diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index be32146eb3b9a1e36d879378583a4ba26210f351..58ceba2a993f994afca6c71a04c81ff73adc2e12 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,46 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * VM/Machine.cpp:
+        (JSC::fastToUInt32): Call toUInt32SlowCase function; no longer a member
+        of JSValue.
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::toInt32): Ditto.
+        (JSC::JSNumberCell::toUInt32): Ditto.
+
+        * kjs/JSValue.cpp:
+        (JSC::toInt32SlowCase): Made a non-member function.
+        (JSC::JSValue::toInt32SlowCase): Changed to call non-member function.
+        (JSC::toUInt32SlowCase): More of the same.
+        (JSC::JSValue::toUInt32SlowCase): Ditto.
+
+        * kjs/JSValue.h: Moved static member function so they are no longer
+        member functions at all.
+
+        * VM/CTI.h: Removed forward declaration of JSValue.
+        * VM/ExceptionHelpers.h: Ditto.
+        * kjs/CallData.h: Ditto.
+        * kjs/ConstructData.h: Ditto.
+        * kjs/JSGlobalObjectFunctions.h: Ditto.
+        * kjs/PropertyMap.h: Ditto.
+        * kjs/StructureID.h: Ditto.
+        * kjs/collector.h: Ditto.
+        * kjs/completion.h: Ditto.
+
+        * kjs/grammar.y:
+        (JSC::makeBitwiseNotNode): Call new non-member toInt32 function.
+        (JSC::makeLeftShiftNode): More of the same.
+        (JSC::makeRightShiftNode): Ditto.
+
+        * kjs/protect.h: Added a specialization for ProtectedPtr<JSValuePtr>
+        so this can be used with JSValuePtr.
+
 2008-10-18  Darin Adler  <darin@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/JavaScriptCore/VM/CTI.h b/JavaScriptCore/VM/CTI.h
index f6f83e112be529d0738d7c698ecaf93d7cbf411d..a4350c7ad995842c022bcca58c8134bf43dccb89 100644
--- a/JavaScriptCore/VM/CTI.h
+++ b/JavaScriptCore/VM/CTI.h
@@ -86,7 +86,6 @@ namespace JSC {
 
     class CodeBlock;
     class JSPropertyNameIterator;
-    class JSValue;
     class Machine;
     class Register;
     class RegisterFile;
diff --git a/JavaScriptCore/VM/ExceptionHelpers.h b/JavaScriptCore/VM/ExceptionHelpers.h
index 8a33fa9488613bd1e6a9de2515291c7ed17d5262..5ae479c6d326b7d3ebd52bce5a7a0c6f0256d8ce 100644
--- a/JavaScriptCore/VM/ExceptionHelpers.h
+++ b/JavaScriptCore/VM/ExceptionHelpers.h
@@ -40,7 +40,6 @@ namespace JSC {
     class JSGlobalData;
     class JSNotAnObjectErrorStub;
     class JSObject;
-    class JSValue;
     class Node;
 
     JSValuePtr createInterruptedExecutionException(JSGlobalData*);
diff --git a/JavaScriptCore/VM/Machine.cpp b/JavaScriptCore/VM/Machine.cpp
index f8cfb2b39c7fde76c0580ed8f62265d118567094..97faa6e868303c648602d41ac87915db715fa4a9 100644
--- a/JavaScriptCore/VM/Machine.cpp
+++ b/JavaScriptCore/VM/Machine.cpp
@@ -157,7 +157,7 @@ static ALWAYS_INLINE bool fastToUInt32(JSValuePtr value, uint32_t& arg)
         if (JSImmediate::getTruncatedUInt32(value, arg))
             return true;
         bool scratch;
-        arg = JSValue::toUInt32SlowCase(JSImmediate::getTruncatedInt32(value), scratch);
+        arg = toUInt32SlowCase(JSImmediate::getTruncatedInt32(value), scratch);
         return true;
     } else if (!JSImmediate::isImmediate(value) && Heap::isNumber(asCell(value)))
         arg = asNumberCell(value)->toUInt32();
diff --git a/JavaScriptCore/kjs/CallData.h b/JavaScriptCore/kjs/CallData.h
index 4beb0410b8aa69450443a2aa9fc99b7fc93bfcba..ef1c364bc0cf6c44c88f9307b89015dbb38972f0 100644
--- a/JavaScriptCore/kjs/CallData.h
+++ b/JavaScriptCore/kjs/CallData.h
@@ -37,7 +37,6 @@ namespace JSC {
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValue;
     class ScopeChainNode;
 
     enum CallType {
diff --git a/JavaScriptCore/kjs/ConstructData.h b/JavaScriptCore/kjs/ConstructData.h
index fe647922bbf25c6796336badd8fd91533ec01de7..0866ef28d4ad1fe0cf0b65490cb238ff469fb6b3 100644
--- a/JavaScriptCore/kjs/ConstructData.h
+++ b/JavaScriptCore/kjs/ConstructData.h
@@ -37,7 +37,6 @@ namespace JSC {
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValue;
     class ScopeChainNode;
 
     enum ConstructType {
diff --git a/JavaScriptCore/kjs/JSGlobalObjectFunctions.h b/JavaScriptCore/kjs/JSGlobalObjectFunctions.h
index 2e09a0c4e1a221a419b8ffe0e147b044e7c29bb0..d12539ce62a9f1c606e84828519b3069c8e83abe 100644
--- a/JavaScriptCore/kjs/JSGlobalObjectFunctions.h
+++ b/JavaScriptCore/kjs/JSGlobalObjectFunctions.h
@@ -31,7 +31,6 @@ namespace JSC {
     class ArgList;
     class ExecState;
     class JSObject;
-    class JSValue;
 
     // FIXME: These functions should really be in JSGlobalObject.cpp, but putting them there
     // is a 0.5% reduction.
diff --git a/JavaScriptCore/kjs/JSNumberCell.h b/JavaScriptCore/kjs/JSNumberCell.h
index 77db1f52e28cb594c53c5e5a29db6a220d364e54..eae4358240b90a5e38f4a471368cfe114babc693 100644
--- a/JavaScriptCore/kjs/JSNumberCell.h
+++ b/JavaScriptCore/kjs/JSNumberCell.h
@@ -241,7 +241,7 @@ namespace JSC {
         if (m_value >= -2147483648.0 && m_value < 2147483648.0)
             return static_cast<int32_t>(m_value);
         bool scratch;
-        return JSValue::toInt32SlowCase(m_value, scratch);
+        return JSC::toInt32SlowCase(m_value, scratch);
     }
 
     inline uint32_t JSNumberCell::toUInt32() const
@@ -249,7 +249,7 @@ namespace JSC {
         if (m_value >= 0.0 && m_value < 4294967296.0)
             return static_cast<uint32_t>(m_value);
         bool scratch;
-        return JSValue::toUInt32SlowCase(m_value, scratch);
+        return JSC::toUInt32SlowCase(m_value, scratch);
     }
 
     ALWAYS_INLINE JSValuePtr JSValue::toJSNumber(ExecState* exec) const
diff --git a/JavaScriptCore/kjs/JSValue.cpp b/JavaScriptCore/kjs/JSValue.cpp
index 27a0b28d3ddcda48fcc0e45efeed8efab1e8eb46..73580b0b4bca199f929df625d13068ed74be61ba 100644
--- a/JavaScriptCore/kjs/JSValue.cpp
+++ b/JavaScriptCore/kjs/JSValue.cpp
@@ -48,7 +48,7 @@ double JSValue::toIntegerPreserveNaN(ExecState* exec) const
     return trunc(toNumber(exec));
 }
 
-int32_t JSValue::toInt32SlowCase(double d, bool& ok)
+int32_t toInt32SlowCase(double d, bool& ok)
 {
     ok = true;
 
@@ -70,10 +70,10 @@ int32_t JSValue::toInt32SlowCase(double d, bool& ok)
 
 int32_t JSValue::toInt32SlowCase(ExecState* exec, bool& ok) const
 {
-    return JSValue::toInt32SlowCase(toNumber(exec), ok);
+    return JSC::toInt32SlowCase(toNumber(exec), ok);
 }
 
