Bug 847934 - GC: Remove Unrooted - Remove use of DropUnrooted and rename UnrootedThings to RawThings r=terrence
authorJon Coppeard <jcoppeard@mozilla.com>
Tue, 05 Mar 2013 18:32:12 +0000
changeset 123942 fcb84b09972fd124bafe10a065e68b9ea14c094f
parent 123941 491d60eb44bf6f18f20c0fd1cf2d3b54f16d5b95
child 123943 5f3445fecec1fa78c07ad1873a32db58d37fa1ce
push id24406
push userryanvm@gmail.com
push dateThu, 07 Mar 2013 17:19:02 +0000
treeherderautoland@71395a927025 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs847934
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 847934 - GC: Remove Unrooted - Remove use of DropUnrooted and rename UnrootedThings to RawThings r=terrence
js/src/builtin/Eval.cpp
js/src/builtin/Object.cpp
js/src/builtin/RegExp.cpp
js/src/frontend/BytecodeCompiler.cpp
js/src/frontend/BytecodeCompiler.h
js/src/frontend/NameFunctions.cpp
js/src/frontend/SharedContext-inl.h
js/src/gc/Marking.cpp
js/src/gc/Marking.h
js/src/ion/Bailouts.cpp
js/src/ion/CompileInfo.h
js/src/ion/CompilerRoot.h
js/src/ion/ExecutionModeInlines.h
js/src/ion/Ion.cpp
js/src/ion/Ion.h
js/src/ion/IonBuilder.cpp
js/src/ion/IonBuilder.h
js/src/ion/IonCaches.cpp
js/src/ion/IonCaches.h
js/src/ion/IonCode.h
js/src/ion/IonCompartment.h
js/src/ion/IonFrameIterator.h
js/src/ion/IonFrames-inl.h
js/src/ion/IonFrames.cpp
js/src/ion/IonFrames.h
js/src/ion/IonMacroAssembler.h
js/src/ion/JSONSpewer.cpp
js/src/ion/JSONSpewer.h
js/src/ion/LIR-Common.h
js/src/ion/MIR.cpp
js/src/ion/MIR.h
js/src/ion/MIRGraph.h
js/src/ion/ParallelArrayAnalysis.h
js/src/ion/PcScriptCache.h
js/src/ion/SnapshotWriter.h
js/src/ion/Snapshots.cpp
js/src/ion/TypeOracle.cpp
js/src/ion/TypeOracle.h
js/src/ion/VMFunctions.cpp
js/src/ion/shared/Assembler-shared.h
js/src/ion/shared/CodeGenerator-shared.h
js/src/jsanalyze.cpp
js/src/jsanalyze.h
js/src/jsapi.cpp
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscompartment.cpp
js/src/jsdate.cpp
js/src/jsdbgapi.cpp
js/src/jsfriendapi.h
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsfuninlines.h
js/src/jsgcinlines.h
js/src/jsinfer.cpp
js/src/jsinfer.h
js/src/jsinferinlines.h
js/src/jsmemorymetrics.cpp
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/jsonparser.cpp
js/src/jsprobes.cpp
js/src/jsprobes.h
js/src/jspropertycacheinlines.h
js/src/jspropertytree.cpp
js/src/jspropertytree.h
js/src/jsproxy.cpp
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsscriptinlines.h
js/src/jsstr.cpp
js/src/jswatchpoint.cpp
js/src/methodjit/BaseAssembler.h
js/src/methodjit/Compiler.cpp
js/src/methodjit/FastOps.cpp
js/src/methodjit/MethodJIT.cpp
js/src/methodjit/MethodJIT.h
js/src/methodjit/MonoIC.cpp
js/src/methodjit/MonoIC.h
js/src/methodjit/PolyIC.cpp
js/src/methodjit/PolyIC.h
js/src/methodjit/StubCalls.cpp
js/src/shell/js.cpp
js/src/vm/ArgumentsObject.cpp
js/src/vm/Debugger.cpp
js/src/vm/ObjectImpl-inl.h
js/src/vm/ObjectImpl.cpp
js/src/vm/ObjectImpl.h
js/src/vm/RegExpObject.cpp
js/src/vm/RegExpObject.h
js/src/vm/RegExpStatics-inl.h
js/src/vm/SPSProfiler.cpp
js/src/vm/SPSProfiler.h
js/src/vm/ScopeObject.cpp
js/src/vm/ScopeObject.h
js/src/vm/Shape-inl.h
js/src/vm/Shape.cpp
js/src/vm/Shape.h
js/src/vm/Stack-inl.h
js/src/vm/Stack.cpp
js/src/vm/Stack.h
js/src/vm/String-inl.h
js/src/vm/StringBuffer.cpp
js/src/vm/StringBuffer.h
js/src/vm/StringObject.h
--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -30,17 +30,17 @@ AssertInnerizedScopeChain(JSContext *cx,
         if (JSObjectOp op = obj->getClass()->ext.innerObject) {
             JS_ASSERT(op(cx, obj) == obj);
         }
     }
 #endif
 }
 
 static bool
-IsEvalCacheCandidate(UnrootedScript script)
+IsEvalCacheCandidate(RawScript script)
 {
     // Make sure there are no inner objects which might use the wrong parent
     // and/or call scope by reusing the previous eval's script. Skip the
     // script's first object, which entrains the eval's scope.
     return script->savedCallerFun &&
            !script->hasSingletons &&
            script->objects()->length == 1 &&
            !script->hasRegexps();
@@ -52,17 +52,17 @@ EvalCacheHashPolicy::hash(const EvalCach
     return AddToHash(HashString(l.str->chars(), l.str->length()),
                      l.caller,
                      l.staticLevel,
                      l.version,
                      l.compartment);
 }
 
 /* static */ bool
-EvalCacheHashPolicy::match(UnrootedScript script, const EvalCacheLookup &l)
+EvalCacheHashPolicy::match(RawScript script, const EvalCacheLookup &l)
 {
     JS_ASSERT(IsEvalCacheCandidate(script));
 
     // Get the source string passed for safekeeping in the atom map
     // by the prior eval to frontend::CompileScript.
     JSAtom *keyStr = script->atoms[0];
 
     return EqualStrings(keyStr, l.str) &&
@@ -122,17 +122,17 @@ class EvalScriptGuard
             script_ = *p_;
             cx_->runtime->evalCache.remove(p_);
             CallNewScriptHook(cx_, script_, NullPtr());
             script_->isCachedEval = false;
             script_->isActiveEval = true;
         }
     }
 
-    void setNewScript(UnrootedScript script) {
+    void setNewScript(RawScript script) {
         // JSScript::initFromEmitter has already called js_CallNewScriptHook.
         JS_ASSERT(!script_ && script);
         script_ = script;
         script_->isActiveEval = true;
     }
 
     bool foundScript() {
         return !!script_;
@@ -288,18 +288,18 @@ EvalKernel(JSContext *cx, const CallArgs
 
         CompileOptions options(cx);
         options.setFileAndLine(filename, lineno)
                .setCompileAndGo(true)
                .setNoScriptRval(false)
                .setPrincipals(principals)
                .setOriginPrincipals(originPrincipals);
         RootedScript callerScript(cx, caller ? caller.script() : NULL);
-        UnrootedScript compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
-                                                          chars.get(), length, stableStr, staticLevel);
+        RawScript compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
+                                                     chars.get(), length, stableStr, staticLevel);
         if (!compiled)
             return false;
 
         esg.setNewScript(compiled);
     }
 
     return ExecuteKernel(cx, esg.script(), *scopeobj, thisv, ExecuteType(evalType),
                          NullFramePtr() /* evalInFrame */, args.rval().address());
@@ -349,18 +349,18 @@ js::DirectEvalFromIon(JSContext *cx,
                                     CALLED_FROM_JSOP_EVAL);
 
         CompileOptions options(cx);
         options.setFileAndLine(filename, lineno)
                .setCompileAndGo(true)
                .setNoScriptRval(false)
                .setPrincipals(principals)
                .setOriginPrincipals(originPrincipals);
-        UnrootedScript compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
-                                                          chars.get(), length, stableStr, staticLevel);
+        RawScript compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
+                                                     chars.get(), length, stableStr, staticLevel);
         if (!compiled)
             return false;
 
         esg.setNewScript(compiled);
     }
 
     // Primitive 'this' values should have been filtered out by Ion. If boxed,
     // the calling frame cannot be updated to store the new object.
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -322,17 +322,17 @@ obj_toString(JSContext *cx, unsigned arg
     }
 
     /* Step 3. */
     RootedObject obj(cx, ToObject(cx, args.thisv()));
     if (!obj)
         return false;
 
     /* Steps 4-5. */
-    UnrootedString str = js::obj_toStringHelper(cx, obj);
+    RawString str = js::obj_toStringHelper(cx, obj);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 /* ES5 15.2.4.3. */
 static JSBool
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -196,17 +196,17 @@ EscapeNakedForwardSlashes(JSContext *cx,
             if (!sb.append('\\'))
                 return NULL;
         }
 
         if (!sb.empty() && !sb.append(*it))
             return NULL;
     }
 
-    return sb.empty() ? UnrootedAtom(unescaped) : sb.finishAtom();
+    return sb.empty() ? RawAtom(unescaped) : sb.finishAtom();
 }
 
 /*
  * Compile a new |RegExpShared| for the |RegExpObject|.
  *
  * Per ECMAv5 15.10.4.1, we act on combinations of (pattern, flags) as
  * arguments:
  *
@@ -362,17 +362,17 @@ regexp_construct(JSContext *cx, unsigned
     return CompileRegExpObject(cx, builder, args);
 }
 
 JS_ALWAYS_INLINE bool
 regexp_toString_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsRegExp(args.thisv()));
 
-    UnrootedString str = args.thisv().toObject().asRegExp().toString(cx);
+    RawString str = args.thisv().toObject().asRegExp().toString(cx);
     if (!str)
         return false;
 
     args.rval().setString(str);
     return true;
 }
 
 JSBool
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -33,17 +33,17 @@ CheckLength(JSContext *cx, size_t length
     if (length > UINT32_MAX) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_SOURCE_TOO_LONG);
         return false;
     }
     return true;
 }
 
 static bool
-SetSourceMap(JSContext *cx, TokenStream &tokenStream, ScriptSource *ss, UnrootedScript script)
+SetSourceMap(JSContext *cx, TokenStream &tokenStream, ScriptSource *ss, RawScript script)
 {
     if (tokenStream.hasSourceMap()) {
         if (!ss->setSourceMap(cx, tokenStream.releaseSourceMap(), script->filename))
             return false;
     }
     return true;
 }
 
@@ -63,17 +63,17 @@ CheckArgumentsWithinEval(JSContext *cx, 
     if (script->argumentsHasVarBinding()) {
         if (!JSScript::argumentsOptimizationFailed(cx, script))
             return false;
     }
 
     return true;
 }
 
-UnrootedScript
+RawScript
 frontend::CompileScript(JSContext *cx, HandleObject scopeChain,
                         HandleScript evalCaller,
                         const CompileOptions &options,
                         const jschar *chars, size_t length,
                         JSString *source_ /* = NULL */,
                         unsigned staticLevel /* = 0 */,
                         SourceCompressionToken *extraSct /* = NULL */)
 {
@@ -95,185 +95,185 @@ frontend::CompileScript(JSContext *cx, H
     /*
      * The scripted callerFrame can only be given for compile-and-go scripts
      * and non-zero static level requires callerFrame.
      */
     JS_ASSERT_IF(evalCaller, options.compileAndGo);
     JS_ASSERT_IF(staticLevel != 0, evalCaller);
 
     if (!CheckLength(cx, length))
-        return UnrootedScript(NULL);
+        return NULL;
     JS_ASSERT_IF(staticLevel != 0, options.sourcePolicy != CompileOptions::LAZY_SOURCE);
     ScriptSource *ss = cx->new_<ScriptSource>();
     if (!ss)
-        return UnrootedScript(NULL);
+        return NULL;
     ScriptSourceHolder ssh(ss);
     SourceCompressionToken mysct(cx);
     SourceCompressionToken *sct = (extraSct) ? extraSct : &mysct;
     switch (options.sourcePolicy) {
       case CompileOptions::SAVE_SOURCE:
         if (!ss->setSourceCopy(cx, chars, length, false, sct))
-            return UnrootedScript(NULL);
+            return NULL;
         break;
       case CompileOptions::LAZY_SOURCE:
         ss->setSourceRetrievable();
         break;
       case CompileOptions::NO_SOURCE:
         break;
     }
 
     Parser<FullParseHandler> parser(cx, options, chars, length, /* foldConstants = */ true);
     if (!parser.init())
-        return UnrootedScript(NULL);
+        return NULL;
     parser.sct = sct;
 
     GlobalSharedContext globalsc(cx, scopeChain, StrictModeFromContext(cx));
 
