Version 3.24.21

Performance and stability improvements on all platforms.

git-svn-id: http://v8.googlecode.com/svn/trunk@18733 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/arm/code-stubs-arm.cc b/src/arm/code-stubs-arm.cc
index 6ab69b3..758d35f 100644
--- a/src/arm/code-stubs-arm.cc
+++ b/src/arm/code-stubs-arm.cc
@@ -200,7 +200,7 @@
   // register state
   // r0 -- number of arguments
   // r1 -- function
-  // r2 -- type info cell with elements kind
+  // r2 -- allocation site with elements kind
   static Register registers_variable_args[] = { r1, r2, r0 };
   static Register registers_no_args[] = { r1, r2 };
 
@@ -5784,7 +5784,7 @@
 
 static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
                                            AllocationSiteOverrideMode mode) {
-  // r2 - type info cell (if mode != DISABLE_ALLOCATION_SITES)
+  // r2 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
   // r3 - kind (if mode != DISABLE_ALLOCATION_SITES)
   // r0 - number of arguments
   // r1 - constructor?
@@ -5824,22 +5824,20 @@
     // We are going to create a holey array, but our kind is non-holey.
     // Fix kind and retry (only if we have an allocation site in the cell).
     __ add(r3, r3, Operand(1));
-    __ ldr(r5, FieldMemOperand(r2, Cell::kValueOffset));
 
     if (FLAG_debug_code) {
-      __ ldr(r5, FieldMemOperand(r5, 0));
+      __ ldr(r5, FieldMemOperand(r2, 0));
       __ CompareRoot(r5, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, kExpectedAllocationSiteInCell);
-      __ ldr(r5, FieldMemOperand(r2, Cell::kValueOffset));
+      __ Assert(eq, kExpectedAllocationSite);
     }
 
     // Save the resulting elements kind in type info. We can't just store r3
     // in the AllocationSite::transition_info field because elements kind is
     // restricted to a portion of the field...upper bits need to be left alone.
     STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ ldr(r4, FieldMemOperand(r5, AllocationSite::kTransitionInfoOffset));
+    __ ldr(r4, FieldMemOperand(r2, AllocationSite::kTransitionInfoOffset));
     __ add(r4, r4, Operand(Smi::FromInt(kFastElementsKindPackedToHoley)));
-    __ str(r4, FieldMemOperand(r5, AllocationSite::kTransitionInfoOffset));
+    __ str(r4, FieldMemOperand(r2, AllocationSite::kTransitionInfoOffset));
 
     __ bind(&normal_sequence);
     int last_index = GetSequenceIndexFromFastElementsKind(
@@ -5963,15 +5961,15 @@
   // Get the elements kind and case on that.
   __ CompareRoot(r2, Heap::kUndefinedValueRootIndex);
   __ b(eq, &no_info);
-  __ ldr(r3, FieldMemOperand(r2, Cell::kValueOffset));
+  __ ldr(r2, FieldMemOperand(r2, Cell::kValueOffset));
 
   // If the type cell is undefined, or contains anything other than an
   // AllocationSite, call an array constructor that doesn't use AllocationSites.
-  __ ldr(r4, FieldMemOperand(r3, 0));
+  __ ldr(r4, FieldMemOperand(r2, 0));
   __ CompareRoot(r4, Heap::kAllocationSiteMapRootIndex);
   __ b(ne, &no_info);
 
-  __ ldr(r3, FieldMemOperand(r3, AllocationSite::kTransitionInfoOffset));
+  __ ldr(r3, FieldMemOperand(r2, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(r3);
   STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
   __ and_(r3, r3, Operand(AllocationSite::ElementsKindBits::kMask));
diff --git a/src/arm/codegen-arm.h b/src/arm/codegen-arm.h
index ecbe64c..1ef71a0 100644
--- a/src/arm/codegen-arm.h
+++ b/src/arm/codegen-arm.h
@@ -44,8 +44,8 @@
 
 class CodeGenerator: public AstVisitor {
  public:
-  explicit CodeGenerator(Isolate* isolate) {
-    InitializeAstVisitor(isolate);
+  explicit CodeGenerator(Zone* zone) {
+    InitializeAstVisitor(zone);
   }
 
   static bool MakeCode(CompilationInfo* info);
diff --git a/src/arm/macro-assembler-arm.cc b/src/arm/macro-assembler-arm.cc
index 624ba81..013c7c0 100644
--- a/src/arm/macro-assembler-arm.cc
+++ b/src/arm/macro-assembler-arm.cc
@@ -3926,10 +3926,16 @@
 
   // Check that there are no elements. Register r2 contains the current JS
   // object we've reached through the prototype chain.
+  Label no_elements;
   ldr(r2, FieldMemOperand(r2, JSObject::kElementsOffset));
   cmp(r2, empty_fixed_array_value);
+  b(eq, &no_elements);
+
+  // Second chance, the object may be using the empty slow element dictionary.
+  CompareRoot(r2, Heap::kEmptySlowElementDictionaryRootIndex);
   b(ne, call_runtime);
 
+  bind(&no_elements);
   ldr(r2, FieldMemOperand(r1, Map::kPrototypeOffset));
   cmp(r2, null_value);
   b(ne, &next);
diff --git a/src/arm/stub-cache-arm.cc b/src/arm/stub-cache-arm.cc
index 43212c0..e7c5733 100644
--- a/src/arm/stub-cache-arm.cc
+++ b/src/arm/stub-cache-arm.cc
@@ -1120,7 +1120,7 @@
 #define __ ACCESS_MASM(masm())
 
 
-Register StubCompiler::CheckPrototypes(Handle<Type> type,
+Register StubCompiler::CheckPrototypes(Handle<HeapType> type,
                                        Register object_reg,
                                        Handle<JSObject> holder,
                                        Register holder_reg,
@@ -1266,7 +1266,7 @@
 
 
 Register LoadStubCompiler::CallbackHandlerFrontend(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Register object_reg,
     Handle<JSObject> holder,
     Handle<Name> name,
@@ -2005,7 +2005,7 @@
 }
 
 
-Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<Type> type,
+Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<HeapType> type,
                                                       Handle<JSObject> last,
                                                       Handle<Name> name) {
   NonexistentHandlerFrontend(type, last, name);
@@ -2088,7 +2088,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadGlobal(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<GlobalObject> global,
     Handle<PropertyCell> cell,
     Handle<Name> name,
@@ -2144,13 +2144,13 @@
   int number_of_handled_maps = 0;
   __ ldr(map_reg, FieldMemOperand(receiver(), HeapObject::kMapOffset));
   for (int current = 0; current < receiver_count; ++current) {
-    Handle<Type> type = types->at(current);
+    Handle<HeapType> type = types->at(current);
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
       __ mov(ip, Operand(map));
       __ cmp(map_reg, ip);
-      if (type->Is(Type::Number())) {
+      if (type->Is(HeapType::Number())) {
         ASSERT(!number_case.is_unused());
         __ bind(&number_case);
       }
diff --git a/src/ast.cc b/src/ast.cc
index c7e06d3..9d8624c 100644
--- a/src/ast.cc
+++ b/src/ast.cc
@@ -82,8 +82,8 @@
 }
 
 
-VariableProxy::VariableProxy(Isolate* isolate, Variable* var, int position)
-    : Expression(isolate, position),
+VariableProxy::VariableProxy(Zone* zone, Variable* var, int position)
+    : Expression(zone, position),
       name_(var->name()),
       var_(NULL),  // Will be set by the call to BindTo.
       is_this_(var->is_this()),
@@ -94,12 +94,12 @@
 }
 
 
-VariableProxy::VariableProxy(Isolate* isolate,
+VariableProxy::VariableProxy(Zone* zone,
                              Handle<String> name,
                              bool is_this,
                              Interface* interface,
                              int position)
-    : Expression(isolate, position),
+    : Expression(zone, position),
       name_(name),
       var_(NULL),
       is_this_(is_this),
@@ -126,17 +126,17 @@
 }
 
 
-Assignment::Assignment(Isolate* isolate,
+Assignment::Assignment(Zone* zone,
                        Token::Value op,
                        Expression* target,
                        Expression* value,
                        int pos)
-    : Expression(isolate, pos),
+    : Expression(zone, pos),
       op_(op),
       target_(target),
       value_(value),
       binary_operation_(NULL),
-      assignment_id_(GetNextId(isolate)),
+      assignment_id_(GetNextId(zone)),
       is_uninitialized_(false),
       is_pre_monomorphic_(false),
       store_mode_(STANDARD_STORE) { }
@@ -203,15 +203,14 @@
 }
 
 
-ObjectLiteralProperty::ObjectLiteralProperty(Literal* key,
-                                             Expression* value,
-                                             Isolate* isolate) {
+ObjectLiteralProperty::ObjectLiteralProperty(
+    Zone* zone, Literal* key, Expression* value) {
   emit_store_ = true;
   key_ = key;
   value_ = value;
   Object* k = *key->value();
   if (k->IsInternalizedString() &&
-      isolate->heap()->proto_string()->Equals(String::cast(k))) {
+      zone->isolate()->heap()->proto_string()->Equals(String::cast(k))) {
     kind_ = PROTOTYPE;
   } else if (value_->AsMaterializedLiteral() != NULL) {
     kind_ = MATERIALIZED_LITERAL;
@@ -223,8 +222,8 @@
 }
 
 
-ObjectLiteralProperty::ObjectLiteralProperty(bool is_getter,
-                                             FunctionLiteral* value) {
+ObjectLiteralProperty::ObjectLiteralProperty(
+    Zone* zone, bool is_getter, FunctionLiteral* value) {
   emit_store_ = true;
   value_ = value;
   kind_ = is_getter ? GETTER : SETTER;
@@ -1146,16 +1145,16 @@
 }
 
 
-CaseClause::CaseClause(Isolate* isolate,
+CaseClause::CaseClause(Zone* zone,
                        Expression* label,
                        ZoneList<Statement*>* statements,
                        int pos)
-    : Expression(isolate, pos),
+    : Expression(zone, pos),
       label_(label),
       statements_(statements),
-      compare_type_(Type::None(isolate)),
-      compare_id_(AstNode::GetNextId(isolate)),
-      entry_id_(AstNode::GetNextId(isolate)) {
+      compare_type_(Type::None(zone)),
+      compare_id_(AstNode::GetNextId(zone)),
+      entry_id_(AstNode::GetNextId(zone)) {
 }
 
 
diff --git a/src/ast.h b/src/ast.h
index fe457bd..07227b1 100644
--- a/src/ast.h
+++ b/src/ast.h
@@ -226,13 +226,13 @@
   virtual MaterializedLiteral* AsMaterializedLiteral() { return NULL; }
 
  protected:
-  static int GetNextId(Isolate* isolate) {
-    return ReserveIdRange(isolate, 1);
+  static int GetNextId(Zone* zone) {
+    return ReserveIdRange(zone, 1);
   }
 
-  static int ReserveIdRange(Isolate* isolate, int n) {
-    int tmp = isolate->ast_node_id();
-    isolate->set_ast_node_id(tmp + n);
+  static int ReserveIdRange(Zone* zone, int n) {
+    int tmp = zone->isolate()->ast_node_id();
+    zone->isolate()->set_ast_node_id(tmp + n);
     return tmp;
   }
 
@@ -255,7 +255,7 @@
 
 class Statement : public AstNode {
  public:
-  explicit Statement(int position) : AstNode(position) {}
+  explicit Statement(Zone* zone, int position) : AstNode(position) {}
 
   bool IsEmpty() { return AsEmptyStatement() != NULL; }
   virtual bool IsJump() const { return false; }
@@ -377,11 +377,11 @@
   TypeFeedbackId test_id() const { return test_id_; }
 
  protected:
-  Expression(Isolate* isolate, int pos)
+  Expression(Zone* zone, int pos)
       : AstNode(pos),
-        bounds_(Bounds::Unbounded(isolate)),
-        id_(GetNextId(isolate)),
-        test_id_(GetNextId(isolate)) {}
+        bounds_(Bounds::Unbounded(zone)),
+        id_(GetNextId(zone)),
+        test_id_(GetNextId(zone)) {}
   void set_to_boolean_types(byte types) { to_boolean_types_ = types; }
 
  private:
@@ -422,13 +422,13 @@
 
  protected:
   BreakableStatement(
-      Isolate* isolate, ZoneStringList* labels,
+      Zone* zone, ZoneStringList* labels,
       BreakableType breakable_type, int position)
-      : Statement(position),
+      : Statement(zone, position),
         labels_(labels),
         breakable_type_(breakable_type),
-        entry_id_(GetNextId(isolate)),
-        exit_id_(GetNextId(isolate)) {
+        entry_id_(GetNextId(zone)),
+        exit_id_(GetNextId(zone)) {
     ASSERT(labels == NULL || labels->length() > 0);
   }
 
@@ -462,13 +462,12 @@
   void set_scope(Scope* scope) { scope_ = scope; }
 
  protected:
-  Block(Isolate* isolate,
+  Block(Zone* zone,
         ZoneStringList* labels,
         int capacity,
         bool is_initializer_block,
-        int pos,
-        Zone* zone)
-      : BreakableStatement(isolate, labels, TARGET_FOR_NAMED_ONLY, pos),
+        int pos)
+      : BreakableStatement(zone, labels, TARGET_FOR_NAMED_ONLY, pos),
         statements_(capacity, zone),
         is_initializer_block_(is_initializer_block),
         scope_(NULL) {
@@ -490,7 +489,8 @@
   virtual bool IsInlineable() const;
 
  protected:
-  Declaration(VariableProxy* proxy,
+  Declaration(Zone* zone,
+              VariableProxy* proxy,
               VariableMode mode,
               Scope* scope,
               int pos)
@@ -519,11 +519,12 @@
   }
 
  protected:
-  VariableDeclaration(VariableProxy* proxy,
+  VariableDeclaration(Zone* zone,
+                      VariableProxy* proxy,
                       VariableMode mode,
                       Scope* scope,
                       int pos)
-      : Declaration(proxy, mode, scope, pos) {
+      : Declaration(zone, proxy, mode, scope, pos) {
   }
 };
 
@@ -539,12 +540,13 @@
   virtual bool IsInlineable() const V8_OVERRIDE;
 
  protected:
-  FunctionDeclaration(VariableProxy* proxy,
+  FunctionDeclaration(Zone* zone,
+                      VariableProxy* proxy,
                       VariableMode mode,
                       FunctionLiteral* fun,
                       Scope* scope,
                       int pos)
-      : Declaration(proxy, mode, scope, pos),
+      : Declaration(zone, proxy, mode, scope, pos),
         fun_(fun) {
     // At the moment there are no "const functions" in JavaScript...
     ASSERT(mode == VAR || mode == LET);
@@ -566,11 +568,12 @@
   }
 
  protected:
-  ModuleDeclaration(VariableProxy* proxy,
+  ModuleDeclaration(Zone* zone,
+                    VariableProxy* proxy,
                     Module* module,
                     Scope* scope,
                     int pos)
-      : Declaration(proxy, MODULE, scope, pos),
+      : Declaration(zone, proxy, MODULE, scope, pos),
         module_(module) {
   }
 
@@ -589,11 +592,12 @@
   }
 
  protected:
-  ImportDeclaration(VariableProxy* proxy,
+  ImportDeclaration(Zone* zone,
+                    VariableProxy* proxy,
                     Module* module,
                     Scope* scope,
                     int pos)
-      : Declaration(proxy, LET, scope, pos),
+      : Declaration(zone, proxy, LET, scope, pos),
         module_(module) {
   }
 
@@ -611,8 +615,8 @@
   }
 
  protected:
-  ExportDeclaration(VariableProxy* proxy, Scope* scope, int pos)
-      : Declaration(proxy, LET, scope, pos) {}
+  ExportDeclaration(Zone* zone, VariableProxy* proxy, Scope* scope, int pos)
+      : Declaration(zone, proxy, LET, scope, pos) {}
 };
 
 
@@ -626,7 +630,7 @@
       : AstNode(pos),
         interface_(Interface::NewModule(zone)),
         body_(NULL) {}
-  Module(Interface* interface, int pos, Block* body = NULL)
+  Module(Zone* zone, Interface* interface, int pos, Block* body = NULL)
       : AstNode(pos),
         interface_(interface),
         body_(body) {}
@@ -642,8 +646,8 @@
   DECLARE_NODE_TYPE(ModuleLiteral)
 
  protected:
-  ModuleLiteral(Block* body, Interface* interface, int pos)
-      : Module(interface, pos, body) {}
+  ModuleLiteral(Zone* zone, Block* body, Interface* interface, int pos)
+      : Module(zone, interface, pos, body) {}
 };
 
 
@@ -654,7 +658,7 @@
   VariableProxy* proxy() const { return proxy_; }
 
  protected:
-  inline ModuleVariable(VariableProxy* proxy, int pos);
+  inline ModuleVariable(Zone* zone, VariableProxy* proxy, int pos);
 
  private:
   VariableProxy* proxy_;
@@ -669,7 +673,7 @@
   Handle<String> name() const { return name_; }
 
  protected:
-  ModulePath(Module* module, Handle<String> name, Zone* zone, int pos)
+  ModulePath(Zone* zone, Module* module, Handle<String> name, int pos)
       : Module(zone, pos),
         module_(module),
         name_(name) {
@@ -688,7 +692,7 @@
   Handle<String> url() const { return url_; }
 
  protected:
-  ModuleUrl(Handle<String> url, Zone* zone, int pos)
+  ModuleUrl(Zone* zone, Handle<String> url, int pos)
       : Module(zone, pos), url_(url) {
   }
 
@@ -705,8 +709,8 @@
   Block* body() const { return body_; }
 
  protected:
-  ModuleStatement(VariableProxy* proxy, Block* body, int pos)
-      : Statement(pos),
+  ModuleStatement(Zone* zone, VariableProxy* proxy, Block* body, int pos)
+      : Statement(zone, pos),
         proxy_(proxy),
         body_(body) {
   }
@@ -734,10 +738,10 @@
   Label* continue_target()  { return &continue_target_; }
 
  protected:
-  IterationStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : BreakableStatement(isolate, labels, TARGET_FOR_ANONYMOUS, pos),
+  IterationStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : BreakableStatement(zone, labels, TARGET_FOR_ANONYMOUS, pos),
         body_(NULL),
-        osr_entry_id_(GetNextId(isolate)) {
+        osr_entry_id_(GetNextId(zone)) {
   }
 
   void Initialize(Statement* body) {
@@ -768,11 +772,11 @@
   BailoutId BackEdgeId() const { return back_edge_id_; }
 
  protected:
-  DoWhileStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : IterationStatement(isolate, labels, pos),
+  DoWhileStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : IterationStatement(zone, labels, pos),
         cond_(NULL),
-        continue_id_(GetNextId(isolate)),
-        back_edge_id_(GetNextId(isolate)) {
+        continue_id_(GetNextId(zone)),
+        back_edge_id_(GetNextId(zone)) {
   }
 
  private:
@@ -805,11 +809,11 @@
   BailoutId BodyId() const { return body_id_; }
 
  protected:
-  WhileStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : IterationStatement(isolate, labels, pos),
+  WhileStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : IterationStatement(zone, labels, pos),
         cond_(NULL),
         may_have_function_literal_(true),
-        body_id_(GetNextId(isolate)) {
+        body_id_(GetNextId(zone)) {
   }
 
  private:
@@ -856,15 +860,15 @@
   void set_loop_variable(Variable* var) { loop_variable_ = var; }
 
  protected:
-  ForStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : IterationStatement(isolate, labels, pos),
+  ForStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : IterationStatement(zone, labels, pos),
         init_(NULL),
         cond_(NULL),
         next_(NULL),
         may_have_function_literal_(true),
         loop_variable_(NULL),
-        continue_id_(GetNextId(isolate)),
-        body_id_(GetNextId(isolate)) {
+        continue_id_(GetNextId(zone)),
+        body_id_(GetNextId(zone)) {
   }
 
  private:
@@ -898,8 +902,8 @@
   Expression* subject() const { return subject_; }
 
  protected:
-  ForEachStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : IterationStatement(isolate, labels, pos),
+  ForEachStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : IterationStatement(zone, labels, pos),
         each_(NULL),
         subject_(NULL) {
   }
@@ -929,11 +933,11 @@
   virtual BailoutId StackCheckId() const V8_OVERRIDE { return body_id_; }
 
  protected:
-  ForInStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : ForEachStatement(isolate, labels, pos),
+  ForInStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : ForEachStatement(zone, labels, pos),
         for_in_type_(SLOW_FOR_IN),
-        body_id_(GetNextId(isolate)),
-        prepare_id_(GetNextId(isolate)) {
+        body_id_(GetNextId(zone)),
+        prepare_id_(GetNextId(zone)) {
   }
 
   ForInType for_in_type_;
@@ -990,13 +994,13 @@
   BailoutId BackEdgeId() const { return back_edge_id_; }
 
  protected:
-  ForOfStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : ForEachStatement(isolate, labels, pos),
+  ForOfStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : ForEachStatement(zone, labels, pos),
         assign_iterator_(NULL),
         next_result_(NULL),
         result_done_(NULL),
         assign_each_(NULL),
-        back_edge_id_(GetNextId(isolate)) {
+        back_edge_id_(GetNextId(zone)) {
   }
 
   Expression* assign_iterator_;
@@ -1016,8 +1020,8 @@
   virtual bool IsJump() const V8_OVERRIDE { return expression_->IsThrow(); }
 
  protected:
-  ExpressionStatement(Expression* expression, int pos)
-      : Statement(pos), expression_(expression) { }
+  ExpressionStatement(Zone* zone, Expression* expression, int pos)
+      : Statement(zone, pos), expression_(expression) { }
 
  private:
   Expression* expression_;
@@ -1029,7 +1033,7 @@
   virtual bool IsJump() const V8_FINAL V8_OVERRIDE { return true; }
 
  protected:
-  explicit JumpStatement(int pos) : Statement(pos) {}
+  explicit JumpStatement(Zone* zone, int pos) : Statement(zone, pos) {}
 };
 
 
@@ -1040,8 +1044,8 @@
   IterationStatement* target() const { return target_; }
 
  protected:
-  explicit ContinueStatement(IterationStatement* target, int pos)
-      : JumpStatement(pos), target_(target) { }
+  explicit ContinueStatement(Zone* zone, IterationStatement* target, int pos)
+      : JumpStatement(zone, pos), target_(target) { }
 
  private:
   IterationStatement* target_;
@@ -1055,8 +1059,8 @@
   BreakableStatement* target() const { return target_; }
 
  protected:
-  explicit BreakStatement(BreakableStatement* target, int pos)
-      : JumpStatement(pos), target_(target) { }
+  explicit BreakStatement(Zone* zone, BreakableStatement* target, int pos)
+      : JumpStatement(zone, pos), target_(target) { }
 
  private:
   BreakableStatement* target_;
@@ -1070,8 +1074,8 @@
   Expression* expression() const { return expression_; }
 
  protected:
-  explicit ReturnStatement(Expression* expression, int pos)
-      : JumpStatement(pos), expression_(expression) { }
+  explicit ReturnStatement(Zone* zone, Expression* expression, int pos)
+      : JumpStatement(zone, pos), expression_(expression) { }
 
  private:
   Expression* expression_;
@@ -1088,8 +1092,9 @@
 
  protected:
   WithStatement(
-      Scope* scope, Expression* expression, Statement* statement, int pos)
-      : Statement(pos),
+      Zone* zone, Scope* scope,
+      Expression* expression, Statement* statement, int pos)
+      : Statement(zone, pos),
         scope_(scope),
         expression_(expression),
         statement_(statement) { }
@@ -1117,11 +1122,11 @@
 
   // Type feedback information.
   TypeFeedbackId CompareId() { return compare_id_; }
-  Handle<Type> compare_type() { return compare_type_; }
-  void set_compare_type(Handle<Type> type) { compare_type_ = type; }
+  Type* compare_type() { return compare_type_; }
+  void set_compare_type(Type* type) { compare_type_ = type; }
 
  private:
-  CaseClause(Isolate* isolate,
+  CaseClause(Zone* zone,
              Expression* label,
              ZoneList<Statement*>* statements,
              int pos);
@@ -1129,7 +1134,7 @@
   Expression* label_;
   Label body_target_;
   ZoneList<Statement*>* statements_;
-  Handle<Type> compare_type_;
+  Type* compare_type_;
 
   const TypeFeedbackId compare_id_;
   const BailoutId entry_id_;
@@ -1149,8 +1154,8 @@
   ZoneList<CaseClause*>* cases() const { return cases_; }
 
  protected:
-  SwitchStatement(Isolate* isolate, ZoneStringList* labels, int pos)
-      : BreakableStatement(isolate, labels, TARGET_FOR_ANONYMOUS, pos),
+  SwitchStatement(Zone* zone, ZoneStringList* labels, int pos)
+      : BreakableStatement(zone, labels, TARGET_FOR_ANONYMOUS, pos),
         tag_(NULL),
         cases_(NULL) { }
 