-uint32_t JSValue::toUInt32SlowCase(double d, bool& ok)
+uint32_t toUInt32SlowCase(double d, bool& ok)
 {
     ok = true;
 
@@ -93,7 +93,7 @@ uint32_t JSValue::toUInt32SlowCase(double d, bool& ok)
 
 uint32_t JSValue::toUInt32SlowCase(ExecState* exec, bool& ok) const
 {
-    return JSValue::toUInt32SlowCase(toNumber(exec), ok);
+    return JSC::toUInt32SlowCase(toNumber(exec), ok);
 }
 
 float JSValue::toFloat(ExecState* exec) const
diff --git a/JavaScriptCore/kjs/JSValue.h b/JavaScriptCore/kjs/JSValue.h
index 5a1d345551567b1455d8d36645e3eaf0c579488b..29f2636985a9de9e0394f0cf271d079c04ca88d4 100644
--- a/JavaScriptCore/kjs/JSValue.h
+++ b/JavaScriptCore/kjs/JSValue.h
@@ -115,10 +115,6 @@ namespace JSC {
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
 
-        // These are identical logic to above, and faster than jsNumber(number)->toInt32(exec)
-        static int32_t toInt32(double);
-        static uint32_t toUInt32(double);
-
         // Floating point conversions.
         float toFloat(ExecState*) const;
 
@@ -126,9 +122,6 @@ namespace JSC {
         void mark();
         bool marked() const;
 
-        static int32_t toInt32SlowCase(double, bool& ok);
-        static uint32_t toUInt32SlowCase(double, bool& ok);
-
         // Object operations, with the toObject operation included.
         JSValuePtr get(ExecState*, const Identifier& propertyName) const;
         JSValuePtr get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
@@ -157,6 +150,12 @@ namespace JSC {
         uint32_t toUInt32SlowCase(ExecState*, bool& ok) const;
     };
 
+    // These are identical logic to the JSValue functions above, and faster than jsNumber(number)->toInt32().
+    int32_t toInt32(double);
+    uint32_t toUInt32(double);
+    int32_t toInt32SlowCase(double, bool& ok);
+    uint32_t toUInt32SlowCase(double, bool& ok);
+
     inline JSValue::JSValue()
     {
     }
@@ -223,7 +222,7 @@ namespace JSC {
         return toUInt32SlowCase(exec, ok);
     }
 
-    inline int32_t JSValue::toInt32(double val)
+    inline int32_t toInt32(double val)
     {
         if (!(val >= -2147483648.0 && val < 2147483648.0)) {
             bool ignored;
@@ -232,7 +231,7 @@ namespace JSC {
         return static_cast<int32_t>(val);
     }
 
-    inline uint32_t JSValue::toUInt32(double val)
+    inline uint32_t toUInt32(double val)
     {
         if (!(val >= 0.0 && val < 4294967296.0)) {
             bool ignored;
diff --git a/JavaScriptCore/kjs/PropertyMap.h b/JavaScriptCore/kjs/PropertyMap.h
index bf821a0e19202076b1b8aef4d2a5a88aaed4c242..b8d07f8491d0500faab1c1318f272f5dc969ecc3 100644
--- a/JavaScriptCore/kjs/PropertyMap.h
+++ b/JavaScriptCore/kjs/PropertyMap.h
@@ -35,7 +35,6 @@
 namespace JSC {
 
     class JSObject;
-    class JSValue;
     class PropertyNameArray;
 
     typedef JSValuePtr* PropertyStorage;
diff --git a/JavaScriptCore/kjs/StructureID.h b/JavaScriptCore/kjs/StructureID.h
index 6aaf884533e65a5ec3b58fcffa5246792267d880..4a8047cabbb49791ba6f599ec2c6c5e3d6e27d81 100644
--- a/JavaScriptCore/kjs/StructureID.h
+++ b/JavaScriptCore/kjs/StructureID.h
@@ -42,7 +42,6 @@
 
 namespace JSC {
 
-    class JSValue;
     class PropertyNameArray;
     class PropertyNameArrayData;
     class StructureIDChain;
diff --git a/JavaScriptCore/kjs/collector.h b/JavaScriptCore/kjs/collector.h
index 80f9c95de842031048c7a1053fcbade474e771a7..e239ccb2b2964b925833d7f39e685db3818233ee 100644
--- a/JavaScriptCore/kjs/collector.h
+++ b/JavaScriptCore/kjs/collector.h
@@ -43,7 +43,6 @@ namespace JSC {
     class CollectorBlock;
     class JSCell;
     class JSGlobalData;
-    class JSValue;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
     enum HeapType { PrimaryHeap, NumberHeap };
diff --git a/JavaScriptCore/kjs/completion.h b/JavaScriptCore/kjs/completion.h
index 623e8be3e3fd3953ea95ee1c18e2c3cce278af06..3c91a01df8e39817423f67d1c15738e7a5bc816b 100644
--- a/JavaScriptCore/kjs/completion.h
+++ b/JavaScriptCore/kjs/completion.h
@@ -27,8 +27,6 @@
 
 namespace JSC {
 
-    class JSValue;
-
     enum ComplType { Normal, Break, Continue, ReturnValue, Throw, Interrupted };
 
     /*
diff --git a/JavaScriptCore/kjs/grammar.y b/JavaScriptCore/kjs/grammar.y
index 66ad17c7ee3cdee9ae6fc0b85178bdf3569632ca..b7a2c9ac5d148451bd4e8d4d2527608469594f99 100644
--- a/JavaScriptCore/kjs/grammar.y
+++ b/JavaScriptCore/kjs/grammar.y
@@ -1418,7 +1418,7 @@ static NumberNode* makeNumberNode(void* globalPtr, double d)
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
-        return makeNumberNode(globalPtr, ~JSValue::toInt32(static_cast<NumberNode*>(expr)->value()));
+        return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
     return new BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
@@ -1469,14 +1469,14 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, JSValue::toInt32(static_cast<NumberNode*>(expr1)->value()) << (JSValue::toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
     return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalPtr, JSValue::toInt32(static_cast<NumberNode*>(expr1)->value()) >> (JSValue::toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
+        return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
     return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
diff --git a/JavaScriptCore/kjs/protect.h b/JavaScriptCore/kjs/protect.h
index 25ed71b2fa343297de7e13aec87f3f8ae50971d8..74c20d4f992bd1dbe0411259c01d7558d01a3c78 100644
--- a/JavaScriptCore/kjs/protect.h
+++ b/JavaScriptCore/kjs/protect.h
@@ -68,7 +68,7 @@ namespace JSC {
         operator T*() const { return m_ptr; }
         T* operator->() const { return m_ptr; }
         
-        bool operator!() const { return m_ptr == NULL; }
+        bool operator!() const { return !m_ptr; }
 
         ProtectedPtr& operator=(const ProtectedPtr&);
         ProtectedPtr& operator=(T*);
@@ -77,6 +77,23 @@ namespace JSC {
         T* m_ptr;
     };
 
+    template <> class ProtectedPtr<JSValuePtr> {
+    public:
+        ProtectedPtr() { }
+        ProtectedPtr(JSValuePtr ptr) : m_ptr(ptr) { }
+
+        template <class U> ProtectedPtr(const ProtectedPtr<U>& ptr) : m_ptr(ptr) { }
+        
+        JSValuePtr get() const { return m_ptr; }
+        operator JSValuePtr() const { return m_ptr; }
+        JSValue* operator->() const { return m_ptr; }
+        
+        bool operator!() const { return !m_ptr; }
+        
+    private:
+        ProtectedPtr<JSValue> m_ptr;
+    };
+
     template <class T> ProtectedPtr<T>::ProtectedPtr(T* ptr)
         : m_ptr(ptr)
     {
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index c8606c7c144eeb4d8b73e6a2059a6b9bd486257e..1a24660d1f9b6066e0f80d639751fa632c9d168a 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,14 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * JSValueWrapper.h: Use JSValuePtr instead of JSValue*.
+
 2008-10-18  Darin Adler  <darin@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/JavaScriptGlue/JSValueWrapper.h b/JavaScriptGlue/JSValueWrapper.h
index 5c3329755eea36ff4c7d77ff074712979325239b..8fc80f5dadc8e5efed04461ac89d9086caa8e255 100644
--- a/JavaScriptGlue/JSValueWrapper.h
+++ b/JavaScriptGlue/JSValueWrapper.h
@@ -35,15 +35,15 @@
 
 class JSValueWrapper {
 public:
-    JSValueWrapper(JSValue *inValue);
+    JSValueWrapper(JSValuePtr);
     virtual ~JSValueWrapper();
 
     static void GetJSObectCallBacks(JSObjectCallBacks& callBacks);
 