     ParseContext<FullParseHandler> pc(&parser, &globalsc, staticLevel, /* bodyid = */ 0);
     if (!pc.init())
-        return UnrootedScript(NULL);
+        return NULL;
 
     bool savedCallerFun =
         options.compileAndGo &&
         evalCaller &&
         (evalCaller->function() || evalCaller->savedCallerFun);
     Rooted<JSScript*> script(cx, JSScript::Create(cx, NullPtr(), savedCallerFun,
                                                   options, staticLevel, ss, 0, length));
     if (!script)
-        return UnrootedScript(NULL);
+        return NULL;
 
     // Global/eval script bindings are always empty (all names are added to the
     // scope dynamically via JSOP_DEFFUN/VAR).
     InternalHandle<Bindings*> bindings(script, &script->bindings);
     if (!Bindings::initWithTemporaryStorage(cx, bindings, 0, 0, NULL))
-        return UnrootedScript(NULL);
+        return NULL;
 
     // We can specialize a bit for the given scope chain if that scope chain is the global object.
     JSObject *globalScope = scopeChain && scopeChain == &scopeChain->global() ? (JSObject*) scopeChain : NULL;
     JS_ASSERT_IF(globalScope, globalScope->isNative());
     JS_ASSERT_IF(globalScope, JSCLASS_HAS_GLOBAL_FLAG_AND_SLOTS(globalScope->getClass()));
 
     BytecodeEmitter bce(/* parent = */ NULL, &parser, &globalsc, script, evalCaller, !!globalScope,
                         options.lineno, options.selfHostingMode);
     if (!bce.init())
-        return UnrootedScript(NULL);
+        return NULL;
 
     /* If this is a direct call to eval, inherit the caller's strictness.  */
     if (evalCaller && evalCaller->strict)
         globalsc.strict = true;
 
     if (options.compileAndGo) {
         if (source) {
             /*
              * Save eval program source in script->atoms[0] for the
              * eval cache (see EvalCacheLookup in jsobj.cpp).
              */
             JSAtom *atom = AtomizeString<CanGC>(cx, source);
             jsatomid _;
             if (!atom || !bce.makeAtomIndex(atom, &_))
-                return UnrootedScript(NULL);
+                return NULL;
         }
 
         if (evalCaller && evalCaller->functionOrCallerFunction()) {
             /*
              * An eval script in a caller frame needs to have its enclosing
              * function captured in case it refers to an upvar, and someone
              * wishes to decompile it while it's running.
              */
             JSFunction *fun = evalCaller->functionOrCallerFunction();
             ObjectBox *funbox = parser.newFunctionBox(fun, &pc, fun->strict());
             if (!funbox)
-                return UnrootedScript(NULL);
+                return NULL;
             bce.objectList.add(funbox);
         }
     }
 
     bool canHaveDirectives = true;
     for (;;) {
         TokenKind tt = parser.tokenStream.peekToken(TSF_OPERAND);
         if (tt <= TOK_EOF) {
             if (tt == TOK_EOF)
                 break;
             JS_ASSERT(tt == TOK_ERROR);
-            return UnrootedScript(NULL);
+            return NULL;
         }
 
         ParseNode *pn = parser.statement();
         if (!pn)
-            return UnrootedScript(NULL);
+            return NULL;
 
         if (canHaveDirectives) {
             if (!parser.maybeParseDirective(pn, &canHaveDirectives))
-                return UnrootedScript(NULL);
+                return NULL;
         }
 
         if (!FoldConstants(cx, &pn, &parser))
-            return UnrootedScript(NULL);
+            return NULL;
         if (!NameFunctions(cx, pn))
-            return UnrootedScript(NULL);
+            return NULL;
 
         if (!EmitTree(cx, &bce, pn))
-            return UnrootedScript(NULL);
+            return NULL;
 
         parser.handler.freeTree(pn);
     }
 
     if (!SetSourceMap(cx, parser.tokenStream, ss, script))
-        return UnrootedScript(NULL);
+        return NULL;
 
     if (evalCaller && evalCaller->functionOrCallerFunction()) {
         // Watch for uses of 'arguments' within the evaluated script, both as
         // free variables and as variables redeclared with 'var'.
         RootedFunction fun(cx, evalCaller->functionOrCallerFunction());
         HandlePropertyName arguments = cx->names().arguments;
         for (AtomDefnRange r = pc.lexdeps->all(); !r.empty(); r.popFront()) {
             if (r.front().key() == arguments) {
                 if (!CheckArgumentsWithinEval(cx, parser, fun))
-                    return UnrootedScript(NULL);
+                    return NULL;
             }
         }
         for (AtomDefnListMap::Range r = pc.decls().all(); !r.empty(); r.popFront()) {
             if (r.front().key() == arguments) {
                 if (!CheckArgumentsWithinEval(cx, parser, fun))
-                    return UnrootedScript(NULL);
+                    return NULL;
             }
         }
 
         // If the eval'ed script contains any debugger statement, force construction
         // of arguments objects for the caller script and any other scripts it is
         // transitively nested inside.
         if (pc.sc->hasDebuggerStatement()) {
             RootedObject scope(cx, scopeChain);
             while (scope->isScope() || scope->isDebugScope()) {
                 if (scope->isCall() && !scope->asCall().isForEval()) {
                     RootedScript script(cx, scope->asCall().callee().nonLazyScript());
                     if (script->argumentsHasVarBinding()) {
                         if (!JSScript::argumentsOptimizationFailed(cx, script))
-                            return UnrootedScript(NULL);
+                            return NULL;
                     }
                 }
                 scope = scope->enclosingScope();
             }
         }
     }
 
     /*
      * Nowadays the threaded interpreter needs a stop instruction, so we
      * do have to emit that here.
      */
     if (Emit1(cx, &bce, JSOP_STOP) < 0)
-        return UnrootedScript(NULL);
+        return NULL;
 
     if (!JSScript::fullyInitFromEmitter(cx, script, &bce))
-        return UnrootedScript(NULL);
+        return NULL;
 
     bce.tellDebuggerAboutCompiledScript(cx);
 
     if (sct == &mysct && !sct->complete())
-        return UnrootedScript(NULL);
+        return NULL;
 
     return script;
 }
 
 bool
 frontend::ParseScript(JSContext *cx, HandleObject scopeChain,
                       const CompileOptions &options, StableCharPtr chars, size_t length)
 {
--- a/js/src/frontend/BytecodeCompiler.h
+++ b/js/src/frontend/BytecodeCompiler.h
@@ -8,17 +8,17 @@
 #ifndef BytecodeCompiler_h__
 #define BytecodeCompiler_h__
 
 #include "frontend/Parser.h"
 
 namespace js {
 namespace frontend {
 
-UnrootedScript
+RawScript
 CompileScript(JSContext *cx, HandleObject scopeChain, HandleScript evalCaller,
               const CompileOptions &options, const jschar *chars, size_t length,
               JSString *source_ = NULL, unsigned staticLevel = 0,
               SourceCompressionToken *extraSct = NULL);
 
 bool
 ParseScript(JSContext *cx, HandleObject scopeChain,
             const CompileOptions &options, StableCharPtr chars, size_t length);
--- a/js/src/frontend/NameFunctions.cpp
+++ b/js/src/frontend/NameFunctions.cpp
@@ -241,17 +241,17 @@ class NameResolver
          * other namespace are rather considered as "contributing" to the outer
          * function, so give them a contribution symbol here.
          */
         if (!buf.empty() && *(buf.end() - 1) == '/' && !buf.append("<"))
             return NULL;
         if (buf.empty())
             return NULL;
 
-        UnrootedAtom atom = buf.finishAtom();
+        RawAtom atom = buf.finishAtom();
         fun->setGuessedAtom(atom);
         return atom;
     }
 
     /*
      * Tests whether parents[pos] is a function call whose callee is cur.
      * This is the case for functions which do things like simply create a scope
      * for new variables and then return an anonymous function using this scope.
--- a/js/src/frontend/SharedContext-inl.h
+++ b/js/src/frontend/SharedContext-inl.h
@@ -126,17 +126,17 @@ frontend::LexicalLookup(ContextT *ct, Ha
         if (stmt->type == STMT_WITH)
             break;
 
         // Skip statements that do not introduce a new scope
         if (!stmt->isBlockScope)
             continue;
 
         StaticBlockObject &blockObj = *stmt->blockObj;
-        UnrootedShape shape = blockObj.nativeLookup(ct->sc->context, id);
+        RawShape shape = blockObj.nativeLookup(ct->sc->context, id);
         if (shape) {
             JS_ASSERT(shape->hasShortID());
 
             if (slotp)
                 *slotp = blockObj.stackDepth() + shape->shortid();
             return stmt;
         }
     }
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -59,34 +59,34 @@ void * const js::NullPtr::constNullValue
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSObject *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSFunction *thing);
 
 static inline void
-PushMarkStack(GCMarker *gcmarker, UnrootedScript thing);
+PushMarkStack(GCMarker *gcmarker, RawScript thing);
 
 static inline void
-PushMarkStack(GCMarker *gcmarker, UnrootedShape thing);
+PushMarkStack(GCMarker *gcmarker, RawShape thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSString *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, types::TypeObject *thing);
 
 namespace js {
 namespace gc {
 
 static void MarkChildren(JSTracer *trc, JSString *str);
-static void MarkChildren(JSTracer *trc, UnrootedScript script);
-static void MarkChildren(JSTracer *trc, UnrootedShape shape);
-static void MarkChildren(JSTracer *trc, UnrootedBaseShape base);
+static void MarkChildren(JSTracer *trc, RawScript script);
+static void MarkChildren(JSTracer *trc, RawShape shape);
+static void MarkChildren(JSTracer *trc, RawBaseShape base);
 static void MarkChildren(JSTracer *trc, types::TypeObject *type);
 static void MarkChildren(JSTracer *trc, ion::IonCode *code);
 
 } /* namespace gc */
 } /* namespace js */
 
 /*** Object Marking ***/
 
@@ -741,34 +741,34 @@ PushMarkStack(GCMarker *gcmarker, types:
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushType(thing);
 }
 
 static void
-PushMarkStack(GCMarker *gcmarker, UnrootedScript thing)
+PushMarkStack(GCMarker *gcmarker, RawScript thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
 
     /*
      * We mark scripts directly rather than pushing on the stack as they can
      * refer to other scripts only indirectly (like via nested functions) and
      * we cannot get to deep recursion.
      */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         MarkChildren(gcmarker, thing);
 }
 
 static void
-ScanShape(GCMarker *gcmarker, UnrootedShape shape);
+ScanShape(GCMarker *gcmarker, RawShape shape);
 
 static void
-PushMarkStack(GCMarker *gcmarker, UnrootedShape thing)
+PushMarkStack(GCMarker *gcmarker, RawShape thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
 
     /* We mark shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         ScanShape(gcmarker, thing);
 }
 
@@ -777,47 +777,47 @@ PushMarkStack(GCMarker *gcmarker, ion::I
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushIonCode(thing);
 }
 
 static inline void
-ScanBaseShape(GCMarker *gcmarker, UnrootedBaseShape base);
+ScanBaseShape(GCMarker *gcmarker, RawBaseShape base);
 
 static void
-PushMarkStack(GCMarker *gcmarker, UnrootedBaseShape thing)
+PushMarkStack(GCMarker *gcmarker, RawBaseShape thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
 
     /* We mark base shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         ScanBaseShape(gcmarker, thing);
 }
 
 static void
-ScanShape(GCMarker *gcmarker, UnrootedShape shape)
+ScanShape(GCMarker *gcmarker, RawShape shape)
 {
   restart:
     PushMarkStack(gcmarker, shape->base());
 
     const EncapsulatedId &id = shape->propidRef();
     if (JSID_IS_STRING(id))
         PushMarkStack(gcmarker, JSID_TO_STRING(id));
     else if (JS_UNLIKELY(JSID_IS_OBJECT(id)))
         PushMarkStack(gcmarker, JSID_TO_OBJECT(id));
 
     shape = shape->previous();
     if (shape && shape->markIfUnmarked(gcmarker->getMarkColor()))
         goto restart;
 }
 
 static inline void
-ScanBaseShape(GCMarker *gcmarker, UnrootedBaseShape base)
+ScanBaseShape(GCMarker *gcmarker, RawBaseShape base)
 {
     base->assertConsistency();
 
     if (base->hasGetterObject())
         PushMarkStack(gcmarker, base->getterObject());
 
     if (base->hasSetterObject())
         PushMarkStack(gcmarker, base->setterObject());
@@ -829,17 +829,17 @@ ScanBaseShape(GCMarker *gcmarker, Unroot
     }
 