@@ -1186,18 +1191,18 @@
   BailoutId ElseId() const { return else_id_; }
 
  protected:
-  IfStatement(Isolate* isolate,
+  IfStatement(Zone* zone,
               Expression* condition,
               Statement* then_statement,
               Statement* else_statement,
               int pos)
-      : Statement(pos),
+      : Statement(zone, pos),
         condition_(condition),
         then_statement_(then_statement),
         else_statement_(else_statement),
-        if_id_(GetNextId(isolate)),
-        then_id_(GetNextId(isolate)),
-        else_id_(GetNextId(isolate)) {
+        if_id_(GetNextId(zone)),
+        then_id_(GetNextId(zone)),
+        else_id_(GetNextId(zone)) {
   }
 
  private:
@@ -1245,8 +1250,8 @@
   ZoneList<Label*>* escaping_targets() const { return escaping_targets_; }
 
  protected:
-  TryStatement(int index, Block* try_block, int pos)
-      : Statement(pos),
+  TryStatement(Zone* zone, int index, Block* try_block, int pos)
+      : Statement(zone, pos),
         index_(index),
         try_block_(try_block),
         escaping_targets_(NULL) { }
@@ -1269,13 +1274,14 @@
   Block* catch_block() const { return catch_block_; }
 
  protected:
-  TryCatchStatement(int index,
+  TryCatchStatement(Zone* zone,
+                    int index,
                     Block* try_block,
                     Scope* scope,
                     Variable* variable,
                     Block* catch_block,
                     int pos)
-      : TryStatement(index, try_block, pos),
+      : TryStatement(zone, index, try_block, pos),
         scope_(scope),
         variable_(variable),
         catch_block_(catch_block) {
@@ -1296,8 +1302,8 @@
 
  protected:
   TryFinallyStatement(
-      int index, Block* try_block, Block* finally_block, int pos)
-      : TryStatement(index, try_block, pos),
+      Zone* zone, int index, Block* try_block, Block* finally_block, int pos)
+      : TryStatement(zone, index, try_block, pos),
         finally_block_(finally_block) { }
 
  private:
@@ -1310,7 +1316,7 @@
   DECLARE_NODE_TYPE(DebuggerStatement)
 
  protected:
-  explicit DebuggerStatement(int pos): Statement(pos) {}
+  explicit DebuggerStatement(Zone* zone, int pos): Statement(zone, pos) {}
 };
 
 
@@ -1319,7 +1325,7 @@
   DECLARE_NODE_TYPE(EmptyStatement)
 
  protected:
-  explicit EmptyStatement(int pos): Statement(pos) {}
+  explicit EmptyStatement(Zone* zone, int pos): Statement(zone, pos) {}
 };
 
 
@@ -1376,11 +1382,10 @@
   TypeFeedbackId LiteralFeedbackId() const { return reuse(id()); }
 
  protected:
-  Literal(
-      Isolate* isolate, Handle<Object> value, int position)
-      : Expression(isolate, position),
+  Literal(Zone* zone, Handle<Object> value, int position)
+      : Expression(zone, position),
         value_(value),
-        isolate_(isolate) { }
+        isolate_(zone->isolate()) { }
 
  private:
   Handle<String> ToString();
@@ -1405,10 +1410,10 @@
   }
 
  protected:
-  MaterializedLiteral(Isolate* isolate,
+  MaterializedLiteral(Zone* zone,
                       int literal_index,
                       int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         literal_index_(literal_index),
         is_simple_(false),
         depth_(0) {}
@@ -1456,7 +1461,7 @@
     PROTOTYPE              // Property is __proto__.
   };
 
-  ObjectLiteralProperty(Literal* key, Expression* value, Isolate* isolate);
+  ObjectLiteralProperty(Zone* zone, Literal* key, Expression* value);
 
   Literal* key() { return key_; }
   Expression* value() { return value_; }
@@ -1475,7 +1480,7 @@
  protected:
   template<class> friend class AstNodeFactory;
 
-  ObjectLiteralProperty(bool is_getter, FunctionLiteral* value);
+  ObjectLiteralProperty(Zone* zone, bool is_getter, FunctionLiteral* value);
   void set_key(Literal* key) { key_ = key; }
 
  private:
@@ -1527,13 +1532,13 @@
   };
 
  protected:
-  ObjectLiteral(Isolate* isolate,
+  ObjectLiteral(Zone* zone,
                 ZoneList<Property*>* properties,
                 int literal_index,
                 int boilerplate_properties,
                 bool has_function,
                 int pos)
-      : MaterializedLiteral(isolate, literal_index, pos),
+      : MaterializedLiteral(zone, literal_index, pos),
         properties_(properties),
         boilerplate_properties_(boilerplate_properties),
         fast_elements_(false),
@@ -1559,12 +1564,12 @@
   Handle<String> flags() const { return flags_; }
 
  protected:
-  RegExpLiteral(Isolate* isolate,
+  RegExpLiteral(Zone* zone,
                 Handle<String> pattern,
                 Handle<String> flags,
                 int literal_index,
                 int pos)
-      : MaterializedLiteral(isolate, literal_index, pos),
+      : MaterializedLiteral(zone, literal_index, pos),
         pattern_(pattern),
         flags_(flags) {
     set_depth(1);
@@ -1600,13 +1605,13 @@
   };
 
  protected:
-  ArrayLiteral(Isolate* isolate,
+  ArrayLiteral(Zone* zone,
                ZoneList<Expression*>* values,
                int literal_index,
                int pos)
-      : MaterializedLiteral(isolate, literal_index, pos),
+      : MaterializedLiteral(zone, literal_index, pos),
         values_(values),
-        first_element_id_(ReserveIdRange(isolate, values->length())) {}
+        first_element_id_(ReserveIdRange(zone, values->length())) {}
 
  private:
   Handle<FixedArray> constant_elements_;
@@ -1646,9 +1651,9 @@
   void BindTo(Variable* var);
 
  protected:
-  VariableProxy(Isolate* isolate, Variable* var, int position);
+  VariableProxy(Zone* zone, Variable* var, int position);
 
-  VariableProxy(Isolate* isolate,
+  VariableProxy(Zone* zone,
                 Handle<String> name,
                 bool is_this,
                 Interface* interface,
@@ -1702,14 +1707,14 @@
   TypeFeedbackId PropertyFeedbackId() { return reuse(id()); }
 
  protected:
-  Property(Isolate* isolate,
+  Property(Zone* zone,
            Expression* obj,
            Expression* key,
            int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         obj_(obj),
         key_(key),
-        load_id_(GetNextId(isolate)),
+        load_id_(GetNextId(zone)),
         is_pre_monomorphic_(false),
         is_uninitialized_(false),
         is_string_access_(false),
@@ -1796,17 +1801,17 @@
 #endif
 
  protected:
-  Call(Isolate* isolate,
+  Call(Zone* zone,
        Expression* expression,
        ZoneList<Expression*>* arguments,
        int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         expression_(expression),
         arguments_(arguments),
         is_monomorphic_(false),
         keyed_array_call_is_holey_(true),
         check_type_(RECEIVER_MAP_CHECK),
-        return_id_(GetNextId(isolate)) { }
+        return_id_(GetNextId(zone)) { }
 
  private:
   Expression* expression_;
@@ -1844,16 +1849,16 @@
   BailoutId ReturnId() const { return return_id_; }
 
  protected:
-  CallNew(Isolate* isolate,
+  CallNew(Zone* zone,
           Expression* expression,
           ZoneList<Expression*>* arguments,
           int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         expression_(expression),
         arguments_(arguments),
         is_monomorphic_(false),
         elements_kind_(GetInitialFastElementsKind()),
-        return_id_(GetNextId(isolate)) { }
+        return_id_(GetNextId(zone)) { }
 
  private:
   Expression* expression_;
@@ -1884,12 +1889,12 @@
   TypeFeedbackId CallRuntimeFeedbackId() const { return reuse(id()); }
 
  protected:
-  CallRuntime(Isolate* isolate,
+  CallRuntime(Zone* zone,
               Handle<String> name,
               const Runtime::Function* function,
               ZoneList<Expression*>* arguments,
               int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         name_(name),
         function_(function),
         arguments_(arguments) { }
@@ -1915,15 +1920,15 @@
       TypeFeedbackOracle* oracle) V8_OVERRIDE;
 
  protected:
-  UnaryOperation(Isolate* isolate,
+  UnaryOperation(Zone* zone,
                  Token::Value op,
                  Expression* expression,
                  int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         op_(op),
         expression_(expression),
-        materialize_true_id_(GetNextId(isolate)),
-        materialize_false_id_(GetNextId(isolate)) {
+        materialize_true_id_(GetNextId(zone)),
+        materialize_false_id_(GetNextId(zone)) {
     ASSERT(Token::IsUnaryOp(op));
   }
 
@@ -1962,16 +1967,16 @@
       TypeFeedbackOracle* oracle) V8_OVERRIDE;
 
  protected:
-  BinaryOperation(Isolate* isolate,
+  BinaryOperation(Zone* zone,
                   Token::Value op,
                   Expression* left,
                   Expression* right,
                   int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         op_(op),
         left_(left),
         right_(right),
-        right_id_(GetNextId(isolate)) {
+        right_id_(GetNextId(zone)) {
     ASSERT(Token::IsBinaryOp(op));
   }
 
@@ -2014,9 +2019,9 @@
   virtual KeyedAccessStoreMode GetStoreMode() V8_OVERRIDE {
     return store_mode_;
   }
-  Handle<Type> type() const { return type_; }
+  Type* type() const { return type_; }
   void set_store_mode(KeyedAccessStoreMode mode) { store_mode_ = mode; }
-  void set_type(Handle<Type> type) { type_ = type; }
+  void set_type(Type* type) { type_ = type; }
 
   BailoutId AssignmentId() const { return assignment_id_; }
 
@@ -2024,25 +2029,25 @@
   TypeFeedbackId CountStoreFeedbackId() const { return reuse(id()); }
 
  protected:
-  CountOperation(Isolate* isolate,
+  CountOperation(Zone* zone,
                  Token::Value op,
                  bool is_prefix,
                  Expression* expr,
                  int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         op_(op),
         is_prefix_(is_prefix),
         store_mode_(STANDARD_STORE),
         expression_(expr),
-        assignment_id_(GetNextId(isolate)),
-        count_id_(GetNextId(isolate)) {}
+        assignment_id_(GetNextId(zone)),
+        count_id_(GetNextId(zone)) {}
 
  private:
   Token::Value op_;
   bool is_prefix_ : 1;
   KeyedAccessStoreMode store_mode_ : 5;  // Windows treats as signed,
                                          // must have extra bit.
-  Handle<Type> type_;
+  Type* type_;
 
   Expression* expression_;
   const BailoutId assignment_id_;
@@ -2061,8 +2066,8 @@
 
   // Type feedback information.
   TypeFeedbackId CompareOperationFeedbackId() const { return reuse(id()); }
-  Handle<Type> combined_type() const { return combined_type_; }
-  void set_combined_type(Handle<Type> type) { combined_type_ = type; }
+  Type* combined_type() const { return combined_type_; }
+  void set_combined_type(Type* type) { combined_type_ = type; }
 
   // Match special cases.
   bool IsLiteralCompareTypeof(Expression** expr, Handle<String>* check);
@@ -2070,16 +2075,16 @@
   bool IsLiteralCompareNull(Expression** expr);
 
  protected:
-  CompareOperation(Isolate* isolate,
+  CompareOperation(Zone* zone,
                    Token::Value op,
                    Expression* left,
                    Expression* right,
                    int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         op_(op),
         left_(left),
         right_(right),
-        combined_type_(Type::None(isolate)) {
+        combined_type_(Type::None(zone)) {
     ASSERT(Token::IsCompareOp(op));
   }
 
@@ -2088,7 +2093,7 @@
   Expression* left_;
   Expression* right_;
 
-  Handle<Type> combined_type_;
+  Type* combined_type_;
 };
 
 
@@ -2104,17 +2109,17 @@
   BailoutId ElseId() const { return else_id_; }
 
  protected:
-  Conditional(Isolate* isolate,
+  Conditional(Zone* zone,
               Expression* condition,
               Expression* then_expression,
               Expression* else_expression,
               int position)
-      : Expression(isolate, position),
+      : Expression(zone, position),
         condition_(condition),
         then_expression_(then_expression),
         else_expression_(else_expression),
-        then_id_(GetNextId(isolate)),
-        else_id_(GetNextId(isolate)) { }
+        then_id_(GetNextId(zone)),
+        else_id_(GetNextId(zone)) { }
 
  private:
   Expression* condition_;
@@ -2164,14 +2169,14 @@
   void set_store_mode(KeyedAccessStoreMode mode) { store_mode_ = mode; }
 
  protected:
-  Assignment(Isolate* isolate,
+  Assignment(Zone* zone,
              Token::Value op,
              Expression* target,
              Expression* value,
              int pos);
 
   template<class Visitor>
-  void Init(Isolate* isolate, AstNodeFactory<Visitor>* factory) {
+  void Init(Zone* zone, AstNodeFactory<Visitor>* factory) {
     ASSERT(Token::IsAssignmentOp(op_));
     if (is_compound()) {
       binary_operation_ = factory->NewBinaryOperation(
@@ -2222,12 +2227,12 @@
   }
 
  protected:
-  Yield(Isolate* isolate,
+  Yield(Zone* zone,
         Expression* generator_object,
         Expression* expression,
         Kind yield_kind,
         int pos)
-      : Expression(isolate, pos),
+      : Expression(zone, pos),
         generator_object_(generator_object),
         expression_(expression),
         yield_kind_(yield_kind),
@@ -2248,8 +2253,8 @@
   Expression* exception() const { return exception_; }
 
  protected:
-  Throw(Isolate* isolate, Expression* exception, int pos)
-      : Expression(isolate, pos), exception_(exception) {}
+  Throw(Zone* zone, Expression* exception, int pos)
+      : Expression(zone, pos), exception_(exception) {}
 
  private:
   Expression* exception_;
@@ -2360,7 +2365,7 @@
   }
 
  protected:
-  FunctionLiteral(Isolate* isolate,
+  FunctionLiteral(Zone* zone,
                   Handle<String> name,
                   Scope* scope,
                   ZoneList<Statement*>* body,
@@ -2374,11 +2379,11 @@
                   IsParenthesizedFlag is_parenthesized,
                   IsGeneratorFlag is_generator,
                   int position)
-      : Expression(isolate, position),
+      : Expression(zone, position),
         name_(name),
         scope_(scope),
         body_(body),
-        inferred_name_(isolate->factory()->empty_string()),
+        inferred_name_(zone->isolate()->factory()->empty_string()),
         dont_optimize_reason_(kNoReason),
         materialized_literal_count_(materialized_literal_count),
         expected_property_count_(expected_property_count),
@@ -2430,8 +2435,8 @@
 
  protected:
   NativeFunctionLiteral(
-      Isolate* isolate, Handle<String> name, v8::Extension* extension, int pos)
-      : Expression(isolate, pos), name_(name), extension_(extension) {}
+      Zone* zone, Handle<String> name, v8::Extension* extension, int pos)
+      : Expression(zone, pos), name_(name), extension_(extension) {}
 
  private:
   Handle<String> name_;
@@ -2444,7 +2449,7 @@
   DECLARE_NODE_TYPE(ThisFunction)
 
  protected:
-  explicit ThisFunction(Isolate* isolate, int pos): Expression(isolate, pos) {}
+  explicit ThisFunction(Zone* zone, int pos): Expression(zone, pos) {}
 };
 
 #undef DECLARE_NODE_TYPE
@@ -2811,8 +2816,8 @@
 // ----------------------------------------------------------------------------
 // Out-of-line inline constructors (to side-step cyclic dependencies).
 
-inline ModuleVariable::ModuleVariable(VariableProxy* proxy, int pos)
-    : Module(proxy->interface(), pos),
+inline ModuleVariable::ModuleVariable(Zone* zone, VariableProxy* proxy, int pos)
+    : Module(zone, proxy->interface(), pos),
       proxy_(proxy) {
 }
 
@@ -2844,7 +2849,7 @@
 
 #define DEFINE_AST_VISITOR_SUBCLASS_MEMBERS()                       \
 public:                                                             \
-  virtual void Visit(AstNode* node) V8_FINAL V8_OVERRIDE {                \
+  virtual void Visit(AstNode* node) V8_FINAL V8_OVERRIDE {          \
     if (!CheckStackOverflow()) node->Accept(this);                  \
   }                                                                 \
                                                                     \
@@ -2854,19 +2859,20 @@
                                                                     \
   bool CheckStackOverflow() {                                       \
     if (stack_overflow_) return true;                               \
-    StackLimitCheck check(isolate_);                                \
+    StackLimitCheck check(zone_->isolate());                        \
     if (!check.HasOverflowed()) return false;                       \
     return (stack_overflow_ = true);                                \
   }                                                                 \
                                                                     \
 private:                                                            \
-  void InitializeAstVisitor(Isolate* isolate) {                     \
-    isolate_ = isolate;                                             \
+  void InitializeAstVisitor(Zone* zone) {                           \
+    zone_ = zone;                                                   \
     stack_overflow_ = false;                                        \
   }                                                                 \
-  Isolate* isolate() { return isolate_; }                           \
+  Zone* zone() { return zone_; }                                    \
+  Isolate* isolate() { return zone_->isolate(); }                   \
                                                                     \
-  Isolate* isolate_;                                                \
+  Zone* zone_;                                                      \
   bool stack_overflow_
 
 
@@ -2917,9 +2923,7 @@
 template<class Visitor>
 class AstNodeFactory V8_FINAL BASE_EMBEDDED {
  public:
-  AstNodeFactory(Isolate* isolate, Zone* zone)
-      : isolate_(isolate),
-        zone_(zone) { }
+  explicit AstNodeFactory(Zone* zone) : zone_(zone) { }
 
   Visitor* visitor() { return &visitor_; }
 
@@ -2932,7 +2936,7 @@
                                               Scope* scope,
                                               int pos) {
     VariableDeclaration* decl =
-        new(zone_) VariableDeclaration(proxy, mode, scope, pos);
+        new(zone_) VariableDeclaration(zone_, proxy, mode, scope, pos);
     VISIT_AND_RETURN(VariableDeclaration, decl)
   }
 
@@ -2942,7 +2946,7 @@
                                               Scope* scope,
                                               int pos) {
     FunctionDeclaration* decl =
-        new(zone_) FunctionDeclaration(proxy, mode, fun, scope, pos);
+        new(zone_) FunctionDeclaration(zone_, proxy, mode, fun, scope, pos);
     VISIT_AND_RETURN(FunctionDeclaration, decl)
   }
 
@@ -2951,7 +2955,7 @@
                                           Scope* scope,
                                           int pos) {
     ModuleDeclaration* decl =
-        new(zone_) ModuleDeclaration(proxy, module, scope, pos);
+        new(zone_) ModuleDeclaration(zone_, proxy, module, scope, pos);
     VISIT_AND_RETURN(ModuleDeclaration, decl)
   }
 
@@ -2960,7 +2964,7 @@
                                           Scope* scope,
                                           int pos) {
     ImportDeclaration* decl =
-        new(zone_) ImportDeclaration(proxy, module, scope, pos);
+        new(zone_) ImportDeclaration(zone_, proxy, module, scope, pos);
     VISIT_AND_RETURN(ImportDeclaration, decl)
   }
 
@@ -2968,27 +2972,28 @@
                                           Scope* scope,
                                           int pos) {
     ExportDeclaration* decl =
-        new(zone_) ExportDeclaration(proxy, scope, pos);
+        new(zone_) ExportDeclaration(zone_, proxy, scope, pos);
     VISIT_AND_RETURN(ExportDeclaration, decl)
   }
 
   ModuleLiteral* NewModuleLiteral(Block* body, Interface* interface, int pos) {
-    ModuleLiteral* module = new(zone_) ModuleLiteral(body, interface, pos);
+    ModuleLiteral* module =
+        new(zone_) ModuleLiteral(zone_, body, interface, pos);
     VISIT_AND_RETURN(ModuleLiteral, module)
   }
 
   ModuleVariable* NewModuleVariable(VariableProxy* proxy, int pos) {
-    ModuleVariable* module = new(zone_) ModuleVariable(proxy, pos);
+    ModuleVariable* module = new(zone_) ModuleVariable(zone_, proxy, pos);
     VISIT_AND_RETURN(ModuleVariable, module)
   }
 
   ModulePath* NewModulePath(Module* origin, Handle<String> name, int pos) {
-    ModulePath* module = new(zone_) ModulePath(origin, name, zone_, pos);
+    ModulePath* module = new(zone_) ModulePath(zone_, origin, name, pos);
     VISIT_AND_RETURN(ModulePath, module)
   }
 
   ModuleUrl* NewModuleUrl(Handle<String> url, int pos) {
-    ModuleUrl* module = new(zone_) ModuleUrl(url, zone_, pos);
+    ModuleUrl* module = new(zone_) ModuleUrl(zone_, url, pos);
     VISIT_AND_RETURN(ModuleUrl, module)
   }
 
@@ -2997,13 +3002,13 @@
                   bool is_initializer_block,
                   int pos) {
     Block* block = new(zone_) Block(
-        isolate_, labels, capacity, is_initializer_block, pos, zone_);
+        zone_, labels, capacity, is_initializer_block, pos);
     VISIT_AND_RETURN(Block, block)
   }
 
 #define STATEMENT_WITH_LABELS(NodeType) \
   NodeType* New##NodeType(ZoneStringList* labels, int pos) { \
-    NodeType* stmt = new(zone_) NodeType(isolate_, labels, pos); \
+    NodeType* stmt = new(zone_) NodeType(zone_, labels, pos); \
     VISIT_AND_RETURN(NodeType, stmt); \
   }
   STATEMENT_WITH_LABELS(DoWhileStatement)
@@ -3017,11 +3022,11 @@
                                         int pos) {
     switch (visit_mode) {
       case ForEachStatement::ENUMERATE: {
-        ForInStatement* stmt = new(zone_) ForInStatement(isolate_, labels, pos);
+        ForInStatement* stmt = new(zone_) ForInStatement(zone_, labels, pos);
         VISIT_AND_RETURN(ForInStatement, stmt);
       }
       case ForEachStatement::ITERATE: {
-        ForOfStatement* stmt = new(zone_) ForOfStatement(isolate_, labels, pos);
+        ForOfStatement* stmt = new(zone_) ForOfStatement(zone_, labels, pos);
         VISIT_AND_RETURN(ForOfStatement, stmt);
       }
     }
@@ -3031,27 +3036,28 @@
 
   ModuleStatement* NewModuleStatement(
       VariableProxy* proxy, Block* body, int pos) {
-    ModuleStatement* stmt = new(zone_) ModuleStatement(proxy, body, pos);
+    ModuleStatement* stmt = new(zone_) ModuleStatement(zone_, proxy, body, pos);
     VISIT_AND_RETURN(ModuleStatement, stmt)
   }
 
   ExpressionStatement* NewExpressionStatement(Expression* expression, int pos) {
-    ExpressionStatement* stmt = new(zone_) ExpressionStatement(expression, pos);
+    ExpressionStatement* stmt =
+        new(zone_) ExpressionStatement(zone_, expression, pos);
     VISIT_AND_RETURN(ExpressionStatement, stmt)
   }
 
   ContinueStatement* NewContinueStatement(IterationStatement* target, int pos) {
-    ContinueStatement* stmt = new(zone_) ContinueStatement(target, pos);
+    ContinueStatement* stmt = new(zone_) ContinueStatement(zone_, target, pos);
     VISIT_AND_RETURN(ContinueStatement, stmt)
   }
 
   BreakStatement* NewBreakStatement(BreakableStatement* target, int pos) {
-    BreakStatement* stmt = new(zone_) BreakStatement(target, pos);
+    BreakStatement* stmt = new(zone_) BreakStatement(zone_, target, pos);
     VISIT_AND_RETURN(BreakStatement, stmt)
   }
 
   ReturnStatement* NewReturnStatement(Expression* expression, int pos) {
-    ReturnStatement* stmt = new(zone_) ReturnStatement(expression, pos);
+    ReturnStatement* stmt = new(zone_) ReturnStatement(zone_, expression, pos);
     VISIT_AND_RETURN(ReturnStatement, stmt)
   }
 
@@ -3060,7 +3066,7 @@
                                   Statement* statement,
                                   int pos) {
     WithStatement* stmt = new(zone_) WithStatement(
-        scope, expression, statement, pos);
+        zone_, scope, expression, statement, pos);
     VISIT_AND_RETURN(WithStatement, stmt)
   }
 
@@ -3069,7 +3075,7 @@
                               Statement* else_statement,
                               int pos) {
     IfStatement* stmt = new(zone_) IfStatement(
-        isolate_, condition, then_statement, else_statement, pos);
+        zone_, condition, then_statement, else_statement, pos);
     VISIT_AND_RETURN(IfStatement, stmt)
   }
 
@@ -3080,7 +3086,7 @@
                                           Block* catch_block,
                                           int pos) {
     TryCatchStatement* stmt = new(zone_) TryCatchStatement(
-        index, try_block, scope, variable, catch_block, pos);
+        zone_, index, try_block, scope, variable, catch_block, pos);
     VISIT_AND_RETURN(TryCatchStatement, stmt)
   }
 
