF16Encode(from, &from_lead, &from_trail);
+        if (from == to) {
+            builder->AddCharacter(from_lead);
+            builder->AddCharacter(from_trail);
+        } else {
+            unicode::UTF16Encode(to, &to_lead, &to_trail);
+            if (from_lead == to_lead) {
+                MOZ_ASSERT(from_trail != to_trail);
+                builder->AddCharacter(from_lead);
+                builder->AddAtom(RangeAtom(alloc, from_trail, to_trail));
+            } else if (from_trail == unicode::TrailSurrogateMin &&
+                       to_trail == unicode::TrailSurrogateMax)
+            {
+                builder->AddAtom(RangeAtom(alloc, from_lead, to_lead));
+                builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin,
+                                           unicode::TrailSurrogateMax));
+            } else if (from_lead + 1 == to_lead) {
+                builder->AddCharacter(from_lead);
+                builder->AddAtom(RangeAtom(alloc, from_trail, unicode::TrailSurrogateMax));
+
+                builder->NewAlternative();
+
+                builder->AddCharacter(to_lead);
+                builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin, to_trail));
+            } else if (from_lead + 2 == to_lead) {
+                builder->AddCharacter(from_lead);
+                builder->AddAtom(RangeAtom(alloc, from_trail, unicode::TrailSurrogateMax));
+
+                builder->NewAlternative();
+
+                builder->AddCharacter(from_lead + 1);
+                builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin,
+                                           unicode::TrailSurrogateMax));
+
+                builder->NewAlternative();
+
+                builder->AddCharacter(to_lead);
+                builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin, to_trail));
+            } else {
+                builder->AddCharacter(from_lead);
+                builder->AddAtom(RangeAtom(alloc, from_trail, unicode::TrailSurrogateMax));
+
+                builder->NewAlternative();
+
+                builder->AddAtom(RangeAtom(alloc, from_lead + 1, to_lead - 1));
+                builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin,
+                                           unicode::TrailSurrogateMax));
+
+                builder->NewAlternative();
+
+                builder->AddCharacter(to_lead);
+                builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin, to_trail));
+            }
+        }
+        added = true;
+    }
+
+    return builder->ToRegExp();
+}
+
+template <typename CharT>
+RegExpTree*
+RegExpParser<CharT>::ParseCharacterClass()
+{
+    MOZ_ASSERT(current() == '[');
+    Advance();
+    bool is_negated = false;
+    if (current() == '^') {
+        is_negated = true;
+        Advance();
+    }
+    CharacterRangeVector* ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    CharacterRangeVector* lead_ranges = nullptr;
+    CharacterRangeVector* trail_ranges = nullptr;
+    WideCharRangeVector* wide_ranges = nullptr;
+
+    if (unicode_) {
+        lead_ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+        trail_ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+        wide_ranges = alloc->newInfallible<WideCharRangeVector>(*alloc);
+    }
+
+    while (has_more() && current() != ']') {
+        char16_t char_class = kNoCharClass;
+        widechar first = 0;
+        if (!ParseClassAtom(&char_class, &first))
+            return nullptr;
+        if (current() == '-') {
+            Advance();
+            if (current() == kEndMarker) {
+                // If we reach the end we break out of the loop and let the
+                // following code report an error.
+                break;
+            } else if (current() == ']') {
+                if (unicode_) {
+                    AddCharOrEscapeUnicode(alloc, ranges, lead_ranges, trail_ranges, wide_ranges,
+                                           char_class, first, ignore_case_);
+                } else {
+                    AddCharOrEscape(alloc, ranges, char_class, first);
+                }
+                ranges->append(CharacterRange::Singleton('-'));
+                break;
+            }
+            char16_t char_class_2 = kNoCharClass;
+            widechar next = 0;
+            if (!ParseClassAtom(&char_class_2, &next))
+                return nullptr;
+            if (char_class != kNoCharClass || char_class_2 != kNoCharClass) {
+                if (unicode_)
+                    return ReportError(JSMSG_RANGE_WITH_CLASS_ESCAPE);
+
+                // Either end is an escaped character class. Treat the '-' verbatim.
+                AddCharOrEscape(alloc, ranges, char_class, first);
+                ranges->append(CharacterRange::Singleton('-'));
+                AddCharOrEscape(alloc, ranges, char_class_2, next);
+                continue;
+            }
+            if (first > next)
+                return ReportError(JSMSG_BAD_CLASS_RANGE);
+            if (unicode_)
+                AddUnicodeRange(alloc, ranges, lead_ranges, trail_ranges,wide_ranges, first, next);
+            else
+                ranges->append(CharacterRange::Range(first, next));
+        } else {
+            if (unicode_) {
+                AddCharOrEscapeUnicode(alloc, ranges, lead_ranges, trail_ranges, wide_ranges,
+                                       char_class, first, ignore_case_);
+            } else {
+                AddCharOrEscape(alloc, ranges, char_class, first);
+            }
+        }
+    }
+    if (!has_more())
+        return ReportError(JSMSG_UNTERM_CLASS);
+    Advance();
+    if (!unicode_) {
+        if (ranges->length() == 0) {
+            ranges->append(CharacterRange::Everything());
+            is_negated = !is_negated;
+        }
+        return alloc->newInfallible<RegExpCharacterClass>(ranges, is_negated);
+    }
+
+    if (!is_negated && ranges->length() == 0 && lead_ranges->length() == 0 &&
+        trail_ranges->length() == 0 && wide_ranges->length() == 0)
+    {
+        ranges->append(CharacterRange::Everything());
+        return alloc->newInfallible<RegExpCharacterClass>(ranges, true);
+    }
+
+    return UnicodeRangesAtom(alloc, ranges, lead_ranges, trail_ranges, wide_ranges, is_negated,
+                             ignore_case_);
+}
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseClassAtom(char16_t* char_class, widechar* value)
+{
+    MOZ_ASSERT(*char_class == kNoCharClass);
+    widechar first = current();
+    if (first == '\\') {
+        switch (Next()) {
+          case 'w': case 'W': case 'd': case 'D': case 's': case 'S': {
+            *char_class = Next();
+            Advance(2);
+            return true;
+          }
+          case kEndMarker:
+            return ReportError(JSMSG_ESCAPE_AT_END_OF_REGEXP);
+          default:
+            if (!ParseClassCharacterEscape(value))
+                return false;
+            return true;
+        }
+    } else {
+        if (unicode_) {
+            char16_t lead, trail;
+            if (ParseRawSurrogatePair(&lead, &trail)) {
+                *value = unicode::UTF16Decode(lead, trail);
+                return true;
+            }
+        }
+        Advance();
+        *value = first;
+        return true;
+    }
+}
+
+// In order to know whether an escape is a backreference or not we have to scan
+// the entire regexp and find the number of capturing parentheses.  However we
+// don't want to scan the regexp twice unless it is necessary.  This mini-parser
+// is called when needed.  It can see the difference between capturing and
+// noncapturing parentheses and can skip character classes and backslash-escaped
+// characters.
