diff --git a/src/arm/codegen-arm.cc b/src/arm/codegen-arm.cc
index 469d41f..59bc14e 100644
--- a/src/arm/codegen-arm.cc
+++ b/src/arm/codegen-arm.cc
@@ -36,7 +36,7 @@
 #include "debug.h"
 #include "ic-inl.h"
 #include "jsregexp.h"
-#include "jump-target-light-inl.h"
+#include "jump-target-inl.h"
 #include "parser.h"
 #include "regexp-macro-assembler.h"
 #include "regexp-stack.h"
@@ -79,12 +79,12 @@
 }
 
 
-void ICRuntimeCallHelper::BeforeCall(MacroAssembler* masm) const {
+void StubRuntimeCallHelper::BeforeCall(MacroAssembler* masm) const {
   masm->EnterInternalFrame();
 }
 
 
-void ICRuntimeCallHelper::AfterCall(MacroAssembler* masm) const {
+void StubRuntimeCallHelper::AfterCall(MacroAssembler* masm) const {
   masm->LeaveInternalFrame();
 }
 
@@ -165,6 +165,9 @@
 
   int slots = scope()->num_parameters() + scope()->num_stack_slots();
   ScopedVector<TypeInfo> type_info_array(slots);
+  for (int i = 0; i < slots; i++) {
+    type_info_array[i] = TypeInfo::Unknown();
+  }
   type_info_ = &type_info_array;
 
   ASSERT(allocator_ == NULL);
@@ -1150,7 +1153,7 @@
   }
   // Check that the *signed* result fits in a smi. Not necessary for AND, SAR
   // if the shift if more than 0 or SHR if the shit is more than 1.
-  if (!( (op_ == Token::AND && value_ >= 0) ||
+  if (!( (op_ == Token::AND) ||
         ((op_ == Token::SAR) && (shift_value > 0)) ||
         ((op_ == Token::SHR) && (shift_value > 1)))) {
     __ add(r3, int32, Operand(0x40000000), SetCC);
@@ -1411,10 +1414,8 @@
           default: UNREACHABLE();
         }
         deferred->BindExit();
-        TypeInfo result_type = TypeInfo::Integer32();
-        if (op == Token::BIT_AND && int_value >= 0) {
-          result_type = TypeInfo::Smi();
-        }
+        TypeInfo result_type =
+            (op == Token::BIT_AND) ? TypeInfo::Smi() : TypeInfo::Integer32();
         frame_->EmitPush(tos, result_type);
       }
       break;
@@ -5163,11 +5164,11 @@
 
     // Set the bit in the map to indicate that it has been checked safe for
     // default valueOf and set true result.
-    __ ldrb(scratch1_, FieldMemOperand(map_result_, Map::kBitField2Offset));
+    __ ldr(scratch1_, FieldMemOperand(map_result_, Map::kBitField2Offset));
     __ orr(scratch1_,
            scratch1_,
            Operand(1 << Map::kStringWrapperSafeForDefaultValueOf));
-    __ strb(scratch1_, FieldMemOperand(map_result_, Map::kBitField2Offset));
+    __ str(scratch1_, FieldMemOperand(map_result_, Map::kBitField2Offset));
     __ mov(map_result_, Operand(1));
     __ jmp(exit_label());
     __ bind(&false_result);
@@ -5418,97 +5419,14 @@
 