@@ -3088,34 +3094,35 @@
                                               Block* try_block,
                                               Block* finally_block,
                                               int pos) {
-    TryFinallyStatement* stmt =
-        new(zone_) TryFinallyStatement(index, try_block, finally_block, pos);
+    TryFinallyStatement* stmt = new(zone_) TryFinallyStatement(
+        zone_, index, try_block, finally_block, pos);
     VISIT_AND_RETURN(TryFinallyStatement, stmt)
   }
 
   DebuggerStatement* NewDebuggerStatement(int pos) {
-    DebuggerStatement* stmt = new(zone_) DebuggerStatement(pos);
+    DebuggerStatement* stmt = new(zone_) DebuggerStatement(zone_, pos);
     VISIT_AND_RETURN(DebuggerStatement, stmt)
   }
 
   EmptyStatement* NewEmptyStatement(int pos) {
-    return new(zone_) EmptyStatement(pos);
+    return new(zone_) EmptyStatement(zone_, pos);
   }
 
   CaseClause* NewCaseClause(
       Expression* label, ZoneList<Statement*>* statements, int pos) {
     CaseClause* clause =
-        new(zone_) CaseClause(isolate_, label, statements, pos);
+        new(zone_) CaseClause(zone_, label, statements, pos);
     VISIT_AND_RETURN(CaseClause, clause)
   }
 
   Literal* NewLiteral(Handle<Object> handle, int pos) {
-    Literal* lit = new(zone_) Literal(isolate_, handle, pos);
+    Literal* lit = new(zone_) Literal(zone_, handle, pos);
     VISIT_AND_RETURN(Literal, lit)
   }
 
   Literal* NewNumberLiteral(double number, int pos) {
-    return NewLiteral(isolate_->factory()->NewNumber(number, TENURED), pos);
+    return NewLiteral(
+        zone_->isolate()->factory()->NewNumber(number, TENURED), pos);
   }
 
   ObjectLiteral* NewObjectLiteral(
@@ -3125,16 +3132,21 @@
       bool has_function,
       int pos) {
     ObjectLiteral* lit = new(zone_) ObjectLiteral(
-        isolate_, properties, literal_index, boilerplate_properties,
+        zone_, properties, literal_index, boilerplate_properties,
         has_function, pos);
     VISIT_AND_RETURN(ObjectLiteral, lit)
   }
 
+  ObjectLiteral::Property* NewObjectLiteralProperty(Literal* key,
+                                                    Expression* value) {
+    return new(zone_) ObjectLiteral::Property(zone_, key, value);
+  }
+
   ObjectLiteral::Property* NewObjectLiteralProperty(bool is_getter,
                                                     FunctionLiteral* value,
                                                     int pos) {
     ObjectLiteral::Property* prop =
-        new(zone_) ObjectLiteral::Property(is_getter, value);
+        new(zone_) ObjectLiteral::Property(zone_, is_getter, value);
     prop->set_key(NewLiteral(value->name(), pos));
     return prop;  // Not an AST node, will not be visited.
   }
@@ -3144,7 +3156,7 @@
                                   int literal_index,
                                   int pos) {
     RegExpLiteral* lit =
-        new(zone_) RegExpLiteral(isolate_, pattern, flags, literal_index, pos);
+        new(zone_) RegExpLiteral(zone_, pattern, flags, literal_index, pos);
     VISIT_AND_RETURN(RegExpLiteral, lit);
   }
 
@@ -3152,13 +3164,13 @@
                                 int literal_index,
                                 int pos) {
     ArrayLiteral* lit = new(zone_) ArrayLiteral(
-        isolate_, values, literal_index, pos);
+        zone_, values, literal_index, pos);
     VISIT_AND_RETURN(ArrayLiteral, lit)
   }
 
   VariableProxy* NewVariableProxy(Variable* var,
                                   int pos = RelocInfo::kNoPosition) {
-    VariableProxy* proxy = new(zone_) VariableProxy(isolate_, var, pos);
+    VariableProxy* proxy = new(zone_) VariableProxy(zone_, var, pos);
     VISIT_AND_RETURN(VariableProxy, proxy)
   }
 
@@ -3167,26 +3179,26 @@
                                   Interface* interface = Interface::NewValue(),
                                   int position = RelocInfo::kNoPosition) {
     VariableProxy* proxy =
-        new(zone_) VariableProxy(isolate_, name, is_this, interface, position);
+        new(zone_) VariableProxy(zone_, name, is_this, interface, position);
     VISIT_AND_RETURN(VariableProxy, proxy)
   }
 
   Property* NewProperty(Expression* obj, Expression* key, int pos) {
-    Property* prop = new(zone_) Property(isolate_, obj, key, pos);
+    Property* prop = new(zone_) Property(zone_, obj, key, pos);
     VISIT_AND_RETURN(Property, prop)
   }
 
   Call* NewCall(Expression* expression,
                 ZoneList<Expression*>* arguments,
                 int pos) {
-    Call* call = new(zone_) Call(isolate_, expression, arguments, pos);
+    Call* call = new(zone_) Call(zone_, expression, arguments, pos);
     VISIT_AND_RETURN(Call, call)
   }
 
   CallNew* NewCallNew(Expression* expression,
                       ZoneList<Expression*>* arguments,
                       int pos) {
-    CallNew* call = new(zone_) CallNew(isolate_, expression, arguments, pos);
+    CallNew* call = new(zone_) CallNew(zone_, expression, arguments, pos);
     VISIT_AND_RETURN(CallNew, call)
   }
 
@@ -3195,7 +3207,7 @@
                               ZoneList<Expression*>* arguments,
                               int pos) {
     CallRuntime* call =
-        new(zone_) CallRuntime(isolate_, name, function, arguments, pos);
+        new(zone_) CallRuntime(zone_, name, function, arguments, pos);
     VISIT_AND_RETURN(CallRuntime, call)
   }
 
@@ -3203,7 +3215,7 @@
                                     Expression* expression,
                                     int pos) {
     UnaryOperation* node =
-        new(zone_) UnaryOperation(isolate_, op, expression, pos);
+        new(zone_) UnaryOperation(zone_, op, expression, pos);
     VISIT_AND_RETURN(UnaryOperation, node)
   }
 
@@ -3212,7 +3224,7 @@
                                       Expression* right,
                                       int pos) {
     BinaryOperation* node =
-        new(zone_) BinaryOperation(isolate_, op, left, right, pos);
+        new(zone_) BinaryOperation(zone_, op, left, right, pos);
     VISIT_AND_RETURN(BinaryOperation, node)
   }
 
@@ -3221,7 +3233,7 @@
                                     Expression* expr,
                                     int pos) {
     CountOperation* node =
-        new(zone_) CountOperation(isolate_, op, is_prefix, expr, pos);
+        new(zone_) CountOperation(zone_, op, is_prefix, expr, pos);
     VISIT_AND_RETURN(CountOperation, node)
   }
 
@@ -3230,7 +3242,7 @@
                                         Expression* right,
                                         int pos) {
     CompareOperation* node =
-        new(zone_) CompareOperation(isolate_, op, left, right, pos);
+        new(zone_) CompareOperation(zone_, op, left, right, pos);
     VISIT_AND_RETURN(CompareOperation, node)
   }
 
@@ -3239,7 +3251,7 @@
                               Expression* else_expression,
                               int position) {
     Conditional* cond = new(zone_) Conditional(
-        isolate_, condition, then_expression, else_expression, position);
+        zone_, condition, then_expression, else_expression, position);
     VISIT_AND_RETURN(Conditional, cond)
   }
 
@@ -3248,8 +3260,8 @@
                             Expression* value,
                             int pos) {
     Assignment* assign =
-        new(zone_) Assignment(isolate_, op, target, value, pos);
-    assign->Init(isolate_, this);
+        new(zone_) Assignment(zone_, op, target, value, pos);
+    assign->Init(zone_, this);
     VISIT_AND_RETURN(Assignment, assign)
   }
 
@@ -3258,12 +3270,12 @@
                   Yield::Kind yield_kind,
                   int pos) {
     Yield* yield = new(zone_) Yield(
-        isolate_, generator_object, expression, yield_kind, pos);
+        zone_, generator_object, expression, yield_kind, pos);
     VISIT_AND_RETURN(Yield, yield)
   }
 
   Throw* NewThrow(Expression* exception, int pos) {
-    Throw* t = new(zone_) Throw(isolate_, exception, pos);
+    Throw* t = new(zone_) Throw(zone_, exception, pos);
     VISIT_AND_RETURN(Throw, t)
   }
 
@@ -3282,7 +3294,7 @@
       FunctionLiteral::IsGeneratorFlag is_generator,
       int position) {
     FunctionLiteral* lit = new(zone_) FunctionLiteral(
-        isolate_, name, scope, body,
+        zone_, name, scope, body,
         materialized_literal_count, expected_property_count, handler_count,
         parameter_count, function_type, has_duplicate_parameters, is_function,
         is_parenthesized, is_generator, position);
@@ -3296,19 +3308,18 @@
   NativeFunctionLiteral* NewNativeFunctionLiteral(
       Handle<String> name, v8::Extension* extension, int pos) {
     NativeFunctionLiteral* lit =
-        new(zone_) NativeFunctionLiteral(isolate_, name, extension, pos);
+        new(zone_) NativeFunctionLiteral(zone_, name, extension, pos);
     VISIT_AND_RETURN(NativeFunctionLiteral, lit)
   }
 
   ThisFunction* NewThisFunction(int pos) {
-    ThisFunction* fun = new(zone_) ThisFunction(isolate_, pos);
+    ThisFunction* fun = new(zone_) ThisFunction(zone_, pos);
     VISIT_AND_RETURN(ThisFunction, fun)
   }
 
 #undef VISIT_AND_RETURN
 
  private:
-  Isolate* isolate_;
   Zone* zone_;
   Visitor visitor_;
 };
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index 785b9ca..32b4b3e 100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -323,7 +323,7 @@
 HValue* CodeStubGraphBuilder<NumberToStringStub>::BuildCodeStub() {
   info()->MarkAsSavesCallerDoubles();
   HValue* number = GetParameter(NumberToStringStub::kNumber);
-  return BuildNumberToString(number, Type::Number(isolate()));
+  return BuildNumberToString(number, Type::Number(zone()));
 }
 
 
@@ -652,10 +652,7 @@
     AllocationSiteOverrideMode override_mode,
     ArgumentClass argument_class) {
   HValue* constructor = GetParameter(ArrayConstructorStubBase::kConstructor);
-  HValue* property_cell = GetParameter(ArrayConstructorStubBase::kPropertyCell);
-  // Walk through the property cell to the AllocationSite
-  HValue* alloc_site = Add<HLoadNamedField>(property_cell,
-                                            HObjectAccess::ForCellValue());
+  HValue* alloc_site = GetParameter(ArrayConstructorStubBase::kAllocationSite);
   JSArrayBuilder array_builder(this, kind, alloc_site, constructor,
                                override_mode);
   HValue* result = NULL;
@@ -844,7 +841,7 @@
   CompareNilICStub* stub = casted_stub();
   HIfContinuation continuation;
   Handle<Map> sentinel_map(isolate->heap()->meta_map());
-  Handle<Type> type = stub->GetType(isolate, sentinel_map);
+  Type* type = stub->GetType(zone(), sentinel_map);
   BuildCompareNil(GetParameter(0), type, &continuation);
   IfBuilder if_nil(this, &continuation);
   if_nil.Then();
@@ -871,9 +868,9 @@
   HValue* left = GetParameter(BinaryOpICStub::kLeft);
   HValue* right = GetParameter(BinaryOpICStub::kRight);
 
-  Handle<Type> left_type = state.GetLeftType(isolate());
-  Handle<Type> right_type = state.GetRightType(isolate());
-  Handle<Type> result_type = state.GetResultType(isolate());
+  Type* left_type = state.GetLeftType(zone());
+  Type* right_type = state.GetRightType(zone());
+  Type* result_type = state.GetResultType(zone());
 
   ASSERT(!left_type->Is(Type::None()) && !right_type->Is(Type::None()) &&
          (state.HasSideEffects() || !result_type->Is(Type::None())));
@@ -892,7 +889,7 @@
       {
         Push(BuildBinaryOperation(
                     state.op(), left, right,
-                    Type::String(isolate()), right_type,
+                    Type::String(zone()), right_type,
                     result_type, state.fixed_right_arg(),
                     allocation_mode));
       }
@@ -912,7 +909,7 @@
       {
         Push(BuildBinaryOperation(
                     state.op(), left, right,
-                    left_type, Type::String(isolate()),
+                    left_type, Type::String(zone()),
                     result_type, state.fixed_right_arg(),
                     allocation_mode));
       }
@@ -986,9 +983,9 @@
   HValue* left = GetParameter(BinaryOpWithAllocationSiteStub::kLeft);
   HValue* right = GetParameter(BinaryOpWithAllocationSiteStub::kRight);
 
-  Handle<Type> left_type = state.GetLeftType(isolate());
-  Handle<Type> right_type = state.GetRightType(isolate());
-  Handle<Type> result_type = state.GetResultType(isolate());
+  Type* left_type = state.GetLeftType(zone());
+  Type* right_type = state.GetRightType(zone());
+  Type* result_type = state.GetResultType(zone());
   HAllocationMode allocation_mode(allocation_site);
 
   return BuildBinaryOperation(state.op(), left, right,
diff --git a/src/code-stubs.cc b/src/code-stubs.cc
index 7e88675..da0a9b6 100644
--- a/src/code-stubs.cc
+++ b/src/code-stubs.cc
@@ -476,37 +476,33 @@
 }
 
 
-Handle<Type> CompareNilICStub::GetType(
-    Isolate* isolate,
-    Handle<Map> map) {
+Type* CompareNilICStub::GetType(Zone* zone, Handle<Map> map) {
   if (state_.Contains(CompareNilICStub::GENERIC)) {
-    return Type::Any(isolate);
+    return Type::Any(zone);
   }
 
-  Handle<Type> result = Type::None(isolate);
+  Type* result = Type::None(zone);
   if (state_.Contains(CompareNilICStub::UNDEFINED)) {
-    result = Type::Union(result, Type::Undefined(isolate), isolate);
+    result = Type::Union(result, Type::Undefined(zone), zone);
   }
   if (state_.Contains(CompareNilICStub::NULL_TYPE)) {
-    result = Type::Union(result, Type::Null(isolate), isolate);
+    result = Type::Union(result, Type::Null(zone), zone);
   }
   if (state_.Contains(CompareNilICStub::MONOMORPHIC_MAP)) {
-    Handle<Type> type = map.is_null()
-        ? Type::Detectable(isolate) : Type::Class(map, isolate);
-    result = Type::Union(result, type, isolate);
+    Type* type =
+        map.is_null() ? Type::Detectable(zone) : Type::Class(map, zone);
+    result = Type::Union(result, type, zone);
   }
 
   return result;
 }
 
 
-Handle<Type> CompareNilICStub::GetInputType(
-    Isolate* isolate,
-    Handle<Map> map) {
-  Handle<Type> output_type = GetType(isolate, map);
-  Handle<Type> nil_type = nil_value_ == kNullValue
-      ? Type::Null(isolate) : Type::Undefined(isolate);
-  return Type::Union(output_type, nil_type, isolate);
+Type* CompareNilICStub::GetInputType(Zone* zone, Handle<Map> map) {
+  Type* output_type = GetType(zone, map);
+  Type* nil_type =
+      nil_value_ == kNullValue ? Type::Null(zone) : Type::Undefined(zone);
+  return Type::Union(output_type, nil_type, zone);
 }
 
 
diff --git a/src/code-stubs.h b/src/code-stubs.h
index 62eb71f..b08f982 100644
--- a/src/code-stubs.h
+++ b/src/code-stubs.h
@@ -1368,8 +1368,8 @@
 
 class CompareNilICStub : public HydrogenCodeStub  {
  public:
-  Handle<Type> GetType(Isolate* isolate, Handle<Map> map = Handle<Map>());
-  Handle<Type> GetInputType(Isolate* isolate, Handle<Map> map);
+  Type* GetType(Zone* zone, Handle<Map> map = Handle<Map>());
+  Type* GetInputType(Zone* zone, Handle<Map> map);
 
   explicit CompareNilICStub(NilValue nil) : nil_value_(nil) { }
 
@@ -2062,7 +2062,7 @@
 
   // Parameters accessed via CodeStubGraphBuilder::GetParameter()
   static const int kConstructor = 0;
-  static const int kPropertyCell = 1;
+  static const int kAllocationSite = 1;
 
  protected:
   void BasePrintName(const char* name, StringStream* stream);
diff --git a/src/codegen.cc b/src/codegen.cc
index adb47b8..13ce221 100644
--- a/src/codegen.cc
+++ b/src/codegen.cc
@@ -89,12 +89,12 @@
 #ifdef DEBUG
   if (!info->IsStub() && print_source) {
     PrintF("--- Source from AST ---\n%s\n",
-           PrettyPrinter(info->isolate()).PrintProgram(info->function()));
+           PrettyPrinter(info->zone()).PrintProgram(info->function()));
   }
 
   if (!info->IsStub() && print_ast) {
     PrintF("--- AST ---\n%s\n",
-           AstPrinter(info->isolate()).PrintProgram(info->function()));
+           AstPrinter(info->zone()).PrintProgram(info->function()));
   }
 #endif  // DEBUG
 }
diff --git a/src/effects.h b/src/effects.h
index afb8f9e..5d980f5 100644
--- a/src/effects.h
+++ b/src/effects.h
@@ -59,24 +59,24 @@
   Effect(Bounds b, Modality m = DEFINITE) : modality(m), bounds(b) {}
 
   // The unknown effect.
-  static Effect Unknown(Isolate* isolate) {
-    return Effect(Bounds::Unbounded(isolate), POSSIBLE);
+  static Effect Unknown(Zone* zone) {
+    return Effect(Bounds::Unbounded(zone), POSSIBLE);
   }
 
-  static Effect Forget(Isolate* isolate) {
-    return Effect(Bounds::Unbounded(isolate), DEFINITE);
+  static Effect Forget(Zone* zone) {
+    return Effect(Bounds::Unbounded(zone), DEFINITE);
   }
 
   // Sequential composition, as in 'e1; e2'.
-  static Effect Seq(Effect e1, Effect e2, Isolate* isolate) {
+  static Effect Seq(Effect e1, Effect e2, Zone* zone) {
     if (e2.modality == DEFINITE) return e2;
-    return Effect(Bounds::Either(e1.bounds, e2.bounds, isolate), e1.modality);
+    return Effect(Bounds::Either(e1.bounds, e2.bounds, zone), e1.modality);
   }
 
   // Alternative composition, as in 'cond ? e1 : e2'.
-  static Effect Alt(Effect e1, Effect e2, Isolate* isolate) {
+  static Effect Alt(Effect e1, Effect e2, Zone* zone) {
     return Effect(
-        Bounds::Either(e1.bounds, e2.bounds, isolate),
+        Bounds::Either(e1.bounds, e2.bounds, zone),
         e1.modality == POSSIBLE ? POSSIBLE : e2.modality);
   }
 };
@@ -106,20 +106,20 @@
   Effect Lookup(Var var) {
     Locator locator;
     return this->Find(var, &locator)
-        ? locator.value() : Effect::Unknown(Base::isolate());
+        ? locator.value() : Effect::Unknown(Base::zone());
   }
 
   Bounds LookupBounds(Var var) {
     Effect effect = Lookup(var);
     return effect.modality == Effect::DEFINITE
-        ? effect.bounds : Bounds::Unbounded(Base::isolate());
+        ? effect.bounds : Bounds::Unbounded(Base::zone());
   }
 
   // Sequential composition.
   void Seq(Var var, Effect effect) {
     Locator locator;
     if (!this->Insert(var, &locator)) {
-      effect = Effect::Seq(locator.value(), effect, Base::isolate());
+      effect = Effect::Seq(locator.value(), effect, Base::zone());
     }
     locator.set_value(effect);
   }
@@ -133,7 +133,7 @@
   void Alt(Var var, Effect effect) {
     Locator locator;
     if (!this->Insert(var, &locator)) {
-      effect = Effect::Alt(locator.value(), effect, Base::isolate());
+      effect = Effect::Alt(locator.value(), effect, Base::zone());
     }
     locator.set_value(effect);
   }
@@ -148,7 +148,7 @@
   // Invalidation.
   void Forget() {
     Overrider override = {
-        Effect::Forget(Base::isolate()), Effects(Base::zone()) };
+        Effect::Forget(Base::zone()), Effects(Base::zone()) };
     this->ForEach(&override);
     Seq(override.effects);
   }
@@ -206,7 +206,6 @@
       EffectsMixin<Var, NestedEffectsBase<Var, kNoVar>, Effects<Var, kNoVar> >;
 
   Zone* zone() { return map_->allocator().zone(); }
-  Isolate* isolate() { return zone()->isolate(); }
 
   struct SplayTreeConfig {
     typedef Var Key;
@@ -277,7 +276,6 @@
   typedef typename EffectsBase<Var, kNoVar>::Locator Locator;
 
   Zone* zone() { return node_->zone; }
-  Isolate* isolate() { return zone()->isolate(); }
 
   void push() { node_ = new(node_->zone) Node(node_->zone, node_); }
   void pop() { node_ = node_->previous; }
diff --git a/src/full-codegen.cc b/src/full-codegen.cc
index ec25b23..cbf013e 100644
--- a/src/full-codegen.cc
+++ b/src/full-codegen.cc
@@ -421,7 +421,7 @@
                          !Snapshot::HaveASnapshotToStartFrom();
   masm_->set_emit_debug_code(generate_debug_code_);
   masm_->set_predictable_code_size(true);
-  InitializeAstVisitor(info_->isolate());
+  InitializeAstVisitor(info_->zone());
 }
 
 
@@ -847,7 +847,7 @@
   } else {
     // Check if the statement will be breakable without adding a debug break
     // slot.
-    BreakableStatementChecker checker(isolate());
+    BreakableStatementChecker checker(zone());
     checker.Check(stmt);
     // Record the statement position right here if the statement is not
     // breakable. For breakable statements the actual recording of the
@@ -873,7 +873,7 @@
   } else {
     // Check if the expression will be breakable without adding a debug break
     // slot.
-    BreakableStatementChecker checker(isolate());
+    BreakableStatementChecker checker(zone());
     checker.Check(expr);
     // Record a statement position right here if the expression is not
     // breakable. For breakable expressions the actual recording of the
diff --git a/src/full-codegen.h b/src/full-codegen.h
index 12f355a..5aa0a09 100644
--- a/src/full-codegen.h
+++ b/src/full-codegen.h
@@ -52,8 +52,8 @@
 // debugger to piggybag on.
 class BreakableStatementChecker: public AstVisitor {
  public:
-  explicit BreakableStatementChecker(Isolate* isolate) : is_breakable_(false) {
-    InitializeAstVisitor(isolate);
+  explicit BreakableStatementChecker(Zone* zone) : is_breakable_(false) {
+    InitializeAstVisitor(zone);
   }
 
   void Check(Statement* stmt);
@@ -99,8 +99,7 @@
         type_feedback_cells_(info->HasDeoptimizationSupport()
                              ? info->function()->ast_node_count() : 0,
                              info->zone()),
-        ic_total_count_(0),
-        zone_(info->zone()) {
+        ic_total_count_(0) {
     Initialize();
   }
 
@@ -122,8 +121,6 @@
     return NULL;
   }
 
-  Zone* zone() const { return zone_; }
-
   static const int kMaxBackEdgeWeight = 127;
 
   // Platform-specific code size multiplier.
@@ -853,7 +850,6 @@
   Handle<FixedArray> handler_table_;
   Handle<Cell> profiling_counter_;
   bool generate_debug_code_;
-  Zone* zone_;
 
   friend class NestedStatement;
 
diff --git a/src/heap.cc b/src/heap.cc
index 9cd6e95..de91288 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -1986,7 +1986,6 @@
 
 
 void Heap::ResetAllAllocationSitesDependentCode(PretenureFlag flag) {
-  ASSERT(AllowCodeDependencyChange::IsAllowed());
   DisallowHeapAllocation no_allocation_scope;
   Object* cur = allocation_sites_list();
   bool marked = false;
@@ -2980,7 +2979,7 @@
   cell->set_dependent_code(DependentCode::cast(empty_fixed_array()),
                            SKIP_WRITE_BARRIER);
   cell->set_value(the_hole_value());
-  cell->set_type(Type::None());
+  cell->set_type(HeapType::None());
   return result;
 }
 
@@ -6531,6 +6530,8 @@
 
   store_buffer()->SetUp();
 
+  mark_compact_collector()->SetUp();
+
   if (FLAG_concurrent_recompilation) relocation_mutex_ = new Mutex;
 
   return true;
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 63b6da7..0780385 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1557,8 +1557,7 @@
 }
 
 
-HValue* HGraphBuilder::BuildNumberToString(HValue* object,
-                                           Handle<Type> type) {
+HValue* HGraphBuilder::BuildNumberToString(HValue* object, Type* type) {
   NoObservableSideEffectsScope scope(this);
 