-    JSValue *GetValue();
+    JSValuePtr GetValue();
 
 private:
-    ProtectedPtr<JSValue> fValue;
+    ProtectedPtr<JSValuePtr> fValue;
     
     static void JSObjectDispose(void *data);
     static CFArrayRef JSObjectCopyPropertyNames(void *data);
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index c0aa42a10381cdddf88bd23d012859289253e53d..b1de273aded9f2387abe3c4a13e3039c1eb6f2fd 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,72 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * bindings/js/JSCustomXPathNSResolver.h: Removed declaration of JSValue
+        and used JSValuePtr instead.
+        * bindings/js/JSEventTarget.h: Ditto.
+        * bindings/js/JSNodeFilterCondition.h: Ditto.
+        * bindings/js/ScheduledAction.h: Ditto.
+        * bindings/js/ScriptController.h: Ditto.
+        * bindings/objc/WebScriptObjectPrivate.h: Ditto.
+        * bridge/c/c_utility.h: Ditto.
+        * bridge/jni/jni_jsobject.h: Ditto.
+        * bridge/jni/jni_utility.h: Ditto.
+        * bridge/objc/WebScriptObject.h: Ditto.
+        * dom/Traversal.h: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/JavaScriptProfile.h: Ditto.
+        * inspector/JavaScriptProfileNode.h: Ditto.
+        * loader/FrameLoader.h: Ditto.
+        * page/Console.h: Ditto.
+        * plugins/MimeTypeArray.h: Ditto.
+        * plugins/Plugin.h: Ditto.
+        * plugins/PluginArray.h: Ditto.
+        * plugins/PluginView.cpp:
+        (WebCore::getString): Ditto.
+        (WebCore::PluginView::performRequest): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp: Ditto.
+        * plugins/qt/PluginViewQt.cpp: Ditto.
+        * plugins/win/PluginViewWin.cpp: Ditto.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject): Use JSValuePtr and JSObject*
+        instead of JSValue*.
+        * bridge/qt/qt_class.h: Ditto.
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::mark): Ditto.
+        (JSC::Bindings::QtInstance::invokeMethod): Ditto.
+        (JSC::Bindings::QtInstance::defaultValue): Ditto.
+        (JSC::Bindings::QtInstance::stringValue): Ditto.
+        (JSC::Bindings::QtInstance::numberValue): Ditto.
+        (JSC::Bindings::QtInstance::booleanValue): Ditto.
+        (JSC::Bindings::QtInstance::valueOf): Ditto.
+        (JSC::Bindings::QtField::valueFromInstance): Ditto.
+        (JSC::Bindings::QtField::setValueToInstance): Ditto.
+        * bridge/qt/qt_instance.h: Ditto.
+        * bridge/qt/qt_runtime.cpp: Ditto.
+        (JSC::Bindings::valueRealType): Ditto.
+        (JSC::Bindings::convertValueToQVariant): Ditto.
+        (JSC::Bindings::convertQVariantToValue): Ditto.
+        (JSC::Bindings::findMethodIndex): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::call): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): Ditto.
+        (JSC::Bindings::QtRuntimeConnectionMethod::call): Ditto.
+        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter): Ditto.
+        (JSC::Bindings::QtArray::setValueAt): Ditto.
+        (JSC::Bindings::QtArray::valueAt): Ditto.
+        * bridge/qt/qt_runtime.h: Ditto.
+
+        * bridge/testqtbindings.cpp:
+        (main): Use JSValuePtr.
+
 2008-10-18  Darin Adler  <darin@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.h b/WebCore/bindings/js/JSCustomXPathNSResolver.h
index 6d9fb57a4e166ca24d27a9e807816cc5b32380f8..40d258efe1f25004e71edc922a0881b3e23740bd 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -29,13 +29,13 @@
 #if ENABLE(XPATH)
 
 #include "XPathNSResolver.h"
+#include <kjs/JSValue.h>
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 
 namespace JSC {
     class ExecState;
     class JSObject;
-    class JSValue;
 }
 
 namespace WebCore {
@@ -44,7 +44,7 @@ namespace WebCore {
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
-        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValue*);
+        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValuePtr);
         
         virtual ~JSCustomXPathNSResolver();
 
diff --git a/WebCore/bindings/js/JSEventTarget.h b/WebCore/bindings/js/JSEventTarget.h
index ccd20b451ac76fe1a8780ee052f93632b02a4435..561179cda2c975cf527c2c19016c28c97c677dd1 100644
--- a/WebCore/bindings/js/JSEventTarget.h
+++ b/WebCore/bindings/js/JSEventTarget.h
@@ -26,8 +26,9 @@
 #ifndef JSEventTarget_h
 #define JSEventTarget_h
 
+#include <kjs/JSValue.h>
+
 namespace JSC {
-    class JSValue;
     class ExecState;
 }
 
@@ -35,7 +36,7 @@ namespace WebCore {
 
     class EventTarget;
 
-    JSC::JSValue* toJS(JSC::ExecState*, EventTarget*);
+    JSC::JSValuePtr toJS(JSC::ExecState*, EventTarget*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.h b/WebCore/bindings/js/JSNodeFilterCondition.h
index e6c79ad387654f2760b09d5527654732ac4991c4..5dac42d6a26fe8b0571498ef21a28c3bb5fcabcf 100644
--- a/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -21,30 +21,27 @@
 #define JSNodeFilterCondition_h
 
 #include "NodeFilterCondition.h"
+#include <kjs/JSValue.h>
 #include <wtf/PassRefPtr.h>
 
-namespace JSC {
-    class JSValue;
-}
-
 namespace WebCore {
 
     class Node;
 
     class JSNodeFilterCondition : public NodeFilterCondition {
     public:
-        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue* filter)
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValuePtr filter)
         {
             return adoptRef(new JSNodeFilterCondition(filter));
         }
 
     private:
-        JSNodeFilterCondition(JSC::JSValue* filter);
+        JSNodeFilterCondition(JSC::JSValuePtr filter);
 
         virtual short acceptNode(JSC::ExecState*, Node*) const;
         virtual void mark();
 
-        JSC::JSValue* m_filter;
+        JSC::JSValuePtr m_filter;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScheduledAction.h b/WebCore/bindings/js/ScheduledAction.h
index e1144923e98573c4e9146a480628b1db9eb447e4..5abc3ecff6a379cb5aadaaede98d09d5bec85803 100644
--- a/WebCore/bindings/js/ScheduledAction.h
+++ b/WebCore/bindings/js/ScheduledAction.h
@@ -43,8 +43,8 @@ namespace WebCore {
         void execute(JSDOMWindowShell*);
 
     private:
-        JSC::ProtectedPtr<JSC::JSValue> m_function;
-        Vector<JSC::ProtectedPtr<JSC::JSValue> > m_args;
+        JSC::ProtectedPtr<JSC::JSValuePtr> m_function;
+        Vector<JSC::ProtectedPtr<JSC::JSValuePtr> > m_args;
         String m_code;
     };
 
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 59514af743b8f7bf20cc46aa04eb9ac33e2d7f31..fdfe220ac49c8ec67d5f0275387b8f416a57726e 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -40,7 +40,6 @@ struct NPObject;
 
 namespace JSC {
     class JSGlobalObject;
-    class JSValue;
 
     namespace Bindings {
         class Instance;
diff --git a/WebCore/bindings/objc/WebScriptObjectPrivate.h b/WebCore/bindings/objc/WebScriptObjectPrivate.h
index 7050141a57a452b35dad396ca62ec5b307357799..51702777397c79e410bf46f6a69cf87b646f93d6 100644
--- a/WebCore/bindings/objc/WebScriptObjectPrivate.h
+++ b/WebCore/bindings/objc/WebScriptObjectPrivate.h
@@ -27,13 +27,12 @@
 #define _WEB_SCRIPT_OBJECT_PRIVATE_H_
 