     /*
      * All children of the owned base shape are consistent with its
      * unowned one, thus we do not need to trace through children of the
      * unowned base shape.
      */
     if (base->isOwned()) {
-        UnrootedUnownedBaseShape unowned = base->baseUnowned();
+        RawUnownedBaseShape unowned = base->baseUnowned();
         JS_ASSERT(base->compartment() == unowned->compartment());
         unowned->markIfUnmarked(gcmarker->getMarkColor());
     }
 }
 
 static inline void
 ScanLinearString(GCMarker *gcmarker, JSLinearString *str)
 {
@@ -949,43 +949,43 @@ gc::MarkChildren(JSTracer *trc, JSString
 {
     if (str->hasBase())
         str->markBase(trc);
     else if (str->isRope())
         str->asRope().markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, UnrootedScript script)
+gc::MarkChildren(JSTracer *trc, RawScript script)
 {
     script->markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, UnrootedShape shape)
+gc::MarkChildren(JSTracer *trc, RawShape shape)
 {
     shape->markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, UnrootedBaseShape base)
+gc::MarkChildren(JSTracer *trc, RawBaseShape base)
 {
     base->markChildren(trc);
 }
 
 /*
  * This function is used by the cycle collector to trace through the
  * children of a BaseShape (and its baseUnowned(), if any). The cycle
  * collector does not directly care about BaseShapes, so only the
  * getter, setter, and parent are marked. Furthermore, the parent is
  * marked only if it isn't the same as prevParent, which will be
  * updated to the current shape's parent.
  */
 static inline void
-MarkCycleCollectorChildren(JSTracer *trc, UnrootedBaseShape base, JSObject **prevParent)
+MarkCycleCollectorChildren(JSTracer *trc, RawBaseShape base, JSObject **prevParent)
 {
     JS_ASSERT(base);
 
     /*
      * The cycle collector does not need to trace unowned base shapes,
      * as they have the same getter, setter and parent as the original
      * base shape.
      */
@@ -1015,17 +1015,17 @@ MarkCycleCollectorChildren(JSTracer *trc
  * This function is used by the cycle collector to trace through a
  * shape. The cycle collector does not care about shapes or base
  * shapes, so those are not marked. Instead, any shapes or base shapes
  * that are encountered have their children marked. Stack space is
  * bounded. If two shapes in a row have the same parent pointer, the
  * parent pointer will only be marked once.
  */
 void
-gc::MarkCycleCollectorChildren(JSTracer *trc, UnrootedShape shape)
+gc::MarkCycleCollectorChildren(JSTracer *trc, RawShape shape)
 {
     JSObject *prevParent = NULL;
     do {
         MarkCycleCollectorChildren(trc, shape->base(), &prevParent);
         MarkId(trc, &shape->propidRef(), "propid");
         shape = shape->previous();
     } while (shape);
 }
@@ -1356,17 +1356,17 @@ GCMarker::processMarkStackTop(SliceBudge
         if (budget.isOverBudget()) {
             pushObject(obj);
             return;
         }
 
         types::TypeObject *type = obj->typeFromGC();
         PushMarkStack(this, type);
 
-        UnrootedShape shape = obj->lastProperty();
+        RawShape shape = obj->lastProperty();
         PushMarkStack(this, shape);
 
         /* Call the trace hook if necessary. */
         Class *clasp = type->clasp;
         if (clasp->trace) {
             JS_ASSERT_IF(runtime->gcMode == JSGC_MODE_INCREMENTAL &&
                          runtime->gcIncrementalEnabled,
                          clasp->flags & JSCLASS_IMPLEMENTS_BARRIERS);
--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@@ -238,17 +238,17 @@ void
 MarkChildren(JSTracer *trc, JSObject *obj);
 
 /*
  * Trace through the shape and any shapes it contains to mark
  * non-shape children. This is exposed to the JS API as
  * JS_TraceShapeCycleCollectorChildren.
  */
 void
-MarkCycleCollectorChildren(JSTracer *trc, UnrootedShape shape);
+MarkCycleCollectorChildren(JSTracer *trc, RawShape shape);
 
 void
 PushArena(GCMarker *gcmarker, ArenaHeader *aheader);
 
 /*** Generic ***/
 
 /*
  * The Mark() functions interface should only be used by code that must be
--- a/js/src/ion/Bailouts.cpp
+++ b/js/src/ion/Bailouts.cpp
@@ -69,17 +69,17 @@ IonBailoutIterator::dump() const
                 break;
             ++frames;
         }
     } else {
         IonFrameIterator::dump();
     }
 }
 
-static UnrootedScript
+static RawScript
 GetBailedJSScript(JSContext *cx)
 {
     AutoAssertNoGC nogc;
 
     // Just after the frame conversion, we can safely interpret the ionTop as JS
     // frame because it targets the bailed JS frame converted to an exit frame.
     IonJSFrameLayout *frame = reinterpret_cast<IonJSFrameLayout*>(cx->mainThread().ionTop);
     switch (GetCalleeTokenTag(frame->calleeToken())) {
@@ -479,17 +479,17 @@ ion::ReflowTypeInfo(uint32_t bailoutResu
     return true;
 }
 
 uint32_t
 ion::RecompileForInlining()
 {
     AutoAssertNoGC nogc;
     JSContext *cx = GetIonContext()->cx;
-    UnrootedScript script = cx->fp()->script();
+    RawScript script = cx->fp()->script();
 
     IonSpew(IonSpew_Inlining, "Recompiling script to inline calls %s:%d", script->filename,
             script->lineno);
 
     // Invalidate the script to force a recompile.
     if (!Invalidate(cx, script, /* resetUses */ false))
         return BAILOUT_RETURN_FATAL_ERROR;
 
@@ -511,17 +511,17 @@ ion::EnsureHasScopeObjects(JSContext *cx
     }
     return true;
 }
 
 uint32_t
 ion::BoundsCheckFailure()
 {
     JSContext *cx = GetIonContext()->cx;
-    UnrootedScript script = GetBailedJSScript(cx);
+    RawScript script = GetBailedJSScript(cx);
 
     IonSpew(IonSpew_Bailouts, "Bounds check failure %s:%d", script->filename,
             script->lineno);
 
     if (!script->failedBoundsCheck) {
         script->failedBoundsCheck = true;
 
         // Invalidate the script to force a recompile.
@@ -532,33 +532,33 @@ ion::BoundsCheckFailure()
 
     return true;
 }
 
 uint32_t
 ion::ShapeGuardFailure()
 {
     JSContext *cx = GetIonContext()->cx;
-    UnrootedScript script = GetBailedJSScript(cx);
+    RawScript script = GetBailedJSScript(cx);
 
     JS_ASSERT(script->hasIonScript());
     JS_ASSERT(!script->ion->invalidated());
 
     script->failedShapeGuard = true;
 
     IonSpew(IonSpew_Invalidate, "Invalidating due to shape guard failure");
 
     return Invalidate(cx, script);
 }
 
 uint32_t
 ion::CachedShapeGuardFailure()
 {
     JSContext *cx = GetIonContext()->cx;
-    UnrootedScript script = GetBailedJSScript(cx);
+    RawScript script = GetBailedJSScript(cx);
 
     JS_ASSERT(script->hasIonScript());
     JS_ASSERT(!script->ion->invalidated());
 
     script->failedShapeGuard = true;
 
     // Purge JM caches in the script and all inlined script, to avoid baking in
     // the same shape guard next time.
--- a/js/src/ion/CompileInfo.h
+++ b/js/src/ion/CompileInfo.h
@@ -25,26 +25,26 @@ enum ExecutionMode {
     // e.g. by ParallelArray
     ParallelExecution
 };
 
 // Contains information about the compilation source for IR being generated.
 class CompileInfo
 {
   public:
-    CompileInfo(UnrootedScript script, JSFunction *fun, jsbytecode *osrPc, bool constructing,
+    CompileInfo(RawScript script, JSFunction *fun, jsbytecode *osrPc, bool constructing,
                 ExecutionMode executionMode)
       : script_(script), fun_(fun), osrPc_(osrPc), constructing_(constructing),
         executionMode_(executionMode)
     {
         JS_ASSERT_IF(osrPc, JSOp(*osrPc) == JSOP_LOOPENTRY);
         nslots_ = script->nslots + CountArgSlots(fun);
     }
 
-    UnrootedScript script() const {
+    RawScript script() const {
         return script_;
     }
     JSFunction *fun() const {
         return fun_;
     }
     bool constructing() const {
         return constructing_;
     }
--- a/js/src/ion/CompilerRoot.h
+++ b/js/src/ion/CompilerRoot.h
@@ -36,17 +36,16 @@ class CompilerRoot : public CompilerRoot
         JS_ASSERT(!ptr_);
         ptr_ = root;
         next = rootList;
         rootList = this;
     }
 
   public:
     operator T () const { return static_cast<T>(ptr_); }
-    operator Unrooted<T> () const { return static_cast<T>(ptr_); }
     T operator ->() const { return static_cast<T>(ptr_); }
 
   private:
     CompilerRoot() MOZ_DELETE;
     CompilerRoot(const CompilerRoot<T> &) MOZ_DELETE;
     CompilerRoot<T> &operator =(const CompilerRoot<T> &) MOZ_DELETE;
 };
 
--- a/js/src/ion/ExecutionModeInlines.h
+++ b/js/src/ion/ExecutionModeInlines.h
@@ -6,37 +6,37 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef jsion_compilemode_h__
 #define jsion_compilemode_h__
 
 namespace js {
 namespace ion {
 
-static inline bool HasIonScript(UnrootedScript script, ExecutionMode cmode)
+static inline bool HasIonScript(RawScript script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->hasIonScript();
       case ParallelExecution: return script->hasParallelIonScript();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
 
-static inline IonScript *GetIonScript(UnrootedScript script, ExecutionMode cmode)
+static inline IonScript *GetIonScript(RawScript script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->ion;
       case ParallelExecution: return script->parallelIon;
     }
     JS_NOT_REACHED("No such execution mode");
     return NULL;
 }
 
-static inline void SetIonScript(UnrootedScript script, ExecutionMode cmode, IonScript *ionScript)
+static inline void SetIonScript(RawScript script, ExecutionMode cmode, IonScript *ionScript)
 {
     switch (cmode) {
       case SequentialExecution: script->ion = ionScript; return;
       case ParallelExecution: script->parallelIon = ionScript; return;
     }
     JS_NOT_REACHED("No such execution mode");
 }
 
@@ -53,17 +53,17 @@ static inline bool CanIonCompile(HandleS
 static inline bool CanIonCompile(JSContext *cx, HandleFunction fun, ExecutionMode cmode)
 {
     if (!fun->isInterpreted())
         return false;
     RootedScript script(cx, fun->nonLazyScript());
     return CanIonCompile(script, cmode);
 }
 
-static inline bool CompilingOffThread(UnrootedScript script, ExecutionMode cmode)
+static inline bool CompilingOffThread(RawScript script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->isIonCompilingOffThread();
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
@@ -73,17 +73,17 @@ static inline bool CompilingOffThread(Ha
     switch (cmode) {
       case SequentialExecution: return script->isIonCompilingOffThread();
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
 
-static inline bool Disabled(UnrootedScript script, ExecutionMode cmode) {
+static inline bool Disabled(RawScript script, ExecutionMode cmode) {
     switch (cmode) {
       case SequentialExecution: return script->isIonCompilingOffThread();
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
 
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -783,17 +783,17 @@ IonScript::purgeCaches(JSCompartment *c)
 }
 
 void
 ion::ToggleBarriers(JSCompartment *comp, bool needs)
 {
     IonContext ictx(NULL, comp, NULL);
     AutoFlushCache afc("ToggleBarriers");
     for (gc::CellIterUnderGC i(comp, gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
-        UnrootedScript script = i.get<JSScript>();
+        RawScript script = i.get<JSScript>();
         if (script->hasIonScript())
             script->ion->toggleBarriers(needs);
     }
 }
 
 namespace js {
 namespace ion {
 
@@ -1075,17 +1075,17 @@ CompileBackEnd(MIRGenerator *mir)
 }
 
 class SequentialCompileContext {
 public:
     ExecutionMode executionMode() {
         return SequentialExecution;
     }
 
-    MethodStatus checkScriptSize(JSContext *cx, UnrootedScript script);
+    MethodStatus checkScriptSize(JSContext *cx, RawScript script);
     AbortReason compile(IonBuilder *builder, MIRGraph *graph,
                         ScopedJSDeletePtr<LifoAlloc> &autoDelete);
 };
 
 void
 AttachFinishedCompilations(JSContext *cx)
 {
 #ifdef JS_THREADSAFE
@@ -1311,34 +1311,34 @@ CheckFrame(AbstractFramePtr fp)
         IonSpew(IonSpew_Abort, "too many actual args");
         return false;
     }
 
     return true;
 }
 
 static bool
-CheckScript(UnrootedScript script)
+CheckScript(RawScript script)
 {
     if (script->needsArgsObj()) {
         // Functions with arguments objects, are not supported yet.
         IonSpew(IonSpew_Abort, "script has argsobj");
         return false;
     }
 
     if (!script->compileAndGo) {
         IonSpew(IonSpew_Abort, "not compile-and-go");
         return false;
     }
 
     return true;
 }
 
 MethodStatus
-SequentialCompileContext::checkScriptSize(JSContext *cx, UnrootedScript script)
+SequentialCompileContext::checkScriptSize(JSContext *cx, RawScript script)
 {
     if (!js_IonOptions.limitScriptSize)
         return Method_Compiled;
 