   // Convert constant numbers at compile time.
@@ -2584,7 +2583,7 @@
 
 void HGraphBuilder::BuildCompareNil(
     HValue* value,
-    Handle<Type> type,
+    Type* type,
     HIfContinuation* continuation) {
   IfBuilder if_nil(this);
   bool some_case_handled = false;
@@ -2902,7 +2901,7 @@
   // constructor for the initial state relies on function_state_ == NULL
   // to know it's the initial state.
   function_state_= &initial_function_state_;
-  InitializeAstVisitor(info->isolate());
+  InitializeAstVisitor(info->zone());
   if (FLAG_emit_opt_code_positions) {
     SetSourcePosition(info->shared_info()->start_position());
   }
@@ -4233,7 +4232,7 @@
   CHECK_ALIVE(VisitForValue(stmt->tag()));
   Add<HSimulate>(stmt->EntryId());
   HValue* tag_value = Top();
-  Handle<Type> tag_type = stmt->tag()->bounds().lower;
+  Type* tag_type = stmt->tag()->bounds().lower;
 
   // 1. Build all the tests, with dangling true branches
   BailoutId default_id = BailoutId::None();
@@ -4249,8 +4248,8 @@
     CHECK_ALIVE(VisitForValue(clause->label()));
     HValue* label_value = Pop();
 
-    Handle<Type> label_type = clause->label()->bounds().lower;
-    Handle<Type> combined_type = clause->compare_type();
+    Type* label_type = clause->label()->bounds().lower;
+    Type* combined_type = clause->compare_type();
     HControlInstruction* compare = BuildCompareInstruction(
         Token::EQ_STRICT, tag_value, label_value, tag_type, label_type,
         combined_type, stmt->tag()->position(), clause->label()->position(),
@@ -8543,8 +8542,7 @@
     bool returns_original_input,
     CountOperation* expr) {
   // The input to the count operation is on top of the expression stack.
-  Handle<Type> info = expr->type();
-  Representation rep = Representation::FromType(info);
+  Representation rep = Representation::FromType(expr->type());
   if (rep.IsNone() || rep.IsTagged()) {
     rep = Representation::Smi();
   }
@@ -8795,7 +8793,7 @@
 
 
 HValue* HGraphBuilder::EnforceNumberType(HValue* number,
-                                         Handle<Type> expected) {
+                                         Type* expected) {
   if (expected->Is(Type::Smi())) {
     return AddUncasted<HForceRepresentation>(number, Representation::Smi());
   }
@@ -8807,12 +8805,12 @@
 }
 
 
-HValue* HGraphBuilder::TruncateToNumber(HValue* value, Handle<Type>* expected) {
+HValue* HGraphBuilder::TruncateToNumber(HValue* value, Type** expected) {
   if (value->IsConstant()) {
     HConstant* constant = HConstant::cast(value);
     Maybe<HConstant*> number = constant->CopyToTruncatedNumber(zone());
     if (number.has_value) {
-      *expected = Type::Number(isolate());
+      *expected = Type::Number(zone());
       return AddInstruction(number.value);
     }
   }
@@ -8822,25 +8820,24 @@
   // pushes with a NoObservableSideEffectsScope.
   NoObservableSideEffectsScope no_effects(this);
 
-  Handle<Type> expected_type = *expected;
+  Type* expected_type = *expected;
 
   // Separate the number type from the rest.
-  Handle<Type> expected_obj = Type::Intersect(
-      expected_type, Type::NonNumber(isolate()), isolate());
-  Handle<Type> expected_number = Type::Intersect(
-      expected_type, Type::Number(isolate()), isolate());
+  Type* expected_obj =
+      Type::Intersect(expected_type, Type::NonNumber(zone()), zone());
+  Type* expected_number =
+      Type::Intersect(expected_type, Type::Number(zone()), zone());
 
   // We expect to get a number.
   // (We need to check first, since Type::None->Is(Type::Any()) == true.
   if (expected_obj->Is(Type::None())) {
-    ASSERT(!expected_number->Is(Type::None()));
+    ASSERT(!expected_number->Is(Type::None(zone())));
     return value;
   }
 
-  if (expected_obj->Is(Type::Undefined())) {
+  if (expected_obj->Is(Type::Undefined(zone()))) {
     // This is already done by HChange.
-    *expected = Type::Union(
-          expected_number, Type::Double(isolate()), isolate());
+    *expected = Type::Union(expected_number, Type::Double(zone()), zone());
     return value;
   }
 
@@ -8852,9 +8849,9 @@
     BinaryOperation* expr,
     HValue* left,
     HValue* right) {
-  Handle<Type> left_type = expr->left()->bounds().lower;
-  Handle<Type> right_type = expr->right()->bounds().lower;
-  Handle<Type> result_type = expr->bounds().lower;
+  Type* left_type = expr->left()->bounds().lower;
+  Type* right_type = expr->right()->bounds().lower;
+  Type* result_type = expr->bounds().lower;
   Maybe<int> fixed_right_arg = expr->fixed_right_arg();
   Handle<AllocationSite> allocation_site = expr->allocation_site();
 
@@ -8884,9 +8881,9 @@
     Token::Value op,
     HValue* left,
     HValue* right,
-    Handle<Type> left_type,
-    Handle<Type> right_type,
-    Handle<Type> result_type,
+    Type* left_type,
+    Type* right_type,
+    Type* result_type,
     Maybe<int> fixed_right_arg,
     HAllocationMode allocation_mode) {
 
@@ -8902,7 +8899,7 @@
                      Deoptimizer::SOFT);
     // TODO(rossberg): we should be able to get rid of non-continuous
     // defaults.
-    left_type = Type::Any(isolate());
+    left_type = Type::Any(zone());
   } else {
     if (!maybe_string_add) left = TruncateToNumber(left, &left_type);
     left_rep = Representation::FromType(left_type);
@@ -8911,7 +8908,7 @@
   if (right_type->Is(Type::None())) {
     Add<HDeoptimize>("Insufficient type feedback for RHS of binary operation",
                      Deoptimizer::SOFT);
-    right_type = Type::Any(isolate());
+    right_type = Type::Any(zone());
   } else {
     if (!maybe_string_add) right = TruncateToNumber(right, &right_type);
     right_rep = Representation::FromType(right_type);
@@ -9319,9 +9316,9 @@
     return ast_context()->ReturnControl(instr, expr->id());
   }
 
-  Handle<Type> left_type = expr->left()->bounds().lower;
-  Handle<Type> right_type = expr->right()->bounds().lower;
-  Handle<Type> combined_type = expr->combined_type();
+  Type* left_type = expr->left()->bounds().lower;
+  Type* right_type = expr->right()->bounds().lower;
+  Type* combined_type = expr->combined_type();
 
   CHECK_ALIVE(VisitForValue(expr->left()));
   CHECK_ALIVE(VisitForValue(expr->right()));
@@ -9398,9 +9395,9 @@
     Token::Value op,
     HValue* left,
     HValue* right,
-    Handle<Type> left_type,
-    Handle<Type> right_type,
-    Handle<Type> combined_type,
+    Type* left_type,
+    Type* right_type,
+    Type* combined_type,
     int left_position,
     int right_position,
     BailoutId bailout_id) {
@@ -9410,7 +9407,7 @@
     Add<HDeoptimize>("Insufficient type feedback for combined type "
                      "of binary operation",
                      Deoptimizer::SOFT);
-    combined_type = left_type = right_type = Type::Any(isolate());
+    combined_type = left_type = right_type = Type::Any(zone());
   }
 
   Representation left_rep = Representation::FromType(left_type);
@@ -9506,8 +9503,8 @@
     return ast_context()->ReturnControl(instr, expr->id());
   } else {
     ASSERT_EQ(Token::EQ, expr->op());
-    Handle<Type> type = expr->combined_type()->Is(Type::None())
-        ? Type::Any(isolate_) : expr->combined_type();
+    Type* type = expr->combined_type()->Is(Type::None())
+        ? Type::Any(zone()) : expr->combined_type();
     HIfContinuation continuation;
     BuildCompareNil(value, type, &continuation);
     return ast_context()->ReturnContinuation(&continuation, expr->id());
@@ -10277,7 +10274,7 @@
   ASSERT_EQ(1, call->arguments()->length());
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   HValue* number = Pop();
-  HValue* result = BuildNumberToString(number, Type::Number(isolate()));
+  HValue* result = BuildNumberToString(number, Type::Any(zone()));
   return ast_context()->ReturnValue(result);
 }
 
diff --git a/src/hydrogen.h b/src/hydrogen.h
index 643074c..d7579c4 100644
--- a/src/hydrogen.h
+++ b/src/hydrogen.h
@@ -1306,7 +1306,7 @@
                                    ElementsKind to_kind,
                                    bool is_jsarray);
 
-  HValue* BuildNumberToString(HValue* object, Handle<Type> type);
+  HValue* BuildNumberToString(HValue* object, Type* type);
 
   HValue* BuildUncheckedDictionaryElementLoad(HValue* receiver,
                                               HValue* key);
@@ -1386,9 +1386,9 @@
   HValue* BuildBinaryOperation(Token::Value op,
                                HValue* left,
                                HValue* right,
-                               Handle<Type> left_type,
-                               Handle<Type> right_type,
-                               Handle<Type> result_type,
+                               Type* left_type,
+                               Type* right_type,
+                               Type* result_type,
                                Maybe<int> fixed_right_arg,
                                HAllocationMode allocation_mode);
 
@@ -1396,8 +1396,8 @@
 
   HValue* AddLoadJSBuiltin(Builtins::JavaScript builtin);
 
-  HValue* EnforceNumberType(HValue* number, Handle<Type> expected);
-  HValue* TruncateToNumber(HValue* value, Handle<Type>* expected);
+  HValue* EnforceNumberType(HValue* number, Type* expected);
+  HValue* TruncateToNumber(HValue* value, Type** expected);
 
   void FinishExitWithHardDeoptimization(const char* reason,
                                         HBasicBlock* continuation);
@@ -1753,7 +1753,7 @@
 
   void BuildCompareNil(
       HValue* value,
-      Handle<Type> type,
+      Type* type,
       HIfContinuation* continuation);
 
   void BuildCreateAllocationMemento(HValue* previous_object,
@@ -2368,9 +2368,9 @@
   HControlInstruction* BuildCompareInstruction(Token::Value op,
                                                HValue* left,
                                                HValue* right,
-                                               Handle<Type> left_type,
-                                               Handle<Type> right_type,
-                                               Handle<Type> combined_type,
+                                               Type* left_type,
+                                               Type* right_type,
+                                               Type* combined_type,
                                                int left_position,
                                                int right_position,
                                                BailoutId bailout_id);
diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
index f64e110..a2e6855 100644
--- a/src/ia32/code-stubs-ia32.cc
+++ b/src/ia32/code-stubs-ia32.cc
@@ -191,7 +191,7 @@
   // register state
   // eax -- number of arguments
   // edi -- function
-  // ebx -- type info cell with elements kind
+  // ebx -- allocation site with elements kind
   static Register registers_variable_args[] = { edi, ebx, eax };
   static Register registers_no_args[] = { edi, ebx };
 
@@ -5623,7 +5623,7 @@
 
 static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
                                            AllocationSiteOverrideMode mode) {
-  // ebx - type info cell (if mode != DISABLE_ALLOCATION_SITES)
+  // ebx - allocation site (if mode != DISABLE_ALLOCATION_SITES)
   // edx - kind (if mode != DISABLE_ALLOCATION_SITES)
   // eax - number of arguments
   // edi - constructor?
@@ -5664,19 +5664,19 @@
     // We are going to create a holey array, but our kind is non-holey.
     // Fix kind and retry.
     __ inc(edx);
-    __ mov(ecx, FieldOperand(ebx, Cell::kValueOffset));
+
     if (FLAG_debug_code) {
       Handle<Map> allocation_site_map =
           masm->isolate()->factory()->allocation_site_map();
-      __ cmp(FieldOperand(ecx, 0), Immediate(allocation_site_map));
-      __ Assert(equal, kExpectedAllocationSiteInCell);
+      __ cmp(FieldOperand(ebx, 0), Immediate(allocation_site_map));
+      __ Assert(equal, kExpectedAllocationSite);
     }
 
     // Save the resulting elements kind in type info. We can't just store r3
     // in the AllocationSite::transition_info field because elements kind is
     // restricted to a portion of the field...upper bits need to be left alone.
     STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ add(FieldOperand(ecx, AllocationSite::kTransitionInfoOffset),
+    __ add(FieldOperand(ebx, AllocationSite::kTransitionInfoOffset),
            Immediate(Smi::FromInt(kFastElementsKindPackedToHoley)));
 
     __ bind(&normal_sequence);
@@ -5808,13 +5808,13 @@
   // AllocationSite, call an array constructor that doesn't use AllocationSites.
   __ cmp(ebx, Immediate(undefined_sentinel));
   __ j(equal, &no_info);
-  __ mov(edx, FieldOperand(ebx, Cell::kValueOffset));
-  __ cmp(FieldOperand(edx, 0), Immediate(
+  __ mov(ebx, FieldOperand(ebx, Cell::kValueOffset));
+  __ cmp(FieldOperand(ebx, 0), Immediate(
       masm->isolate()->factory()->allocation_site_map()));
   __ j(not_equal, &no_info);
 
   // Only look at the lower 16 bits of the transition info.
-  __ mov(edx, FieldOperand(edx, AllocationSite::kTransitionInfoOffset));
+  __ mov(edx, FieldOperand(ebx, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(edx);
   STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
   __ and_(edx, Immediate(AllocationSite::ElementsKindBits::kMask));
diff --git a/src/ia32/macro-assembler-ia32.cc b/src/ia32/macro-assembler-ia32.cc
index 56a6e0e..2e00980 100644
--- a/src/ia32/macro-assembler-ia32.cc
+++ b/src/ia32/macro-assembler-ia32.cc
@@ -3585,10 +3585,16 @@
 
   // Check that there are no elements. Register rcx contains the current JS
   // object we've reached through the prototype chain.
+  Label no_elements;
   mov(ecx, FieldOperand(ecx, JSObject::kElementsOffset));
   cmp(ecx, isolate()->factory()->empty_fixed_array());
+  j(equal, &no_elements);
+
+  // Second chance, the object may be using the empty slow element dictionary.
+  cmp(ecx, isolate()->factory()->empty_slow_element_dictionary());
   j(not_equal, call_runtime);
 
+  bind(&no_elements);
   mov(ecx, FieldOperand(ebx, Map::kPrototypeOffset));
   cmp(ecx, isolate()->factory()->null_value());
   j(not_equal, &next);
diff --git a/src/ia32/stub-cache-ia32.cc b/src/ia32/stub-cache-ia32.cc
index c60a377..584d064 100644
--- a/src/ia32/stub-cache-ia32.cc
+++ b/src/ia32/stub-cache-ia32.cc
@@ -1183,7 +1183,7 @@
 #define __ ACCESS_MASM(masm())
 
 
-Register StubCompiler::CheckPrototypes(Handle<Type> type,
+Register StubCompiler::CheckPrototypes(Handle<HeapType> type,
                                        Register object_reg,
                                        Handle<JSObject> holder,
                                        Register holder_reg,
@@ -1331,7 +1331,7 @@
 
 
 Register LoadStubCompiler::CallbackHandlerFrontend(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Register object_reg,
     Handle<JSObject> holder,
     Handle<Name> name,
@@ -2108,7 +2108,7 @@
 }
 
 
-Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<Type> type,
+Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<HeapType> type,
                                                       Handle<JSObject> last,
                                                       Handle<Name> name) {
   NonexistentHandlerFrontend(type, last, name);
@@ -2186,7 +2186,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadGlobal(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<GlobalObject> global,
     Handle<PropertyCell> cell,
     Handle<Name> name,
@@ -2246,12 +2246,12 @@
   int receiver_count = types->length();
   int number_of_handled_maps = 0;
   for (int current = 0; current < receiver_count; ++current) {
-    Handle<Type> type = types->at(current);
+    Handle<HeapType> type = types->at(current);
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
       __ cmp(map_reg, map);
-      if (type->Is(Type::Number())) {
+      if (type->Is(HeapType::Number())) {
         ASSERT(!number_case.is_unused());
         __ bind(&number_case);
       }
diff --git a/src/ic-inl.h b/src/ic-inl.h
index 24a939d..e0f807c 100644
--- a/src/ic-inl.h
+++ b/src/ic-inl.h
@@ -111,8 +111,8 @@
 
 
 HeapObject* IC::GetCodeCacheHolder(Isolate* isolate,
-                                 Object* object,
-                                 InlineCacheHolderFlag holder) {
+                                   Object* object,
+                                   InlineCacheHolderFlag holder) {
   if (object->IsSmi()) holder = PROTOTYPE_MAP;
   Object* map_owner = holder == OWN_MAP
       ? object : object->GetPrototype(isolate);
@@ -120,11 +120,11 @@
 }
 
 
-InlineCacheHolderFlag IC::GetCodeCacheFlag(Type* type) {
-  if (type->Is(Type::Boolean()) ||
-      type->Is(Type::Number()) ||
-      type->Is(Type::String()) ||
-      type->Is(Type::Symbol())) {
+InlineCacheHolderFlag IC::GetCodeCacheFlag(HeapType* type) {
+  if (type->Is(HeapType::Boolean()) ||
+      type->Is(HeapType::Number()) ||
+      type->Is(HeapType::String()) ||
+      type->Is(HeapType::Symbol())) {
     return PROTOTYPE_MAP;
   }
   return OWN_MAP;
@@ -132,19 +132,19 @@
 
 
 Handle<Map> IC::GetCodeCacheHolder(InlineCacheHolderFlag flag,
-                                   Type* type,
+                                   HeapType* type,
                                    Isolate* isolate) {
   if (flag == PROTOTYPE_MAP) {
     Context* context = isolate->context()->native_context();
     JSFunction* constructor;
-    if (type->Is(Type::Boolean())) {
+    if (type->Is(HeapType::Boolean())) {
       constructor = context->boolean_function();
-    } else if (type->Is(Type::Number())) {
+    } else if (type->Is(HeapType::Number())) {
       constructor = context->number_function();
-    } else if (type->Is(Type::String())) {
+    } else if (type->Is(HeapType::String())) {
       constructor = context->string_function();
     } else {
-      ASSERT(type->Is(Type::Symbol()));
+      ASSERT(type->Is(HeapType::Symbol()));
       constructor = context->symbol_function();
     }
     return handle(JSObject::cast(constructor->instance_prototype())->map());
diff --git a/src/ic.cc b/src/ic.cc
index 20a714d..b465757 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -898,7 +898,7 @@
 }
 
 
-bool IC::UpdatePolymorphicIC(Handle<Type> type,
+bool IC::UpdatePolymorphicIC(Handle<HeapType> type,
                              Handle<String> name,
                              Handle<Code> code) {
   if (!code->is_handler()) return false;
@@ -913,7 +913,7 @@
   number_of_valid_types = number_of_types;
 
   for (int i = 0; i < number_of_types; i++) {
-    Handle<Type> current_type = types.at(i);
+    Handle<HeapType> current_type = types.at(i);
     // Filter out deprecated maps to ensure their instances get migrated.
     if (current_type->IsClass() && current_type->AsClass()->is_deprecated()) {
       number_of_valid_types--;
@@ -946,16 +946,17 @@
 }
 
 
-Handle<Type> IC::CurrentTypeOf(Handle<Object> object, Isolate* isolate) {
+Handle<HeapType> IC::CurrentTypeOf(Handle<Object> object, Isolate* isolate) {
   return object->IsJSGlobalObject()
-      ? Type::Constant(Handle<JSGlobalObject>::cast(object), isolate)
-      : Type::OfCurrently(object, isolate);
+      ? HeapType::Constant(Handle<JSGlobalObject>::cast(object), isolate)
+      : HeapType::OfCurrently(object, isolate);
 }
 
 
-Handle<Map> IC::TypeToMap(Type* type, Isolate* isolate) {
-  if (type->Is(Type::Number())) return isolate->factory()->heap_number_map();
-  if (type->Is(Type::Boolean())) return isolate->factory()->oddball_map();
+Handle<Map> IC::TypeToMap(HeapType* type, Isolate* isolate) {
+  if (type->Is(HeapType::Number()))
+    return isolate->factory()->heap_number_map();
+  if (type->Is(HeapType::Boolean())) return isolate->factory()->oddball_map();
   if (type->IsConstant()) {
     return handle(Handle<JSGlobalObject>::cast(type->AsConstant())->map());
   }
@@ -964,16 +965,20 @@
 }
 
 
-Handle<Type> IC::MapToType(Handle<Map> map) {
+Handle<HeapType> IC::MapToType(Handle<Map> map) {
   Isolate* isolate = map->GetIsolate();
-  if (map->instance_type() == HEAP_NUMBER_TYPE) return Type::Number(isolate);
-  // The only oddballs that can be recorded in ICs are booleans.
-  if (map->instance_type() == ODDBALL_TYPE) return Type::Boolean(isolate);
-  return Type::Class(map, isolate);
+  if (map->instance_type() == HEAP_NUMBER_TYPE) {
+    return HeapType::Number(isolate);
+  } else if (map->instance_type() == ODDBALL_TYPE) {
+    // The only oddballs that can be recorded in ICs are booleans.
+    return HeapType::Boolean(isolate);
+  } else {
+    return HeapType::Class(map, isolate);
+  }
 }
 
 
-void IC::UpdateMonomorphicIC(Handle<Type> type,
+void IC::UpdateMonomorphicIC(Handle<HeapType> type,
                              Handle<Code> handler,
                              Handle<String> name) {
   if (!handler->is_handler()) return set_target(*handler);
@@ -994,7 +999,7 @@
 }
 
 
-bool IC::IsTransitionOfMonomorphicTarget(Handle<Type> type) {
+bool IC::IsTransitionOfMonomorphicTarget(Handle<HeapType> type) {
   if (!type->IsClass()) return false;
   Map* receiver_map = *type->AsClass();
   Map* current_map = target()->FindFirstMap();
@@ -1010,7 +1015,7 @@
 }
 
 
-void IC::PatchCache(Handle<Type> type,
+void IC::PatchCache(Handle<HeapType> type,
                     Handle<String> name,
                     Handle<Code> code) {
   switch (state()) {
@@ -1096,7 +1101,7 @@
     return;
   }
 
-  Handle<Type> type = CurrentTypeOf(object, isolate());
+  Handle<HeapType> type = CurrentTypeOf(object, isolate());
   Handle<Code> code;
   if (!lookup->IsCacheable()) {
     // Bail out if the result is not cacheable.
@@ -1116,7 +1121,7 @@
 }
 
 
-void IC::UpdateMegamorphicCache(Type* type, Name* name, Code* code) {
+void IC::UpdateMegamorphicCache(HeapType* type, Name* name, Code* code) {
   // Cache code holding map should be consistent with
   // GenerateMonomorphicCacheProbe.
   Map* map = *TypeToMap(type, isolate());
@@ -1157,7 +1162,7 @@
     return SimpleFieldLoad(length_index);
   }
 
-  Handle<Type> type = CurrentTypeOf(object, isolate());
+  Handle<HeapType> type = CurrentTypeOf(object, isolate());
   Handle<JSObject> holder(lookup->holder());
   LoadStubCompiler compiler(isolate(), kNoExtraICState, cache_holder, kind());
 
@@ -1629,7 +1634,7 @@
         // global object.
         Handle<GlobalObject> global = Handle<GlobalObject>::cast(receiver);
         Handle<PropertyCell> cell(global->GetPropertyCell(lookup), isolate());
-        Handle<Type> union_type = PropertyCell::UpdatedType(cell, value);
+        Handle<HeapType> union_type = PropertyCell::UpdatedType(cell, value);
         StoreGlobalStub stub(union_type->IsConstant());
 
         Handle<Code> code = stub.GetCodeCopyFromTemplate(
@@ -2563,17 +2568,17 @@
 }
 
 
-Handle<Type> BinaryOpIC::State::GetResultType(Isolate* isolate) const {
+Type* BinaryOpIC::State::GetResultType(Zone* zone) const {
   Kind result_kind = result_kind_;
   if (HasSideEffects()) {
     result_kind = NONE;
   } else if (result_kind == GENERIC && op_ == Token::ADD) {
-    return Type::Union(Type::Number(isolate), Type::String(isolate), isolate);
+    return Type::Union(Type::Number(zone), Type::String(zone), zone);
   } else if (result_kind == NUMBER && op_ == Token::SHR) {
-    return Type::Unsigned32(isolate);
+    return Type::Unsigned32(zone);
   }
   ASSERT_NE(GENERIC, result_kind);
-  return KindToType(result_kind, isolate);
+  return KindToType(result_kind, zone);
 }
 
 
@@ -2704,17 +2709,17 @@
 
 
 // static
-Handle<Type> BinaryOpIC::State::KindToType(Kind kind, Isolate* isolate) {
+Type* BinaryOpIC::State::KindToType(Kind kind, Zone* zone) {
   switch (kind) {
-    case NONE: return Type::None(isolate);
-    case SMI: return Type::Smi(isolate);
-    case INT32: return Type::Signed32(isolate);
-    case NUMBER: return Type::Number(isolate);
-    case STRING: return Type::String(isolate);
-    case GENERIC: return Type::Any(isolate);
+    case NONE: return Type::None(zone);
+    case SMI: return Type::Smi(zone);
+    case INT32: return Type::Signed32(zone);
+    case NUMBER: return Type::Number(zone);
+    case STRING: return Type::String(zone);
+    case GENERIC: return Type::Any(zone);
   }
   UNREACHABLE();
-  return Handle<Type>();
+  return NULL;
 }
 