+template <typename CharT>
+void
+RegExpParser<CharT>::ScanForCaptures()
+{
+    // Start with captures started previous to current position
+    int capture_count = captures_started();
+    // Add count of captures after this position.
+    widechar n;
+    while ((n = current()) != kEndMarker) {
+        Advance();
+        switch (n) {
+          case '\\':
+            Advance();
+            break;
+          case '[': {
+            widechar c;
+            while ((c = current()) != kEndMarker) {
+                Advance();
+                if (c == '\\') {
+                    Advance();
+                } else {
+                    if (c == ']') break;
+                }
+            }
+            break;
+          }
+          case '(':
+            if (current() != '?') capture_count++;
+            break;
+        }
+    }
+    capture_count_ = capture_count;
+    is_scanned_for_captures_ = true;
+}
+
+inline bool
+IsInRange(int value, int lower_limit, int higher_limit)
+{
+    MOZ_ASSERT(lower_limit <= higher_limit);
+    return static_cast<unsigned int>(value - lower_limit) <=
+           static_cast<unsigned int>(higher_limit - lower_limit);
+}
+
+inline bool
+IsDecimalDigit(widechar c)
+{
+    // ECMA-262, 3rd, 7.8.3 (p 16)
+    return IsInRange(c, '0', '9');
+}
+
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseBackReferenceIndex(int* index_out)
+{
+    MOZ_ASSERT('\\' == current());
+    MOZ_ASSERT('1' <= Next() && Next() <= '9');
+
+    // Try to parse a decimal literal that is no greater than the total number
+    // of left capturing parentheses in the input.
+    const CharT* start = position();
+    int value = Next() - '0';
+    Advance(2);
+    while (true) {
+        widechar c = current();
+        if (IsDecimalDigit(c)) {
+            value = 10 * value + (c - '0');
+            if (value > kMaxCaptures) {
+                Reset(start);
+                return false;
+            }
+            Advance();
+        } else {
+            break;
+        }
+    }
+    if (value > captures_started()) {
+        if (!is_scanned_for_captures_) {
+            const CharT* saved_position = position();
+            ScanForCaptures();
+            Reset(saved_position);
+        }
+        if (value > capture_count_) {
+            Reset(start);
+            return false;
+        }
+    }
+    *index_out = value;
+    return true;
+}
+
+// QuantifierPrefix ::
+//   { DecimalDigits }
+//   { DecimalDigits , }
+//   { DecimalDigits , DecimalDigits }
+//
+// Returns true if parsing succeeds, and set the min_out and max_out
+// values. Values are truncated to RegExpTree::kInfinity if they overflow.
+template <typename CharT>
+bool
+RegExpParser<CharT>::ParseIntervalQuantifier(int* min_out, int* max_out)
+{
+    MOZ_ASSERT(current() == '{');
+    const CharT* start = position();
+    Advance();
+    int min = 0;
+    if (!IsDecimalDigit(current())) {
+        Reset(start);
+        return false;
+    }
+    while (IsDecimalDigit(current())) {
+        int next = current() - '0';
+        if (min > (RegExpTree::kInfinity - next) / 10) {
+            // Overflow. Skip past remaining decimal digits and return -1.
+            do {
+                Advance();
+            } while (IsDecimalDigit(current()));
+            min = RegExpTree::kInfinity;
+            break;
+        }
+        min = 10 * min + next;
+        Advance();
+    }
+    int max = 0;
+    if (current() == '}') {
+        max = min;
+        Advance();
+    } else if (current() == ',') {
+        Advance();
+        if (current() == '}') {
+            max = RegExpTree::kInfinity;
+            Advance();
+        } else {
+            while (IsDecimalDigit(current())) {
+                int next = current() - '0';
+                if (max > (RegExpTree::kInfinity - next) / 10) {
+                    do {
+                        Advance();
+                    } while (IsDecimalDigit(current()));
+                    max = RegExpTree::kInfinity;
+                    break;
+                }
+                max = 10 * max + next;
+                Advance();
+            }
+            if (current() != '}') {
+                Reset(start);
+                return false;
+            }
+            Advance();
+        }
+    } else {
+        Reset(start);
+        return false;
+    }
+    *min_out = min;
+    *max_out = max;
+    return true;
+}
+
+// Pattern ::
+//   Disjunction
+template <typename CharT>
+RegExpTree*
+RegExpParser<CharT>::ParsePattern()
+{
+    RegExpTree* result = ParseDisjunction();
+    MOZ_ASSERT_IF(result, !has_more());
+    return result;
+}
+
+static inline RegExpTree*
+CaseFoldingSurrogatePairAtom(LifoAlloc* alloc, char16_t lead, char16_t trail, int32_t diff)
+{
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+
+    builder->AddCharacter(lead);
+    CharacterRangeVector* ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    ranges->append(CharacterRange::Range(trail, trail));
+    ranges->append(CharacterRange::Range(trail + diff, trail + diff));
+    builder->AddAtom(alloc->newInfallible<RegExpCharacterClass>(ranges, false));
+
+    return builder->ToRegExp();
+}
+
+static inline RegExpTree*
+SurrogatePairAtom(LifoAlloc* alloc, char16_t lead, char16_t trail, bool ignore_case)
+{
+    if (ignore_case) {
+#define CALL_ATOM(FROM, TO, LEAD, TRAIL_FROM, TRAIL_TO, DIFF) \
+        if (lead == LEAD &&trail >= TRAIL_FROM && trail <= TRAIL_TO) \
+            return CaseFoldingSurrogatePairAtom(alloc, lead, trail, DIFF);