     // Longer scripts can only be compiled off thread, as these compilations
     // can be expensive and stall the main thread for too long.
     static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2000;
     static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 20000;
@@ -1525,17 +1525,17 @@ ion::CanEnter(JSContext *cx, JSScript *s
             ForbidCompilation(cx, script);
         return status;
     }
 
     return Method_Compiled;
 }
 
 MethodStatus
-ParallelCompileContext::checkScriptSize(JSContext *cx, UnrootedScript script)
+ParallelCompileContext::checkScriptSize(JSContext *cx, RawScript script)
 {
     if (!js_IonOptions.limitScriptSize)
         return Method_Compiled;
 
     // When compiling for parallel execution we don't have off-thread
     // compilation. We also up the max script size of the kernels.
     static const uint32_t MAX_SCRIPT_SIZE = 5000;
     static const uint32_t MAX_LOCALS_AND_ARGS = 256;
@@ -2086,17 +2086,17 @@ ion::Invalidate(types::TypeCompartment &
             continue;
           case types::CompilerOutput::Ion:
             break;
           case types::CompilerOutput::ParallelIon:
             executionMode = ParallelExecution;
             break;
         }
         JS_ASSERT(co.isValid());
-        UnrootedScript script = co.script;
+        RawScript script = co.script;
         IonScript *ionScript = GetIonScript(script, executionMode);
 
         Zone *zone = script->zone();
         if (zone->needsBarrier()) {
             // We're about to remove edges from the JSScript to gcthings
             // embedded in the IonScript. Perform one final trace of the
             // IonScript for the incremental GC, as it must know about
             // those edges.
@@ -2117,17 +2117,17 @@ ion::Invalidate(types::TypeCompartment &
 void
 ion::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses)
 {
     AutoAssertNoGC nogc;
     ion::Invalidate(cx->compartment->types, cx->runtime->defaultFreeOp(), invalid, resetUses);
 }
 
 bool
-ion::Invalidate(JSContext *cx, UnrootedScript script, ExecutionMode mode, bool resetUses)
+ion::Invalidate(JSContext *cx, RawScript script, ExecutionMode mode, bool resetUses)
 {
     AutoAssertNoGC nogc;
     JS_ASSERT(script->hasIonScript());
 
     Vector<types::RecompileInfo> scripts(cx);
 
     switch (mode) {
       case SequentialExecution:
@@ -2142,39 +2142,39 @@ ion::Invalidate(JSContext *cx, UnrootedS
         break;
     }
 
     Invalidate(cx, scripts, resetUses);
     return true;
 }
 
 bool
-ion::Invalidate(JSContext *cx, UnrootedScript script, bool resetUses)
+ion::Invalidate(JSContext *cx, RawScript script, bool resetUses)
 {
     return Invalidate(cx, script, SequentialExecution, resetUses);
 }
 
 static void
-FinishInvalidationOf(FreeOp *fop, UnrootedScript script, IonScript **ionField)
+FinishInvalidationOf(FreeOp *fop, RawScript script, IonScript **ionField)
 {
     // If this script has Ion code on the stack, invalidation() will return
     // true. In this case we have to wait until destroying it.
     if (!(*ionField)->invalidated()) {
         types::TypeCompartment &types = script->compartment()->types;
         (*ionField)->recompileInfo().compilerOutput(types)->invalidate();
 
         ion::IonScript::Destroy(fop, *ionField);
     }
 
     // In all cases, NULL out script->ion to avoid re-entry.
     *ionField = NULL;
 }
 
 void
-ion::FinishInvalidation(FreeOp *fop, UnrootedScript script)
+ion::FinishInvalidation(FreeOp *fop, RawScript script)
 {
     if (script->hasIonScript())
         FinishInvalidationOf(fop, script, &script->ion);
 
     if (script->hasParallelIonScript())
         FinishInvalidationOf(fop, script, &script->parallelIon);
 }
 
@@ -2186,23 +2186,23 @@ ion::MarkValueFromIon(JSRuntime *rt, Val
 
 void
 ion::MarkShapeFromIon(JSRuntime *rt, Shape **shapep)
 {
     gc::MarkShapeUnbarriered(&rt->gcMarker, shapep, "write barrier");
 }
 
 void
-ion::ForbidCompilation(JSContext *cx, UnrootedScript script)
+ion::ForbidCompilation(JSContext *cx, RawScript script)
 {
     ForbidCompilation(cx, script, SequentialExecution);
 }
 
 void
-ion::ForbidCompilation(JSContext *cx, UnrootedScript script, ExecutionMode mode)
+ion::ForbidCompilation(JSContext *cx, RawScript script, ExecutionMode mode)
 {
     IonSpew(IonSpew_Abort, "Disabling Ion mode %d compilation of script %s:%d",
             mode, script->filename, script->lineno);
 
     CancelOffThreadIonCompile(cx->compartment, script);
 
     switch (mode) {
       case SequentialExecution:
@@ -2228,17 +2228,17 @@ ion::ForbidCompilation(JSContext *cx, Un
         script->parallelIon = ION_DISABLED_SCRIPT;
         return;
     }
 
     JS_NOT_REACHED("No such execution mode");
 }
 
 uint32_t
-ion::UsesBeforeIonRecompile(UnrootedScript script, jsbytecode *pc)
+ion::UsesBeforeIonRecompile(RawScript script, jsbytecode *pc)
 {
     JS_ASSERT(pc == script->code || JSOp(*pc) == JSOP_LOOPENTRY);
 
     uint32_t minUses = js_IonOptions.usesBeforeCompile;
     if (JSOp(*pc) != JSOP_LOOPENTRY || !script->hasAnalysis() || js_IonOptions.eagerCompilation)
         return minUses;
 
     analyze::LoopAnalysis *loop = script->analysis()->getLoop(pc);
@@ -2303,46 +2303,46 @@ AutoFlushInhibitor::~AutoFlushInhibitor(
     ic_->setFlusher(afc);
     if (afc)
         IonSpewCont(IonSpew_CacheFlush, "{");
 }
 
 int js::ion::LabelBase::id_count = 0;
 
 void
-ion::PurgeCaches(UnrootedScript script, JSCompartment *c) {
+ion::PurgeCaches(RawScript script, JSCompartment *c) {
     if (script->hasIonScript())
         script->ion->purgeCaches(c);
 
     if (script->hasParallelIonScript())
         script->parallelIon->purgeCaches(c);
 }
 
 size_t
-ion::MemoryUsed(UnrootedScript script, JSMallocSizeOfFun mallocSizeOf) {
+ion::MemoryUsed(RawScript script, JSMallocSizeOfFun mallocSizeOf) {
     size_t result = 0;
 
     if (script->hasIonScript())
         result += script->ion->sizeOfIncludingThis(mallocSizeOf);
 
     if (script->hasParallelIonScript())
         result += script->parallelIon->sizeOfIncludingThis(mallocSizeOf);
 
     return result;
 }
 
 void
-ion::DestroyIonScripts(FreeOp *fop, UnrootedScript script) {
+ion::DestroyIonScripts(FreeOp *fop, RawScript script) {
     if (script->hasIonScript())
         ion::IonScript::Destroy(fop, script->ion);
 
     if (script->hasParallelIonScript())
         ion::IonScript::Destroy(fop, script->parallelIon);
 }
 
 void
-ion::TraceIonScripts(JSTracer* trc, UnrootedScript script) {
+ion::TraceIonScripts(JSTracer* trc, RawScript script) {
     if (script->hasIonScript())
         ion::IonScript::Trace(trc, script->ion);
 
     if (script->hasParallelIonScript())
         ion::IonScript::Trace(trc, script->parallelIon);
 }
--- a/js/src/ion/Ion.h
+++ b/js/src/ion/Ion.h
@@ -293,18 +293,18 @@ IonExecStatus SideCannon(JSContext *cx, 
 
 // Used to enter Ion from C++ natives like Array.map. Called from FastInvokeGuard.
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgsList &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
 void Invalidate(types::TypeCompartment &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true);
-bool Invalidate(JSContext *cx, UnrootedScript script, ExecutionMode mode, bool resetUses = true);
-bool Invalidate(JSContext *cx, UnrootedScript script, bool resetUses = true);
+bool Invalidate(JSContext *cx, RawScript script, ExecutionMode mode, bool resetUses = true);
+bool Invalidate(JSContext *cx, RawScript script, bool resetUses = true);
 
 void MarkValueFromIon(JSRuntime *rt, Value *vp);
 void MarkShapeFromIon(JSRuntime *rt, Shape **shapep);
 
 void ToggleBarriers(JSCompartment *comp, bool needs);
 
 class IonBuilder;
 class MIRGenerator;
@@ -314,22 +314,22 @@ CodeGenerator *CompileBackEnd(MIRGenerat
 void AttachFinishedCompilations(JSContext *cx);
 void FinishOffThreadBuilder(IonBuilder *builder);
 
 static inline bool IsEnabled(JSContext *cx)
 {
     return cx->hasOption(JSOPTION_ION) && cx->typeInferenceEnabled();
 }
 
-void ForbidCompilation(JSContext *cx, UnrootedScript script);
-void ForbidCompilation(JSContext *cx, UnrootedScript script, ExecutionMode mode);
-uint32_t UsesBeforeIonRecompile(UnrootedScript script, jsbytecode *pc);
+void ForbidCompilation(JSContext *cx, RawScript script);
+void ForbidCompilation(JSContext *cx, RawScript script, ExecutionMode mode);
+uint32_t UsesBeforeIonRecompile(RawScript script, jsbytecode *pc);
 
-void PurgeCaches(UnrootedScript script, JSCompartment *c);
-size_t MemoryUsed(UnrootedScript script, JSMallocSizeOfFun mallocSizeOf);
-void DestroyIonScripts(FreeOp *fop, UnrootedScript script);
-void TraceIonScripts(JSTracer* trc, UnrootedScript script);
+void PurgeCaches(RawScript script, JSCompartment *c);
+size_t MemoryUsed(RawScript script, JSMallocSizeOfFun mallocSizeOf);
+void DestroyIonScripts(FreeOp *fop, RawScript script);
+void TraceIonScripts(JSTracer* trc, RawScript script);
 
 } // namespace ion
 } // namespace js
 
 #endif // jsion_ion_h__
 
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -6428,17 +6428,17 @@ IonBuilder::loadSlot(MDefinition *obj, H
     current->add(load);
     current->push(load);
 
     load->setResultType(rvalType);
     return pushTypeBarrier(load, types, barrier);
 }
 
 bool
-IonBuilder::storeSlot(MDefinition *obj, UnrootedShape shape, MDefinition *value, bool needsBarrier)
+IonBuilder::storeSlot(MDefinition *obj, RawShape shape, MDefinition *value, bool needsBarrier)
 {
     JS_ASSERT(shape->hasDefaultSetter());
     JS_ASSERT(shape->writable());
     JS_ASSERT(shape->hasSlot());
 
     if (shape->slot() < shape->numFixedSlots()) {
         MStoreFixedSlot *store = MStoreFixedSlot::New(obj, shape->slot(), value);
         current->add(store);
@@ -7230,17 +7230,17 @@ IonBuilder::addBoundsCheck(MDefinition *
     // If a bounds check failed in the past, don't optimize bounds checks.
     if (failedBoundsCheck_)
         check->setNotMovable();
 
     return check;
 }
 
 MInstruction *
-IonBuilder::addShapeGuard(MDefinition *obj, const UnrootedShape shape, BailoutKind bailoutKind)
+IonBuilder::addShapeGuard(MDefinition *obj, const RawShape shape, BailoutKind bailoutKind)
 {
     MGuardShape *guard = MGuardShape::New(obj, shape, bailoutKind);
     current->add(guard);
 
     // If a shape guard failed in the past, don't optimize shape guard.
     if (failedShapeGuard_)
         guard->setNotMovable();
 
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -297,24 +297,24 @@ class IonBuilder : public MIRGenerator
     MDefinition *createThis(HandleFunction target, MDefinition *callee);
     MInstruction *createDeclEnvObject(MDefinition *callee, MDefinition *scopeObj);
     MInstruction *createCallObject(MDefinition *callee, MDefinition *scopeObj);
 
     MDefinition *walkScopeChain(unsigned hops);
 
     MInstruction *addConvertElementsToDoubles(MDefinition *elements);
     MInstruction *addBoundsCheck(MDefinition *index, MDefinition *length);
-    MInstruction *addShapeGuard(MDefinition *obj, const UnrootedShape shape, BailoutKind bailoutKind);
+    MInstruction *addShapeGuard(MDefinition *obj, const RawShape shape, BailoutKind bailoutKind);
 