 
@@ -2844,41 +2849,39 @@
 }
 
 
-Handle<Type> CompareIC::StateToType(
-    Isolate* isolate,
+Type* CompareIC::StateToType(
+    Zone* zone,
     CompareIC::State state,
     Handle<Map> map) {
   switch (state) {
-    case CompareIC::UNINITIALIZED: return Type::None(isolate);
-    case CompareIC::SMI: return Type::Smi(isolate);
-    case CompareIC::NUMBER: return Type::Number(isolate);
-    case CompareIC::STRING: return Type::String(isolate);
-    case CompareIC::INTERNALIZED_STRING:
-      return Type::InternalizedString(isolate);
-    case CompareIC::UNIQUE_NAME: return Type::UniqueName(isolate);
-    case CompareIC::OBJECT: return Type::Receiver(isolate);
+    case CompareIC::UNINITIALIZED: return Type::None(zone);
+    case CompareIC::SMI: return Type::Smi(zone);
+    case CompareIC::NUMBER: return Type::Number(zone);
+    case CompareIC::STRING: return Type::String(zone);
+    case CompareIC::INTERNALIZED_STRING: return Type::InternalizedString(zone);
+    case CompareIC::UNIQUE_NAME: return Type::UniqueName(zone);
+    case CompareIC::OBJECT: return Type::Receiver(zone);
     case CompareIC::KNOWN_OBJECT:
-      return map.is_null()
-          ? Type::Receiver(isolate) : Type::Class(map, isolate);
-    case CompareIC::GENERIC: return Type::Any(isolate);
+      return map.is_null() ? Type::Receiver(zone) : Type::Class(map, zone);
+    case CompareIC::GENERIC: return Type::Any(zone);
   }
   UNREACHABLE();
-  return Handle<Type>();
+  return NULL;
 }
 
 
 void CompareIC::StubInfoToType(int stub_minor_key,
-                               Handle<Type>* left_type,
-                               Handle<Type>* right_type,
-                               Handle<Type>* overall_type,
+                               Type** left_type,
+                               Type** right_type,
+                               Type** overall_type,
                                Handle<Map> map,
-                               Isolate* isolate) {
+                               Zone* zone) {
   State left_state, right_state, handler_state;
   ICCompareStub::DecodeMinorKey(stub_minor_key, &left_state, &right_state,
                                 &handler_state, NULL);
-  *left_type = StateToType(isolate, left_state);
-  *right_type = StateToType(isolate, right_state);
-  *overall_type = StateToType(isolate, handler_state, map);
+  *left_type = StateToType(zone, left_state);
+  *right_type = StateToType(zone, right_state);
+  *overall_type = StateToType(zone, handler_state, map);
 }
 
 
diff --git a/src/ic.h b/src/ic.h
index a253017..64098ea 100644
--- a/src/ic.h
+++ b/src/ic.h
@@ -130,9 +130,9 @@
                                                Object* object,
                                                InlineCacheHolderFlag holder);
 
-  static inline InlineCacheHolderFlag GetCodeCacheFlag(Type* type);
+  static inline InlineCacheHolderFlag GetCodeCacheFlag(HeapType* type);
   static inline Handle<Map> GetCodeCacheHolder(InlineCacheHolderFlag flag,
-                                               Type* type,
+                                               HeapType* type,
                                                Isolate* isolate);
 
   static bool IsCleared(Code* code) {
@@ -145,9 +145,10 @@
   // - The heap_number_map is used as a marker which includes heap numbers as
   //   well as smis.
   // - The oddball map is only used for booleans.
-  static Handle<Map> TypeToMap(Type* type, Isolate* isolate);
-  static Handle<Type> MapToType(Handle<Map> type);
-  static Handle<Type> CurrentTypeOf(Handle<Object> object, Isolate* isolate);
+  static Handle<Map> TypeToMap(HeapType* type, Isolate* isolate);
+  static Handle<HeapType> MapToType(Handle<Map> map);
+  static Handle<HeapType> CurrentTypeOf(
+      Handle<Object> object, Isolate* isolate);
 
  protected:
   // Get the call-site target; used for determining the state.
@@ -201,19 +202,19 @@
     return Handle<Code>::null();
   }
 
-  void UpdateMonomorphicIC(Handle<Type> type,
+  void UpdateMonomorphicIC(Handle<HeapType> type,
                            Handle<Code> handler,
                            Handle<String> name);
 
-  bool UpdatePolymorphicIC(Handle<Type> type,
+  bool UpdatePolymorphicIC(Handle<HeapType> type,
                            Handle<String> name,
                            Handle<Code> code);
 
-  virtual void UpdateMegamorphicCache(Type* type, Name* name, Code* code);
+  virtual void UpdateMegamorphicCache(HeapType* type, Name* name, Code* code);
 
   void CopyICToMegamorphicCache(Handle<String> name);
-  bool IsTransitionOfMonomorphicTarget(Handle<Type> type);
-  void PatchCache(Handle<Type> type,
+  bool IsTransitionOfMonomorphicTarget(Handle<HeapType> type);
+  void PatchCache(Handle<HeapType> type,
                   Handle<String> name,
                   Handle<Code> code);
   virtual Code::Kind kind() const {
@@ -536,7 +537,7 @@
     return isolate()->builtins()->KeyedLoadIC_Slow();
   }
 
-  virtual void UpdateMegamorphicCache(Type* type, Name* name, Code* code) { }
+  virtual void UpdateMegamorphicCache(HeapType* type, Name* name, Code* code) {}
 
  private:
   // Stub accessors.
@@ -708,7 +709,7 @@
  protected:
   virtual Code::Kind kind() const { return Code::KEYED_STORE_IC; }
 
-  virtual void UpdateMegamorphicCache(Type* type, Name* name, Code* code) { }
+  virtual void UpdateMegamorphicCache(HeapType* type, Name* name, Code* code) {}
 
   virtual Handle<Code> pre_monomorphic_stub() {
     return pre_monomorphic_stub(isolate(), strict_mode());
@@ -843,13 +844,13 @@
     OverwriteMode mode() const { return mode_; }
     Maybe<int> fixed_right_arg() const { return fixed_right_arg_; }
 
-    Handle<Type> GetLeftType(Isolate* isolate) const {
-      return KindToType(left_kind_, isolate);
+    Type* GetLeftType(Zone* zone) const {
+      return KindToType(left_kind_, zone);
     }
-    Handle<Type> GetRightType(Isolate* isolate) const {
-      return KindToType(right_kind_, isolate);
+    Type* GetRightType(Zone* zone) const {
+      return KindToType(right_kind_, zone);
     }
-    Handle<Type> GetResultType(Isolate* isolate) const;
+    Type* GetResultType(Zone* zone) const;
 
     void Print(StringStream* stream) const;
 
@@ -863,7 +864,7 @@
     Kind UpdateKind(Handle<Object> object, Kind kind) const;
 
     static const char* KindToString(Kind kind);
-    static Handle<Type> KindToType(Kind kind, Isolate* isolate);
+    static Type* KindToType(Kind kind, Zone* zone);
     static bool KindMaybeSmi(Kind kind) {
       return (kind >= SMI && kind <= NUMBER) || kind == GENERIC;
     }
@@ -921,16 +922,16 @@
 
   static State NewInputState(State old_state, Handle<Object> value);
 
-  static Handle<Type> StateToType(Isolate* isolate,
-                                  State state,
-                                  Handle<Map> map = Handle<Map>());
+  static Type* StateToType(Zone* zone,
+                           State state,
+                           Handle<Map> map = Handle<Map>());
 
   static void StubInfoToType(int stub_minor_key,
-                             Handle<Type>* left_type,
-                             Handle<Type>* right_type,
-                             Handle<Type>* overall_type,
+                             Type** left_type,
+                             Type** right_type,
+                             Type** overall_type,
                              Handle<Map> map,
-                             Isolate* isolate);
+                             Zone* zone);
 
   CompareIC(Isolate* isolate, Token::Value op)
       : IC(EXTRA_CALL_FRAME, isolate), op_(op) { }
diff --git a/src/list-inl.h b/src/list-inl.h
index 143c830..a80aa67 100644
--- a/src/list-inl.h
+++ b/src/list-inl.h
@@ -166,6 +166,7 @@
 
 template<typename T, class P>
 void List<T, P>::Rewind(int pos) {
+  ASSERT(0 <= pos && pos <= length_);
   length_ = pos;
 }
 
diff --git a/src/list.h b/src/list.h
index e498ae1..65645c9 100644
--- a/src/list.h
+++ b/src/list.h
@@ -206,13 +206,13 @@
 class Map;
 template<class> class TypeImpl;
 struct HeapTypeConfig;
-typedef TypeImpl<HeapTypeConfig> Type;
+typedef TypeImpl<HeapTypeConfig> HeapType;
 class Code;
 template<typename T> class Handle;
 typedef List<Map*> MapList;
 typedef List<Code*> CodeList;
 typedef List<Handle<Map> > MapHandleList;
-typedef List<Handle<Type> > TypeHandleList;
+typedef List<Handle<HeapType> > TypeHandleList;
 typedef List<Handle<Code> > CodeHandleList;
 
 // Perform binary search for an element in an already sorted
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index 45642c1..e625ddf 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -348,6 +348,12 @@
 #endif
 
 
+void MarkCompactCollector::SetUp() {
+  free_list_old_data_space_.Reset(new FreeList(heap_->old_data_space()));
+  free_list_old_pointer_space_.Reset(new FreeList(heap_->old_pointer_space()));
+}
+
+
 void MarkCompactCollector::TearDown() {
   AbortCompaction();
 }
@@ -564,6 +570,11 @@
 
 
 void MarkCompactCollector::StartSweeperThreads() {
+  // TODO(hpayer): This check is just used for debugging purpose and
+  // should be removed or turned into an assert after investigating the
+  // crash in concurrent sweeping.
+  CHECK(free_list_old_pointer_space_.get()->IsEmpty());
+  CHECK(free_list_old_data_space_.get()->IsEmpty());
   sweeping_pending_ = true;
   for (int i = 0; i < isolate()->num_sweeper_threads(); i++) {
     isolate()->sweeper_threads()[i]->StartSweeping();
@@ -577,19 +588,27 @@
     isolate()->sweeper_threads()[i]->WaitForSweeperThread();
   }
   sweeping_pending_ = false;
-  StealMemoryFromSweeperThreads(heap()->paged_space(OLD_DATA_SPACE));
-  StealMemoryFromSweeperThreads(heap()->paged_space(OLD_POINTER_SPACE));
+  RefillFreeLists(heap()->paged_space(OLD_DATA_SPACE));
+  RefillFreeLists(heap()->paged_space(OLD_POINTER_SPACE));
   heap()->paged_space(OLD_DATA_SPACE)->ResetUnsweptFreeBytes();
   heap()->paged_space(OLD_POINTER_SPACE)->ResetUnsweptFreeBytes();
 }
 
 
-intptr_t MarkCompactCollector::
-             StealMemoryFromSweeperThreads(PagedSpace* space) {
-  intptr_t freed_bytes = 0;
-  for (int i = 0; i < isolate()->num_sweeper_threads(); i++) {
-    freed_bytes += isolate()->sweeper_threads()[i]->StealMemory(space);
+intptr_t MarkCompactCollector::RefillFreeLists(PagedSpace* space) {
+  FreeList* free_list;
+
+  if (space == heap()->old_pointer_space()) {
+    free_list = free_list_old_pointer_space_.get();
+  } else if (space == heap()->old_data_space()) {
+    free_list = free_list_old_data_space_.get();
+  } else {
+    // Any PagedSpace might invoke RefillFreeLists, so we need to make sure
+    // to only refill them for old data and pointer spaces.
+    return 0;
   }
+
+  intptr_t freed_bytes = space->free_list()->Concatenate(free_list);
   space->AddToAccountingStats(freed_bytes);
   space->DecrementUnsweptFreeBytes(freed_bytes);
   return freed_bytes;
@@ -3054,8 +3073,12 @@
   int npages = evacuation_candidates_.length();
   for (int i = 0; i < npages; i++) {
     Page* p = evacuation_candidates_[i];
-    ASSERT(p->IsEvacuationCandidate() ||
-           p->IsFlagSet(Page::RESCAN_ON_EVACUATION));
+    // TODO(hpayer): This check is just used for debugging purpose and
+    // should be removed or turned into an assert after investigating the
+    // crash in concurrent sweeping.
+    CHECK(p->IsEvacuationCandidate() ||
+          p->IsFlagSet(Page::RESCAN_ON_EVACUATION));
+    CHECK_EQ(static_cast<int>(p->parallel_sweeping()), 0);
     if (p->IsEvacuationCandidate()) {
       // During compaction we might have to request a new page.
       // Check that space still have room for that.
@@ -3886,7 +3909,10 @@
 intptr_t MarkCompactCollector::SweepConservatively(PagedSpace* space,
                                                    FreeList* free_list,
                                                    Page* p) {
-  ASSERT(!p->IsEvacuationCandidate() && !p->WasSwept());
+  // TODO(hpayer): This check is just used for debugging purpose and
+  // should be removed or turned into an assert after investigating the
+  // crash in concurrent sweeping.
+  CHECK(!p->IsEvacuationCandidate() && !p->WasSwept());
   ASSERT((mode == MarkCompactCollector::SWEEP_IN_PARALLEL &&
          free_list != NULL) ||
          (mode == MarkCompactCollector::SWEEP_SEQUENTIALLY &&
@@ -3970,16 +3996,18 @@
 }
 
 
-void MarkCompactCollector::SweepInParallel(PagedSpace* space,
-                                           FreeList* private_free_list,
-                                           FreeList* free_list) {
+void MarkCompactCollector::SweepInParallel(PagedSpace* space) {
   PageIterator it(space);
+  FreeList* free_list = space == heap()->old_pointer_space()
+                            ? free_list_old_pointer_space_.get()
+                            : free_list_old_data_space_.get();
+  FreeList private_free_list(space);
   while (it.has_next()) {
     Page* p = it.next();
 
     if (p->TryParallelSweeping()) {
-      SweepConservatively<SWEEP_IN_PARALLEL>(space, private_free_list, p);
-      free_list->Concatenate(private_free_list);
+      SweepConservatively<SWEEP_IN_PARALLEL>(space, &private_free_list, p);
+      free_list->Concatenate(&private_free_list);
     }
   }
 }
diff --git a/src/mark-compact.h b/src/mark-compact.h
index 01ecbf8..0773d02 100644
--- a/src/mark-compact.h
+++ b/src/mark-compact.h
@@ -571,6 +571,8 @@
 
   static void Initialize();
 
+  void SetUp();
+
   void TearDown();
 
   void CollectEvacuationCandidates(PagedSpace* space);
@@ -715,13 +717,11 @@
   MarkingParity marking_parity() { return marking_parity_; }
 
   // Concurrent and parallel sweeping support.
-  void SweepInParallel(PagedSpace* space,
-                       FreeList* private_free_list,
-                       FreeList* free_list);
+  void SweepInParallel(PagedSpace* space);
 
   void WaitUntilSweepingCompleted();
 
-  intptr_t StealMemoryFromSweeperThreads(PagedSpace* space);
+  intptr_t RefillFreeLists(PagedSpace* space);
 
   bool AreSweeperThreadsActivated();
 
@@ -957,6 +957,9 @@
   List<Page*> evacuation_candidates_;
   List<Code*> invalidated_code_;
 
+  SmartPointer<FreeList> free_list_old_data_space_;
+  SmartPointer<FreeList> free_list_old_pointer_space_;
+
   friend class Heap;
 };
 
diff --git a/src/mips/code-stubs-mips.cc b/src/mips/code-stubs-mips.cc
index d620c76..c7010c9 100644
--- a/src/mips/code-stubs-mips.cc
+++ b/src/mips/code-stubs-mips.cc
@@ -201,7 +201,7 @@
   // register state
   // a0 -- number of arguments
   // a1 -- function
-  // a2 -- type info cell with elements kind
+  // a2 -- allocation site with elements kind
   static Register registers_variable_args[] = { a1, a2, a0 };
   static Register registers_no_args[] = { a1, a2 };
 
@@ -5950,7 +5950,7 @@
 
 static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
                                            AllocationSiteOverrideMode mode) {
-  // a2 - type info cell (if mode != DISABLE_ALLOCATION_SITES)
+  // a2 - allocation site (if mode != DISABLE_ALLOCATION_SITES)
   // a3 - kind (if mode != DISABLE_ALLOCATION_SITES)
   // a0 - number of arguments
   // a1 - constructor?
@@ -5989,22 +5989,20 @@
     // We are going to create a holey array, but our kind is non-holey.
     // Fix kind and retry (only if we have an allocation site in the cell).
     __ Addu(a3, a3, Operand(1));
-    __ lw(t1, FieldMemOperand(a2, Cell::kValueOffset));
 
     if (FLAG_debug_code) {
-      __ lw(t1, FieldMemOperand(t1, 0));
+      __ lw(t1, FieldMemOperand(a2, 0));
       __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
-      __ Assert(eq, kExpectedAllocationSiteInCell, t1, Operand(at));
-      __ lw(t1, FieldMemOperand(a2, Cell::kValueOffset));
+      __ Assert(eq, kExpectedAllocationSite, t1, Operand(at));
     }
 
     // Save the resulting elements kind in type info. We can't just store a3
     // in the AllocationSite::transition_info field because elements kind is
     // restricted to a portion of the field...upper bits need to be left alone.
     STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ lw(t0, FieldMemOperand(t1, AllocationSite::kTransitionInfoOffset));
+    __ lw(t0, FieldMemOperand(a2, AllocationSite::kTransitionInfoOffset));
     __ Addu(t0, t0, Operand(Smi::FromInt(kFastElementsKindPackedToHoley)));
-    __ sw(t0, FieldMemOperand(t1, AllocationSite::kTransitionInfoOffset));
+    __ sw(t0, FieldMemOperand(a2, AllocationSite::kTransitionInfoOffset));
 
 
     __ bind(&normal_sequence);
@@ -6129,15 +6127,15 @@
   // Get the elements kind and case on that.
   __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
   __ Branch(&no_info, eq, a2, Operand(at));
-  __ lw(a3, FieldMemOperand(a2, Cell::kValueOffset));
+  __ lw(a2, FieldMemOperand(a2, Cell::kValueOffset));
 
   // If the type cell is undefined, or contains anything other than an
   // AllocationSite, call an array constructor that doesn't use AllocationSites.
-  __ lw(t0, FieldMemOperand(a3, 0));
+  __ lw(t0, FieldMemOperand(a2, 0));
   __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
   __ Branch(&no_info, ne, t0, Operand(at));
 
-  __ lw(a3, FieldMemOperand(a3, AllocationSite::kTransitionInfoOffset));
+  __ lw(a3, FieldMemOperand(a2, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(a3);
   STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
   __ And(a3, a3, Operand(AllocationSite::ElementsKindBits::kMask));
diff --git a/src/mips/codegen-mips.h b/src/mips/codegen-mips.h
index 822b94a..278b200 100644
--- a/src/mips/codegen-mips.h
+++ b/src/mips/codegen-mips.h
@@ -46,8 +46,8 @@
 
 class CodeGenerator: public AstVisitor {
  public:
-  explicit CodeGenerator(Isolate* isolate) {
-    InitializeAstVisitor(isolate);
+  explicit CodeGenerator(Zone* zone) {
+    InitializeAstVisitor(zone);
   }
 
   static bool MakeCode(CompilationInfo* info);
diff --git a/src/mips/macro-assembler-mips.cc b/src/mips/macro-assembler-mips.cc
index 8d85aed..dcc528f 100644
--- a/src/mips/macro-assembler-mips.cc
+++ b/src/mips/macro-assembler-mips.cc
@@ -5554,11 +5554,17 @@
 
   bind(&start);
 
-  // Check that there are no elements. Register r2 contains the current JS
+  // Check that there are no elements. Register a2 contains the current JS
   // object we've reached through the prototype chain.
+  Label no_elements;
   lw(a2, FieldMemOperand(a2, JSObject::kElementsOffset));
-  Branch(call_runtime, ne, a2, Operand(empty_fixed_array_value));
+  Branch(&no_elements, eq, a2, Operand(empty_fixed_array_value));
 
+  // Second chance, the object may be using the empty slow element dictionary.
+  LoadRoot(at, Heap::kEmptySlowElementDictionaryRootIndex);
+  Branch(call_runtime, ne, a2, Operand(at));
+
+  bind(&no_elements);
   lw(a2, FieldMemOperand(a1, Map::kPrototypeOffset));
   Branch(&next, ne, a2, Operand(null_value));
 }
diff --git a/src/mips/stub-cache-mips.cc b/src/mips/stub-cache-mips.cc
index 6632f94..e5cb200 100644
--- a/src/mips/stub-cache-mips.cc
+++ b/src/mips/stub-cache-mips.cc
@@ -1107,7 +1107,7 @@
 #define __ ACCESS_MASM(masm())
 
 
-Register StubCompiler::CheckPrototypes(Handle<Type> type,
+Register StubCompiler::CheckPrototypes(Handle<HeapType> type,
                                        Register object_reg,
                                        Handle<JSObject> holder,
                                        Register holder_reg,
@@ -1253,7 +1253,7 @@
 
 
 Register LoadStubCompiler::CallbackHandlerFrontend(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Register object_reg,
     Handle<JSObject> holder,
     Handle<Name> name,
@@ -1991,7 +1991,7 @@
 }
 
 
-Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<Type> type,
+Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<HeapType> type,
                                                       Handle<JSObject> last,
                                                       Handle<Name> name) {
   NonexistentHandlerFrontend(type, last, name);
@@ -2073,7 +2073,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadGlobal(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<GlobalObject> global,
     Handle<PropertyCell> cell,
     Handle<Name> name,
@@ -2127,11 +2127,11 @@
   int number_of_handled_maps = 0;
   __ lw(map_reg, FieldMemOperand(receiver(), HeapObject::kMapOffset));
   for (int current = 0; current < receiver_count; ++current) {
-    Handle<Type> type = types->at(current);
+    Handle<HeapType> type = types->at(current);
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
-      if (type->Is(Type::Number())) {
+      if (type->Is(HeapType::Number())) {
         ASSERT(!number_case.is_unused());
         __ bind(&number_case);
       }
diff --git a/src/objects.cc b/src/objects.cc
index 9c1a9cd..94bc427 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -7905,6 +7905,14 @@
 }
 
 
+void FixedArray::Shrink(int new_length) {
+  ASSERT(0 <= new_length && new_length <= length());
+  if (new_length < length()) {
+    RightTrimFixedArray<FROM_MUTATOR>(GetHeap(), this, length() - new_length);
+  }
+}
+
+
 MaybeObject* FixedArray::AddKeysFromJSArray(JSArray* array) {
   ElementsAccessor* accessor = array->GetElementsAccessor();
   MaybeObject* maybe_result =
@@ -11791,7 +11799,6 @@
 bool DependentCode::MarkCodeForDeoptimization(
     Isolate* isolate,
     DependentCode::DependencyGroup group) {
-  ASSERT(AllowCodeDependencyChange::IsAllowed());
   DisallowHeapAllocation no_allocation_scope;
   DependentCode::GroupStartIndexes starts(this);
   int start = starts.at(group);
@@ -16533,25 +16540,25 @@
 }
 
 
-Type* PropertyCell::type() {
-  return static_cast<Type*>(type_raw());
+HeapType* PropertyCell::type() {
+  return static_cast<HeapType*>(type_raw());
 }
 
 
-void PropertyCell::set_type(Type* type, WriteBarrierMode ignored) {
+void PropertyCell::set_type(HeapType* type, WriteBarrierMode ignored) {
   ASSERT(IsPropertyCell());
   set_type_raw(type, ignored);
 }
 
 
-Handle<Type> PropertyCell::UpdatedType(Handle<PropertyCell> cell,
-                                       Handle<Object> value) {
+Handle<HeapType> PropertyCell::UpdatedType(Handle<PropertyCell> cell,
+                                           Handle<Object> value) {
   Isolate* isolate = cell->GetIsolate();
-  Handle<Type> old_type(cell->type(), isolate);
+  Handle<HeapType> old_type(cell->type(), isolate);
   // TODO(2803): Do not track ConsString as constant because they cannot be
   // embedded into code.
-  Handle<Type> new_type = value->IsConsString() || value->IsTheHole()
-      ? Type::Any(isolate) : Type::Constant(value, isolate);
+  Handle<HeapType> new_type = value->IsConsString() || value->IsTheHole()
+      ? HeapType::Any(isolate) : HeapType::Constant(value, isolate);
 
   if (new_type->Is(old_type)) {
     return old_type;
@@ -16560,19 +16567,19 @@
   cell->dependent_code()->DeoptimizeDependentCodeGroup(
       isolate, DependentCode::kPropertyCellChangedGroup);
 
-  if (old_type->Is(Type::None()) || old_type->Is(Type::Undefined())) {
+  if (old_type->Is(HeapType::None()) || old_type->Is(HeapType::Undefined())) {
     return new_type;
   }
 