 
 void CodeGenerator::GenerateRegExpConstructResult(ZoneList<Expression*>* args) {
-  // No stub. This code only occurs a few times in regexp.js.
-  const int kMaxInlineLength = 100;
   ASSERT_EQ(3, args->length());
+
   Load(args->at(0));  // Size of array, smi.
   Load(args->at(1));  // "index" property value.
   Load(args->at(2));  // "input" property value.
-  {
-    VirtualFrame::SpilledScope spilled_scope(frame_);
-    Label slowcase;
-    Label done;
-    __ ldr(r1, MemOperand(sp, kPointerSize * 2));
-    STATIC_ASSERT(kSmiTag == 0);
-    STATIC_ASSERT(kSmiTagSize == 1);
-    __ tst(r1, Operand(kSmiTagMask));
-    __ b(ne, &slowcase);
-    __ cmp(r1, Operand(Smi::FromInt(kMaxInlineLength)));
-    __ b(hi, &slowcase);
-    // Smi-tagging is equivalent to multiplying by 2.
-    // Allocate RegExpResult followed by FixedArray with size in ebx.
-    // JSArray:   [Map][empty properties][Elements][Length-smi][index][input]
-    // Elements:  [Map][Length][..elements..]
-    // Size of JSArray with two in-object properties and the header of a
-    // FixedArray.
-    int objects_size =
-        (JSRegExpResult::kSize + FixedArray::kHeaderSize) / kPointerSize;
-    __ mov(r5, Operand(r1, LSR, kSmiTagSize + kSmiShiftSize));
-    __ add(r2, r5, Operand(objects_size));
-    __ AllocateInNewSpace(
-        r2,  // In: Size, in words.
-        r0,  // Out: Start of allocation (tagged).
-        r3,  // Scratch register.
-        r4,  // Scratch register.
-        &slowcase,
-        static_cast<AllocationFlags>(TAG_OBJECT | SIZE_IN_WORDS));
-    // r0: Start of allocated area, object-tagged.
-    // r1: Number of elements in array, as smi.
-    // r5: Number of elements, untagged.
-
-    // Set JSArray map to global.regexp_result_map().
-    // Set empty properties FixedArray.
-    // Set elements to point to FixedArray allocated right after the JSArray.
-    // Interleave operations for better latency.
-    __ ldr(r2, ContextOperand(cp, Context::GLOBAL_INDEX));
-    __ add(r3, r0, Operand(JSRegExpResult::kSize));
-    __ mov(r4, Operand(Factory::empty_fixed_array()));
-    __ ldr(r2, FieldMemOperand(r2, GlobalObject::kGlobalContextOffset));
-    __ str(r3, FieldMemOperand(r0, JSObject::kElementsOffset));
-    __ ldr(r2, ContextOperand(r2, Context::REGEXP_RESULT_MAP_INDEX));
-    __ str(r4, FieldMemOperand(r0, JSObject::kPropertiesOffset));
-    __ str(r2, FieldMemOperand(r0, HeapObject::kMapOffset));
-
-    // Set input, index and length fields from arguments.
-    __ ldm(ia_w, sp, static_cast<RegList>(r2.bit() | r4.bit()));
-    __ str(r1, FieldMemOperand(r0, JSArray::kLengthOffset));
-    __ add(sp, sp, Operand(kPointerSize));
-    __ str(r4, FieldMemOperand(r0, JSRegExpResult::kIndexOffset));
-    __ str(r2, FieldMemOperand(r0, JSRegExpResult::kInputOffset));
-
-    // Fill out the elements FixedArray.
-    // r0: JSArray, tagged.
-    // r3: FixedArray, tagged.
-    // r5: Number of elements in array, untagged.
-
-    // Set map.
-    __ mov(r2, Operand(Factory::fixed_array_map()));
-    __ str(r2, FieldMemOperand(r3, HeapObject::kMapOffset));
-    // Set FixedArray length.
-    __ mov(r6, Operand(r5, LSL, kSmiTagSize));
-    __ str(r6, FieldMemOperand(r3, FixedArray::kLengthOffset));
-    // Fill contents of fixed-array with the-hole.
-    __ mov(r2, Operand(Factory::the_hole_value()));
-    __ add(r3, r3, Operand(FixedArray::kHeaderSize - kHeapObjectTag));
-    // Fill fixed array elements with hole.
-    // r0: JSArray, tagged.
-    // r2: the hole.
-    // r3: Start of elements in FixedArray.
-    // r5: Number of elements to fill.
-    Label loop;
-    __ tst(r5, Operand(r5));
-    __ bind(&loop);
-    __ b(le, &done);  // Jump if r1 is negative or zero.
-    __ sub(r5, r5, Operand(1), SetCC);
-    __ str(r2, MemOperand(r3, r5, LSL, kPointerSizeLog2));
-    __ jmp(&loop);
-
-    __ bind(&slowcase);
-    __ CallRuntime(Runtime::kRegExpConstructResult, 3);
-
-    __ bind(&done);
-  }
-  frame_->Forget(3);
+  RegExpConstructResultStub stub;
+  frame_->SpillAll();
+  frame_->CallStub(&stub, 3);
   frame_->EmitPush(r0);
 }
 
@@ -5758,6 +5676,20 @@
 }
 
 
+void CodeGenerator::GenerateMathLog(ZoneList<Expression*>* args) {
+  ASSERT_EQ(args->length(), 1);
+  Load(args->at(0));
+  if (CpuFeatures::IsSupported(VFP3)) {
+    TranscendentalCacheStub stub(TranscendentalCache::LOG);
+    frame_->SpillAllButCopyTOSToR0();
+    frame_->CallStub(&stub, 1);
+  } else {
+    frame_->CallRuntime(Runtime::kMath_log, 1);
+  }
+  frame_->EmitPush(r0);
+}
+
+
 void CodeGenerator::GenerateObjectEquals(ZoneList<Expression*>* args) {
   ASSERT(args->length() == 2);
 
@@ -6537,7 +6469,7 @@
     case Token::INSTANCEOF: {
       Load(left);
       Load(right);
-      InstanceofStub stub;
+      InstanceofStub stub(InstanceofStub::kNoFlags);
       frame_->CallStub(&stub, 2);
       // At this point if instanceof succeeded then r0 == 0.
       __ tst(r0, Operand(r0));