 #import "WebScriptObject.h"
-
+#import <kjs/JSValue.h>
 #import <wtf/PassRefPtr.h>
 
 namespace JSC {
     
     class JSObject;
-    class JSValue;
     
     namespace Bindings {
         class RootObject;
@@ -47,7 +46,7 @@ namespace WebCore {
 }
 
 @interface WebScriptObject (Private)
-+ (id)_convertValueToObjcValue:(JSC::JSValue*)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
++ (id)_convertValueToObjcValue:(JSC::JSValuePtr)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
 + (id)scriptObjectForJSObject:(JSObjectRef)jsObject originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
 - (id)_init;
 - (id)_initWithJSObject:(JSC::JSObject*)imp originRootObject:(PassRefPtr<JSC::Bindings::RootObject>)originRootObject rootObject:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
diff --git a/WebCore/bridge/c/c_utility.h b/WebCore/bridge/c/c_utility.h
index da728c8f14daa15630691ec8dcb57abd55e57d49..e3f270d8e2ad24415da1b50e8544ec5fd837d61c 100644
--- a/WebCore/bridge/c/c_utility.h
+++ b/WebCore/bridge/c/c_utility.h
@@ -29,6 +29,7 @@
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
 #include "npruntime_internal.h"
+#include <kjs/JSValue.h>
 
 namespace WebCore {
     class String;
@@ -38,7 +39,6 @@ namespace JSC {
 
 class ExecState;
 class Identifier;
-class JSValue;
 
 namespace Bindings {
 
@@ -57,8 +57,8 @@ enum NP_ValueType {
 };
 
 WebCore::String convertNPStringToUTF16(const NPString *string);
-void convertValueToNPVariant(ExecState*, JSValue*, NPVariant* result);
-JSValue* convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
+void convertValueToNPVariant(ExecState*, JSValuePtr, NPVariant* result);
+JSValuePtr convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
 Identifier identifierFromNPIdentifier(const NPUTF8* name);
 
 struct PrivateIdentifier {
diff --git a/WebCore/bridge/jni/jni_jsobject.h b/WebCore/bridge/jni/jni_jsobject.h
index f58705ea8caf05a46bf17269add7544bc6eec98e..b85be7f7f51321f0fbec89cdb7cc5e28b2455ab9 100644
--- a/WebCore/bridge/jni/jni_jsobject.h
+++ b/WebCore/bridge/jni/jni_jsobject.h
@@ -29,8 +29,8 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include <CoreFoundation/CoreFoundation.h>
-
 #include <JavaVM/jni.h>
+#include <kjs/JSValue.h>
 #include <wtf/RefPtr.h>
 
 #define jlong_to_ptr(a) ((void*)(uintptr_t)(a))
@@ -42,7 +42,6 @@ namespace JSC {
 class ArgList;
 class ExecState;
 class JSObject;
-class JSValue;
 
 namespace Bindings {
 
@@ -91,8 +90,8 @@ public:
     
     static jvalue invoke(JSObjectCallContext*);
 
-    jobject convertValueToJObject(JSValue*) const;
-    JSValue* convertJObjectToValue(ExecState*, jobject) const;
+    jobject convertValueToJObject(JSValuePtr) const;
+    JSValuePtr convertJObjectToValue(ExecState*, jobject) const;
     void getListFromJArray(ExecState*, jobjectArray, ArgList&) const;
     
     RootObject* rootObject() const;
diff --git a/WebCore/bridge/jni/jni_utility.h b/WebCore/bridge/jni/jni_utility.h
index 292ebce8963dc70cb9cc0c5e3e85eea009d2f203..968bee02ef12fd3bcd63d604499908eb9155c789 100644
--- a/WebCore/bridge/jni/jni_utility.h
+++ b/WebCore/bridge/jni/jni_utility.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(MAC_JAVA_BRIDGE)
 
+#include <kjs/JSValue.h>
 #include <JavaVM/jni.h>
 
 // The order of these items can not be modified as they are tightly
@@ -54,7 +55,6 @@ namespace JSC {
 
 class ExecState;
 class JSObject;    
-class JSValue;
 
 namespace Bindings {
 
@@ -72,7 +72,7 @@ JNIType JNITypeFromClassName(const char *name);
 JNIType JNITypeFromPrimitiveType(char type);
 const char *signatureFromPrimitiveType(JNIType type);
 
-jvalue convertValueToJValue(ExecState *exec, JSValue *value, JNIType _JNIType, const char *javaClassName);
+jvalue convertValueToJValue(ExecState*, JSValuePtr, JNIType, const char* javaClassName);
 
 jvalue getJNIField(jobject obj, JNIType type, const char *name, const char *signature);
 
@@ -277,7 +277,7 @@ T callJNIStaticMethod(jclass cls, const char* methodName, const char* methodSign
     return result;
 }
     
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue*& exceptionDescription);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValuePtr& exceptionDescription);
 
 } // namespace Bindings
 
diff --git a/WebCore/bridge/objc/WebScriptObject.h b/WebCore/bridge/objc/WebScriptObject.h
index 36e89921ace4bc137b6e1b23b8812911864cbf97..7942635257f3a65f1d63791fce7255209f530441 100644
--- a/WebCore/bridge/objc/WebScriptObject.h
+++ b/WebCore/bridge/objc/WebScriptObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,8 +24,7 @@
  */
 
 #import <Foundation/Foundation.h>
-
-#include "runtime_root.h"
+#import "runtime_root.h"
 
 @class WebUndefined;
 
@@ -35,7 +34,7 @@
 + (NSString *)webScriptNameForKey:(const char *)name;
 + (BOOL)isKeyExcludedFromWebScript:(const char *)name;
 
-+ (id)_convertValueToObjcValue:(JSC::JSValue *)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
++ (id)_convertValueToObjcValue:(JSC::JSValuePtr)value originRootObject:(JSC::Bindings::RootObject*)originRootObject rootObject:(JSC::Bindings::RootObject*)rootObject;
 - _initWithJSObject:(JSC::JSObject*)imp originRootObject:(PassRefPtr<JSC::Bindings::RootObject>)originRootObject rootObject:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
 - (JSC::JSObject *)_imp;
 @end
diff --git a/WebCore/bridge/qt/qt_class.cpp b/WebCore/bridge/qt/qt_class.cpp
index ca8cb2a8560be57e95a61357eea735c25f3f1b8a..21aaa9a26f4c70d244c0d65223d2a3a01eee424f 100644
--- a/WebCore/bridge/qt/qt_class.cpp
+++ b/WebCore/bridge/qt/qt_class.cpp
@@ -63,17 +63,17 @@ const char* QtClass::name() const
 }
 
 // We use this to get at signals (so we can return a proper function object,
-// and not get wrapped in RuntimeMethod).  Also, use this for methods,
-// so we can cache the JSValue* and return the same JSValue for the same
-// identifier...
-JSValue* QtClass::fallbackObject(ExecState *exec, Instance *inst, const Identifier &identifier)
+// and not get wrapped in RuntimeMethod). Also, use this for methods,
+// so we can cache the object and return the same object for the same
+// identifier.
+JSValuePtr QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
 {
     QtInstance* qtinst = static_cast<QtInstance*>(inst);
 
     QByteArray name(identifier.ascii());
 
     // First see if we have a cache hit
-    JSValue* val = qtinst->m_methods.value(name);
+    JSObject* val = qtinst->m_methods.value(name);
     if (val)
         return val;
 