-  return Type::Any(isolate);
+  return HeapType::Any(isolate);
 }
 
 
 void PropertyCell::SetValueInferType(Handle<PropertyCell> cell,
                                      Handle<Object> value) {
   cell->set_value(*value);
-  if (!Type::Any()->Is(cell->type())) {
-    Handle<Type> new_type = UpdatedType(cell, value);
+  if (!HeapType::Any()->Is(cell->type())) {
+    Handle<HeapType> new_type = UpdatedType(cell, value);
     cell->set_type(*new_type);
   }
 }
diff --git a/src/objects.h b/src/objects.h
index 85cae02..874c486 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -906,10 +906,10 @@
 class GlobalObject;
 class ObjectVisitor;
 class StringStream;
-// We cannot just say "class Type;" if it is created from a template... =8-?
+// We cannot just say "class HeapType;" if it is created from a template... =8-?
 template<class> class TypeImpl;
 struct HeapTypeConfig;
-typedef TypeImpl<HeapTypeConfig> Type;
+typedef TypeImpl<HeapTypeConfig> HeapType;
 
 
 // A template-ized version of the IsXXX functions.
@@ -1146,8 +1146,6 @@
   V(kExpected0AsASmiSentinel, "Expected 0 as a Smi sentinel")                 \
   V(kExpectedAlignmentMarker, "expected alignment marker")                    \
   V(kExpectedAllocationSite, "expected allocation site")                      \
-  V(kExpectedAllocationSiteInCell,                                            \
-    "Expected AllocationSite in property cell")                               \
   V(kExpectedPropertyCellInRegisterA2,                                        \
     "Expected property cell in register a2")                                  \
   V(kExpectedPropertyCellInRegisterEbx,                                       \
@@ -2980,6 +2978,9 @@
   // Gives access to raw memory which stores the array's data.
   inline Object** data_start();
 
+  // Shrink length and insert filler objects.
+  void Shrink(int length);
+
   // Copy operations.
   MUST_USE_RESULT inline MaybeObject* Copy();
   MUST_USE_RESULT MaybeObject* CopySize(int new_length,
@@ -9511,8 +9512,8 @@
 class PropertyCell: public Cell {
  public:
   // [type]: type of the global property.
-  Type* type();
-  void set_type(Type* value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  HeapType* type();
+  void set_type(HeapType* value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // [dependent_code]: dependent code that depends on the type of the global
   // property.
@@ -9527,8 +9528,8 @@
 
   // Computes the new type of the cell's contents for the given value, but
   // without actually modifying the 'type' field.
-  static Handle<Type> UpdatedType(Handle<PropertyCell> cell,
-                                  Handle<Object> value);
+  static Handle<HeapType> UpdatedType(Handle<PropertyCell> cell,
+                                      Handle<Object> value);
 
   void AddDependentCompilationInfo(CompilationInfo* info);
 
diff --git a/src/parser.cc b/src/parser.cc
index bfb5bd1..d525252 100644
--- a/src/parser.cc
+++ b/src/parser.cc
@@ -485,9 +485,7 @@
 };
 
 
-Parser::FunctionState::FunctionState(Parser* parser,
-                                     Scope* scope,
-                                     Isolate* isolate)
+Parser::FunctionState::FunctionState(Parser* parser, Scope* scope)
     : next_materialized_literal_index_(JSFunction::kLiteralsPrefixSize),
       next_handler_index_(0),
       expected_property_count_(0),
@@ -495,11 +493,11 @@
       parser_(parser),
       outer_function_state_(parser->current_function_state_),
       outer_scope_(parser->top_scope_),
-      saved_ast_node_id_(isolate->ast_node_id()),
-      factory_(isolate, parser->zone()) {
+      saved_ast_node_id_(parser->zone()->isolate()->ast_node_id()),
+      factory_(parser->zone()) {
   parser->top_scope_ = scope;
   parser->current_function_state_ = this;
-  isolate->set_ast_node_id(BailoutId::FirstUsable().ToInt());
+  parser->zone()->isolate()->set_ast_node_id(BailoutId::FirstUsable().ToInt());
 }
 
 
@@ -645,7 +643,7 @@
     ParsingModeScope parsing_mode(this, mode);
 
     // Enters 'scope'.
-    FunctionState function_state(this, scope, isolate());
+    FunctionState function_state(this, scope);
 
     top_scope_->SetLanguageMode(info->language_mode());
     ZoneList<Statement*>* body = new(zone()) ZoneList<Statement*>(16, zone());
@@ -759,7 +757,7 @@
                                            zone());
     }
     original_scope_ = scope;
-    FunctionState function_state(this, scope, isolate());
+    FunctionState function_state(this, scope);
     ASSERT(scope->language_mode() != STRICT_MODE || !info()->is_classic_mode());
     ASSERT(scope->language_mode() != EXTENDED_MODE ||
            info()->is_extended_mode());
@@ -3835,7 +3833,7 @@
     Expression* value = ParseAssignmentExpression(true, CHECK_OK);
 
     ObjectLiteral::Property* property =
-        new(zone()) ObjectLiteral::Property(key, value, isolate());
+        factory()->NewObjectLiteralProperty(key, value);
 
     // Mark top-level object literals that contain function literals and
     // pretenure the literal so it can be added as a constant function
@@ -4084,7 +4082,7 @@
   AstProperties ast_properties;
   BailoutReason dont_optimize_reason = kNoReason;
   // Parse function body.
-  { FunctionState function_state(this, scope, isolate());
+  { FunctionState function_state(this, scope);
     top_scope_->SetScopeName(function_name);
 
     if (is_generator) {
diff --git a/src/parser.h b/src/parser.h
index d3c24d1..2d7c899 100644
--- a/src/parser.h
+++ b/src/parser.h
@@ -451,9 +451,7 @@
 
   class FunctionState BASE_EMBEDDED {
    public:
-    FunctionState(Parser* parser,
-                  Scope* scope,
-                  Isolate* isolate);
+    FunctionState(Parser* parser, Scope* scope);
     ~FunctionState();
 
     int NextMaterializedLiteralIndex() {
diff --git a/src/prettyprinter.cc b/src/prettyprinter.cc
index 4b441b9..130fec1 100644
--- a/src/prettyprinter.cc
+++ b/src/prettyprinter.cc
@@ -38,11 +38,11 @@
 
 #ifdef DEBUG
 
-PrettyPrinter::PrettyPrinter(Isolate* isolate) {
+PrettyPrinter::PrettyPrinter(Zone* zone) {
   output_ = NULL;
   size_ = 0;
   pos_ = 0;
-  InitializeAstVisitor(isolate);
+  InitializeAstVisitor(zone);
 }
 
 
@@ -493,8 +493,8 @@
 }
 
 
-void PrettyPrinter::PrintOut(Isolate* isolate, AstNode* node) {
-  PrettyPrinter printer(isolate);
+void PrettyPrinter::PrintOut(Zone* zone, AstNode* node) {
+  PrettyPrinter printer(zone);
   PrintF("%s", printer.Print(node));
 }
 
@@ -657,7 +657,7 @@
 //-----------------------------------------------------------------------------
 
 
-AstPrinter::AstPrinter(Isolate* isolate) : PrettyPrinter(isolate), indent_(0) {
+AstPrinter::AstPrinter(Zone* zone) : PrettyPrinter(zone), indent_(0) {
 }
 
 
diff --git a/src/prettyprinter.h b/src/prettyprinter.h
index b7ff2af..a792720 100644
--- a/src/prettyprinter.h
+++ b/src/prettyprinter.h
@@ -38,7 +38,7 @@
 
 class PrettyPrinter: public AstVisitor {
  public:
-  explicit PrettyPrinter(Isolate* isolate);
+  explicit PrettyPrinter(Zone* zone);
   virtual ~PrettyPrinter();
 
   // The following routines print a node into a string.
@@ -50,7 +50,7 @@
   void Print(const char* format, ...);
 
   // Print a node to stdout.
-  static void PrintOut(Isolate* isolate, AstNode* node);
+  static void PrintOut(Zone* zone, AstNode* node);
 
   // Individual nodes
 #define DECLARE_VISIT(type) virtual void Visit##type(type* node);
@@ -82,7 +82,7 @@
 // Prints the AST structure
 class AstPrinter: public PrettyPrinter {
  public:
-  explicit AstPrinter(Isolate* isolate);
+  explicit AstPrinter(Zone* zone);
   virtual ~AstPrinter();
 
   const char* PrintProgram(FunctionLiteral* program);
diff --git a/src/property-details.h b/src/property-details.h
index 5686ed0..5f0920b 100644
--- a/src/property-details.h
+++ b/src/property-details.h
@@ -59,8 +59,8 @@
 
 class Smi;
 template<class> class TypeImpl;
-struct HeapTypeConfig;
-typedef TypeImpl<HeapTypeConfig> Type;
+struct ZoneTypeConfig;
+typedef TypeImpl<ZoneTypeConfig> Type;
 class TypeInfo;
 
 // Type of properties.
@@ -116,7 +116,7 @@
 
   static Representation FromKind(Kind kind) { return Representation(kind); }
 
-  static Representation FromType(Handle<Type> type);
+  static Representation FromType(Type* type);
 
   bool Equals(const Representation& other) const {
     return kind_ == other.kind_;
diff --git a/src/rewriter.cc b/src/rewriter.cc
index 5e81cf8..2b68ed1 100644
--- a/src/rewriter.cc
+++ b/src/rewriter.cc
@@ -43,8 +43,8 @@
         result_assigned_(false),
         is_set_(false),
         in_try_(false),
-        factory_(zone->isolate(), zone) {
-    InitializeAstVisitor(zone->isolate());
+        factory_(zone) {
+    InitializeAstVisitor(zone);
   }
 
   virtual ~Processor() { }
diff --git a/src/runtime.cc b/src/runtime.cc
index 8697a91..e877d79 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -14779,10 +14779,8 @@
 
   Handle<AllocationSite> site;
   if (!type_info.is_null() &&
-      *type_info != isolate->heap()->undefined_value() &&
-      Cell::cast(*type_info)->value()->IsAllocationSite()) {
-    site = Handle<AllocationSite>(
-        AllocationSite::cast(Cell::cast(*type_info)->value()), isolate);
+      *type_info != isolate->heap()->undefined_value()) {
+    site = Handle<AllocationSite>::cast(type_info);
     ASSERT(!site->SitePointsToLiteral());
   }
 
diff --git a/src/scopes.cc b/src/scopes.cc
index a84d4e7..97b67bd 100644
--- a/src/scopes.cc
+++ b/src/scopes.cc
@@ -290,8 +290,7 @@
 
   // Allocate the variables.
   {
-    AstNodeFactory<AstNullVisitor> ast_node_factory(info->isolate(),
-                                                    info->zone());
+    AstNodeFactory<AstNullVisitor> ast_node_factory(info->zone());
     if (!top->AllocateVariables(info, &ast_node_factory)) return false;
   }
 
diff --git a/src/spaces.cc b/src/spaces.cc
index 70e482f..a80341b 100644
--- a/src/spaces.cc
+++ b/src/spaces.cc
@@ -1142,6 +1142,11 @@
     DecreaseUnsweptFreeBytes(page);
   }
 
+  // TODO(hpayer): This check is just used for debugging purpose and
+  // should be removed or turned into an assert after investigating the
+  // crash in concurrent sweeping.
+  CHECK(!free_list_.ContainsPageFreeListItems(page));
+
   if (Page::FromAllocationTop(allocation_info_.top()) == page) {
     allocation_info_.set_top(NULL);
     allocation_info_.set_limit(NULL);
@@ -2125,6 +2130,16 @@
 }
 
 
+bool FreeListCategory::ContainsPageFreeListItemsInList(Page* p) {
+  FreeListNode** n = &top_;
+  while (*n != NULL) {
+    if (Page::FromAddress((*n)->address()) == p) return true;
+    n = (*n)->next_address();
+  }
+  return false;
+}
+
+
 FreeListNode* FreeListCategory::PickNodeFromList(int *node_size) {
   FreeListNode* node = top_;
 
@@ -2452,6 +2467,14 @@
 }
 
 
+bool FreeList::ContainsPageFreeListItems(Page* p) {
+  return huge_list_.EvictFreeListItemsInList(p) ||
+         small_list_.EvictFreeListItemsInList(p) ||
+         medium_list_.EvictFreeListItemsInList(p) ||
+         large_list_.EvictFreeListItemsInList(p);
+}
+
+
 void FreeList::RepairLists(Heap* heap) {
   small_list_.RepairFreeList(heap);
   medium_list_.RepairFreeList(heap);
@@ -2612,7 +2635,7 @@
   MarkCompactCollector* collector = heap()->mark_compact_collector();
   if (collector->AreSweeperThreadsActivated()) {
     if (collector->IsConcurrentSweepingInProgress()) {
-      if (collector->StealMemoryFromSweeperThreads(this) < size_in_bytes) {
+      if (collector->RefillFreeLists(this) < size_in_bytes) {
         if (!collector->sequential_sweeping()) {
           collector->WaitUntilSweepingCompleted();
           return true;
diff --git a/src/spaces.h b/src/spaces.h
index ee11b6b..44e8cb6 100644
--- a/src/spaces.h
+++ b/src/spaces.h
@@ -1521,6 +1521,7 @@
   FreeListNode* PickNodeFromList(int size_in_bytes, int *node_size);
 
   intptr_t EvictFreeListItemsInList(Page* p);
+  bool ContainsPageFreeListItemsInList(Page* p);
 
   void RepairFreeList(Heap* heap);
 
@@ -1538,6 +1539,10 @@
 
   Mutex* mutex() { return &mutex_; }
 
+  bool IsEmpty() {
+    return top_ == NULL;
+  }
+
 #ifdef DEBUG
   intptr_t SumFreeList();
   int FreeListLength();
@@ -1576,7 +1581,7 @@
 //     These spaces are call large.
 // At least 16384 words.  This list is for objects of 2048 words or larger.
 //     Empty pages are added to this list.  These spaces are called huge.
-class FreeList BASE_EMBEDDED {
+class FreeList {
  public:
   explicit FreeList(PagedSpace* owner);
 
@@ -1605,6 +1610,11 @@
   // 'wasted_bytes'.  The size should be a non-zero multiple of the word size.
   MUST_USE_RESULT HeapObject* Allocate(int size_in_bytes);
 
+  bool IsEmpty() {
+    return small_list_.IsEmpty() && medium_list_.IsEmpty() &&
+           large_list_.IsEmpty() && huge_list_.IsEmpty();
+  }
+
 #ifdef DEBUG
   void Zap();
   intptr_t SumFreeLists();
@@ -1615,6 +1625,7 @@
   void RepairLists(Heap* heap);
 
   intptr_t EvictFreeListItems(Page* p);
+  bool ContainsPageFreeListItems(Page* p);
 
   FreeListCategory* small_list() { return &small_list_; }
   FreeListCategory* medium_list() { return &medium_list_; }
@@ -1945,7 +1956,7 @@
   MUST_USE_RESULT virtual HeapObject* SlowAllocateRaw(int size_in_bytes);
 
   friend class PageIterator;
-  friend class SweeperThread;
+  friend class MarkCompactCollector;
 };
 
 
diff --git a/src/stub-cache.cc b/src/stub-cache.cc
index 62e4ddc..e2558e8 100644
--- a/src/stub-cache.cc
+++ b/src/stub-cache.cc
@@ -128,7 +128,7 @@
 
 Handle<Code> StubCache::ComputeMonomorphicIC(
     Handle<Name> name,
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<Code> handler,
     ExtraICState extra_ic_state) {
   Code::Kind kind = handler->handler_kind();
@@ -139,7 +139,7 @@
   // There are multiple string maps that all use the same prototype. That
   // prototype cannot hold multiple handlers, one for each of the string maps,
   // for a single name. Hence, turn off caching of the IC.
-  bool can_be_cached = !type->Is(Type::String());
+  bool can_be_cached = !type->Is(HeapType::String());
   if (can_be_cached) {
     stub_holder = IC::GetCodeCacheHolder(flag, *type, isolate());
     ic = FindIC(name, stub_holder, kind, extra_ic_state, flag);
@@ -169,7 +169,7 @@
 
 
 Handle<Code> StubCache::ComputeLoadNonexistent(Handle<Name> name,
-                                               Handle<Type> type) {
+                                               Handle<HeapType> type) {
   InlineCacheHolderFlag flag = IC::GetCodeCacheFlag(*type);
   Handle<Map> stub_holder = IC::GetCodeCacheHolder(flag, *type, isolate());
   // If no dictionary mode objects are present in the prototype chain, the load
@@ -638,7 +638,7 @@
 
   TypeHandleList types(receiver_maps->length());
   for (int i = 0; i < receiver_maps->length(); i++) {
-    types.Add(Type::Class(receiver_maps->at(i), isolate()));
+    types.Add(HeapType::Class(receiver_maps->at(i), isolate()));
   }
   CodeHandleList handlers(receiver_maps->length());
   KeyedLoadStubCompiler compiler(isolate_);
@@ -1343,20 +1343,20 @@
 
 
 Register LoadStubCompiler::HandlerFrontendHeader(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Register object_reg,
     Handle<JSObject> holder,
     Handle<Name> name,
     Label* miss) {
   PrototypeCheckType check_type = CHECK_ALL_MAPS;
   int function_index = -1;
-  if (type->Is(Type::String())) {
+  if (type->Is(HeapType::String())) {
     function_index = Context::STRING_FUNCTION_INDEX;
-  } else if (type->Is(Type::Symbol())) {
+  } else if (type->Is(HeapType::Symbol())) {
     function_index = Context::SYMBOL_FUNCTION_INDEX;
-  } else if (type->Is(Type::Number())) {
+  } else if (type->Is(HeapType::Number())) {
     function_index = Context::NUMBER_FUNCTION_INDEX;
-  } else if (type->Is(Type::Boolean())) {
+  } else if (type->Is(HeapType::Boolean())) {
     // Booleans use the generic oddball map, so an additional check is needed to
     // ensure the receiver is really a boolean.
     GenerateBooleanCheck(object_reg, miss);
@@ -1384,7 +1384,7 @@
 // HandlerFrontend for store uses the name register. It has to be restored
 // before a miss.
 Register StoreStubCompiler::HandlerFrontendHeader(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Register object_reg,
     Handle<JSObject> holder,
     Handle<Name> name,
@@ -1396,13 +1396,13 @@
 
 bool BaseLoadStoreStubCompiler::IncludesNumberType(TypeHandleList* types) {
   for (int i = 0; i < types->length(); ++i) {
-    if (types->at(i)->Is(Type::Number())) return true;
+    if (types->at(i)->Is(HeapType::Number())) return true;
   }
   return false;
 }
 
 
-Register BaseLoadStoreStubCompiler::HandlerFrontend(Handle<Type> type,
+Register BaseLoadStoreStubCompiler::HandlerFrontend(Handle<HeapType> type,
                                                     Register object_reg,
                                                     Handle<JSObject> holder,
                                                     Handle<Name> name) {
@@ -1416,7 +1416,7 @@
 }
 
 
-void LoadStubCompiler::NonexistentHandlerFrontend(Handle<Type> type,
+void LoadStubCompiler::NonexistentHandlerFrontend(Handle<HeapType> type,
                                                   Handle<JSObject> last,
                                                   Handle<Name> name) {
   Label miss;
@@ -1461,7 +1461,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadField(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<JSObject> holder,
     Handle<Name> name,
     PropertyIndex field,
@@ -1481,7 +1481,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadConstant(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<JSObject> holder,
     Handle<Name> name,
     Handle<Object> value) {
@@ -1494,7 +1494,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadCallback(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<JSObject> holder,
     Handle<Name> name,
     Handle<ExecutableAccessorInfo> callback) {
@@ -1508,7 +1508,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadCallback(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<JSObject> holder,
     Handle<Name> name,
     const CallOptimization& call_optimization) {
@@ -1523,7 +1523,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadInterceptor(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<JSObject> holder,
     Handle<Name> name) {
   LookupResult lookup(isolate());
@@ -1576,7 +1576,7 @@
 
 
 Handle<Code> BaseLoadStoreStubCompiler::CompileMonomorphicIC(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<Code> handler,
     Handle<Name> name) {
   TypeHandleList types(1);
@@ -1589,7 +1589,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadViaGetter(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<JSObject> holder,
     Handle<Name> name,
     Handle<JSFunction> getter) {
diff --git a/src/stub-cache.h b/src/stub-cache.h
index e7c18c2..fd1b278 100644
--- a/src/stub-cache.h
+++ b/src/stub-cache.h
@@ -92,11 +92,11 @@
                            InlineCacheHolderFlag cache_holder = OWN_MAP);
 
   Handle<Code> ComputeMonomorphicIC(Handle<Name> name,
-                                    Handle<Type> type,
+                                    Handle<HeapType> type,
                                     Handle<Code> handler,
                                     ExtraICState extra_ic_state);
 
-  Handle<Code> ComputeLoadNonexistent(Handle<Name> name, Handle<Type> type);
+  Handle<Code> ComputeLoadNonexistent(Handle<Name> name, Handle<HeapType> type);
 
   Handle<Code> ComputeKeyedLoadElement(Handle<Map> receiver_map);
 
@@ -475,7 +475,7 @@
   // The function can optionally (when save_at_depth !=
   // kInvalidProtoDepth) save the object at the given depth by moving
   // it to [esp + kPointerSize].
-  Register CheckPrototypes(Handle<Type> type,
+  Register CheckPrototypes(Handle<HeapType> type,
                            Register object_reg,
                            Handle<JSObject> holder,
                            Register holder_reg,
@@ -488,7 +488,7 @@
                            scratch2, name, kInvalidProtoDepth, miss, check);
   }
 
-  Register CheckPrototypes(Handle<Type> type,
+  Register CheckPrototypes(Handle<HeapType> type,
                            Register object_reg,
                            Handle<JSObject> holder,
                            Register holder_reg,
@@ -544,7 +544,7 @@
   }
   virtual ~BaseLoadStoreStubCompiler() { }
 
-  Handle<Code> CompileMonomorphicIC(Handle<Type> type,
+  Handle<Code> CompileMonomorphicIC(Handle<HeapType> type,
                                     Handle<Code> handler,
                                     Handle<Name> name);
 
@@ -566,7 +566,7 @@
   }
 
  protected:
-  virtual Register HandlerFrontendHeader(Handle<Type> type,
+  virtual Register HandlerFrontendHeader(Handle<HeapType> type,
                                          Register object_reg,
                                          Handle<JSObject> holder,
                                          Handle<Name> name,
@@ -574,7 +574,7 @@
 
   virtual void HandlerFrontendFooter(Handle<Name> name, Label* miss) = 0;
 
-  Register HandlerFrontend(Handle<Type> type,
+  Register HandlerFrontend(Handle<HeapType> type,
                            Register object_reg,
                            Handle<JSObject> holder,
                            Handle<Name> name);
@@ -633,32 +633,32 @@
                                   cache_holder) { }
   virtual ~LoadStubCompiler() { }
 
-  Handle<Code> CompileLoadField(Handle<Type> type,
+  Handle<Code> CompileLoadField(Handle<HeapType> type,
                                 Handle<JSObject> holder,
                                 Handle<Name> name,
                                 PropertyIndex index,
                                 Representation representation);
 
-  Handle<Code> CompileLoadCallback(Handle<Type> type,
+  Handle<Code> CompileLoadCallback(Handle<HeapType> type,
                                    Handle<JSObject> holder,
                                    Handle<Name> name,
                                    Handle<ExecutableAccessorInfo> callback);
 
-  Handle<Code> CompileLoadCallback(Handle<Type> type,
+  Handle<Code> CompileLoadCallback(Handle<HeapType> type,
                                    Handle<JSObject> holder,
                                    Handle<Name> name,
                                    const CallOptimization& call_optimization);
 
-  Handle<Code> CompileLoadConstant(Handle<Type> type,
+  Handle<Code> CompileLoadConstant(Handle<HeapType> type,
                                    Handle<JSObject> holder,
                                    Handle<Name> name,
                                    Handle<Object> value);
 
-  Handle<Code> CompileLoadInterceptor(Handle<Type> type,
+  Handle<Code> CompileLoadInterceptor(Handle<HeapType> type,
                                       Handle<JSObject> holder,
                                       Handle<Name> name);
 
-  Handle<Code> CompileLoadViaGetter(Handle<Type> type,
+  Handle<Code> CompileLoadViaGetter(Handle<HeapType> type,
                                     Handle<JSObject> holder,
                                     Handle<Name> name,
                                     Handle<JSFunction> getter);
@@ -667,11 +667,11 @@
                                     Register receiver,
                                     Handle<JSFunction> getter);
 
-  Handle<Code> CompileLoadNonexistent(Handle<Type> type,
+  Handle<Code> CompileLoadNonexistent(Handle<HeapType> type,
                                       Handle<JSObject> last,
                                       Handle<Name> name);
 
-  Handle<Code> CompileLoadGlobal(Handle<Type> type,
+  Handle<Code> CompileLoadGlobal(Handle<HeapType> type,
                                  Handle<GlobalObject> holder,
                                  Handle<PropertyCell> cell,
                                  Handle<Name> name,
@@ -684,7 +684,7 @@
     return LoadIC::GetContextualMode(extra_state());
   }
 