     JSObject *getNewArrayTemplateObject(uint32_t count);
 
     bool invalidatedIdempotentCache();
 
     bool loadSlot(MDefinition *obj, HandleShape shape, MIRType rvalType);
-    bool storeSlot(MDefinition *obj, UnrootedShape shape, MDefinition *value, bool needsBarrier);
+    bool storeSlot(MDefinition *obj, RawShape shape, MDefinition *value, bool needsBarrier);
 
     // jsop_getprop() helpers.
     bool getPropTryArgumentsLength(bool *emitted);
     bool getPropTryConstant(bool *emitted, HandleId id, types::StackTypeSet *barrier,
                             types::StackTypeSet *types, TypeOracle::UnaryTypes unaryTypes);
     bool getPropTryDefiniteSlot(bool *emitted, HandlePropertyName name,
                             types::StackTypeSet *barrier, types::StackTypeSet *types,
                             TypeOracle::Unary unary, TypeOracle::UnaryTypes unaryTypes);
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -238,29 +238,29 @@ IsCacheableProtoChain(JSObject *obj, JSO
         if (!proto || !proto->isNative())
             return false;
         obj = proto;
     }
     return true;
 }
 
 static bool
-IsCacheableGetPropReadSlot(JSObject *obj, JSObject *holder, UnrootedShape shape)
+IsCacheableGetPropReadSlot(JSObject *obj, JSObject *holder, RawShape shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (!shape->hasSlot() || !shape->hasDefaultGetter())
         return false;
 
     return true;
 }
 
 static bool
-IsCacheableNoProperty(JSObject *obj, JSObject *holder, UnrootedShape shape, jsbytecode *pc,
+IsCacheableNoProperty(JSObject *obj, JSObject *holder, RawShape shape, jsbytecode *pc,
                       const TypedOrValueRegister &output)
 {
     if (shape)
         return false;
 
     JS_ASSERT(!holder);
 
     // Just because we didn't find the property on the object doesn't mean it
@@ -301,30 +301,30 @@ IsCacheableNoProperty(JSObject *obj, JSO
     // monitor and invalidate the script.
     if (!output.hasValue())
         return false;
 
     return true;
 }
 
 static bool
-IsCacheableGetPropCallNative(JSObject *obj, JSObject *holder, UnrootedShape shape)
+IsCacheableGetPropCallNative(JSObject *obj, JSObject *holder, RawShape shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (!shape->hasGetterValue() || !shape->getterValue().isObject())
         return false;
 
     return shape->getterValue().toObject().isFunction() &&
            shape->getterValue().toObject().toFunction()->isNative();
 }
 
 static bool
-IsCacheableGetPropCallPropertyOp(JSObject *obj, JSObject *holder, UnrootedShape shape)
+IsCacheableGetPropCallPropertyOp(JSObject *obj, JSObject *holder, RawShape shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (shape->hasSlot() || shape->hasGetterValue() || shape->hasDefaultGetter())
         return false;
 
     return true;
@@ -1278,17 +1278,17 @@ SetPropertyIC::attachNativeAdding(JSCont
     masm.branchTestObjShape(Assembler::NotEqual, object(), oldShape, &failures);
 
     Label protoFailures;
     masm.push(object());    // save object reg because we clobber it
 
     JSObject *proto = obj->getProto();
     Register protoReg = object();
     while (proto) {
-        UnrootedShape protoShape = proto->lastProperty();
+        RawShape protoShape = proto->lastProperty();
 
         // load next prototype
         masm.loadPtr(Address(protoReg, JSObject::offsetOfType()), protoReg);
         masm.loadPtr(Address(protoReg, offsetof(types::TypeObject, proto)), protoReg);
 
         // ensure that the prototype is not NULL and that its shape matches
         masm.branchTestPtr(Assembler::Zero, protoReg, protoReg, &protoFailures);
         masm.branchTestObjShape(Assembler::NotEqual, protoReg, protoShape, &protoFailures);
@@ -1344,17 +1344,17 @@ IsPropertyInlineable(JSObject *obj)
         return false;
 
     return true;
 }
 
 static bool
 IsPropertySetInlineable(JSContext *cx, HandleObject obj, HandleId id, MutableHandleShape pshape)
 {
-    UnrootedShape shape = obj->nativeLookup(cx, id);
+    RawShape shape = obj->nativeLookup(cx, id);
 
     if (!shape)
         return false;
 
     if (!shape->hasSlot())
         return false;
 
     if (!shape->hasDefaultSetter())
@@ -1418,17 +1418,17 @@ IsPropertyAddInlineable(JSContext *cx, H
     // are native, and that all prototypes have no getter or setter
     // defined on the property
     for (JSObject *proto = obj->getProto(); proto; proto = proto->getProto()) {
         // if prototype is non-native, don't optimize
         if (!proto->isNative())
             return false;
 
         // if prototype defines this property in a non-plain way, don't optimize
-        UnrootedShape protoShape = proto->nativeLookup(cx, id);
+        RawShape protoShape = proto->nativeLookup(cx, id);
         if (protoShape && !protoShape->hasDefaultSetter())
             return false;
 
         // Otherise, if there's no such property, watch out for a resolve hook that would need
         // to be invoked and thus prevent inlining of property addition.
         if (proto->getClass()->resolve != JS_ResolveStub)
              return false;
     }
@@ -1770,27 +1770,27 @@ BindNameIC::attachGlobal(JSContext *cx, 
     CodeOffsetJump rejoinOffset = masm.jumpWithPatch(&rejoin_);
     masm.bind(&rejoin_);
 
     return linkAndAttachStub(cx, masm, ion, "global", rejoinOffset, &exitOffset);
 }
 
 static inline void
 GenerateScopeChainGuard(MacroAssembler &masm, JSObject *scopeObj,
-                        Register scopeObjReg, UnrootedShape shape, Label *failures)
+                        Register scopeObjReg, RawShape shape, Label *failures)
 {
     AutoAssertNoGC nogc;
     if (scopeObj->isCall()) {
         // We can skip a guard on the call object if the script's bindings are
         // guaranteed to be immutable (and thus cannot introduce shadowing
         // variables).
         CallObject *callObj = &scopeObj->asCall();
         if (!callObj->isForEval()) {
             RawFunction fun = &callObj->callee();
-            UnrootedScript script = fun->nonLazyScript();
+            RawScript script = fun->nonLazyScript();
             if (!script->funHasExtensibleScope)
                 return;
         }
     } else if (scopeObj->isGlobal()) {
         // If this is the last object on the scope walk, and the property we've
         // found is not configurable, then we don't need a shape guard because
         // the shape cannot be removed.
         if (shape && !shape->configurable())
--- a/js/src/ion/IonCaches.h
+++ b/js/src/ion/IonCaches.h
@@ -258,17 +258,17 @@ class IonCache
     }
     void setIdempotent() {
         JS_ASSERT(!idempotent_);
         JS_ASSERT(!script);
         JS_ASSERT(!pc);
         idempotent_ = true;
     }
 
-    void setScriptedLocation(UnrootedScript script, jsbytecode *pc) {
+    void setScriptedLocation(RawScript script, jsbytecode *pc) {
         JS_ASSERT(!idempotent_);
         this->script = script;
         this->pc = pc;
     }
 
     void getScriptedLocation(MutableHandleScript pscript, jsbytecode **ppc) {
         pscript.set(script);
         *ppc = pc;
--- a/js/src/ion/IonCode.h
+++ b/js/src/ion/IonCode.h
@@ -363,17 +363,17 @@ struct IonScript
         return snapshotsSize_;
     }
     const uint8_t *safepoints() const {
         return reinterpret_cast<const uint8_t *>(this) + safepointsStart_;
     }
     size_t safepointsSize() const {
         return safepointsSize_;
     }
-    UnrootedScript getScript(size_t i) const {
+    RawScript getScript(size_t i) const {
         JS_ASSERT(i < scriptEntries_);
         return scriptList()[i];
     }
     size_t scriptEntries() const {
         return scriptEntries_;
     }
     size_t parallelInvalidatedScriptEntries() const {
         return parallelInvalidatedScriptEntries_;
--- a/js/src/ion/IonCompartment.h
+++ b/js/src/ion/IonCompartment.h
@@ -220,15 +220,15 @@ class IonActivation
     }
     static inline size_t offsetOfEntryFp() {
         return offsetof(IonActivation, entryfp_);
     }
 };
 
 // Called from JSCompartment::discardJitCode().
 void InvalidateAll(FreeOp *fop, JSCompartment *comp);
-void FinishInvalidation(FreeOp *fop, UnrootedScript script);
+void FinishInvalidation(FreeOp *fop, RawScript script);
 
 } // namespace ion
 } // namespace js
 
 #endif // jsion_ion_compartment_h__
 
--- a/js/src/ion/IonFrameIterator.h
+++ b/js/src/ion/IonFrameIterator.h
@@ -125,17 +125,17 @@ class IonFrameIterator
     bool isConstructing() const;
 
     bool isEntryJSFrame() const;
 
     void *calleeToken() const;
     JSFunction *callee() const;
     JSFunction *maybeCallee() const;
     unsigned numActualArgs() const;
-    UnrootedScript script() const;
+    RawScript script() const;
     Value *nativeVp() const;
     Value *actualArgs() const;
 
     // Returns the return address of the frame above this one (that is, the
     // return address that returns back to the current frame).
     uint8_t *returnAddressToFp() const {
         return returnAddressToFp_;
     }
@@ -288,17 +288,17 @@ class InlineFrameIterator
     JSFunction *maybeCallee() const {
         return callee_;
     }
     unsigned numActualArgs() const;
 
     template <class Op>
     inline void forEachCanonicalActualArg(JSContext *cx, Op op, unsigned start, unsigned count) const;
 
-    UnrootedScript script() const {
+    RawScript script() const {
         return script_;
     }
     jsbytecode *pc() const {
         return pc_;
     }
     SnapshotIterator snapshotIterator() const {
         return si_;
     }
--- a/js/src/ion/IonFrames-inl.h
+++ b/js/src/ion/IonFrames-inl.h
@@ -76,17 +76,17 @@ IonFrameIterator::prevType() const
 size_t
 IonFrameIterator::frameSize() const
 {
     JS_ASSERT(type_ != IonFrame_Exit);
     return frameSize_;
 }
 
 // Returns the JSScript associated with the topmost Ion frame.
-inline UnrootedScript
+inline RawScript
 GetTopIonJSScript(JSContext *cx, const SafepointIndex **safepointIndexOut, void **returnAddrOut)
 {
     AutoAssertNoGC nogc;
     IonFrameIterator iter(cx->mainThread().ionTop);
     JS_ASSERT(iter.type() == IonFrame_Exit);
     ++iter;
 
     // If needed, grab the safepoint index.
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -150,17 +150,17 @@ IonFrameIterator::isEntryJSFrame() const
     ++iter;
     for (; !iter.done(); ++iter) {
         if (iter.isScripted())
             return false;
     }
     return true;
 }
 
-UnrootedScript
+RawScript
 IonFrameIterator::script() const
 {
     AutoAssertNoGC nogc;
     JS_ASSERT(isScripted());
     RawScript script = ScriptFromCalleeToken(calleeToken());
     JS_ASSERT(script);
     return script;
 }
@@ -418,17 +418,17 @@ MarkCalleeToken(JSTracer *trc, CalleeTok
       {
         JSFunction *fun = CalleeTokenToFunction(token);
         MarkObjectRoot(trc, &fun, "ion-callee");
         JS_ASSERT(fun == CalleeTokenToFunction(token));
         break;
       }
       case CalleeToken_Script:
       {
-        UnrootedScript script = CalleeTokenToScript(token);
+        RawScript script = CalleeTokenToScript(token);
         MarkScriptRoot(trc, &script, "ion-entry");
         JS_ASSERT(script == CalleeTokenToScript(token));
         break;
       }
       default:
         JS_NOT_REACHED("unknown callee token type");
     }
 }
--- a/js/src/ion/IonFrames.h
+++ b/js/src/ion/IonFrames.h
@@ -54,35 +54,35 @@ CalleeTokenIsFunction(CalleeToken token)
     return GetCalleeTokenTag(token) == CalleeToken_Function;
 }
 static inline JSFunction *
 CalleeTokenToFunction(CalleeToken token)
 {
     JS_ASSERT(CalleeTokenIsFunction(token));
     return (JSFunction *)token;
 }
-static inline UnrootedScript
+static inline RawScript
 CalleeTokenToScript(CalleeToken token)
 {
     JS_ASSERT(GetCalleeTokenTag(token) == CalleeToken_Script);
     return (RawScript)(uintptr_t(token) & ~uintptr_t(0x3));
 }
 
-static inline UnrootedScript
+static inline RawScript
 ScriptFromCalleeToken(CalleeToken token)
 {
     AutoAssertNoGC nogc;
     switch (GetCalleeTokenTag(token)) {
       case CalleeToken_Script:
         return CalleeTokenToScript(token);
       case CalleeToken_Function:
         return CalleeTokenToFunction(token)->nonLazyScript();
     }
     JS_NOT_REACHED("invalid callee token tag");
-    return UnrootedScript(NULL);
+    return NULL;
 }
 