+        FOR_EACH_NON_BMP_CASE_FOLDING(CALL_ATOM)
+        FOR_EACH_NON_BMP_REV_CASE_FOLDING(CALL_ATOM)
+#undef CALL_ATOM
+    }
+
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+    builder->AddCharacter(lead);
+    builder->AddCharacter(trail);
+    return builder->ToRegExp();
+}
+
+static inline RegExpTree*
+LeadSurrogateAtom(LifoAlloc* alloc, char16_t value)
+{
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+    builder->AddCharacter(value);
+    builder->AddAtom(NegativeLookahead(alloc, unicode::TrailSurrogateMin,
+                                       unicode::TrailSurrogateMax));
+    return builder->ToRegExp();
+}
+
+static inline RegExpTree*
+TrailSurrogateAtom(LifoAlloc* alloc, char16_t value)
+{
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+    builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(
+        RegExpAssertion::NOT_AFTER_LEAD_SURROGATE));
+    builder->AddCharacter(value);
+    return builder->ToRegExp();
+}
+
+static inline RegExpTree*
+UnicodeEverythingAtom(LifoAlloc* alloc)
+{
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+
+    // everything except \x0a, \x0d, \u2028 and \u2029
+
+    CharacterRangeVector* ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    ranges->append(CharacterRange::Range(0x0, 0x09));
+    ranges->append(CharacterRange::Range(0x0b, 0x0c));
+    ranges->append(CharacterRange::Range(0x0e, 0x2027));
+    ranges->append(CharacterRange::Range(0x202A, unicode::LeadSurrogateMin - 1));
+    ranges->append(CharacterRange::Range(unicode::TrailSurrogateMax + 1, unicode::UTF16Max));
+    builder->AddAtom(alloc->newInfallible<RegExpCharacterClass>(ranges, false));
+
+    builder->NewAlternative();
+
+    builder->AddAtom(RangeAtom(alloc, unicode::LeadSurrogateMin, unicode::LeadSurrogateMax));
+    builder->AddAtom(NegativeLookahead(alloc, unicode::TrailSurrogateMin,
+                                       unicode::TrailSurrogateMax));
+
+    builder->NewAlternative();
+
+    builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(
+        RegExpAssertion::NOT_AFTER_LEAD_SURROGATE));
+    builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin, unicode::TrailSurrogateMax));
+
+    builder->NewAlternative();
+
+    builder->AddAtom(RangeAtom(alloc, unicode::LeadSurrogateMin, unicode::LeadSurrogateMax));
+    builder->AddAtom(RangeAtom(alloc, unicode::TrailSurrogateMin, unicode::TrailSurrogateMax));
+
+    return builder->ToRegExp();
+}
+
+RegExpTree*
+UnicodeCharacterClassEscapeAtom(LifoAlloc* alloc, char16_t char_class, bool ignore_case)
+{
+    CharacterRangeVector* ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    CharacterRangeVector* lead_ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    CharacterRangeVector* trail_ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+    WideCharRangeVector* wide_ranges = alloc->newInfallible<WideCharRangeVector>(*alloc);
+    AddCharOrEscapeUnicode(alloc, ranges, lead_ranges, trail_ranges, wide_ranges, char_class, 0,
+                           ignore_case);
+
+    return UnicodeRangesAtom(alloc, ranges, lead_ranges, trail_ranges, wide_ranges, false, false);
+}
+
+static inline RegExpTree*
+UnicodeBackReferenceAtom(LifoAlloc* alloc, RegExpTree* atom)
+{
+    // If a back reference has a standalone lead surrogate as its last
+    // character, then that lead surrogate shouldn't match lead surrogates that
+    // are paired with a corresponding trail surrogate.
+    RegExpBuilder* builder = alloc->newInfallible<RegExpBuilder>(alloc);
+
+    builder->AddAtom(atom);
+    builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(
+        RegExpAssertion::NOT_IN_SURROGATE_PAIR));
+
+    return builder->ToRegExp();
+}
+
+// Disjunction ::
+//   Alternative
+//   Alternative | Disjunction
+// Alternative ::
+//   [empty]
+//   Term Alternative
+// Term ::
+//   Assertion
+//   Atom
+//   Atom Quantifier
+template <typename CharT>
+RegExpTree*
+RegExpParser<CharT>::ParseDisjunction()
+{
+    // Used to store current state while parsing subexpressions.
+    RegExpParserState initial_state(alloc, nullptr, INITIAL, 0);
+    RegExpParserState* stored_state = &initial_state;
+    // Cache the builder in a local variable for quick access.
+    RegExpBuilder* builder = initial_state.builder();
+    while (true) {
+        switch (current()) {
+          case kEndMarker:
+            if (stored_state->IsSubexpression()) {
+                // Inside a parenthesized group when hitting end of input.
+                return ReportError(JSMSG_MISSING_PAREN);
+            }
+            MOZ_ASSERT(INITIAL == stored_state->group_type());
+            // Parsing completed successfully.
+            return builder->ToRegExp();
+          case ')': {
+            if (!stored_state->IsSubexpression())
+                return ReportError(JSMSG_UNMATCHED_RIGHT_PAREN);
+            MOZ_ASSERT(INITIAL != stored_state->group_type());
+
+            Advance();
+            // End disjunction parsing and convert builder content to new single
+            // regexp atom.
+            RegExpTree* body = builder->ToRegExp();
+
+            int end_capture_index = captures_started();
+
+            int capture_index = stored_state->capture_index();
+            SubexpressionType group_type = stored_state->group_type();
+
+            // Restore previous state.
+            stored_state = stored_state->previous_state();
+            builder = stored_state->builder();
+
+            // Build result of subexpression.