@@ -85,7 +85,7 @@ JSValue* QtClass::fallbackObject(ExecState *exec, Instance *inst, const Identifi
     if (normal.contains('(') && (index = m_metaObject->indexOfMethod(normal)) != -1) {
         QMetaMethod m = m_metaObject->method(index);
         if (m.access() != QMetaMethod::Private) {
-            JSValue *val = new (exec) QtRuntimeMetaMethod(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
+            QtRuntimeMetaMethod* val = new (exec) QtRuntimeMetaMethod(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
             qtinst->m_methods.insert(name, val);
             return val;
         }
@@ -102,7 +102,7 @@ JSValue* QtClass::fallbackObject(ExecState *exec, Instance *inst, const Identifi
         signature.truncate(signature.indexOf('('));
 
         if (normal == signature) {
-            JSValue* val = new (exec) QtRuntimeMetaMethod(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
+            QtRuntimeMetaMethod* val = new (exec) QtRuntimeMetaMethod(exec, identifier, static_cast<QtInstance*>(inst), index, normal, false);
             qtinst->m_methods.insert(name, val);
             return val;
         }
diff --git a/WebCore/bridge/qt/qt_class.h b/WebCore/bridge/qt/qt_class.h
index 449648d1450a94d25ec02c05234b8aecf0d1bf5b..c83bb0f653c3e63800f8110389c0e395a17791ae 100644
--- a/WebCore/bridge/qt/qt_class.h
+++ b/WebCore/bridge/qt/qt_class.h
@@ -45,7 +45,7 @@ public:
     virtual MethodList methodsNamed(const Identifier&, Instance*) const;
     virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
-    virtual JSValue* fallbackObject(ExecState*, Instance*, const Identifier&);
+    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&);
 
 private:
     QtClass(const QtClass&); // prohibit copying
diff --git a/WebCore/bridge/qt/qt_instance.cpp b/WebCore/bridge/qt/qt_instance.cpp
index 22acca4a124b520fb2ef1e8065a2c74760bfed47..ce07b43493ce9c1204dc87b9fe48c554b86bbe34 100644
--- a/WebCore/bridge/qt/qt_instance.cpp
+++ b/WebCore/bridge/qt/qt_instance.cpp
@@ -154,11 +154,11 @@ void QtInstance::mark()
 {
     if (m_defaultMethod)
         m_defaultMethod->mark();
-    foreach(JSValue* val, m_methods.values()) {
+    foreach(JSObject* val, m_methods.values()) {
         if (val && !val->marked())
             val->mark();
     }
-    foreach(JSValue* val, m_children.values()) {
+    foreach(JSValuePtr val, m_children.values()) {
         if (val && !val->marked())
             val->mark();
     }
@@ -206,14 +206,14 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
     }
 }
 
-JSValue* QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
+JSValuePtr QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
 {
     // Implemented via fallbackMethod & QtRuntimeMetaMethod::callAsFunction
     return jsUndefined();
 }
 
 
-JSValue* QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValuePtr QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -222,7 +222,7 @@ JSValue* QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint)
     return valueOf(exec);
 }
 
-JSValue* QtInstance::stringValue(ExecState* exec) const
+JSValuePtr QtInstance::stringValue(ExecState* exec) const
 {
     // Hmm.. see if there is a toString defined
     QByteArray buf;
@@ -266,25 +266,25 @@ JSValue* QtInstance::stringValue(ExecState* exec) const
     return jsString(exec, buf.constData());
 }
 
-JSValue* QtInstance::numberValue(ExecState* exec) const
+JSValuePtr QtInstance::numberValue(ExecState* exec) const
 {
     return jsNumber(exec, 0);
 }
 
-JSValue* QtInstance::booleanValue() const
+JSValuePtr QtInstance::booleanValue() const
 {
     // ECMA 9.2
     return jsBoolean(true);
 }
 
-JSValue* QtInstance::valueOf(ExecState* exec) const
+JSValuePtr QtInstance::valueOf(ExecState* exec) const
 {
     return stringValue(exec);
 }
 
 // In qt_runtime.cpp
-JSValue* convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant);
-QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type hint, int *distance);
+JSValuePtr convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
+QVariant convertValueToQVariant(ExecState*, JSValuePtr, QMetaType::Type hint, int *distance);
 
 const char* QtField::name() const
 {
@@ -297,7 +297,7 @@ const char* QtField::name() const
     return ""; // deleted child object
 }
 
-JSValue* QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const QtInstance* instance = static_cast<const QtInstance*>(inst);
     QObject* obj = instance->getObject();
@@ -314,7 +314,7 @@ JSValue* QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
         else if (m_type == DynamicProperty)
             val = obj->property(m_dynamicProperty);
 
-        JSValue* ret = convertQVariantToValue(exec, inst->rootObject(), val);
+        JSValuePtr ret = convertQVariantToValue(exec, inst->rootObject(), val);
 
         // Need to save children so we can mark them
         if (m_type == ChildObject)
@@ -327,7 +327,7 @@ JSValue* QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
     }
 }
 
-void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValue* aValue) const
+void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValuePtr aValue) const
 {
     if (m_type == ChildObject) // QtScript doesn't allow setting to a named child
         return;
diff --git a/WebCore/bridge/qt/qt_instance.h b/WebCore/bridge/qt/qt_instance.h
index 8eb338c378621d02ed91afae450b25a2d594cbd2..4d3ed49c8968fe455a18de1a3e301e3265572f56 100644
--- a/WebCore/bridge/qt/qt_instance.h
+++ b/WebCore/bridge/qt/qt_instance.h
@@ -34,30 +34,29 @@ class QtClass;
 class QtField;
 class QtRuntimeMetaMethod;
 
-class QtInstance : public Instance
-{
+class QtInstance : public Instance {
 public:
-    ~QtInstance ();
+    ~QtInstance();
 
     virtual Class* getClass() const;
 
     virtual void begin();
     virtual void end();
 
-    virtual JSValue* valueOf(ExecState* exec) const;
-    virtual JSValue* defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValuePtr valueOf(ExecState*) const;
+    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
 
     virtual void mark(); // This isn't inherited
 
-    virtual JSValue* invokeMethod (ExecState *exec, const MethodList &method, const ArgList &args);
+    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
     virtual BindingLanguage getBindingLanguage() const { return QtLanguage; }
 
-    JSValue* stringValue(ExecState* exec) const;
-    JSValue* numberValue(ExecState* exec) const;
-    JSValue* booleanValue() const;
+    JSValuePtr stringValue(ExecState* exec) const;
+    JSValuePtr numberValue(ExecState* exec) const;
+    JSValuePtr booleanValue() const;
 
     QObject* getObject() const { return m_object; }
 
@@ -76,9 +75,9 @@ private:
     mutable QtClass* m_class;
     QPointer<QObject> m_object;
     QObject* m_hashkey;
-    mutable QHash<QByteArray,JSValue*> m_methods;
-    mutable QHash<QString,QtField*> m_fields;
-    mutable QSet<JSValue*> m_children;
+    mutable QHash<QByteArray, JSObject*> m_methods;
+    mutable QHash<QString, QtField*> m_fields;
+    mutable QSet<JSValuePtr> m_children;
     mutable QtRuntimeMetaMethod* m_defaultMethod;
 };
 
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 3013a79dc222b240c594617ac91b0e3a446edfd9..e751035fb616ca5f78b88b8b2e43eda98e29a49e 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -109,7 +109,7 @@ QDebug operator<<(QDebug dbg, const JSRealType &c)
 }
 #endif
 
-static JSRealType valueRealType(ExecState* exec, JSValue* val)
+static JSRealType valueRealType(ExecState* exec, JSValuePtr val)
 {
     if (val->isNumber())
         return Number;
@@ -137,7 +137,7 @@ static JSRealType valueRealType(ExecState* exec, JSValue* val)
     return String; // I don't know.
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
+QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
 {
     JSObject* object = 0;
     if (value->isObject()) {
@@ -293,7 +293,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                 int objdist = 0;
                 while(it != properties.end()) {
                     if (object->propertyIsEnumerable(exec, *it)) {
-                        JSValue* val = object->get(exec, *it);
+                        JSValuePtr val = object->get(exec, *it);
                         QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects);
                         if (objdist >= 0) {
                             UString ustring = (*it).ustring();
@@ -317,7 +317,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValue *val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -336,7 +336,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValue *val = array->get(exec, i);
+                    JSValuePtr val = array->get(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -370,7 +370,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                 QStringList result;
                 int len = rtarray->getLength();
                 for (int i = 0; i < len; ++i) {
-                    JSValue *val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
                     UString ustring = val->toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
@@ -384,7 +384,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                 QStringList result;
                 int len = array->length();
                 for (int i = 0; i < len; ++i) {
-                    JSValue* val = array->get(exec, i);
+                    JSValuePtr val = array->get(exec, i);
                     UString ustring = val->toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
@@ -587,7 +587,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                     QObjectList result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValue *val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -606,7 +606,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                     QObjectList result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValue* val = array->get(exec, i);
+                        JSValuePtr val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -638,7 +638,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                     QList<int> result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValue *val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -657,7 +657,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
                     QList<int> result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValue* val = array->get(exec, i);
+                        JSValuePtr val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -701,13 +701,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type
     return ret;
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type hint, int *distance)
+QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance)
 {
     HashSet<JSObject*> visitedObjects;
     return convertValueToQVariant(exec, value, hint, distance, &visitedObjects);
 }
 