 // In between every two frames lies a small header describing both frames. This
 // header, minimally, contains a returnAddress word and a descriptor word. The
 // descriptor describes the size and type of the previous frame, whereas the
 // returnAddress describes the address the newer frame (the callee) will return
 // to. The exact mechanism in which frames are laid out is architecture
 // dependent.
@@ -268,17 +268,17 @@ MakeFrameDescriptor(uint32_t frameSize, 
 # include "ion/arm/IonFrames-arm.h"
 #else
 # error "unsupported architecture"
 #endif
 
 namespace js {
 namespace ion {
 
-UnrootedScript
+RawScript
 GetTopIonJSScript(JSContext *cx,
                   const SafepointIndex **safepointIndexOut = NULL,
                   void **returnAddrOut = NULL);
 
 void
 GetPcScript(JSContext *cx, JSScript **scriptRes, jsbytecode **pcRes);
 
 // Given a slot index, returns the offset, in bytes, of that slot from an
--- a/js/src/ion/IonMacroAssembler.h
+++ b/js/src/ion/IonMacroAssembler.h
@@ -669,17 +669,17 @@ class MacroAssembler : public MacroAssem
 
     void spsUpdatePCIdx(SPSProfiler *p, int32_t idx, Register temp) {
         Label stackFull;
         spsProfileEntryAddress(p, -1, temp, &stackFull);
         store32(Imm32(idx), Address(temp, ProfileEntry::offsetOfPCIdx()));
         bind(&stackFull);
     }
 
-    void spsPushFrame(SPSProfiler *p, const char *str, UnrootedScript s, Register temp) {
+    void spsPushFrame(SPSProfiler *p, const char *str, RawScript s, Register temp) {
         Label stackFull;
         spsProfileEntryAddress(p, 0, temp, &stackFull);
 
         storePtr(ImmWord(str),    Address(temp, ProfileEntry::offsetOfString()));
         storePtr(ImmGCPtr(s),     Address(temp, ProfileEntry::offsetOfScript()));
         storePtr(ImmWord((void*) NULL),
                  Address(temp, ProfileEntry::offsetOfStackAddress()));
         store32(Imm32(ProfileEntry::NullPCIndex),
--- a/js/src/ion/JSONSpewer.cpp
+++ b/js/src/ion/JSONSpewer.cpp
@@ -173,17 +173,17 @@ JSONSpewer::init(const char *path)
         return false;
 
     beginObject();
     beginListProperty("functions");
     return true;
 }
 
 void
-JSONSpewer::beginFunction(UnrootedScript script)
+JSONSpewer::beginFunction(RawScript script)
 {
     if (inFunction_)
         endFunction();
 
     beginObject();
     stringProperty("name", "%s:%d", script->filename, script->lineno);
     beginListProperty("passes");
 
--- a/js/src/ion/JSONSpewer.h
+++ b/js/src/ion/JSONSpewer.h
@@ -55,17 +55,17 @@ class JSONSpewer
       : inFunction_(false),
         indentLevel_(0),
         first_(true),
         fp_(NULL)
     { }
     ~JSONSpewer();
 
     bool init(const char *path);
-    void beginFunction(UnrootedScript script);
+    void beginFunction(RawScript script);
     void beginPass(const char * pass);
     void spewMDef(MDefinition *def);
     void spewMResumePoint(MResumePoint *rp);
     void spewMIR(MIRGraph *mir);
     void spewLIns(LInstruction *ins);
     void spewLIR(MIRGraph *mir);
     void spewIntervals(LinearScanAllocator *regalloc);
     void endPass();
--- a/js/src/ion/LIR-Common.h
+++ b/js/src/ion/LIR-Common.h
@@ -3957,17 +3957,17 @@ class LFunctionBoundary : public LInstru
     LFunctionBoundary(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
     const LDefinition *temp() {
         return getTemp(0);
     }
 
-    UnrootedScript script() {
+    RawScript script() {
         return mir_->toFunctionBoundary()->script();
     }
 
     MFunctionBoundary::Type type() {
         return mir_->toFunctionBoundary()->type();
     }
 
     unsigned inlineLevel() {
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -368,17 +368,17 @@ MConstant::printOpcode(FILE *fp)
             JSFunction *fun = value().toObject().toFunction();
             if (fun->displayAtom()) {
                 fputs("function ", fp);
                 FileEscapedString(fp, fun->displayAtom(), 0);
             } else {
                 fputs("unnamed function", fp);
             }
             if (fun->hasScript()) {
-                UnrootedScript script = fun->nonLazyScript();
+                RawScript script = fun->nonLazyScript();
                 fprintf(fp, " (%s:%u)",
                         script->filename ? script->filename : "", script->lineno);
             }
             fprintf(fp, " at %p", (void *) fun);
             break;
         }
         fprintf(fp, "object %p (%s)", (void *)&value().toObject(),
                 value().toObject().getClass()->name);
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -5030,79 +5030,79 @@ class MGetElementCache
 class MBindNameCache
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     CompilerRootPropertyName name_;
     CompilerRootScript script_;
     jsbytecode *pc_;
 
-    MBindNameCache(MDefinition *scopeChain, PropertyName *name, UnrootedScript script, jsbytecode *pc)
+    MBindNameCache(MDefinition *scopeChain, PropertyName *name, RawScript script, jsbytecode *pc)
       : MUnaryInstruction(scopeChain), name_(name), script_(script), pc_(pc)
     {
         setResultType(MIRType_Object);
     }
 
   public:
     INSTRUCTION_HEADER(BindNameCache)
 
-    static MBindNameCache *New(MDefinition *scopeChain, PropertyName *name, UnrootedScript script,
+    static MBindNameCache *New(MDefinition *scopeChain, PropertyName *name, RawScript script,
                                jsbytecode *pc) {
         return new MBindNameCache(scopeChain, name, script, pc);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
     MDefinition *scopeChain() const {
         return getOperand(0);
     }
     PropertyName *name() const {
         return name_;
     }
-    UnrootedScript script() const {
+    RawScript script() const {
         return script_;
     }
     jsbytecode *pc() const {
         return pc_;
     }
 };
 
 // Guard on an object's shape.
 class MGuardShape
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     CompilerRootShape shape_;
     BailoutKind bailoutKind_;
 
-    MGuardShape(MDefinition *obj, UnrootedShape shape, BailoutKind bailoutKind)
+    MGuardShape(MDefinition *obj, RawShape shape, BailoutKind bailoutKind)
       : MUnaryInstruction(obj),
         shape_(shape),
         bailoutKind_(bailoutKind)
     {
         setGuard();
         setMovable();
         setResultType(MIRType_Object);
     }
 
   public:
     INSTRUCTION_HEADER(GuardShape)
 
-    static MGuardShape *New(MDefinition *obj, UnrootedShape shape, BailoutKind bailoutKind) {
+    static MGuardShape *New(MDefinition *obj, RawShape shape, BailoutKind bailoutKind) {
         return new MGuardShape(obj, shape, bailoutKind);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
-    const UnrootedShape shape() const {
+    const RawShape shape() const {
         return shape_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
     bool congruentTo(MDefinition * const &ins) const {
         if (!ins->isGuardShape())
             return false;
@@ -6451,33 +6451,33 @@ class MFunctionBoundary : public MNullar
                       // before this boundary
     };
 
   private:
     JSScript *script_;
     Type type_;
     unsigned inlineLevel_;
 
-    MFunctionBoundary(UnrootedScript script, Type type, unsigned inlineLevel)
+    MFunctionBoundary(RawScript script, Type type, unsigned inlineLevel)
       : script_(script), type_(type), inlineLevel_(inlineLevel)
     {
         JS_ASSERT_IF(type != Inline_Exit, script != NULL);
         JS_ASSERT_IF(type == Inline_Enter, inlineLevel != 0);
         setGuard();
     }
 
   public:
     INSTRUCTION_HEADER(FunctionBoundary)
 
-    static MFunctionBoundary *New(UnrootedScript script, Type type,
+    static MFunctionBoundary *New(RawScript script, Type type,
                                   unsigned inlineLevel = 0) {
         return new MFunctionBoundary(script, type, inlineLevel);
     }
 
-    UnrootedScript script() {
+    RawScript script() {
         return script_;
     }
 
     Type type() {
         return type_;
     }
 
     unsigned inlineLevel() {
--- a/js/src/ion/MIRGraph.h
+++ b/js/src/ion/MIRGraph.h
@@ -595,17 +595,17 @@ class MIRGraph
         return osrBlock_;
     }
     void setOsrStart(MStart *osrStart) {
         osrStart_ = osrStart;
     }
     MStart *osrStart() {
         return osrStart_;
     }
-    bool addScript(UnrootedScript script) {
+    bool addScript(RawScript script) {
         // The same script may be inlined multiple times, add it only once.
         for (size_t i = 0; i < scripts_.length(); i++) {
             if (scripts_[i] == script)
                 return true;
         }
         return scripts_.append(script);
     }
     size_t numScripts() const {
--- a/js/src/ion/ParallelArrayAnalysis.h
+++ b/js/src/ion/ParallelArrayAnalysis.h
@@ -43,17 +43,17 @@ class ParallelCompileContext
     // Should we append a function to the worklist?
     bool appendToWorklist(HandleFunction fun);
 
     ExecutionMode executionMode() {
         return ParallelExecution;
     }
 
     // Defined in Ion.cpp, so that they can make use of static fns defined there
-    MethodStatus checkScriptSize(JSContext *cx, UnrootedScript script);
+    MethodStatus checkScriptSize(JSContext *cx, RawScript script);
     MethodStatus compileTransitively();
     AbortReason compile(IonBuilder *builder, MIRGraph *graph,
                         ScopedJSDeletePtr<LifoAlloc> &autoDelete);
 };
 
 
 } // namespace ion
 } // namespace js
--- a/js/src/ion/PcScriptCache.h
+++ b/js/src/ion/PcScriptCache.h
@@ -41,17 +41,17 @@ struct PcScriptCache
         this->gcNumber = gcNumber;
     }
 
     // Get a value from the cache. May perform lazy allocation.
     // Defined in PcScriptCache-inl.h.
     bool get(JSRuntime *rt, uint32_t hash, uint8_t *addr,
              JSScript **scriptRes, jsbytecode **pcRes);
 
-    void add(uint32_t hash, uint8_t *addr, jsbytecode *pc, UnrootedScript script) {
+    void add(uint32_t hash, uint8_t *addr, jsbytecode *pc, RawScript script) {
         entries[hash].returnAddress = addr;
         entries[hash].pc = pc;
         entries[hash].script = script;
     }
 
     static uint32_t Hash(uint8_t *addr) {
         uint32_t key = (uint32_t)((uintptr_t)addr);
         return ((key >> 3) * 2654435761u) % Length;
--- a/js/src/ion/SnapshotWriter.h
+++ b/js/src/ion/SnapshotWriter.h
@@ -29,17 +29,17 @@ class SnapshotWriter
     uint32_t nframes_;
     uint32_t framesWritten_;
     SnapshotOffset lastStart_;
 
     void writeSlotHeader(JSValueType type, uint32_t regCode);
 
   public:
     SnapshotOffset startSnapshot(uint32_t frameCount, BailoutKind kind, bool resumeAfter);
-    void startFrame(JSFunction *fun, UnrootedScript script, jsbytecode *pc, uint32_t exprStack);
+    void startFrame(JSFunction *fun, RawScript script, jsbytecode *pc, uint32_t exprStack);
 #ifdef TRACK_SNAPSHOTS
     void trackFrame(uint32_t pcOpcode, uint32_t mirOpcode, uint32_t mirId,
                                      uint32_t lirOpcode, uint32_t lirId);
 #endif
     void endFrame();
 
     void addSlot(const FloatRegister &reg);
     void addSlot(JSValueType type, const Register &reg);
--- a/js/src/ion/Snapshots.cpp
+++ b/js/src/ion/Snapshots.cpp
@@ -292,17 +292,17 @@ SnapshotWriter::startSnapshot(uint32_t f
     if (resumeAfter)
         bits |= (1 << BAILOUT_RESUME_SHIFT);
 
     writer_.writeUnsigned(bits);
     return lastStart_;
 }
 
 void
-SnapshotWriter::startFrame(JSFunction *fun, UnrootedScript script, jsbytecode *pc, uint32_t exprStack)
+SnapshotWriter::startFrame(JSFunction *fun, RawScript script, jsbytecode *pc, uint32_t exprStack)
 {
     JS_ASSERT(CountArgSlots(fun) < SNAPSHOT_MAX_NARGS);
     JS_ASSERT(exprStack < SNAPSHOT_MAX_STACK);
 
     uint32_t formalArgs = CountArgSlots(fun);
 
     nslots_ = formalArgs + script->nfixed + exprStack;
     slotsWritten_ = 0;
--- a/js/src/ion/TypeOracle.cpp
+++ b/js/src/ion/TypeOracle.cpp
@@ -59,28 +59,28 @@ TypeInferenceOracle::getMIRType(StackTyp
 