+            if (group_type == CAPTURE) {
+                RegExpCapture* capture = alloc->newInfallible<RegExpCapture>(body, capture_index);
+                (*captures_)[capture_index - 1] = capture;
+                body = capture;
+            } else if (group_type != GROUPING) {
+                MOZ_ASSERT(group_type == POSITIVE_LOOKAHEAD ||
+                           group_type == NEGATIVE_LOOKAHEAD);
+                bool is_positive = (group_type == POSITIVE_LOOKAHEAD);
+                body = alloc->newInfallible<RegExpLookahead>(body,
+                                                   is_positive,
+                                                   end_capture_index - capture_index,
+                                                   capture_index);
+            }
+            builder->AddAtom(body);
+            if (unicode_ && (group_type == POSITIVE_LOOKAHEAD || group_type == NEGATIVE_LOOKAHEAD))
+                continue;
+            // For compatability with JSC and ES3, we allow quantifiers after
+            // lookaheads, and break in all cases.
+            break;
+          }
+          case '|': {
+            Advance();
+            builder->NewAlternative();
+            continue;
+          }
+          case '*':
+          case '+':
+          case '?':
+            return ReportError(JSMSG_NOTHING_TO_REPEAT);
+          case '^': {
+            Advance();
+            if (multiline_) {
+                builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(RegExpAssertion::START_OF_LINE));
+            } else {
+                builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(RegExpAssertion::START_OF_INPUT));
+                set_contains_anchor();
+            }
+            continue;
+          }
+          case '$': {
+            Advance();
+            RegExpAssertion::AssertionType assertion_type =
+                multiline_ ? RegExpAssertion::END_OF_LINE :
+                RegExpAssertion::END_OF_INPUT;
+            builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(assertion_type));
+            continue;
+          }
+          case '.': {
+            Advance();
+            // everything except \x0a, \x0d, \u2028 and \u2029
+            if (unicode_) {
+                builder->AddAtom(UnicodeEverythingAtom(alloc));
+                break;
+            }
+            CharacterRangeVector* ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
+            CharacterRange::AddClassEscape(alloc, '.', ranges);
+            RegExpTree* atom = alloc->newInfallible<RegExpCharacterClass>(ranges, false);
+            builder->AddAtom(atom);
+            break;
+          }
+          case '(': {
+            SubexpressionType subexpr_type = CAPTURE;
+            Advance();
+            if (current() == '?') {
+                switch (Next()) {
+                  case ':':
+                    subexpr_type = GROUPING;
+                    break;
+                  case '=':
+                    subexpr_type = POSITIVE_LOOKAHEAD;
+                    break;
+                  case '!':
+                    subexpr_type = NEGATIVE_LOOKAHEAD;
+                    break;
+                  default:
+                    return ReportError(JSMSG_INVALID_GROUP);
+                }
+                Advance(2);
+            } else {
+                if (captures_ == nullptr)
+                    captures_ = alloc->newInfallible<RegExpCaptureVector>(*alloc);
+                if (captures_started() >= kMaxCaptures)
+                    return ReportError(JSMSG_TOO_MANY_PARENS);
+                captures_->append((RegExpCapture*) nullptr);
+            }
+            // Store current state and begin new disjunction parsing.
+            stored_state = alloc->newInfallible<RegExpParserState>(alloc, stored_state, subexpr_type,
+                                                                   captures_started());
+            builder = stored_state->builder();
+            continue;
+          }
+          case '[': {
+            RegExpTree* atom = ParseCharacterClass();
+            if (!atom)
+                return nullptr;
+            builder->AddAtom(atom);
+            break;
+          }
+            // Atom ::
+            //   \ AtomEscape
+          case '\\':
+            switch (Next()) {
+              case kEndMarker:
+                return ReportError(JSMSG_ESCAPE_AT_END_OF_REGEXP);
+              case 'b':
+                Advance(2);
+                builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(RegExpAssertion::BOUNDARY));
+                continue;
+              case 'B':
+                Advance(2);
+                builder->AddAssertion(alloc->newInfallible<RegExpAssertion>(RegExpAssertion::NON_BOUNDARY));
+                continue;
+                // AtomEscape ::
+                //   CharacterClassEscape
+                //
+                // CharacterClassEscape :: one of
+                //   d D s S w W
+              case 'D': case 'S': case 'W':
+                if (unicode_) {
+                    Advance();
+                    builder->AddAtom(UnicodeCharacterClassEscapeAtom(alloc, current(),
+                                                                     ignore_case_));
+                    Advance();
+                    break;
+                }
+                MOZ_FALLTHROUGH;
+              case 'd': case 's': case 'w': {
+                widechar c = Next();
+                Advance(2);
+                CharacterRangeVector* ranges =
+                    alloc->newInfallible<CharacterRangeVector>(*alloc);
+                if (unicode_)
+                    CharacterRange::AddClassEscapeUnicode(alloc, c, ranges, ignore_case_);
+                else
+                    CharacterRange::AddClassEscape(alloc, c, ranges);
+                RegExpTree* atom = alloc->newInfallible<RegExpCharacterClass>(ranges, false);
+                builder->AddAtom(atom);
+                break;
+              }
+              case '1': case '2': case '3': case '4': case '5': case '6':
+              case '7': case '8': case '9': {
+                int index = 0;
+                if (ParseBackReferenceIndex(&index)) {
+                    RegExpCapture* capture = nullptr;
+                    if (captures_ != nullptr && index <= (int) captures_->length()) {
+                        capture = (*captures_)[index - 1];
+                    }
+                    if (capture == nullptr) {
+                        builder->AddEmpty();
+                        break;
+                    }
+                    RegExpTree* atom = alloc->newInfallible<RegExpBackReference>(capture);
+                    if (unicode_)
+                        builder->AddAtom(UnicodeBackReferenceAtom(alloc, atom));
+                    else
+                        builder->AddAtom(atom);
+                    break;
+                }
+                if (unicode_)
+                    return ReportError(JSMSG_BACK_REF_OUT_OF_RANGE);
+                widechar first_digit = Next();
+                if (first_digit == '8' || first_digit == '9') {
+                    // Treat as identity escape
+                    builder->AddCharacter(first_digit);
+                    Advance(2);
+                    break;
+                }
+                MOZ_FALLTHROUGH;
+              }
+              case '0': {
+                if (unicode_) {
+                    Advance(2);
+                    if (IsDecimalDigit(current()))
+                        return ReportError(JSMSG_INVALID_DECIMAL_ESCAPE);
+                    builder->AddCharacter(0);
+                    break;
+                }
+
+                Advance();
+                widechar octal = ParseOctalLiteral();
+                builder->AddCharacter(octal);
+                break;
+              }
+                // ControlEscape :: one of
+                //   f n r t v
+              case 'f':
+                Advance(2);
+                builder->AddCharacter('\f');
+                break;
+              case 'n':
+                Advance(2);
+                builder->AddCharacter('\n');
+                break;
+              case 'r':
+                Advance(2);
+                builder->AddCharacter('\r');
+                break;
+              case 't':
+                Advance(2);
+                builder->AddCharacter('\t');
+                break;
+              case 'v':
+                Advance(2);
+                builder->AddCharacter('\v');
+                break;
+              case 'c': {
+                Advance();
+                widechar controlLetter = Next();
+                // Special case if it is an ASCII letter.