-  virtual Register HandlerFrontendHeader(Handle<Type> type,
+  virtual Register HandlerFrontendHeader(Handle<HeapType> type,
                                          Register object_reg,
                                          Handle<JSObject> holder,
                                          Handle<Name> name,
@@ -692,12 +692,12 @@
 
   virtual void HandlerFrontendFooter(Handle<Name> name, Label* miss);
 
-  Register CallbackHandlerFrontend(Handle<Type> type,
+  Register CallbackHandlerFrontend(Handle<HeapType> type,
                                    Register object_reg,
                                    Handle<JSObject> holder,
                                    Handle<Name> name,
                                    Handle<Object> callback);
-  void NonexistentHandlerFrontend(Handle<Type> type,
+  void NonexistentHandlerFrontend(Handle<HeapType> type,
                                   Handle<JSObject> last,
                                   Handle<Name> name);
 
@@ -828,7 +828,7 @@
   }
 
  protected:
-  virtual Register HandlerFrontendHeader(Handle<Type> type,
+  virtual Register HandlerFrontendHeader(Handle<HeapType> type,
                                          Register object_reg,
                                          Handle<JSObject> holder,
                                          Handle<Name> name,
diff --git a/src/sweeper-thread.cc b/src/sweeper-thread.cc
index 6f3baed..097b594 100644
--- a/src/sweeper-thread.cc
+++ b/src/sweeper-thread.cc
@@ -44,12 +44,7 @@
        collector_(heap_->mark_compact_collector()),
        start_sweeping_semaphore_(0),
        end_sweeping_semaphore_(0),
-       stop_semaphore_(0),
-       free_list_old_data_space_(heap_->paged_space(OLD_DATA_SPACE)),
-       free_list_old_pointer_space_(heap_->paged_space(OLD_POINTER_SPACE)),
-       private_free_list_old_data_space_(heap_->paged_space(OLD_DATA_SPACE)),
-       private_free_list_old_pointer_space_(
-           heap_->paged_space(OLD_POINTER_SPACE)) {
+       stop_semaphore_(0) {
   NoBarrier_Store(&stop_thread_, static_cast<AtomicWord>(false));
 }
 
@@ -68,27 +63,13 @@
       return;
     }
 
-    collector_->SweepInParallel(heap_->old_data_space(),
-                                &private_free_list_old_data_space_,
-                                &free_list_old_data_space_);
-    collector_->SweepInParallel(heap_->old_pointer_space(),
-                                &private_free_list_old_pointer_space_,
-                                &free_list_old_pointer_space_);
+    collector_->SweepInParallel(heap_->old_data_space());
+    collector_->SweepInParallel(heap_->old_pointer_space());
     end_sweeping_semaphore_.Signal();
   }
 }
 
 
-intptr_t SweeperThread::StealMemory(PagedSpace* space) {
-  if (space->identity() == OLD_POINTER_SPACE) {
-    return space->free_list()->Concatenate(&free_list_old_pointer_space_);
-  } else if (space->identity() == OLD_DATA_SPACE) {
-    return space->free_list()->Concatenate(&free_list_old_data_space_);
-  }
-  return 0;
-}
-
-
 void SweeperThread::Stop() {
   Release_Store(&stop_thread_, static_cast<AtomicWord>(true));
   start_sweeping_semaphore_.Signal();
diff --git a/src/sweeper-thread.h b/src/sweeper-thread.h
index 96255a0..3f7917b 100644
--- a/src/sweeper-thread.h
+++ b/src/sweeper-thread.h
@@ -49,7 +49,6 @@
   void Stop();
   void StartSweeping();
   void WaitForSweeperThread();
-  intptr_t StealMemory(PagedSpace* space);
 
   static int NumberOfThreads(int max_available);
 
@@ -60,10 +59,6 @@
   Semaphore start_sweeping_semaphore_;
   Semaphore end_sweeping_semaphore_;
   Semaphore stop_semaphore_;
-  FreeList free_list_old_data_space_;
-  FreeList free_list_old_pointer_space_;
-  FreeList private_free_list_old_data_space_;
-  FreeList private_free_list_old_pointer_space_;
   volatile AtomicWord stop_thread_;
 };
 
diff --git a/src/type-info.cc b/src/type-info.cc
index b880521..d2b2bd1 100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -44,10 +44,8 @@
 
 TypeFeedbackOracle::TypeFeedbackOracle(Handle<Code> code,
                                        Handle<Context> native_context,
-                                       Isolate* isolate,
                                        Zone* zone)
     : native_context_(native_context),
-      isolate_(isolate),
       zone_(zone) {
   BuildDictionary(code);
   ASSERT(dictionary_->IsDictionary());
@@ -65,12 +63,12 @@
     Object* value = dictionary_->ValueAt(entry);
     if (value->IsCell()) {
       Cell* cell = Cell::cast(value);
-      return Handle<Object>(cell->value(), isolate_);
+      return Handle<Object>(cell->value(), isolate());
     } else {
-      return Handle<Object>(value, isolate_);
+      return Handle<Object>(value, isolate());
     }
   }
-  return Handle<Object>::cast(isolate_->factory()->undefined_value());
+  return Handle<Object>::cast(isolate()->factory()->undefined_value());
 }
 
 
@@ -186,7 +184,7 @@
 Handle<JSFunction> TypeFeedbackOracle::GetCallTarget(TypeFeedbackId id) {
   Handle<Object> info = GetInfo(id);
   if (info->IsAllocationSite()) {
-    return Handle<JSFunction>(isolate_->global_context()->array_function());
+    return Handle<JSFunction>(isolate()->global_context()->array_function());
   } else {
     return Handle<JSFunction>::cast(info);
   }
@@ -196,7 +194,7 @@
 Handle<JSFunction> TypeFeedbackOracle::GetCallNewTarget(TypeFeedbackId id) {
   Handle<Object> info = GetInfo(id);
   if (info->IsAllocationSite()) {
-    return Handle<JSFunction>(isolate_->global_context()->array_function());
+    return Handle<JSFunction>(isolate()->global_context()->array_function());
   } else {
     return Handle<JSFunction>::cast(info);
   }
@@ -215,7 +213,7 @@
 
 bool TypeFeedbackOracle::LoadIsBuiltin(
     TypeFeedbackId id, Builtins::Name builtin) {
-  return *GetInfo(id) == isolate_->builtins()->builtin(builtin);
+  return *GetInfo(id) == isolate()->builtins()->builtin(builtin);
 }
 
 
@@ -230,13 +228,13 @@
 
 
 void TypeFeedbackOracle::CompareType(TypeFeedbackId id,
-                                     Handle<Type>* left_type,
-                                     Handle<Type>* right_type,
-                                     Handle<Type>* combined_type) {
+                                     Type** left_type,
+                                     Type** right_type,
+                                     Type** combined_type) {
   Handle<Object> info = GetInfo(id);
   if (!info->IsCode()) {
     // For some comparisons we don't have ICs, e.g. LiteralCompareTypeof.
-    *left_type = *right_type = *combined_type = Type::None(isolate_);
+    *left_type = *right_type = *combined_type = Type::None(zone());
     return;
   }
   Handle<Code> code = Handle<Code>::cast(info);
@@ -253,19 +251,19 @@
   if (code->is_compare_ic_stub()) {
     int stub_minor_key = code->stub_info();
     CompareIC::StubInfoToType(
-        stub_minor_key, left_type, right_type, combined_type, map, isolate());
+        stub_minor_key, left_type, right_type, combined_type, map, zone());
   } else if (code->is_compare_nil_ic_stub()) {
     CompareNilICStub stub(code->extended_extra_ic_state());
-    *combined_type = stub.GetType(isolate_, map);
-    *left_type = *right_type = stub.GetInputType(isolate_, map);
+    *combined_type = stub.GetType(zone(), map);
+    *left_type = *right_type = stub.GetInputType(zone(), map);
   }
 }
 
 
 void TypeFeedbackOracle::BinaryType(TypeFeedbackId id,
-                                    Handle<Type>* left,
-                                    Handle<Type>* right,
-                                    Handle<Type>* result,
+                                    Type** left,
+                                    Type** right,
+                                    Type** result,
                                     Maybe<int>* fixed_right_arg,
                                     Handle<AllocationSite>* allocation_site,
                                     Token::Value op) {
@@ -275,7 +273,7 @@
     // operations covered by the BinaryOpIC we should always have them.
     ASSERT(op < BinaryOpIC::State::FIRST_TOKEN ||
            op > BinaryOpIC::State::LAST_TOKEN);
-    *left = *right = *result = Type::None(isolate_);
+    *left = *right = *result = Type::None(zone());
     *fixed_right_arg = Maybe<int>();
     *allocation_site = Handle<AllocationSite>::null();
     return;
@@ -285,9 +283,9 @@
   BinaryOpIC::State state(code->extended_extra_ic_state());
   ASSERT_EQ(op, state.op());
 
-  *left = state.GetLeftType(isolate());
-  *right = state.GetRightType(isolate());
-  *result = state.GetResultType(isolate());
+  *left = state.GetLeftType(zone());
+  *right = state.GetRightType(zone());
+  *result = state.GetResultType(zone());
   *fixed_right_arg = state.fixed_right_arg();
 
   AllocationSite* first_allocation_site = code->FindFirstAllocationSite();
@@ -299,13 +297,13 @@
 }
 
 
-Handle<Type> TypeFeedbackOracle::CountType(TypeFeedbackId id) {
+Type* TypeFeedbackOracle::CountType(TypeFeedbackId id) {
   Handle<Object> object = GetInfo(id);
-  if (!object->IsCode()) return Type::None(isolate_);
+  if (!object->IsCode()) return Type::None(zone());
   Handle<Code> code = Handle<Code>::cast(object);
   ASSERT_EQ(Code::BINARY_OP_IC, code->kind());
   BinaryOpIC::State state(code->extended_extra_ic_state());
-  return state.GetLeftType(isolate());
+  return state.GetLeftType(zone());
 }
 
 
@@ -375,7 +373,7 @@
   if (FLAG_collect_megamorphic_maps_from_stub_cache &&
       code->ic_state() == MEGAMORPHIC) {
     types->Reserve(4, zone());
-    isolate_->stub_cache()->CollectMatchingMaps(
+    isolate()->stub_cache()->CollectMatchingMaps(
         types, name, flags, native_context_, zone());
   } else {
     CollectReceiverTypes(ast_id, types);
@@ -454,7 +452,7 @@
 void TypeFeedbackOracle::BuildDictionary(Handle<Code> code) {
   DisallowHeapAllocation no_allocation;
   ZoneList<RelocInfo> infos(16, zone());
-  HandleScope scope(isolate_);
+  HandleScope scope(isolate());
   GetRelocInfos(code, &infos);
   CreateDictionary(code, &infos);
   ProcessRelocInfos(&infos);
diff --git a/src/type-info.h b/src/type-info.h
index a82f0c0..a457d2b 100644
--- a/src/type-info.h
+++ b/src/type-info.h
@@ -45,7 +45,6 @@
  public:
   TypeFeedbackOracle(Handle<Code> code,
                      Handle<Context> native_context,
-                     Isolate* isolate,
                      Zone* zone);
 
   bool LoadIsUninitialized(TypeFeedbackId id);
@@ -107,22 +106,22 @@
 
   // Get type information for arithmetic operations and compares.
   void BinaryType(TypeFeedbackId id,
-                  Handle<Type>* left,
-                  Handle<Type>* right,
-                  Handle<Type>* result,
+                  Type** left,
+                  Type** right,
+                  Type** result,
                   Maybe<int>* fixed_right_arg,
                   Handle<AllocationSite>* allocation_site,
                   Token::Value operation);
 
   void CompareType(TypeFeedbackId id,
-                   Handle<Type>* left,
-                   Handle<Type>* right,
-                   Handle<Type>* combined);
+                   Type** left,
+                   Type** right,
+                   Type** combined);
 
-  Handle<Type> CountType(TypeFeedbackId id);
+  Type* CountType(TypeFeedbackId id);
 
   Zone* zone() const { return zone_; }
-  Isolate* isolate() const { return isolate_; }
+  Isolate* isolate() const { return zone_->isolate(); }
 
  private:
   void CollectReceiverTypes(TypeFeedbackId id,
@@ -147,7 +146,6 @@
 
  private:
   Handle<Context> native_context_;
-  Isolate* isolate_;
   Zone* zone_;
   Handle<UnseededNumberDictionary> dictionary_;
 
diff --git a/src/types.cc b/src/types.cc
index 2aa6081..bbaf7a9 100644
--- a/src/types.cc
+++ b/src/types.cc
@@ -38,7 +38,7 @@
   } else if (this->IsUnion()) {
     UnionedHandle unioned = this->AsUnion();
     int result = 0;
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       if (Config::union_get(unioned, i)->IsClass()) ++result;
     }
     return result;
@@ -55,7 +55,7 @@
   } else if (this->IsUnion()) {
     UnionedHandle unioned = this->AsUnion();
     int result = 0;
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       if (Config::union_get(unioned, i)->IsConstant()) ++result;
     }
     return result;
@@ -118,7 +118,7 @@
   ++index_;
   if (type_->IsUnion()) {
     UnionedHandle unioned = type_->AsUnion();
-    for (; index_ < unioned->length(); ++index_) {
+    for (; index_ < Config::union_length(unioned); ++index_) {
       if (matches(Config::union_get(unioned, index_))) return;
     }
   } else if (index_ == 0 && matches(type_)) {
@@ -136,7 +136,7 @@
   } else if (this->IsUnion()) {
     UnionedHandle unioned = this->AsUnion();
     int bitset = kNone;
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       bitset |= Config::union_get(unioned, i)->LubBitset();
     }
     return bitset;
@@ -299,7 +299,7 @@
   // (T1 \/ ... \/ Tn) <= T  <=>  (T1 <= T) /\ ... /\ (Tn <= T)
   if (this->IsUnion()) {
     UnionedHandle unioned = this->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle this_i = Config::union_get(unioned, i);
       if (!this_i->Is(that)) return false;
     }
@@ -311,7 +311,7 @@
   ASSERT(!this->IsUnion());
   if (that->IsUnion()) {
     UnionedHandle unioned = that->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle that_i = Config::union_get(unioned, i);
       if (this->Is(that_i)) return true;
       if (this->IsBitset()) break;  // Fast fail, only first field is a bitset.
@@ -346,7 +346,7 @@
   // (T1 \/ ... \/ Tn) overlaps T <=> (T1 overlaps T) \/ ... \/ (Tn overlaps T)
   if (this->IsUnion()) {
     UnionedHandle unioned = this->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle this_i = Config::union_get(unioned, i);
       if (this_i->Maybe(that)) return true;
     }
@@ -356,7 +356,7 @@
   // T overlaps (T1 \/ ... \/ Tn) <=> (T overlaps T1) \/ ... \/ (T overlaps Tn)
   if (that->IsUnion()) {
     UnionedHandle unioned = that->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle that_i = Config::union_get(unioned, i);
       if (this->Maybe(that_i)) return true;
     }
@@ -389,18 +389,21 @@
 // Get non-bitsets from this which are not subsumed by union, store at unioned,
 // starting at index. Returns updated index.
 template<class Config>
-int TypeImpl<Config>::ExtendUnion(UnionedHandle result, int current_size) {
+int TypeImpl<Config>::ExtendUnion(
+    UnionedHandle result, TypeHandle type, int current_size) {
   int old_size = current_size;
-  if (this->IsClass() || this->IsConstant()) {
-    if (!this->InUnion(result, old_size)) result->set(current_size++, this);
-  } else if (this->IsUnion()) {
-    UnionedHandle unioned = this->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+  if (type->IsClass() || type->IsConstant()) {
+    if (!type->InUnion(result, old_size)) {
+      Config::union_set(result, current_size++, type);
+    }
+  } else if (type->IsUnion()) {
+    UnionedHandle unioned = type->AsUnion();
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle type = Config::union_get(unioned, i);
       ASSERT(i == 0 ||
              !(type->IsBitset() || type->Is(Config::union_get(unioned, 0))));
       if (!type->IsBitset() && !type->InUnion(result, old_size)) {
-        result->set(current_size++, *type);
+        Config::union_set(result, current_size++, type);
       }
     }
   }
@@ -433,51 +436,50 @@
   // Slow case: may need to produce a Unioned object.
   int size = type1->IsBitset() || type2->IsBitset() ? 1 : 0;
   if (!type1->IsBitset()) {
-    size += (type1->IsUnion() ? type1->AsUnion()->length() : 1);
+    size += (type1->IsUnion() ? Config::union_length(type1->AsUnion()) : 1);
   }
   if (!type2->IsBitset()) {
-    size += (type2->IsUnion() ? type2->AsUnion()->length() : 1);
+    size += (type2->IsUnion() ? Config::union_length(type2->AsUnion()) : 1);
   }
   ASSERT(size >= 2);
   UnionedHandle unioned = Config::union_create(size, region);
   size = 0;
 
   int bitset = type1->GlbBitset() | type2->GlbBitset();
-  if (bitset != kNone) unioned->set(size++, Config::from_bitset(bitset));
-  size = type1->ExtendUnion(unioned, size);
-  size = type2->ExtendUnion(unioned, size);
+  if (bitset != kNone) {
+    Config::union_set(unioned, size++, Config::from_bitset(bitset, region));
+  }
+  size = ExtendUnion(unioned, type1, size);
+  size = ExtendUnion(unioned, type2, size);
 
   if (size == 1) {
     return Config::union_get(unioned, 0);
-  } else if (size == unioned->length()) {
+  } else {
+    Config::union_shrink(unioned, size);
     return Config::from_union(unioned);
   }
-
-  // There was an overlap. Copy to smaller union.
-  UnionedHandle result = Config::union_create(size, region);
-  for (int i = 0; i < size; ++i) result->set(i, unioned->get(i));
-  return Config::from_union(result);
 }
 
 
-// Get non-bitsets from this which are also in that, store at unioned,
+// Get non-bitsets from type which are also in other, store at unioned,
 // starting at index. Returns updated index.
 template<class Config>
 int TypeImpl<Config>::ExtendIntersection(
-    UnionedHandle result, TypeHandle that, int current_size) {
+    UnionedHandle result, TypeHandle type, TypeHandle other, int current_size) {
   int old_size = current_size;
-  if (this->IsClass() || this->IsConstant()) {
-    if (this->Is(that) && !this->InUnion(result, old_size))
-      result->set(current_size++, this);
-  } else if (this->IsUnion()) {
-    UnionedHandle unioned = this->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+  if (type->IsClass() || type->IsConstant()) {
+    if (type->Is(other) && !type->InUnion(result, old_size)) {
+      Config::union_set(result, current_size++, type);
+    }
+  } else if (type->IsUnion()) {
+    UnionedHandle unioned = type->AsUnion();
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle type = Config::union_get(unioned, i);
       ASSERT(i == 0 ||
              !(type->IsBitset() || type->Is(Config::union_get(unioned, 0))));
-      if (!type->IsBitset() && type->Is(that) &&
+      if (!type->IsBitset() && type->Is(other) &&
           !type->InUnion(result, old_size)) {
-        result->set(current_size++, *type);
+        Config::union_set(result, current_size++, type);
       }
     }
   }
@@ -510,10 +512,10 @@
   // Slow case: may need to produce a Unioned object.
   int size = 0;
   if (!type1->IsBitset()) {
-    size = (type1->IsUnion() ? type1->AsUnion()->length() : 2);
+    size = (type1->IsUnion() ? Config::union_length(type1->AsUnion()) : 2);
   }
   if (!type2->IsBitset()) {
-    int size2 = (type2->IsUnion() ? type2->AsUnion()->length() : 2);
+    int size2 = (type2->IsUnion() ? Config::union_length(type2->AsUnion()) : 2);
     size = (size == 0 ? size2 : Min(size, size2));
   }
   ASSERT(size >= 2);
@@ -521,27 +523,25 @@
   size = 0;
 
   int bitset = type1->GlbBitset() & type2->GlbBitset();
-  if (bitset != kNone) unioned->set(size++, Config::from_bitset(bitset));
-  size = type1->ExtendIntersection(unioned, type2, size);
-  size = type2->ExtendIntersection(unioned, type1, size);
+  if (bitset != kNone) {
+    Config::union_set(unioned, size++, Config::from_bitset(bitset, region));
+  }
+  size = ExtendIntersection(unioned, type1, type2, size);
+  size = ExtendIntersection(unioned, type2, type1, size);
 
   if (size == 0) {
     return None(region);
   } else if (size == 1) {
     return Config::union_get(unioned, 0);
-  } else if (size == unioned->length()) {
+  } else {
+    Config::union_shrink(unioned, size);
     return Config::from_union(unioned);
   }
-
-  // There were dropped cases. Copy to smaller union.
-  UnionedHandle result = Config::union_create(size, region);
-  for (int i = 0; i < size; ++i) result->set(i, unioned->get(i));
-  return Config::from_union(result);
 }
 
 
 // TODO(rossberg): this does not belong here.
-Representation Representation::FromType(Handle<Type> type) {
+Representation Representation::FromType(Type* type) {
   if (type->Is(Type::None())) return Representation::None();
   if (type->Is(Type::Smi())) return Representation::Smi();
   if (type->Is(Type::Signed32())) return Representation::Integer32();
@@ -601,7 +601,7 @@
   } else if (this->IsUnion()) {
     PrintF(out, "(");
     UnionedHandle unioned = this->AsUnion();
-    for (int i = 0; i < unioned->length(); ++i) {
+    for (int i = 0; i < Config::union_length(unioned); ++i) {
       TypeHandle type_i = Config::union_get(unioned, i);
       if (i > 0) PrintF(out, " | ");
       type_i->TypePrint(out);
@@ -612,6 +612,10 @@
 #endif
 
 
+template class TypeImpl<ZoneTypeConfig>;
+template class TypeImpl<ZoneTypeConfig>::Iterator<i::Map>;
+template class TypeImpl<ZoneTypeConfig>::Iterator<i::Object>;
+
 template class TypeImpl<HeapTypeConfig>;
 template class TypeImpl<HeapTypeConfig>::Iterator<i::Map>;
 template class TypeImpl<HeapTypeConfig>::Iterator<i::Object>;
diff --git a/src/types.h b/src/types.h
index 4d8557e..e7b306e 100644
--- a/src/types.h
+++ b/src/types.h
@@ -137,22 +137,24 @@
 //   typedef Region;
 //   template<class> struct Handle { typedef type; }  // No template typedefs...
 //   static Handle<Type>::type handle(Type* type);    // !is_bitset(type)
-//   static bool is_bitset(Type* type);
-//   static bool is_class(Type* type);
-//   static bool is_constant(Type* type);
-//   static bool is_union(Type* type);
-//   static int as_bitset(Type* type);
-//   static i::Handle<i::Map> as_class(Type* type);
-//   static i::Handle<i::Object> as_constant(Type* type);
-//   static Handle<Unioned>::type as_union(Type* type);
+//   static bool is_bitset(Type*);
+//   static bool is_class(Type*);
+//   static bool is_constant(Type*);
+//   static bool is_union(Type*);
+//   static int as_bitset(Type*);
+//   static i::Handle<i::Map> as_class(Type*);
+//   static i::Handle<i::Object> as_constant(Type*);
+//   static Handle<Unioned>::type as_union(Type*);
 //   static Type* from_bitset(int bitset);
-//   static Handle<Type>::type from_bitset(int bitset, Region* region);
-//   static Handle<Type>::type from_class(i::Handle<i::Map> map, Region* region)
-//   static Handle<Type>::type from_constant(
-//                               i::Handle<i::Object> value, Region* region);
-//   static Handle<Type>::type from_union(Handle<Unioned>::T unioned);
-//   static Handle<Unioned>::type union_create(int size, Region* region);
-//   static Handle<Type>::type union_get(Handle<Unioned>::T unioned, int i);
+//   static Handle<Type>::type from_bitset(int bitset, Region*);
+//   static Handle<Type>::type from_class(i::Handle<i::Map>, Region*)
+//   static Handle<Type>::type from_constant(i::Handle<i::Object>, Region*);
+//   static Handle<Type>::type from_union(Handle<Unioned>::type);
+//   static Handle<Unioned>::type union_create(int size, Region*);
+//   static void union_shrink(Handle<Unioned>::type, int size);
+//   static Handle<Type>::type union_get(Handle<Unioned>::type, int);
+//   static void union_set(Handle<Unioned>::type, int, Handle<Type>::type);
+//   static int union_length(Handle<Unioned>::type);
 // }
 template<class Config>
 class TypeImpl : public Config::Base {
@@ -183,14 +185,17 @@
   }
 
   bool Is(TypeImpl* that) { return this == that || this->SlowIs(that); }
+  template<class TypeHandle>
   bool Is(TypeHandle that) { return this->Is(*that); }
   bool Maybe(TypeImpl* that);
+  template<class TypeHandle>
   bool Maybe(TypeHandle that) { return this->Maybe(*that); }
 
   // State-dependent versions of Of and Is that consider subtyping between
   // a constant and its map class.
   static TypeHandle OfCurrently(i::Handle<i::Object> value, Region* region);
   bool IsCurrently(TypeImpl* that);
+  template<class TypeHandle>
   bool IsCurrently(TypeHandle that)  { return this->IsCurrently(*that); }
 
   bool IsClass() { return Config::is_class(this); }
@@ -232,7 +237,7 @@
     return Iterator<i::Object>(Config::handle(this));
   }
 