-JSValue* convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
+JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
 {
     // Variants with QObject * can be isNull but not a null pointer
     // An empty QString variant is also null
@@ -808,7 +808,7 @@ JSValue* convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, co
         QVariantMap::const_iterator i = map.constBegin();
         while (i != map.constEnd()) {
             QString s = i.key();
-            JSValue* val = convertQVariantToValue(exec, root, i.value());
+            JSValuePtr val = convertQVariantToValue(exec, root, i.value());
             if (val) {
                 PutPropertySlot slot;
                 ret->put(exec, Identifier(exec, (const UChar *)s.constData(), s.length()), val, slot);
@@ -1134,7 +1134,7 @@ static int findMethodIndex(ExecState* exec,
         bool converted = true;
         int matchDistance = 0;
         for (int i = 0; converted && i < types.count() - 1; ++i) {
-            JSValue* arg = i < jsArgs.size() ? jsArgs.at(exec, i) : jsUndefined();
+            JSValuePtr arg = i < jsArgs.size() ? jsArgs.at(exec, i) : jsUndefined();
 
             int argdistance = -1;
             QVariant v = convertValueToQVariant(exec, arg, types.at(i+1).typeId(), &argdistance);
@@ -1282,7 +1282,7 @@ void QtRuntimeMetaMethod::mark()
         d->m_disconnect->mark();
 }
 
-JSValue* QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue* thisValue, const ArgList& args)
+JSValuePtr QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
 {
     QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(functionObject)->d_func();
 
@@ -1340,13 +1340,13 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(ExecState* exec, const Identifier&
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValue *QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValuePtr QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // QtScript always returns 0
     return jsNumber(exec, 0);
 }
 
-JSValue *QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValuePtr QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(slot.slotBase());
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1356,7 +1356,7 @@ JSValue *QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& i
     return d->m_connect;
 }
 
-JSValue* QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValuePtr QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(slot.slotBase());
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1380,7 +1380,7 @@ QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, const Iden
     d->m_isConnect = isConnect;
 }
 
-JSValue* QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue* thisValue, const ArgList& args)
+JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(functionObject)->d_func();
 
@@ -1428,7 +1428,7 @@ JSValue* QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObje
 
                         // ### DropAllLocks
                         // This is resolved at this point in QtScript
-                        JSValue* val = thisObject->get(exec, funcIdent);
+                        JSValuePtr val = thisObject->get(exec, funcIdent);
                         JSObject* asFuncObj = val->toObject(exec);
 
                         if (asFuncObj->getCallData(callData) != CallTypeNone) {
@@ -1526,7 +1526,7 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(ExecState* exec, const Identi
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValue *QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValuePtr QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // we have one formal argument, and one optional
     return jsNumber(exec, 1);
@@ -1692,7 +1692,7 @@ template <typename T> RootObject* QtArray<T>::rootObject() const
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-template <typename T> void QtArray<T>::setValueAt(ExecState *exec, unsigned int index, JSValue *aValue) const
+template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
 {
     // QtScript sets the value, but doesn't forward it to the original source
     // (e.g. if you do 'object.intList[5] = 6', the object is not updated, but the
@@ -1706,7 +1706,7 @@ template <typename T> void QtArray<T>::setValueAt(ExecState *exec, unsigned int
 }
 
 
-template <typename T> JSValue* QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
+template <typename T> JSValuePtr QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
 {
     if (index < m_length) {
         T val = m_list.at(index);
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index bf6f7d545ba3e4548bf9a19611ca11eb09be8990..a91f8e5e2e447bd8e273334f67137aa9bbaa30be 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -56,8 +56,8 @@ public:
         : m_type(ChildObject), m_childObject(child)
         {}
 
-    virtual JSValue* valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValue*) const;
+    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
     virtual const char* name() const;
     QtFieldType fieldType() const {return m_type;}
 private:
@@ -98,8 +98,8 @@ public:
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue *aValue) const;
-    virtual JSValue *valueAt(ExecState *exec, unsigned int index) const;
+    virtual void setValueAt(ExecState*, unsigned index, JSValuePtr) const;
+    virtual JSValuePtr valueAt(ExecState*, unsigned index) const;
     virtual unsigned int getLength() const {return m_length;}
 
 private:
@@ -170,10 +170,10 @@ protected:
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValue* call(ExecState* exec, JSObject* functionObject, JSValue* thisValue, const ArgList& args);
-    static JSValue* lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue* connectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValue* disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
+    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValuePtr connectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValuePtr disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
 };
 
 class QtConnectionObject;
@@ -189,8 +189,8 @@ protected:
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValue* call(ExecState* exec, JSObject* functionObject, JSValue* thisValue, const ArgList& args);
-    static JSValue* lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
+    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
@@ -219,7 +219,7 @@ private:
     ProtectedPtr<JSObject> m_funcObject;
 };
 
-QVariant convertValueToQVariant(ExecState* exec, JSValue* value, QMetaType::Type hint, int *distance);
+QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance);
 
 } // namespace Bindings
 } // namespace JSC
diff --git a/WebCore/bridge/testqtbindings.cpp b/WebCore/bridge/testqtbindings.cpp
index 41a9a3a4f9ff86a18e4fbb820c29cb08a342cfd0..59afbf3f659cb1b4d0b57b04fa106a2501ca08a3 100644
--- a/WebCore/bridge/testqtbindings.cpp
+++ b/WebCore/bridge/testqtbindings.cpp
@@ -114,11 +114,11 @@ int main(int argc, char** argv)
             
             if (comp.complType() == Throw) {
                 qDebug() << "exception thrown";
-                JSValue* exVal = comp.value();
+                JSValuePtr exVal = comp.value();
                 char* msg = exVal->toString(exec).ascii();
                 int lineno = -1;
                 if (exVal->type() == ObjectType) {
-                    JSValue* lineVal = exVal->getObject()->get(exec, Identifier("line"));
+                    JSValuePtr lineVal = exVal->getObject()->get(exec, Identifier("line"));
                     if (lineVal->type() == NumberType)
                         lineno = int(lineVal->toNumber(exec));
                 }
diff --git a/WebCore/dom/Traversal.h b/WebCore/dom/Traversal.h
index abb9e80cf1a5db7668414b4539d455bbd6abef79..6e871037eeb5222c2d5d4d5f2640c9640441e569 100644
--- a/WebCore/dom/Traversal.h
+++ b/WebCore/dom/Traversal.h
@@ -29,7 +29,6 @@
 #include <wtf/RefPtr.h>
 
 namespace JSC {
-    class JSValue;
     class ExecState;
 }
 
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index 75898d7d42d85acd9ad9a8a8dbb43bccb93ceab2..e8c036f4b97f8b9cd70f0490b8da0ff04cabc84f 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -203,7 +203,7 @@ struct ConsoleMessage {
     MessageSource source;
     MessageLevel level;
     String message;
-    Vector<ProtectedPtr<JSValue> > wrappedArguments;
+    Vector<ProtectedPtr<JSValuePtr> > wrappedArguments;
     unsigned line;
     String url;
     unsigned groupLevel;
diff --git a/WebCore/inspector/JavaScriptProfile.h b/WebCore/inspector/JavaScriptProfile.h
index d853e4ce5be760486351efc7f36e0346be3778ee..17c5ce7ec651be8fac5b4d440155bcf61d5be942 100644
--- a/WebCore/inspector/JavaScriptProfile.h
+++ b/WebCore/inspector/JavaScriptProfile.h
@@ -26,17 +26,16 @@
 #ifndef JavaScriptProfile_h
 #define JavaScriptProfile_h
 