 MIRType
 TypeInferenceOracle::getMIRType(HeapTypeSet *types)
 {
     return GetMIRType(types->getKnownTypeTag(cx));
 }
 
 TypeOracle::UnaryTypes
-TypeInferenceOracle::unaryTypes(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::unaryTypes(RawScript script, jsbytecode *pc)
 {
     JS_ASSERT(script == this->script());
 
     UnaryTypes res;
     res.inTypes = script->analysis()->poppedTypes(pc, 0);
     res.outTypes = script->analysis()->pushedTypes(pc, 0);
     return res;
 }
 
 TypeOracle::BinaryTypes
-TypeInferenceOracle::binaryTypes(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::binaryTypes(RawScript script, jsbytecode *pc)
 {
     JS_ASSERT(script == this->script());
 
     JSOp op = (JSOp)*pc;
 
     BinaryTypes res;
     if (op == JSOP_NEG || op == JSOP_POS) {
         res.lhsTypes = script->analysis()->poppedTypes(pc, 0);
@@ -90,28 +90,28 @@ TypeInferenceOracle::binaryTypes(Unroote
         res.lhsTypes = script->analysis()->poppedTypes(pc, 1);
         res.rhsTypes = script->analysis()->poppedTypes(pc, 0);
         res.outTypes = script->analysis()->pushedTypes(pc, 0);
     }
     return res;
 }
 
 TypeOracle::Unary
-TypeInferenceOracle::unaryOp(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::unaryOp(RawScript script, jsbytecode *pc)
 {
     JS_ASSERT(script == this->script());
 
     Unary res;
     res.ival = getMIRType(script->analysis()->poppedTypes(pc, 0));
     res.rval = getMIRType(script->analysis()->pushedTypes(pc, 0));
     return res;
 }
 
 TypeOracle::Binary
-TypeInferenceOracle::binaryOp(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::binaryOp(RawScript script, jsbytecode *pc)
 {
     JS_ASSERT(script == this->script());
 
     JSOp op = (JSOp)*pc;
 
     Binary res;
     if (op == JSOP_NEG || op == JSOP_POS) {
         res.lhs = getMIRType(script->analysis()->poppedTypes(pc, 0));
@@ -121,17 +121,17 @@ TypeInferenceOracle::binaryOp(UnrootedSc
         res.lhs = getMIRType(script->analysis()->poppedTypes(pc, 1));
         res.rhs = getMIRType(script->analysis()->poppedTypes(pc, 0));
         res.rval = getMIRType(script->analysis()->pushedTypes(pc, 0));
     }
     return res;
 }
 
 StackTypeSet *
-TypeInferenceOracle::thisTypeSet(UnrootedScript script)
+TypeInferenceOracle::thisTypeSet(RawScript script)
 {
     JS_ASSERT(script == this->script());
     return TypeScript::ThisTypes(script);
 }
 
 bool
 TypeInferenceOracle::getOsrTypes(jsbytecode *osrPc, Vector<MIRType> &slotTypes)
 {
@@ -200,24 +200,24 @@ TypeInferenceOracle::getOsrTypes(jsbytec
         for (size_t i = ArgSlot(0); i < TotalSlots(script()); i++)
             slotTypes[i - 1] = getMIRType(slotTypeSets[i]);
     }
 
     return true;
 }
 
 StackTypeSet *
-TypeInferenceOracle::parameterTypeSet(UnrootedScript script, size_t index)
+TypeInferenceOracle::parameterTypeSet(RawScript script, size_t index)
 {
     JS_ASSERT(script == this->script());
     return TypeScript::ArgTypes(script, index);
 }
 
 StackTypeSet *
-TypeInferenceOracle::propertyRead(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::propertyRead(RawScript script, jsbytecode *pc)
 {
     return script->analysis()->pushedTypes(pc, 0);
 }
 
 StackTypeSet *
 TypeInferenceOracle::propertyReadBarrier(HandleScript script, jsbytecode *pc)
 {
     if (script->analysis()->typeBarriers(cx, pc))
@@ -252,17 +252,17 @@ TypeInferenceOracle::propertyReadIdempot
                 return false;
         }
     }
 
     return true;
 }
 
 bool
-TypeInferenceOracle::propertyReadAccessGetter(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::propertyReadAccessGetter(RawScript script, jsbytecode *pc)
 {
     return script->analysis()->getCode(pc).accessGetter;
 }
 
 bool
 TypeInferenceOracle::inObjectIsDenseNativeWithoutExtraIndexedProperties(HandleScript script, jsbytecode *pc)
 {
     // Check whether the object is a native and index is int32 or double.
@@ -276,17 +276,17 @@ TypeInferenceOracle::inObjectIsDenseNati
     Class *clasp = obj->getKnownClass();
     if (!clasp || !clasp->isNative())
         return false;
 
     return !types::TypeCanHaveExtraIndexedProperties(cx, obj);
 }
 
 bool
-TypeInferenceOracle::inArrayIsPacked(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::inArrayIsPacked(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *types = script->analysis()->poppedTypes(pc, 0);
     return !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
 }
 
 bool
 TypeInferenceOracle::elementReadIsDenseNative(RawScript script, jsbytecode *pc)
 {
@@ -337,17 +337,17 @@ TypeInferenceOracle::elementReadIsTypedA
         if (!result->hasType(types::Type::Int32Type()))
             return false;
     }
 
     return true;
 }
 
 bool
-TypeInferenceOracle::elementReadIsString(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementReadIsString(RawScript script, jsbytecode *pc)
 {
     // Check for string[index].
     StackTypeSet *value = script->analysis()->poppedTypes(pc, 1);
     StackTypeSet *id = script->analysis()->poppedTypes(pc, 0);
 
     if (value->getKnownTypeTag() != JSVAL_TYPE_STRING)
         return false;
 
@@ -361,39 +361,39 @@ TypeInferenceOracle::elementReadIsString
     StackTypeSet *pushed = script->analysis()->pushedTypes(pc, 0);
     if (pushed->getKnownTypeTag() != JSVAL_TYPE_STRING)
         return false;
 
     return true;
 }
 
 bool
-TypeInferenceOracle::elementReadShouldAlwaysLoadDoubles(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementReadShouldAlwaysLoadDoubles(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *types = script->analysis()->poppedTypes(pc, 1);
     types::StackTypeSet::DoubleConversion conversion = types->convertDoubleElements(cx);
     return conversion == StackTypeSet::AlwaysConvertToDoubles;
 }
 
 bool
-TypeInferenceOracle::elementReadHasExtraIndexedProperty(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementReadHasExtraIndexedProperty(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *obj = script->analysis()->poppedTypes(pc, 1);
     return types::TypeCanHaveExtraIndexedProperties(cx, obj);
 }
 
 bool
-TypeInferenceOracle::elementReadIsPacked(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementReadIsPacked(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *types = script->analysis()->poppedTypes(pc, 1);
     return !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
 }
 
 void
-TypeInferenceOracle::elementReadGeneric(UnrootedScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex)
+TypeInferenceOracle::elementReadGeneric(RawScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex)
 {
     MIRType obj = getMIRType(script->analysis()->poppedTypes(pc, 1));
     MIRType id = getMIRType(script->analysis()->poppedTypes(pc, 0));
 
     *cacheable = (obj == MIRType_Object &&
                   (id == MIRType_Value || id == MIRType_Int32 || id == MIRType_String));
 
     *intIndex = id == MIRType_Int32;
@@ -450,17 +450,17 @@ TypeInferenceOracle::elementWriteIsTyped
     *arrayType = obj->getTypedArrayType();
     if (*arrayType == TypedArray::TYPE_MAX)
         return false;
 
     return true;
 }
 
 bool
-TypeInferenceOracle::elementWriteNeedsDoubleConversion(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementWriteNeedsDoubleConversion(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *types = script->analysis()->poppedTypes(pc, 2);
     types::StackTypeSet::DoubleConversion conversion = types->convertDoubleElements(cx);
     return conversion == StackTypeSet::AlwaysConvertToDoubles ||
            conversion == StackTypeSet::MaybeConvertToDoubles;
 }
 
 bool
@@ -477,25 +477,25 @@ TypeInferenceOracle::elementWriteHasExtr
 bool
 TypeInferenceOracle::elementWriteIsPacked(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *types = script->analysis()->poppedTypes(pc, 2);
     return !types->hasObjectFlags(cx, types::OBJECT_FLAG_NON_PACKED);
 }
 
 bool
-TypeInferenceOracle::setElementHasWrittenHoles(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::setElementHasWrittenHoles(RawScript script, jsbytecode *pc)
 {
     return script->analysis()->getCode(pc).arrayWriteHole;
 }
 
 MIRType
-TypeInferenceOracle::elementWrite(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementWrite(RawScript script, jsbytecode *pc)
 {
-    StackTypeSet *objTypes = DropUnrooted(script)->analysis()->poppedTypes(pc, 2);
+    StackTypeSet *objTypes = script->analysis()->poppedTypes(pc, 2);
     MIRType elementType = MIRType_None;
     unsigned count = objTypes->getObjectCount();
 
     for (unsigned i = 0; i < count; i++) {
         if (objTypes->getSingleObject(i))
             return MIRType_None;
 
         if (TypeObject *object = objTypes->getTypeObject(i)) {
@@ -516,72 +516,72 @@ TypeInferenceOracle::elementWrite(Unroot
                 return MIRType_None;
         }
     }
 
     return elementType;
 }
 
 bool
-TypeInferenceOracle::arrayResultShouldHaveDoubleConversion(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::arrayResultShouldHaveDoubleConversion(RawScript script, jsbytecode *pc)
 {
     types::StackTypeSet::DoubleConversion conversion =
         script->analysis()->pushedTypes(pc, 0)->convertDoubleElements(cx);
     return conversion == types::StackTypeSet::AlwaysConvertToDoubles;
 }
 
 bool
 TypeInferenceOracle::canInlineCalls()
 {
     return script()->analysis()->hasFunctionCalls();
 }
 
 bool
-TypeInferenceOracle::propertyWriteCanSpecialize(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::propertyWriteCanSpecialize(RawScript script, jsbytecode *pc)
 {
     return !script->analysis()->getCode(pc).monitoredTypes;
 }
 
 bool
-TypeInferenceOracle::propertyWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc, RawId id)
+TypeInferenceOracle::propertyWriteNeedsBarrier(RawScript script, jsbytecode *pc, RawId id)
 {
-    StackTypeSet *types = DropUnrooted(script)->analysis()->poppedTypes(pc, 1);
+    StackTypeSet *types = script->analysis()->poppedTypes(pc, 1);
     return types->propertyNeedsBarrier(cx, id);
 }
 
 bool
-TypeInferenceOracle::elementWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementWriteNeedsBarrier(RawScript script, jsbytecode *pc)
 {
     // Return true if SETELEM-like instructions need a write barrier before modifying
     // a property. The object is the third value popped by SETELEM.
-    StackTypeSet *types = DropUnrooted(script)->analysis()->poppedTypes(pc, 2);
+    StackTypeSet *types = script->analysis()->poppedTypes(pc, 2);
     return types->propertyNeedsBarrier(cx, JSID_VOID);
 }
 
 StackTypeSet *
-TypeInferenceOracle::getCallTarget(UnrootedScript caller, uint32_t argc, jsbytecode *pc)
+TypeInferenceOracle::getCallTarget(RawScript caller, uint32_t argc, jsbytecode *pc)
 {
     JS_ASSERT(caller == this->script());
     JS_ASSERT(js_CodeSpec[*pc].format & JOF_INVOKE);
 
     ScriptAnalysis *analysis = script()->analysis();
     return analysis->poppedTypes(pc, argc + 1);
 }
 
 StackTypeSet *
-TypeInferenceOracle::getCallArg(UnrootedScript script, uint32_t argc, uint32_t arg, jsbytecode *pc)
+TypeInferenceOracle::getCallArg(RawScript script, uint32_t argc, uint32_t arg, jsbytecode *pc)
 {
     JS_ASSERT(argc >= arg);
     // Bytecode order: Function, This, Arg0, Arg1, ..., ArgN, Call.
     // |argc| does not include |this|.
     return script->analysis()->poppedTypes(pc, argc - arg);
 }
 
 StackTypeSet *
-TypeInferenceOracle::getCallReturn(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::getCallReturn(RawScript script, jsbytecode *pc)
 {
     return script->analysis()->pushedTypes(pc, 0);
 }
 
 bool
 TypeInferenceOracle::canInlineCall(HandleScript caller, jsbytecode *pc)
 {
     JS_ASSERT(types::IsInlinableCall(pc));
@@ -650,47 +650,47 @@ TypeInferenceOracle::canEnterInlinedFunc
     }
 
     // TI calls ObjectStateChange to trigger invalidation of the caller.
     HeapTypeSet::WatchObjectStateChange(cx, targetType);
     return true;
 }
 