+                // Convert lower case letters to uppercase.
+                widechar letter = controlLetter & ~('a' ^ 'A');
+                if (letter < 'A' || 'Z' < letter) {
+                    if (unicode_)
+                        return ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+                    // controlLetter is not in range 'A'-'Z' or 'a'-'z'.
+                    // This is outside the specification. We match JSC in
+                    // reading the backslash as a literal character instead
+                    // of as starting an escape.
+                    builder->AddCharacter('\\');
+                } else {
+                    Advance(2);
+                    builder->AddCharacter(controlLetter & 0x1f);
+                }
+                break;
+              }
+              case 'x': {
+                Advance(2);
+                widechar value;
+                if (ParseHexEscape(2, &value)) {
+                    builder->AddCharacter(value);
+                } else {
+                    if (unicode_)
+                        return ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+                    builder->AddCharacter('x');
+                }
+                break;
+              }
+              case 'u': {
+                Advance(2);
+                widechar value;
+                if (unicode_) {
+                    if (current() == '{') {
+                        if (!ParseBracedHexEscape(&value))
+                            return nullptr;
+                        if (unicode::IsLeadSurrogate(value)) {
+                            builder->AddAtom(LeadSurrogateAtom(alloc, value));
+                        } else if (unicode::IsTrailSurrogate(value)) {
+                            builder->AddAtom(TrailSurrogateAtom(alloc, value));
+                        } else if (value >= unicode::NonBMPMin) {
+                            char16_t lead, trail;
+                            unicode::UTF16Encode(value, &lead, &trail);
+                            builder->AddAtom(SurrogatePairAtom(alloc, lead, trail,
+                                                               ignore_case_));
+                        } else {
+                            builder->AddCharacter(value);
+                        }
+                    } else if (ParseHexEscape(4, &value)) {
+                        if (unicode::IsLeadSurrogate(value)) {
+                            widechar trail;
+                            if (ParseTrailSurrogate(&trail)) {
+                                builder->AddAtom(SurrogatePairAtom(alloc, value, trail,
+                                                                   ignore_case_));
+                            } else {
+                                builder->AddAtom(LeadSurrogateAtom(alloc, value));
+                            }
+                        } else if (unicode::IsTrailSurrogate(value)) {
+                            builder->AddAtom(TrailSurrogateAtom(alloc, value));
+                        } else {
+                            builder->AddCharacter(value);
+                        }
+                    } else {
+                        return ReportError(JSMSG_INVALID_UNICODE_ESCAPE);
+                    }
+                    break;
+                }
+                if (ParseHexEscape(4, &value)) {
+                    builder->AddCharacter(value);
+                } else {
+                    builder->AddCharacter('u');
+                }
+                break;
+              }
+              default:
+                // Identity escape.
+                if (unicode_ && !IsSyntaxCharacter(Next()))
+                    return ReportError(JSMSG_INVALID_IDENTITY_ESCAPE);
+                builder->AddCharacter(Next());
+                Advance(2);
+                break;
+            }
+            break;
+          case '{': {
+            if (unicode_)
+                return ReportError(JSMSG_RAW_BRACE_IN_REGEP);
+            int dummy;
+            if (ParseIntervalQuantifier(&dummy, &dummy))
+                return ReportError(JSMSG_NOTHING_TO_REPEAT);
+            MOZ_FALLTHROUGH;
+          }
+          default:
+            if (unicode_) {
+                char16_t lead, trail;
+                if (ParseRawSurrogatePair(&lead, &trail)) {
+                    builder->AddAtom(SurrogatePairAtom(alloc, lead, trail, ignore_case_));
+                } else {
+                    widechar c = current();
+                    if (unicode::IsLeadSurrogate(c))
+                        builder->AddAtom(LeadSurrogateAtom(alloc, c));
+                    else if (unicode::IsTrailSurrogate(c))
+                        builder->AddAtom(TrailSurrogateAtom(alloc, c));
+                    else if (c == ']')
+                        return ReportError(JSMSG_RAW_BRACKET_IN_REGEP);
+                    else if (c == '}')
+                        return ReportError(JSMSG_RAW_BRACE_IN_REGEP);
+                    else
+                        builder->AddCharacter(c);
+                    Advance();
+                }
+                break;
+            }
+            builder->AddCharacter(current());
+            Advance();
+            break;
+        }  // end switch(current())
+
+        int min;
+        int max;
+        switch (current()) {
+            // QuantifierPrefix ::
+            //   *
+            //   +
+            //   ?
+            //   {
+          case '*':
+            min = 0;
+            max = RegExpTree::kInfinity;
+            Advance();
+            break;
+          case '+':
+            min = 1;
+            max = RegExpTree::kInfinity;
+            Advance();
+            break;
+          case '?':
+            min = 0;
+            max = 1;
+            Advance();
+            break;
+          case '{':
+            if (ParseIntervalQuantifier(&min, &max)) {
+                if (max < min)
+                    return ReportError(JSMSG_NUMBERS_OUT_OF_ORDER);
+                break;
+            } else {
+                continue;
+            }
+          default:
+            continue;
+        }
+        RegExpQuantifier::QuantifierType quantifier_type = RegExpQuantifier::GREEDY;
+        if (current() == '?') {
+            quantifier_type = RegExpQuantifier::NON_GREEDY;
+            Advance();
+        }
+        builder->AddQuantifierToAtom(min, max, quantifier_type);
+    }
+}
+
+template class irregexp::RegExpParser<Latin1Char>;
+template class irregexp::RegExpParser<char16_t>;
+
+template <typename CharT>
+static bool
+ParsePattern(frontend::TokenStream& ts, LifoAlloc& alloc, const CharT* chars, size_t length,
+             bool multiline, bool match_only, bool unicode, bool ignore_case,
+             bool global, bool sticky, RegExpCompileData* data)
+{
+    if (match_only) {
+        // Try to strip a leading '.*' from the RegExp, but only if it is not
+        // followed by a '?' (which will affect how the .* is parsed). This
+        // pattern will affect the captures produced by the RegExp, but not
+        // whether there is a match or not.