-#include <JavaScriptCore/JSBase.h>
+#include <kjs/JSValue.h>
 
 namespace JSC {
     class ExecState;
-    class JSValue;
     class Profile;
 }
 
 namespace WebCore {
 
-    JSC::JSValue* toJS(JSC::ExecState*, JSC::Profile*);
+    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::Profile*);
 
 } // namespace WebCore
 
diff --git a/WebCore/inspector/JavaScriptProfileNode.h b/WebCore/inspector/JavaScriptProfileNode.h
index dfb71e0a65403fec3315134d2111ae80a8a89ef3..75b4a3220e0b06e890458a28a8e932c0575730f5 100644
--- a/WebCore/inspector/JavaScriptProfileNode.h
+++ b/WebCore/inspector/JavaScriptProfileNode.h
@@ -26,18 +26,18 @@
 #ifndef JavaScriptProfileNode_h
 #define JavaScriptProfileNode_h
 
+#include <kjs/JSValue.h>
 #include <JavaScriptCore/JSBase.h>
 
 namespace JSC {
     class ExecState;
     class ProfileNode;
-    class JSValue;
 }
 
 namespace WebCore {
 
     JSClassRef ProfileNodeClass();
-    JSC::JSValue* toJS(JSC::ExecState*, JSC::ProfileNode*);
+    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::ProfileNode*);
 
 } // namespace WebCore
 
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index fc2a8751d8e36605a375c12be56a26cf7d5215cf..8d706255876379196f82fe14b109fded01ce7fc5 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -47,10 +47,6 @@
 #include "CachedResourceClient.h"
 #endif
 
-namespace JSC {
-    class JSValue;
-}
-
 namespace WebCore {
 
     class Archive;
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index eb6298ba6cc42cf575498df7210f397e668a4482..5774a3f4260eb0ffedc88405651f1007e6ca9757 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -37,7 +37,6 @@ namespace JSC {
     class ExecState;
     class ArgList;
     class Profile;
-    class JSValue;
 }
 
 namespace WebCore {
diff --git a/WebCore/plugins/MimeTypeArray.h b/WebCore/plugins/MimeTypeArray.h
index 6cc9b7a698a9b55af55cf605d7050f4725dbf9ca..b81c8368789e8d2756b52cb3a5af6569c8018721 100644
--- a/WebCore/plugins/MimeTypeArray.h
+++ b/WebCore/plugins/MimeTypeArray.h
@@ -27,7 +27,6 @@
 
 namespace JSC {
     class ExecState;
-    class JSValue;
 };
 
 namespace WebCore {
diff --git a/WebCore/plugins/Plugin.h b/WebCore/plugins/Plugin.h
index a9782d496d64b5d9bf851eec753ae2ac1c0b26a8..8a6d1fb45ea53973123b4213b19f96177adbbe48 100644
--- a/WebCore/plugins/Plugin.h
+++ b/WebCore/plugins/Plugin.h
@@ -26,8 +26,7 @@
 
 namespace JSC {
     class ExecState;
-    class JSValue;
-};
+}
 
 namespace WebCore {
 
diff --git a/WebCore/plugins/PluginArray.h b/WebCore/plugins/PluginArray.h
index fd955aea330c4aeab3895ca373765ce4c5a73993..ac10a6f28ce9fdcf5b75a941671da7c29956d666 100644
--- a/WebCore/plugins/PluginArray.h
+++ b/WebCore/plugins/PluginArray.h
@@ -26,9 +26,8 @@
 #include <wtf/Vector.h>
 
 namespace JSC {
-    class JSValue;
     class ExecState;
-};
+}
 
 namespace WebCore {
 
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index 2fddd48871850590c77d892fe67da5793533a576..0d567ed7b0da5ace0a3acb3b674480f5b7fc3399 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -70,7 +70,7 @@
 using JSC::ExecState;
 using JSC::JSLock;
 using JSC::JSObject;
-using JSC::JSValue;
+using JSC::JSValuePtr;
 using JSC::UString;
 
 using std::min;
@@ -205,7 +205,7 @@ static char* createUTF8String(const String& str)
     return result;
 }
 
-static bool getString(ScriptController* proxy, JSValue* result, String& string)
+static bool getString(ScriptController* proxy, JSValuePtr result, String& string)
 {
     if (!proxy || !result || result->isUndefined())
         return false;
@@ -260,7 +260,7 @@ void PluginView::performRequest(PluginRequest* request)
     
     // Executing a script can cause the plugin view to be destroyed, so we keep a reference to the parent frame.
     RefPtr<Frame> parentFrame = m_parentFrame;
-    JSValue* result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups());
+    JSValuePtr result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups());
 
     if (targetFrameName.isNull()) {
         String resultString;
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index 5ab38422cedbd6c8b6026c539cdc2781966f6561..ec90223017cd751dc9cb9a487f8ad5bb6e01f75a 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -73,7 +73,6 @@ using JSC::ExecState;
 using JSC::Interpreter;
 using JSC::JSLock;
 using JSC::JSObject;
-using JSC::JSValue;
 using JSC::UString;
 
 using std::min;
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index d89e8fc404fada6297698fcc5d9713cf3510383b..2fb910eb9daf0b7e129b110d947ca60e39c784fa 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -66,7 +66,6 @@ using JSC::ExecState;
 using JSC::Interpreter;
 using JSC::JSLock;
 using JSC::JSObject;
-using JSC::JSValue;
 using JSC::UString;
 
 using std::min;
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index 2e999afe2198d95bfc6025c44dffb27285dec6e4..045366a5b047bff05dd6c51cdd8bd5e55cd2b135 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -84,7 +84,6 @@ static inline HWND windowHandleForPlatformWidget(PlatformWidget widget)
 using JSC::ExecState;
 using JSC::JSLock;
 using JSC::JSObject;
-using JSC::JSValue;
 using JSC::UString;
 
 using std::min;
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index 5be6572b0f41caf4117c998994a3165310cf2e97..1c5743662034fddbf597898d0225ec9a4c2971b2 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,17 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        Use JSValuePtr instead of JSValue.
+        * WebView/WebScriptDebugger.h: Removed declaration of JSValue.
+
 2008-10-18  Darin Adler  <darin@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/WebKit/mac/WebView/WebFrame.mm b/WebKit/mac/WebView/WebFrame.mm
index cada414c77c93257d7b2b6a2da88bc4c7a487eff..9715ae958b398327d6262969db383ca9450931ec 100644
--- a/WebKit/mac/WebView/WebFrame.mm
+++ b/WebKit/mac/WebView/WebFrame.mm
@@ -86,7 +86,7 @@ using namespace HTMLNames;
 
 using JSC::JSGlobalObject;
 using JSC::JSLock;
-using JSC::JSValue;
+using JSC::JSValuePtr;
 
 /*
 Here is the current behavior matrix for four types of navigations:
@@ -632,7 +632,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 {
     ASSERT(_private->coreFrame->document());
     
-    JSValue* result = _private->coreFrame->loader()->executeScript(string, forceUserGesture);
+    JSValuePtr result = _private->coreFrame->loader()->executeScript(string, forceUserGesture);
 
     if (!_private->coreFrame) // In case the script removed our frame from the page.
         return @"";
diff --git a/WebKit/mac/WebView/WebScriptDebugger.h b/WebKit/mac/WebView/WebScriptDebugger.h
index 9256784ee991b6db03a3be53c98674bc8607ffd2..5140c413676f2bbe58fbe58c56ea498495e1e761 100644
--- a/WebKit/mac/WebView/WebScriptDebugger.h
+++ b/WebKit/mac/WebView/WebScriptDebugger.h
@@ -38,7 +38,6 @@ namespace JSC {
     class ExecState;
     class JSGlobalObject;
     class JSObject;
-    class JSValue;
     class ArgList;
     class UString;
 }
diff --git a/WebKit/qt/Api/qwebframe.cpp b/WebKit/qt/Api/qwebframe.cpp
index 4fcae7a81141027e746fb81a2bb7ace735257b77..054084f99d75458a5ce962c641100bf8697d1af1 100644
--- a/WebKit/qt/Api/qwebframe.cpp
+++ b/WebKit/qt/Api/qwebframe.cpp
@@ -886,7 +886,7 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValue *v = proxy->evaluate(String(), 1, scriptSource);
+        JSC::JSValuePtr v = proxy->evaluate(String(), 1, scriptSource);
         if (v) {
             int distance = 0;
             rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 60ca19902de1199bc86fd494d4c17d1c12adb359..ca9ffe521813a3bac15df6a338046ab70069eae9 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,15 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript): Use JSValuePtr.
+
 2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
 