-  static TypeImpl* cast(i::Object* object) {
+  static TypeImpl* cast(typename Config::Base* object) {
     TypeImpl* t = static_cast<TypeImpl*>(object);
     ASSERT(t->IsBitset() || t->IsClass() || t->IsConstant() || t->IsUnion());
     return t;
@@ -276,9 +281,10 @@
   static int LubBitset(i::Map* map);
 
   bool InUnion(UnionedHandle unioned, int current_size);
-  int ExtendUnion(UnionedHandle unioned, int current_size);
-  int ExtendIntersection(
-      UnionedHandle unioned, TypeHandle type, int current_size);
+  static int ExtendUnion(
+      UnionedHandle unioned, TypeHandle t, int current_size);
+  static int ExtendIntersection(
+      UnionedHandle unioned, TypeHandle t, TypeHandle other, int current_size);
 
 #ifdef OBJECT_PRINT
   static const char* bitset_name(int bitset);
@@ -286,6 +292,141 @@
 };
 
 
+// Zone-allocated types are either (odd) integers to represent bitsets, or
+// (even) pointers to zone lists for everything else. The first slot of every
+// list is an explicit tag value to distinguish representation.
+struct ZoneTypeConfig {
+ private:
+  typedef i::ZoneList<void*> Tagged;
+
+  enum Tag {
+    kClassTag,
+    kConstantTag,
+    kUnionTag
+  };
+
+  static Tagged* tagged_create(Tag tag, int size, Zone* zone) {
+    Tagged* tagged = new(zone) Tagged(size + 1, zone);
+    tagged->Add(reinterpret_cast<void*>(tag), zone);
+    tagged->AddBlock(NULL, size, zone);
+    return tagged;
+  }
+  static void tagged_shrink(Tagged* tagged, int size) {
+    tagged->Rewind(size + 1);
+  }
+  static Tag tagged_tag(Tagged* tagged) {
+    return static_cast<Tag>(reinterpret_cast<intptr_t>(tagged->at(0)));
+  }
+  template<class T>
+  static T tagged_get(Tagged* tagged, int i) {
+    return reinterpret_cast<T>(tagged->at(i + 1));
+  }
+  template<class T>
+  static void tagged_set(Tagged* tagged, int i, T value) {
+    tagged->at(i + 1) = reinterpret_cast<T>(value);
+  }
+  static int tagged_length(Tagged* tagged) {
+    return tagged->length() - 1;
+  }
+
+ public:
+  typedef TypeImpl<ZoneTypeConfig> Type;
+  class Base {};
+  typedef i::ZoneList<Type*> Unioned;
+  typedef i::Zone Region;
+  template<class T> struct Handle { typedef T* type; };
+
+  static Type* handle(Type* type) { return type; }
+
+  static bool is(Type* type, Tag tag) {
+    return is_tagged(type) && tagged_tag(as_tagged(type)) == tag;
+  }
+
+  static bool is_bitset(Type* type) {
+    return reinterpret_cast<intptr_t>(type) & 1;
+  }
+  static bool is_tagged(Type* type) { return !is_bitset(type); }
+  static bool is_class(Type* type) { return is(type, kClassTag); }
+  static bool is_constant(Type* type) { return is(type, kConstantTag); }
+  static bool is_union(Type* type) { return is(type, kUnionTag); }
+  static bool tagged_is_union(Tagged* tagged) {
+    return is(from_tagged(tagged), kUnionTag);
+  }
+
+  static int as_bitset(Type* type) {
+    ASSERT(is_bitset(type));
+    return static_cast<int>(reinterpret_cast<intptr_t>(type) >> 1);
+  }
+  static Tagged* as_tagged(Type* type) {
+    ASSERT(is_tagged(type));
+    return reinterpret_cast<Tagged*>(type);
+  }
+  static i::Handle<i::Map> as_class(Type* type) {
+    ASSERT(is_class(type));
+    return i::Handle<i::Map>(tagged_get<i::Map**>(as_tagged(type), 0));
+  }
+  static i::Handle<i::Object> as_constant(Type* type) {
+    ASSERT(is_constant(type));
+    return i::Handle<i::Object>(tagged_get<i::Object**>(as_tagged(type), 0));
+  }
+  static Unioned* as_union(Type* type) {
+    ASSERT(is_union(type));
+    return tagged_as_union(as_tagged(type));
+  }
+  static Unioned* tagged_as_union(Tagged* tagged) {
+    ASSERT(tagged_is_union(tagged));
+    return reinterpret_cast<Unioned*>(tagged);
+  }
+
+  static Type* from_bitset(int bitset) {
+    return reinterpret_cast<Type*>((bitset << 1) | 1);
+  }
+  static Type* from_bitset(int bitset, Zone* Zone) {
+    return from_bitset(bitset);
+  }
+  static Type* from_tagged(Tagged* tagged) {
+    return reinterpret_cast<Type*>(tagged);
+  }
+  static Type* from_class(i::Handle<i::Map> map, Zone* zone) {
+    Tagged* tagged = tagged_create(kClassTag, 1, zone);
+    tagged_set(tagged, 0, map.location());
+    return from_tagged(tagged);
+  }
+  static Type* from_constant(i::Handle<i::Object> value, Zone* zone) {
+    Tagged* tagged = tagged_create(kConstantTag, 1, zone);
+    tagged_set(tagged, 0, value.location());
+    return from_tagged(tagged);
+  }
+  static Type* from_union(Unioned* unioned) {
+    return from_tagged(tagged_from_union(unioned));
+  }
+  static Tagged* tagged_from_union(Unioned* unioned) {
+    return reinterpret_cast<Tagged*>(unioned);
+  }
+
+  static Unioned* union_create(int size, Zone* zone) {
+    return tagged_as_union(tagged_create(kUnionTag, size, zone));
+  }
+  static void union_shrink(Unioned* unioned, int size) {
+    tagged_shrink(tagged_from_union(unioned), size);
+  }
+  static Type* union_get(Unioned* unioned, int i) {
+    Type* type = tagged_get<Type*>(tagged_from_union(unioned), i);
+    ASSERT(!is_union(type));
+    return type;
+  }
+  static void union_set(Unioned* unioned, int i, Type* type) {
+    ASSERT(!is_union(type));
+    tagged_set(tagged_from_union(unioned), i, type);
+  }
+  static int union_length(Unioned* unioned) {
+    return tagged_length(tagged_from_union(unioned));
+  }
+};
+
+
+// Heap-allocated types are either smis for bitsets, maps for classes, boxes for
+// constants, or fixed arrays for unions.
 struct HeapTypeConfig {
   typedef TypeImpl<HeapTypeConfig> Type;
   typedef i::Object Base;
@@ -327,8 +468,6 @@
   }
   static i::Handle<Type> from_constant(
       i::Handle<i::Object> value, Isolate* isolate) {
-    ASSERT(isolate || value->IsHeapObject());
-    if (!isolate) isolate = i::HeapObject::cast(*value)->GetIsolate();
     i::Handle<Box> box = isolate->factory()->NewBox(value);
     return i::Handle<Type>::cast(i::Handle<Object>::cast(box));
   }
@@ -339,14 +478,26 @@
   static i::Handle<Unioned> union_create(int size, Isolate* isolate) {
     return isolate->factory()->NewFixedArray(size);
   }
+  static void union_shrink(i::Handle<Unioned> unioned, int size) {
+    unioned->Shrink(size);
+  }
   static i::Handle<Type> union_get(i::Handle<Unioned> unioned, int i) {
     Type* type = static_cast<Type*>(unioned->get(i));
     ASSERT(!is_union(type));
     return i::handle(type, unioned->GetIsolate());
   }
+  static void union_set(
+      i::Handle<Unioned> unioned, int i, i::Handle<Type> type) {
+    ASSERT(!is_union(*type));
+    unioned->set(i, *type);
+  }
+  static int union_length(i::Handle<Unioned> unioned) {
+    return unioned->length();
+  }
 };
 
-typedef TypeImpl<HeapTypeConfig> Type;
+typedef TypeImpl<ZoneTypeConfig> Type;
+typedef TypeImpl<HeapTypeConfig> HeapType;
 
 
 // A simple struct to represent a pair of lower/upper type bounds.
@@ -399,7 +550,7 @@
   }
 };
 
-typedef BoundsImpl<HeapTypeConfig> Bounds;
+typedef BoundsImpl<ZoneTypeConfig> Bounds;
 
 
 } }  // namespace v8::internal
diff --git a/src/typing.cc b/src/typing.cc
index b1fde82..596ea2c 100644
--- a/src/typing.cc
+++ b/src/typing.cc
@@ -41,10 +41,9 @@
       oracle_(
           Handle<Code>(info->closure()->shared()->code()),
           Handle<Context>(info->closure()->context()->native_context()),
-          info->isolate(),
           info->zone()),
       store_(info->zone()) {
-  InitializeAstVisitor(info->isolate());
+  InitializeAstVisitor(info->zone());
 }
 
 
@@ -72,7 +71,7 @@
 
 
 #ifdef OBJECT_PRINT
-  static void PrintObserved(Variable* var, Object* value, Handle<Type> type) {
+  static void PrintObserved(Variable* var, Object* value, Type* type) {
     PrintF("  observed %s ", var->IsParameter() ? "param" : "local");
     var->name()->Print();
     PrintF(" : ");
@@ -84,8 +83,8 @@
 
 
 Effect AstTyper::ObservedOnStack(Object* value) {
-  Handle<Type> lower = Type::OfCurrently(handle(value, isolate()), isolate());
-  return Effect(Bounds(lower, Type::Any(isolate())));
+  Type* lower = Type::OfCurrently(handle(value, isolate()), zone());
+  return Effect(Bounds(lower, Type::Any(zone())));
 }
 
 
@@ -233,7 +232,9 @@
     if (!clause->is_default()) {
       Expression* label = clause->label();
       // Collect type feedback.
-      Handle<Type> tag_type, label_type, combined_type;
+      Type* tag_type;
+      Type* label_type;
+      Type* combined_type;
       oracle()->CompareType(clause->CompareId(),
                             &tag_type, &label_type, &combined_type);
       NarrowLowerType(stmt->tag(), tag_type);
@@ -392,7 +393,7 @@
 
   NarrowType(expr, Bounds::Either(
       expr->then_expression()->bounds(),
-      expr->else_expression()->bounds(), isolate_));
+      expr->else_expression()->bounds(), zone()));
 }
 
 
@@ -405,13 +406,13 @@
 
 
 void AstTyper::VisitLiteral(Literal* expr) {
-  Handle<Type> type = Type::Constant(expr->value(), isolate_);
+  Type* type = Type::Constant(expr->value(), zone());
   NarrowType(expr, Bounds(type));
 }
 
 
 void AstTyper::VisitRegExpLiteral(RegExpLiteral* expr) {
-  NarrowType(expr, Bounds(Type::RegExp(isolate_)));
+  NarrowType(expr, Bounds(Type::RegExp(zone())));
 }
 
 
@@ -432,7 +433,7 @@
     RECURSE(Visit(prop->value()));
   }
 
-  NarrowType(expr, Bounds(Type::Object(isolate_)));
+  NarrowType(expr, Bounds(Type::Object(zone())));
 }
 
 
@@ -443,7 +444,7 @@
     RECURSE(Visit(value));
   }
 
-  NarrowType(expr, Bounds(Type::Array(isolate_)));
+  NarrowType(expr, Bounds(Type::Array(zone())));
 }
 
 
@@ -495,7 +496,7 @@
   RECURSE(Visit(expr->exception()));
   // TODO(rossberg): is it worth having a non-termination effect?
 
-  NarrowType(expr, Bounds(Type::None(isolate_)));
+  NarrowType(expr, Bounds(Type::None(zone())));
 }
 
 
@@ -587,13 +588,13 @@
   switch (expr->op()) {
     case Token::NOT:
     case Token::DELETE:
-      NarrowType(expr, Bounds(Type::Boolean(isolate_)));
+      NarrowType(expr, Bounds(Type::Boolean(zone())));
       break;
     case Token::VOID:
-      NarrowType(expr, Bounds(Type::Undefined(isolate_)));
+      NarrowType(expr, Bounds(Type::Undefined(zone())));
       break;
     case Token::TYPEOF:
-      NarrowType(expr, Bounds(Type::InternalizedString(isolate_)));
+      NarrowType(expr, Bounds(Type::InternalizedString(zone())));
       break;
     default:
       UNREACHABLE();
@@ -611,7 +612,7 @@
 
   RECURSE(Visit(expr->expression()));
 
-  NarrowType(expr, Bounds(Type::Smi(isolate_), Type::Number(isolate_)));
+  NarrowType(expr, Bounds(Type::Smi(zone()), Type::Number(zone())));
 
   VariableProxy* proxy = expr->expression()->AsVariableProxy();
   if (proxy != NULL && proxy->var()->IsStackAllocated()) {
@@ -622,7 +623,9 @@
 
 void AstTyper::VisitBinaryOperation(BinaryOperation* expr) {
   // Collect type feedback.
-  Handle<Type> type, left_type, right_type;
+  Type* type;
+  Type* left_type;
+  Type* right_type;
   Maybe<int> fixed_right_arg;
   Handle<AllocationSite> allocation_site;
   oracle()->BinaryType(expr->BinaryOperationFeedbackId(),
@@ -655,20 +658,17 @@
       store_.Seq(left_effects);
 
       NarrowType(expr, Bounds::Either(
-          expr->left()->bounds(), expr->right()->bounds(), isolate_));
+          expr->left()->bounds(), expr->right()->bounds(), zone()));
       break;
     }
     case Token::BIT_OR:
     case Token::BIT_AND: {
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
-      Handle<Type> upper = Type::Union(
-          expr->left()->bounds().upper, expr->right()->bounds().upper,
-          isolate_);
-      if (!upper->Is(Type::Signed32()))
-        upper = Type::Signed32(isolate_);
-      Handle<Type> lower =
-          Type::Intersect(Type::Smi(isolate_), upper, isolate_);
+      Type* upper = Type::Union(
+          expr->left()->bounds().upper, expr->right()->bounds().upper, zone());
+      if (!upper->Is(Type::Signed32())) upper = Type::Signed32(zone());
+      Type* lower = Type::Intersect(Type::Smi(zone()), upper, zone());
       NarrowType(expr, Bounds(lower, upper));
       break;
     }
@@ -677,7 +677,7 @@
     case Token::SAR:
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
-      NarrowType(expr, Bounds(Type::Smi(isolate_), Type::Signed32(isolate_)));
+      NarrowType(expr, Bounds(Type::Smi(zone()), Type::Signed32(zone())));
       break;
     case Token::SHR:
       RECURSE(Visit(expr->left()));
@@ -685,25 +685,25 @@
       // TODO(rossberg): The upper bound would be Unsigned32, but since there
       // is no 'positive Smi' type for the lower bound, we use the smallest
       // union of Smi and Unsigned32 as upper bound instead.
-      NarrowType(expr, Bounds(Type::Smi(isolate_), Type::Number(isolate_)));
+      NarrowType(expr, Bounds(Type::Smi(zone()), Type::Number(zone())));
       break;
     case Token::ADD: {
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
       Bounds l = expr->left()->bounds();
       Bounds r = expr->right()->bounds();
-      Handle<Type> lower =
+      Type* lower =
           l.lower->Is(Type::None()) || r.lower->Is(Type::None()) ?
-              Type::None(isolate_) :
+              Type::None(zone()) :
           l.lower->Is(Type::String()) || r.lower->Is(Type::String()) ?
-              Type::String(isolate_) :
+              Type::String(zone()) :
           l.lower->Is(Type::Number()) && r.lower->Is(Type::Number()) ?
-              Type::Smi(isolate_) : Type::None(isolate_);
-      Handle<Type> upper =
+              Type::Smi(zone()) : Type::None(zone());
+      Type* upper =
           l.upper->Is(Type::String()) || r.upper->Is(Type::String()) ?
-              Type::String(isolate_) :
+              Type::String(zone()) :
           l.upper->Is(Type::Number()) && r.upper->Is(Type::Number()) ?
-              Type::Number(isolate_) : Type::NumberOrString(isolate_);
+              Type::Number(zone()) : Type::NumberOrString(zone());
       NarrowType(expr, Bounds(lower, upper));
       break;
     }
@@ -713,7 +713,7 @@
     case Token::MOD:
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
-      NarrowType(expr, Bounds(Type::Smi(isolate_), Type::Number(isolate_)));
+      NarrowType(expr, Bounds(Type::Smi(zone()), Type::Number(zone())));
       break;
     default:
       UNREACHABLE();
@@ -723,7 +723,9 @@
 
 void AstTyper::VisitCompareOperation(CompareOperation* expr) {
   // Collect type feedback.
-  Handle<Type> left_type, right_type, combined_type;
+  Type* left_type;
+  Type* right_type;
+  Type* combined_type;
   oracle()->CompareType(expr->CompareOperationFeedbackId(),
       &left_type, &right_type, &combined_type);
   NarrowLowerType(expr->left(), left_type);
@@ -733,7 +735,7 @@
   RECURSE(Visit(expr->left()));
   RECURSE(Visit(expr->right()));
 
-  NarrowType(expr, Bounds(Type::Boolean(isolate_)));
+  NarrowType(expr, Bounds(Type::Boolean(zone())));
 }
 
 
diff --git a/src/typing.h b/src/typing.h
index ec9132f..0517812 100644
--- a/src/typing.h
+++ b/src/typing.h
@@ -70,13 +70,12 @@
   Store store_;
 
   TypeFeedbackOracle* oracle() { return &oracle_; }
-  Zone* zone() const { return info_->zone(); }
 
   void NarrowType(Expression* e, Bounds b) {
-    e->set_bounds(Bounds::Both(e->bounds(), b, isolate_));
+    e->set_bounds(Bounds::Both(e->bounds(), b, zone()));
   }
-  void NarrowLowerType(Expression* e, Handle<Type> t) {
-    e->set_bounds(Bounds::NarrowLower(e->bounds(), t, isolate_));
+  void NarrowLowerType(Expression* e, Type* t) {
+    e->set_bounds(Bounds::NarrowLower(e->bounds(), t, zone()));
   }
 
   Effects EnterEffects() {
diff --git a/src/version.cc b/src/version.cc
index 2fb96bd..17d326f 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -34,7 +34,7 @@
 // system so their names cannot be changed without changing the scripts.
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     24
-#define BUILD_NUMBER      20
+#define BUILD_NUMBER      21
 #define PATCH_LEVEL       0
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index 9b98d94..1e68bdf 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -187,7 +187,7 @@
   // register state
   // rax -- number of arguments
   // rdi -- function
-  // rbx -- type info cell with elements kind
+  // rbx -- allocation site with elements kind
   static Register registers_variable_args[] = { rdi, rbx, rax };
   static Register registers_no_args[] = { rdi, rbx };
 
@@ -5428,7 +5428,7 @@
 
 static void CreateArrayDispatchOneArgument(MacroAssembler* masm,
                                            AllocationSiteOverrideMode mode) {
-  // rbx - type info cell (if mode != DISABLE_ALLOCATION_SITES)
+  // rbx - allocation site (if mode != DISABLE_ALLOCATION_SITES)
   // rdx - kind (if mode != DISABLE_ALLOCATION_SITES)
   // rax - number of arguments
   // rdi - constructor?
@@ -5474,19 +5474,19 @@
     // We are going to create a holey array, but our kind is non-holey.
     // Fix kind and retry (only if we have an allocation site in the cell).
     __ incl(rdx);
-    __ movp(rcx, FieldOperand(rbx, Cell::kValueOffset));
+
     if (FLAG_debug_code) {
       Handle<Map> allocation_site_map =
           masm->isolate()->factory()->allocation_site_map();
-      __ Cmp(FieldOperand(rcx, 0), allocation_site_map);
-      __ Assert(equal, kExpectedAllocationSiteInCell);
+      __ Cmp(FieldOperand(rbx, 0), allocation_site_map);
+      __ Assert(equal, kExpectedAllocationSite);
     }
 
     // Save the resulting elements kind in type info. We can't just store r3
     // in the AllocationSite::transition_info field because elements kind is
     // restricted to a portion of the field...upper bits need to be left alone.
     STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
-    __ SmiAddConstant(FieldOperand(rcx, AllocationSite::kTransitionInfoOffset),
+    __ SmiAddConstant(FieldOperand(rbx, AllocationSite::kTransitionInfoOffset),
                       Smi::FromInt(kFastElementsKindPackedToHoley));
 
     __ bind(&normal_sequence);
@@ -5619,13 +5619,13 @@
   // AllocationSite, call an array constructor that doesn't use AllocationSites.
   __ Cmp(rbx, undefined_sentinel);
   __ j(equal, &no_info);
-  __ movp(rdx, FieldOperand(rbx, Cell::kValueOffset));
-  __ Cmp(FieldOperand(rdx, 0),
+  __ movp(rbx, FieldOperand(rbx, Cell::kValueOffset));
+  __ Cmp(FieldOperand(rbx, 0),
          masm->isolate()->factory()->allocation_site_map());
   __ j(not_equal, &no_info);
 
   // Only look at the lower 16 bits of the transition info.
-  __ movp(rdx, FieldOperand(rdx, AllocationSite::kTransitionInfoOffset));
+  __ movp(rdx, FieldOperand(rbx, AllocationSite::kTransitionInfoOffset));
   __ SmiToInteger32(rdx, rdx);
   STATIC_ASSERT(AllocationSite::ElementsKindBits::kShift == 0);
   __ and_(rdx, Immediate(AllocationSite::ElementsKindBits::kMask));
diff --git a/src/x64/codegen-x64.h b/src/x64/codegen-x64.h
index 811ac50..aa0961d 100644
--- a/src/x64/codegen-x64.h
+++ b/src/x64/codegen-x64.h
@@ -44,8 +44,8 @@
 
 class CodeGenerator: public AstVisitor {
  public:
-  explicit CodeGenerator(Isolate* isolate) {
-    InitializeAstVisitor(isolate);
+  explicit CodeGenerator(Zone* zone) {
+    InitializeAstVisitor(zone);
   }
 
   static bool MakeCode(CompilationInfo* info);
diff --git a/src/x64/macro-assembler-x64.cc b/src/x64/macro-assembler-x64.cc
index fd42b63..bf3e6e1 100644
--- a/src/x64/macro-assembler-x64.cc
+++ b/src/x64/macro-assembler-x64.cc
@@ -4932,10 +4932,17 @@
 
   // Check that there are no elements. Register rcx contains the current JS
   // object we've reached through the prototype chain.
+  Label no_elements;
   cmpq(empty_fixed_array_value,
        FieldOperand(rcx, JSObject::kElementsOffset));
+  j(equal, &no_elements);
+
+  // Second chance, the object may be using the empty slow element dictionary.
+  LoadRoot(kScratchRegister, Heap::kEmptySlowElementDictionaryRootIndex);
+  cmpq(kScratchRegister, FieldOperand(rcx, JSObject::kElementsOffset));
   j(not_equal, call_runtime);
 
+  bind(&no_elements);
   movp(rcx, FieldOperand(rbx, Map::kPrototypeOffset));
   cmpq(rcx, null_value);
   j(not_equal, &next);
diff --git a/src/x64/stub-cache-x64.cc b/src/x64/stub-cache-x64.cc
index c595f84..b563ac6 100644
--- a/src/x64/stub-cache-x64.cc
+++ b/src/x64/stub-cache-x64.cc
@@ -1113,7 +1113,7 @@
 #define __ ACCESS_MASM((masm()))
 
 
-Register StubCompiler::CheckPrototypes(Handle<Type> type,
+Register StubCompiler::CheckPrototypes(Handle<HeapType> type,
                                        Register object_reg,
                                        Handle<JSObject> holder,
                                        Register holder_reg,
@@ -1265,7 +1265,7 @@
 
 
 Register LoadStubCompiler::CallbackHandlerFrontend(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Register object_reg,
     Handle<JSObject> holder,
     Handle<Name> name,
@@ -2038,7 +2038,7 @@
 }
 
 
-Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<Type> type,
+Handle<Code> LoadStubCompiler::CompileLoadNonexistent(Handle<HeapType> type,
                                                       Handle<JSObject> last,
                                                       Handle<Name> name) {
   NonexistentHandlerFrontend(type, last, name);
@@ -2121,7 +2121,7 @@
 
 
 Handle<Code> LoadStubCompiler::CompileLoadGlobal(
-    Handle<Type> type,
+    Handle<HeapType> type,
     Handle<GlobalObject> global,
     Handle<PropertyCell> cell,
     Handle<Name> name,
@@ -2180,13 +2180,13 @@
   int receiver_count = types->length();
   int number_of_handled_maps = 0;
   for (int current = 0; current < receiver_count; ++current) {
-    Handle<Type> type = types->at(current);
+    Handle<HeapType> type = types->at(current);
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
       // Check map and tail call if there's a match
       __ Cmp(map_reg, map);
-      if (type->Is(Type::Number())) {
+      if (type->Is(HeapType::Number())) {
         ASSERT(!number_case.is_unused());
         __ bind(&number_case);
       }