+        if (length >= 3 && chars[0] == '.' && chars[1] == '*' && chars[2] != '?') {
+            chars += 2;
+            length -= 2;
+        }
+
+        // Try to strip a trailing '.*' from the RegExp, which as above will
+        // affect the captures but not whether there is a match. Only do this
+        // when the following conditions are met:
+        //   1. there are no other meta characters in the RegExp, so that we
+        //      are sure this will not affect how the RegExp is parsed
+        //   2. global and sticky flags are not set, as lastIndex needs to be
+        //      set properly on global or sticky match
+        if (length >= 3 && !HasRegExpMetaChars(chars, length - 2) &&
+            !global && !sticky &&
+            chars[length - 2] == '.' && chars[length - 1] == '*')
+        {
+            length -= 2;
+        }
+    }
+
+    RegExpParser<CharT> parser(ts, &alloc, chars, chars + length, multiline, unicode, ignore_case);
+    data->tree = parser.ParsePattern();
+    if (!data->tree)
+        return false;
+
+    data->simple = parser.simple();
+    data->contains_anchor = parser.contains_anchor();
+    data->capture_count = parser.captures_started();
+    return true;
+}
+
+bool
+irregexp::ParsePattern(frontend::TokenStream& ts, LifoAlloc& alloc, JSAtom* str,
+                       bool multiline, bool match_only, bool unicode, bool ignore_case,
+                       bool global, bool sticky, RegExpCompileData* data)
+{
+    JS::AutoCheckCannotGC nogc;
+    return str->hasLatin1Chars()
+           ? ::ParsePattern(ts, alloc, str->latin1Chars(nogc), str->length(),
+                            multiline, match_only, unicode, ignore_case, global, sticky, data)
+           : ::ParsePattern(ts, alloc, str->twoByteChars(nogc), str->length(),
+                            multiline, match_only, unicode, ignore_case, global, sticky, data);
+}
+
+template <typename CharT>
+static bool
+ParsePatternSyntax(frontend::TokenStream& ts, LifoAlloc& alloc, const CharT* chars, size_t length,
+                   bool unicode)
+{
+    LifoAllocScope scope(&alloc);
+
+    RegExpParser<CharT> parser(ts, &alloc, chars, chars + length, false, unicode, false);
+    return parser.ParsePattern() != nullptr;
+}
+
+bool
+irregexp::ParsePatternSyntax(frontend::TokenStream& ts, LifoAlloc& alloc, JSAtom* str,
+                             bool unicode)
+{
+    JS::AutoCheckCannotGC nogc;
+    return str->hasLatin1Chars()
+           ? ::ParsePatternSyntax(ts, alloc, str->latin1Chars(nogc), str->length(), unicode)
+           : ::ParsePatternSyntax(ts, alloc, str->twoByteChars(nogc), str->length(), unicode);
+}
diff --git a/js/src/irregexp/RegExpParser.h b/js/src/irregexp/RegExpParser.h
new file mode 100644
index 000000000..b5228a86f
--- /dev/null
+++ b/js/src/irregexp/RegExpParser.h
@@ -0,0 +1,310 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_PARSER_H_
+#define V8_PARSER_H_
+
+#include "irregexp/RegExpAST.h"
+
+namespace js {
+
+namespace frontend {
+    class TokenStream;
+}
+
+namespace irregexp {
+
+bool
+ParsePattern(frontend::TokenStream& ts, LifoAlloc& alloc, JSAtom* str,
+             bool multiline, bool match_only, bool unicode, bool ignore_case,
+             bool global, bool sticky, RegExpCompileData* data);
+
+bool
+ParsePatternSyntax(frontend::TokenStream& ts, LifoAlloc& alloc, JSAtom* str,
+                   bool unicode);
+
+// A BufferedVector is an automatically growing list, just like (and backed
+// by) a Vector, that is optimized for the case of adding and removing
+// a single element. The last element added is stored outside the backing list,
+// and if no more than one element is ever added, the ZoneList isn't even
+// allocated.
+// Elements must not be nullptr pointers.
+template <typename T, int initial_size>
+class BufferedVector
+{
+  public:
+    typedef InfallibleVector<T*, 1> VectorType;
+
+    BufferedVector() : list_(nullptr), last_(nullptr) {}
+
+    // Adds element at end of list. This element is buffered and can
+    // be read using last() or removed using RemoveLast until a new Add or until
+    // RemoveLast or GetList has been called.
+    void Add(LifoAlloc* alloc, T* value) {
+        if (last_ != nullptr) {
+            if (list_ == nullptr) {
+                list_ = alloc->newInfallible<VectorType>(*alloc);
+                list_->reserve(initial_size);
+            }
+            list_->append(last_);
+        }
+        last_ = value;
+    }
+
+    T* last() {
+        MOZ_ASSERT(last_ != nullptr);
+        return last_;
+    }
+
+    T* RemoveLast() {
+        MOZ_ASSERT(last_ != nullptr);
+        T* result = last_;
+        if ((list_ != nullptr) && (list_->length() > 0))
+            last_ = list_->popCopy();
+        else
+            last_ = nullptr;
+        return result;
+    }
+
+    T* Get(int i) {
+        MOZ_ASSERT((0 <= i) && (i < length()));
+        if (list_ == nullptr) {
+            MOZ_ASSERT(0 == i);
+            return last_;
+        } else {
+            if (size_t(i) == list_->length()) {
+                MOZ_ASSERT(last_ != nullptr);
+                return last_;
+            } else {
+                return (*list_)[i];
+            }
+        }
+    }
+
+    void Clear() {
+        list_ = nullptr;
+        last_ = nullptr;
+    }
+
+    int length() {
+        int length = (list_ == nullptr) ? 0 : list_->length();
+        return length + ((last_ == nullptr) ? 0 : 1);
+    }
+
+    VectorType* GetList(LifoAlloc* alloc) {
+        if (list_ == nullptr)
+            list_ = alloc->newInfallible<VectorType>(*alloc);
+        if (last_ != nullptr) {
+            list_->append(last_);
+            last_ = nullptr;
+        }
+        return list_;
+    }
+
+  private:
+    VectorType* list_;
+    T* last_;
+};
+
+
+// Accumulates RegExp atoms and assertions into lists of terms and alternatives.