         Reviewed by Simon.
diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 80104bebd7b44dd9eb808648d1d32ca1c59e0e49..6102a3b3eec0af9a7794021a39dbbf066839c536 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,22 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * WebScriptCallFrame.cpp:
+        (WebScriptCallFrame::jsValueToString): Use JSValuePtr.
+        (WebScriptCallFrame::stringByEvaluatingJavaScriptFromString): Ditto.
+        (WebScriptCallFrame::valueForVariable): Put more code inside and ifdef.
+        (WebScriptCallFrame::valueByEvaluatingJavaScriptFromString): Ditto.
+        * WebScriptCallFrame.h: Use JSValuePtr.
+
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString): Use JSValuePtr.
+
 2008-10-18  Dan Bernstein  <mitz@apple.com>
 
         - build fix
diff --git a/WebKit/win/WebScriptCallFrame.cpp b/WebKit/win/WebScriptCallFrame.cpp
index 6422d417f7f58086acac03e356a6a235e19b52e2..b6d95a7618057dd0e339b9d9bc1ac1ee8f7dc8d7 100644
--- a/WebKit/win/WebScriptCallFrame.cpp
+++ b/WebKit/win/WebScriptCallFrame.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -49,7 +49,7 @@
 
 using namespace JSC;
 
-UString WebScriptCallFrame::jsValueToString(JSC::ExecState* state, JSValue* jsvalue)
+UString WebScriptCallFrame::jsValueToString(JSC::ExecState* state, JSValuePtr jsvalue)
 {
     if (!jsvalue)
         return "undefined";
@@ -182,7 +182,7 @@ HRESULT STDMETHODCALLTYPE WebScriptCallFrame::stringByEvaluatingJavaScriptFromSt
 
     JSLock lock(false);
 
-    JSValue* scriptExecutionResult = valueByEvaluatingJavaScriptFromString(script);
+    JSValuePtr scriptExecutionResult = valueByEvaluatingJavaScriptFromString(script);
     *result = WebCore::BString(jsValueToString(m_state, scriptExecutionResult)).release();
 
     return S_OK;
@@ -220,8 +220,8 @@ HRESULT STDMETHODCALLTYPE WebScriptCallFrame::valueForVariable(
 
     Identifier identKey(m_state, reinterpret_cast<UChar*>(key), SysStringLen(key));
 
-    JSValue* jsvalue = 0;
 #if 0
+    JSValuePtr jsvalue = noValue();
     ScopeChain scopeChain = m_state->scopeChain();
     for (ScopeChainIterator it = scopeChain.begin(); it != scopeChain.end() && !jsvalue; ++it)
         jsvalue = (*it)->get(m_state, identKey);
@@ -231,7 +231,7 @@ HRESULT STDMETHODCALLTYPE WebScriptCallFrame::valueForVariable(
     return S_OK;
 }
 
-JSValue* WebScriptCallFrame::valueByEvaluatingJavaScriptFromString(BSTR script)
+JSValuePtr WebScriptCallFrame::valueByEvaluatingJavaScriptFromString(BSTR script)
 {
 #if 0
     ExecState* state = m_state;
@@ -240,21 +240,21 @@ JSValue* WebScriptCallFrame::valueByEvaluatingJavaScriptFromString(BSTR script)
     // find "eval"
     JSObject* eval = 0;
     if (state->scopeNode()) {  // "eval" won't work without context (i.e. at global scope)
-        JSValue* v = globObj->get(state, "eval");
-        if (v->isObject() && static_cast<JSObject*>(v)->implementsCall())
-            eval = static_cast<JSObject*>(v);
+        JSValuePtr v = globObj->get(state, "eval");
+        if (v->isObject() && asObject(v)->implementsCall())
+            eval = asObject(v);
         else
             // no "eval" - fallback operates on global exec state
             state = globObj->globalExec();
     }
 
-    JSValue* savedException = state->exception();
+    JSValuePtr savedException = state->exception();
     state->clearException();
 
     UString code(reinterpret_cast<UChar*>(script), SysStringLen(script));
 
     // evaluate
-    JSValue* scriptExecutionResult;
+    JSValuePtr scriptExecutionResult;
     if (eval) {
         ArgList args;
         args.append(jsString(state, code));
diff --git a/WebKit/win/WebScriptCallFrame.h b/WebKit/win/WebScriptCallFrame.h
index 2aaa7d4ab88c8c6241f8078a5e1a2f4a5236de60..b1f7d7a611e03cab38d81214f1dc9893b747409c 100644
--- a/WebKit/win/WebScriptCallFrame.h
+++ b/WebKit/win/WebScriptCallFrame.h
@@ -30,10 +30,10 @@
 #define WebScriptCallFrame_h
 
 #include "WebKit.h"
+#include <kjs/JSValue.h>
 
 namespace JSC {
     class ExecState;
-    class JSValue;
     class UString;
 }
 
@@ -74,10 +74,10 @@ public:
         /* [out, retval] */ BSTR* value);
 
     // Helper and accessors
-    virtual JSC::JSValue* valueByEvaluatingJavaScriptFromString(BSTR script);
+    virtual JSC::JSValuePtr valueByEvaluatingJavaScriptFromString(BSTR script);
     virtual JSC::ExecState* state() const { return m_state; }
 
-    static JSC::UString jsValueToString(JSC::ExecState*, JSC::JSValue*);
+    static JSC::UString jsValueToString(JSC::ExecState*, JSC::JSValuePtr);
 
 private:
     ULONG m_refCount;
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index 2f0ee3e1a372ed32002815edfff1e808b3ea1064..e9ce012c0573a03001501832acb47a37597c47db 100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -2660,7 +2660,7 @@ HRESULT STDMETHODCALLTYPE WebView::stringByEvaluatingJavaScriptFromString(
     if (!coreFrame)
         return E_FAIL;
 
-    JSC::JSValue* scriptExecutionResult = coreFrame->loader()->executeScript(WebCore::String(script), true);
+    JSC::JSValuePtr scriptExecutionResult = coreFrame->loader()->executeScript(WebCore::String(script), true);
     if(!scriptExecutionResult)
         return E_FAIL;
     else if (scriptExecutionResult->isString()) {
diff --git a/WebKit/wx/ChangeLog b/WebKit/wx/ChangeLog
index 952f1e61bbba76f94a9e71d309c5cce765e55970..a304ef5e988179602767a1cd506fe969bbe7e3e6 100644
--- a/WebKit/wx/ChangeLog
+++ b/WebKit/wx/ChangeLog
@@ -1,3 +1,15 @@
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * WebFrame.cpp:
+        (wxWebFrame::RunScript): Use JSValuePtr.
+
 2008-10-17  Kevin Watters  <kevinwatters@gmail.com>
         
         Reviewed by Kevin Ollivier
diff --git a/WebKit/wx/WebFrame.cpp b/WebKit/wx/WebFrame.cpp
index 6798d4b74d0c2750f5462d365c59a3cd5ba01178..5ac3651216888d4e64a2d0c0a0f31bac8c9dcb1c 100644
--- a/WebKit/wx/WebFrame.cpp
+++ b/WebKit/wx/WebFrame.cpp
@@ -172,7 +172,7 @@ wxString wxWebFrame::RunScript(const wxString& javascript)
 {
     wxString returnValue = wxEmptyString;
     if (m_impl->frame) {
-        JSC::JSValue* result = m_impl->frame->loader()->executeScript(javascript, true);
+        JSC::JSValuePtr result = m_impl->frame->loader()->executeScript(javascript, true);
         if (result)
             returnValue = wxString(result->toString(m_impl->frame->script()->globalObject()->globalExec()).UTF8String().c_str(), wxConvUTF8);        
     }