diff -r 56cd8111b7f7 -r 41300fa6a67c src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp	Tue Jan 26 12:42:25 2010 +0200
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp	Tue Feb 02 00:43:10 2010 +0200
@@ -1792,7 +1792,6 @@
     // Setup arg4: This is a plain hack
     move(stackPointerRegister, ARMRegisters::S0);
 
-    move(ctiReturnRegister, ARMRegisters::lr);
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
@@ -2500,7 +2499,13 @@
     // Grab key @ i
     loadPtr(addressFor(it), regT1);
     loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+
+#if USE(JSVALUE64)
     loadPtr(BaseIndex(regT2, regT0, TimesEight), regT2);
+#else
+    loadPtr(BaseIndex(regT2, regT0, TimesFour), regT2);
+#endif
+
     emitPutVirtualRegister(dst, regT2);
 
     // Increment i