+class RegExpBuilder
+{
+  public:
+    explicit RegExpBuilder(LifoAlloc* alloc);
+    void AddCharacter(char16_t character);
+    // "Adds" an empty expression. Does nothing except consume a
+    // following quantifier
+    void AddEmpty();
+    void AddAtom(RegExpTree* tree);
+    void AddAssertion(RegExpTree* tree);
+    void NewAlternative();  // '|'
+    void AddQuantifierToAtom(int min, int max, RegExpQuantifier::QuantifierType type);
+    RegExpTree* ToRegExp();
+
+  private:
+    void FlushCharacters();
+    void FlushText();
+    void FlushTerms();
+
+    LifoAlloc* alloc;
+    bool pending_empty_;
+    CharacterVector* characters_;
+    BufferedVector<RegExpTree, 2> terms_;
+    BufferedVector<RegExpTree, 2> text_;
+    BufferedVector<RegExpTree, 2> alternatives_;
+
+    enum LastAdded {
+        ADD_NONE, ADD_CHAR, ADD_TERM, ADD_ASSERT, ADD_ATOM
+    };
+#ifdef DEBUG
+    LastAdded last_added_;
+#endif
+};
+
+// Characters parsed by RegExpParser can be either char16_t or kEndMarker.
+typedef uint32_t widechar;
+
+template <typename CharT>
+class RegExpParser
+{
+  public:
+    RegExpParser(frontend::TokenStream& ts, LifoAlloc* alloc,
+                 const CharT* chars, const CharT* end, bool multiline_mode, bool unicode,
+                 bool ignore_case);
+
+    RegExpTree* ParsePattern();
+    RegExpTree* ParseDisjunction();
+    RegExpTree* ParseCharacterClass();
+
+    // Parses a {...,...} quantifier and stores the range in the given
+    // out parameters.
+    bool ParseIntervalQuantifier(int* min_out, int* max_out);
+
+    // Tries to parse the input as a single escaped character.  If successful
+    // it stores the result in the output parameter and returns true.
+    // Otherwise it throws an error and returns false.  The character must not
+    // be 'b' or 'B' since they are usually handled specially.
+    bool ParseClassCharacterEscape(widechar* code);
+
+    // Checks whether the following is a length-digit hexadecimal number,
+    // and sets the value if it is.
+    bool ParseHexEscape(int length, widechar* value);
+
+    bool ParseBracedHexEscape(widechar* value);
+    bool ParseTrailSurrogate(widechar* value);
+    bool ParseRawSurrogatePair(char16_t* lead, char16_t* trail);
+
+    widechar ParseOctalLiteral();
+
+    // Tries to parse the input as a back reference.  If successful it
+    // stores the result in the output parameter and returns true.  If
+    // it fails it will push back the characters read so the same characters
+    // can be reparsed.
+    bool ParseBackReferenceIndex(int* index_out);
+
+    bool ParseClassAtom(char16_t* char_class, widechar *value);
+    RegExpTree* ReportError(unsigned errorNumber);
+    void Advance();
+    void Advance(int dist) {
+        next_pos_ += dist - 1;
+        Advance();
+    }
+
+    void Reset(const CharT* pos) {
+        next_pos_ = pos;
+        has_more_ = (pos < end_);
+        Advance();
+    }
+
+    // Reports whether the pattern might be used as a literal search string.
+    // Only use if the result of the parse is a single atom node.
+    bool simple() { return simple_; }
+    bool contains_anchor() { return contains_anchor_; }
+    void set_contains_anchor() { contains_anchor_ = true; }
+    int captures_started() { return captures_ == nullptr ? 0 : captures_->length(); }
+    const CharT* position() { return next_pos_ - 1; }
+
+    static const int kMaxCaptures = 1 << 16;
+    static const widechar kEndMarker = (1 << 21);
+
+  private:
+    enum SubexpressionType {
+        INITIAL,
+        CAPTURE,  // All positive values represent captures.
+        POSITIVE_LOOKAHEAD,
+        NEGATIVE_LOOKAHEAD,
+        GROUPING
+    };
+
+    class RegExpParserState {
+      public:
+        RegExpParserState(LifoAlloc* alloc,
+                          RegExpParserState* previous_state,
+                          SubexpressionType group_type,
+                          int disjunction_capture_index)
+            : previous_state_(previous_state),
+              builder_(alloc->newInfallible<RegExpBuilder>(alloc)),
+              group_type_(group_type),
+              disjunction_capture_index_(disjunction_capture_index)
+        {}
+        // Parser state of containing expression, if any.
+        RegExpParserState* previous_state() { return previous_state_; }
+        bool IsSubexpression() { return previous_state_ != nullptr; }
+        // RegExpBuilder building this regexp's AST.
+        RegExpBuilder* builder() { return builder_; }
+        // Type of regexp being parsed (parenthesized group or entire regexp).
+        SubexpressionType group_type() { return group_type_; }
+        // Index in captures array of first capture in this sub-expression, if any.
+        // Also the capture index of this sub-expression itself, if group_type
+        // is CAPTURE.
+        int capture_index() { return disjunction_capture_index_; }
+
+      private:
+        // Linked list implementation of stack of states.
+        RegExpParserState* previous_state_;
+        // Builder for the stored disjunction.
+        RegExpBuilder* builder_;
+        // Stored disjunction type (capture, look-ahead or grouping), if any.
+        SubexpressionType group_type_;
+        // Stored disjunction's capture index (if any).
+        int disjunction_capture_index_;
+    };
+
+    widechar current() { return current_; }
+    bool has_more() { return has_more_; }
+    bool has_next() { return next_pos_ < end_; }
+    widechar Next() {
+        if (has_next())
+            return *next_pos_;
+        return kEndMarker;
+    }
+    void ScanForCaptures();
+
+    frontend::TokenStream& ts;
+    LifoAlloc* alloc;
+    RegExpCaptureVector* captures_;
+    const CharT* next_pos_;
+    const CharT* end_;
+    widechar current_;
+    // The capture count is only valid after we have scanned for captures.
+    int capture_count_;
+    bool has_more_;
+    bool multiline_;
+    bool unicode_;
+    bool ignore_case_;
+    bool simple_;
+    bool contains_anchor_;
+    bool is_scanned_for_captures_;
+};
+
+} } // namespace js::irregexp
+
+#endif // V8_PARSER_H_
diff --git a/js/src/irregexp/RegExpStack.cpp b/js/src/irregexp/RegExpStack.cpp
new file mode 100644
index 000000000..d00b5feef
--- /dev/null
+++ b/js/src/irregexp/RegExpStack.cpp
@@ -0,0 +1,106 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "irregexp/RegExpStack.h"
+
+#include "vm/Runtime.h"
+
+using namespace js;
+using namespace js::irregexp;
+
+RegExpStackScope::RegExpStackScope(JSRuntime* rt)
+  : regexp_stack(&rt->regexpStack)
+{}
+
+RegExpStackScope::~RegExpStackScope()
+{
+    regexp_stack->reset();
+}
+
+bool
+irregexp::GrowBacktrackStack(JSRuntime* rt)
+{
+    return rt->regexpStack.grow();
+}
+
+RegExpStack::RegExpStack()
+  : base_(nullptr), size(0), limit_(nullptr)
+{}
+
+RegExpStack::~RegExpStack()
+{
+    js_free(base_);
+}
+
+bool
+RegExpStack::init()
+{
+    base_ = js_malloc(kMinimumStackSize);
+    if (!base_)
+        return false;
+
+    size = kMinimumStackSize;
+    updateLimit();
+    return true;
+}
+
+void
+RegExpStack::reset()
+{
+    MOZ_ASSERT(size >= kMinimumStackSize);
+
+    if (size != kMinimumStackSize) {
+        void* newBase = js_realloc(base_, kMinimumStackSize);
+        if (!newBase)
+            return;
+
+        base_ = newBase;
+        size = kMinimumStackSize;
+        updateLimit();
+    }
+}
+
+bool
+RegExpStack::grow()
+{
+    size_t newSize = size * 2;
+    if (newSize > kMaximumStackSize)
+        return false;
+
+    void* newBase = js_realloc(base_, newSize);
+    if (!newBase)
+        return false;
+
+    base_ = newBase;
+    size = newSize;
+    updateLimit();
+
+    return true;
+}
diff --git a/js/src/irregexp/RegExpStack.h b/js/src/irregexp/RegExpStack.h
new file mode 100644
index 000000000..411ce757c
--- /dev/null
+++ b/js/src/irregexp/RegExpStack.h
@@ -0,0 +1,122 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99: */
+
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_REGEXP_STACK_H_
+#define V8_REGEXP_STACK_H_
+
+#include "jspubtd.h"
+#include "js/Utility.h"
+
+namespace js {
+namespace irregexp {
+
+class RegExpStack;
+
+// Maintains a per-thread stack area that can be used by irregexp
+// implementation for its backtracking stack.
+//
+// Since there is only one stack area, the Irregexp implementation is not
+// re-entrant. I.e., no regular expressions may be executed in the same thread
+// during a preempted Irregexp execution.
+class RegExpStackScope
+{
+  public:
+    // Create and delete an instance to control the life-time of a growing stack.
+
+    // Initializes the stack memory area if necessary.
+    explicit RegExpStackScope(JSRuntime* rt);
+
+    // Releases the stack if it has grown.
+    ~RegExpStackScope();
+
+  private:
+    RegExpStack* regexp_stack;
+};
+
+class RegExpStack
+{
+  public:
+    // Number of allocated locations on the stack above the limit.
+    // No sequence of pushes must be longer that this without doing a stack-limit
+    // check.
+    static const int kStackLimitSlack = 32;
+
+    RegExpStack();
+    ~RegExpStack();
+    bool init();
+
+    // Resets the buffer if it has grown beyond the default/minimum size.
+    void reset();
+
+    // Attempts to grow the stack by at least kStackLimitSlack entries.
+    bool grow();
+
+    // Address of allocated memory.
+    const void* addressOfBase() { return &base_; }
+    const void* addressOfLimit() { return &limit_; }
+
+    void* base() { return base_; }
+    void* limit() { return limit_; }
+
+  private:
+    // Artificial limit used when no memory has been allocated.
+    static const uintptr_t kMemoryTop = static_cast<uintptr_t>(-1);
+
+    // Minimal size of allocated stack area, in bytes.
+    static const size_t kMinimumStackSize = 1 * 1024;
+
+    // Maximal size of allocated stack area, in bytes.
+    static const size_t kMaximumStackSize = 64 * 1024 * 1024;
+
+    // If size > 0 then base must be non-nullptr.
+    void* base_;
+
+    // Length in bytes of base.
+    size_t size;
+
+    // If the stack pointer gets above the limit, we should react and
+    // either grow the stack or report an out-of-stack exception.
+    // There is only a limited number of locations above the stack limit,
+    // so users of the stack should check the stack limit during any
+    // sequence of pushes longer than this.
+    void* limit_;
+
+    void updateLimit() {
+        MOZ_ASSERT(size >= kStackLimitSlack * sizeof(void*));
+        limit_ = static_cast<uint8_t*>(base()) + size - (kStackLimitSlack * sizeof(void*));
+    }
+};
+
+bool
+GrowBacktrackStack(JSRuntime* rt);
+
+}}  // namespace js::irregexp
+
+#endif  // V8_REGEXP_STACK_H_