 HeapTypeSet *
-TypeInferenceOracle::globalPropertyWrite(UnrootedScript script, jsbytecode *pc, jsid id,
+TypeInferenceOracle::globalPropertyWrite(RawScript script, jsbytecode *pc, jsid id,
                                          bool *canSpecialize)
 {
     *canSpecialize = !script->analysis()->getCode(pc).monitoredTypes;
     if (!*canSpecialize)
         return NULL;
 
-    return globalPropertyTypeSet(DropUnrooted(script), pc, id);
+    return globalPropertyTypeSet(script, pc, id);
 }
 
 StackTypeSet *
-TypeInferenceOracle::returnTypeSet(UnrootedScript script, jsbytecode *pc, types::StackTypeSet **barrier)
+TypeInferenceOracle::returnTypeSet(RawScript script, jsbytecode *pc, types::StackTypeSet **barrier)
 {
     if (script->analysis()->getCode(pc).monitoredTypesReturn)
         *barrier = script->analysis()->bytecodeTypes(pc);
     else
         *barrier = NULL;
     return script->analysis()->pushedTypes(pc, 0);
 }
 
 StackTypeSet *
-TypeInferenceOracle::aliasedVarBarrier(UnrootedScript script, jsbytecode *pc, types::StackTypeSet **barrier)
+TypeInferenceOracle::aliasedVarBarrier(RawScript script, jsbytecode *pc, types::StackTypeSet **barrier)
 {
     *barrier = script->analysis()->bytecodeTypes(pc);
     return script->analysis()->pushedTypes(pc, 0);
 }
 
 HeapTypeSet *
-TypeInferenceOracle::globalPropertyTypeSet(UnrootedScript script, jsbytecode *pc, jsid id)
+TypeInferenceOracle::globalPropertyTypeSet(RawScript script, jsbytecode *pc, jsid id)
 {
-    TypeObject *type = DropUnrooted(script)->global().getType(cx);
+    TypeObject *type = script->global().getType(cx);
     if (!type || type->unknownProperties())
         return NULL;
 
     return type->getProperty(cx, id, false);
 }
 
 LazyArgumentsType
 TypeInferenceOracle::isArgumentObject(types::StackTypeSet *obj)
@@ -698,27 +698,27 @@ TypeInferenceOracle::isArgumentObject(ty
     if (obj->isMagicArguments())
         return DefinitelyArguments;
     if (obj->hasAnyFlag(TYPE_FLAG_LAZYARGS))
         return MaybeArguments;
     return NotArguments;
 }
 
 LazyArgumentsType
-TypeInferenceOracle::propertyReadMagicArguments(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::propertyReadMagicArguments(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *obj = script->analysis()->poppedTypes(pc, 0);
     return isArgumentObject(obj);
 }
 
 LazyArgumentsType
-TypeInferenceOracle::elementReadMagicArguments(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementReadMagicArguments(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *obj = script->analysis()->poppedTypes(pc, 1);
     return isArgumentObject(obj);
 }
 
 LazyArgumentsType
-TypeInferenceOracle::elementWriteMagicArguments(UnrootedScript script, jsbytecode *pc)
+TypeInferenceOracle::elementWriteMagicArguments(RawScript script, jsbytecode *pc)
 {
     StackTypeSet *obj = script->analysis()->poppedTypes(pc, 2);
     return isArgumentObject(obj);
 }
--- a/js/src/ion/TypeOracle.h
+++ b/js/src/ion/TypeOracle.h
@@ -40,183 +40,183 @@ class TypeOracle
     };
     struct Binary {
         MIRType lhs;
         MIRType rhs;
         MIRType rval;
     };
 
   public:
-    virtual UnaryTypes unaryTypes(UnrootedScript script, jsbytecode *pc) = 0;
-    virtual BinaryTypes binaryTypes(UnrootedScript script, jsbytecode *pc) = 0;
-    virtual Unary unaryOp(UnrootedScript script, jsbytecode *pc) = 0;
-    virtual Binary binaryOp(UnrootedScript script, jsbytecode *pc) = 0;
-    virtual types::StackTypeSet *thisTypeSet(UnrootedScript script) { return NULL; }
+    virtual UnaryTypes unaryTypes(RawScript script, jsbytecode *pc) = 0;
+    virtual BinaryTypes binaryTypes(RawScript script, jsbytecode *pc) = 0;
+    virtual Unary unaryOp(RawScript script, jsbytecode *pc) = 0;
+    virtual Binary binaryOp(RawScript script, jsbytecode *pc) = 0;
+    virtual types::StackTypeSet *thisTypeSet(RawScript script) { return NULL; }
     virtual bool getOsrTypes(jsbytecode *osrPc, Vector<MIRType> &slotTypes) { return true; }
-    virtual types::StackTypeSet *parameterTypeSet(UnrootedScript script, size_t index) { return NULL; }
-    virtual types::HeapTypeSet *globalPropertyTypeSet(UnrootedScript script, jsbytecode *pc, jsid id) {
+    virtual types::StackTypeSet *parameterTypeSet(RawScript script, size_t index) { return NULL; }
+    virtual types::HeapTypeSet *globalPropertyTypeSet(RawScript script, jsbytecode *pc, jsid id) {
         return NULL;
     }
-    virtual types::StackTypeSet *propertyRead(UnrootedScript script, jsbytecode *pc) {
+    virtual types::StackTypeSet *propertyRead(RawScript script, jsbytecode *pc) {
         return NULL;
     }
     virtual types::StackTypeSet *propertyReadBarrier(HandleScript script, jsbytecode *pc) {
         return NULL;
     }
     virtual bool propertyReadIdempotent(HandleScript script, jsbytecode *pc, HandleId id) {
         return false;
     }
-    virtual bool propertyReadAccessGetter(UnrootedScript script, jsbytecode *pc) {
+    virtual bool propertyReadAccessGetter(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual types::HeapTypeSet *globalPropertyWrite(UnrootedScript script, jsbytecode *pc,
+    virtual types::HeapTypeSet *globalPropertyWrite(RawScript script, jsbytecode *pc,
                                                 jsid id, bool *canSpecialize) {
         *canSpecialize = true;
         return NULL;
     }
-    virtual types::StackTypeSet *returnTypeSet(UnrootedScript script, jsbytecode *pc, types::StackTypeSet **barrier) {
+    virtual types::StackTypeSet *returnTypeSet(RawScript script, jsbytecode *pc, types::StackTypeSet **barrier) {
         *barrier = NULL;
         return NULL;
     }
     virtual bool inObjectIsDenseNativeWithoutExtraIndexedProperties(HandleScript script, jsbytecode *pc) {
         return false;
     }
-    virtual bool inArrayIsPacked(UnrootedScript script, jsbytecode *pc) {
+    virtual bool inArrayIsPacked(RawScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementReadIsDenseNative(RawScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementReadIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType) {
         return false;
     }
-    virtual bool elementReadIsString(UnrootedScript script, jsbytecode *pc) {
+    virtual bool elementReadIsString(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual bool elementReadShouldAlwaysLoadDoubles(UnrootedScript script, jsbytecode *pc) {
+    virtual bool elementReadShouldAlwaysLoadDoubles(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual bool elementReadHasExtraIndexedProperty(UnrootedScript, jsbytecode *pc) {
+    virtual bool elementReadHasExtraIndexedProperty(RawScript, jsbytecode *pc) {
         return false;
     }
-    virtual bool elementReadIsPacked(UnrootedScript script, jsbytecode *pc) {
+    virtual bool elementReadIsPacked(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual void elementReadGeneric(UnrootedScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex) {
+    virtual void elementReadGeneric(RawScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex) {
         *cacheable = false;
         *monitorResult = true;
         *intIndex = false;
     }
-    virtual bool setElementHasWrittenHoles(UnrootedScript script, jsbytecode *pc) {
+    virtual bool setElementHasWrittenHoles(RawScript script, jsbytecode *pc) {
         return true;
     }
     virtual bool elementWriteIsDenseNative(HandleScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementWriteIsDenseNative(types::StackTypeSet *obj, types::StackTypeSet *id) {
         return false;
     }
     virtual bool elementWriteIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType) {
         return false;
     }
     virtual bool elementWriteIsTypedArray(types::StackTypeSet *obj, types::StackTypeSet *id, int *arrayType) {
         return false;
     }
-    virtual bool elementWriteNeedsDoubleConversion(UnrootedScript script, jsbytecode *pc) {
+    virtual bool elementWriteNeedsDoubleConversion(RawScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementWriteHasExtraIndexedProperty(RawScript script, jsbytecode *pc) {
         return false;
     }
     virtual bool elementWriteIsPacked(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual bool arrayResultShouldHaveDoubleConversion(UnrootedScript script, jsbytecode *pc) {
+    virtual bool arrayResultShouldHaveDoubleConversion(RawScript script, jsbytecode *pc) {
         return false;
     }
-    virtual bool propertyWriteCanSpecialize(UnrootedScript script, jsbytecode *pc) {
+    virtual bool propertyWriteCanSpecialize(RawScript script, jsbytecode *pc) {
         return true;
     }
-    virtual bool propertyWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc, RawId id) {
+    virtual bool propertyWriteNeedsBarrier(RawScript script, jsbytecode *pc, RawId id) {
         return true;
     }
-    virtual bool elementWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc) {
+    virtual bool elementWriteNeedsBarrier(RawScript script, jsbytecode *pc) {
         return true;
     }
-    virtual MIRType elementWrite(UnrootedScript script, jsbytecode *pc) {
+    virtual MIRType elementWrite(RawScript script, jsbytecode *pc) {
         return MIRType_None;
     }
     virtual bool canInlineCalls() {
         return false;
     }
 
     /* |pc| must be a |JSOP_CALL|. */
-    virtual types::StackTypeSet *getCallTarget(UnrootedScript caller, uint32_t argc, jsbytecode *pc) {
+    virtual types::StackTypeSet *getCallTarget(RawScript caller, uint32_t argc, jsbytecode *pc) {
         // Same assertion as TypeInferenceOracle::getCallTarget.
         JS_ASSERT(js_CodeSpec[*pc].format & JOF_INVOKE && JSOp(*pc) != JSOP_EVAL);
         return NULL;
     }
-    virtual types::StackTypeSet *getCallArg(UnrootedScript script, uint32_t argc, uint32_t arg, jsbytecode *pc) {
+    virtual types::StackTypeSet *getCallArg(RawScript script, uint32_t argc, uint32_t arg, jsbytecode *pc) {
         return NULL;
     }
-    virtual types::StackTypeSet *getCallReturn(UnrootedScript script, jsbytecode *pc) {
+    virtual types::StackTypeSet *getCallReturn(RawScript script, jsbytecode *pc) {
         return NULL;
     }
     virtual bool canInlineCall(HandleScript caller, jsbytecode *pc) {
         return false;
     }
     virtual types::TypeBarrier *callArgsBarrier(HandleScript caller, jsbytecode *pc) {
         return NULL;
     }
     virtual bool canEnterInlinedFunction(RawScript caller, jsbytecode *pc, RawFunction callee) {
         return false;
     }
 
     virtual LazyArgumentsType isArgumentObject(types::StackTypeSet *obj) {
         return MaybeArguments;
     }
-    virtual LazyArgumentsType propertyReadMagicArguments(UnrootedScript script, jsbytecode *pc) {
+    virtual LazyArgumentsType propertyReadMagicArguments(RawScript script, jsbytecode *pc) {
         return MaybeArguments;
     }
-    virtual LazyArgumentsType elementReadMagicArguments(UnrootedScript script, jsbytecode *pc) {
+    virtual LazyArgumentsType elementReadMagicArguments(RawScript script, jsbytecode *pc) {
         return MaybeArguments;
     }
-    virtual LazyArgumentsType elementWriteMagicArguments(UnrootedScript script, jsbytecode *pc) {
+    virtual LazyArgumentsType elementWriteMagicArguments(RawScript script, jsbytecode *pc) {
         return MaybeArguments;
     }
-    virtual types::StackTypeSet *aliasedVarBarrier(UnrootedScript script, jsbytecode *pc,
+    virtual types::StackTypeSet *aliasedVarBarrier(RawScript script, jsbytecode *pc,
                                                    types::StackTypeSet **barrier)
     {
         return NULL;
     }
 };
 
 class DummyOracle : public TypeOracle
 {
   public:
-    UnaryTypes unaryTypes(UnrootedScript script, jsbytecode *pc) {
+    UnaryTypes unaryTypes(RawScript script, jsbytecode *pc) {
         UnaryTypes u;
         u.inTypes = NULL;
         u.outTypes = NULL;
         return u;
     }
-    BinaryTypes binaryTypes(UnrootedScript script, jsbytecode *pc) {
+    BinaryTypes binaryTypes(RawScript script, jsbytecode *pc) {
         BinaryTypes b;
         b.lhsTypes = NULL;
         b.rhsTypes = NULL;
         b.outTypes = NULL;
         return b;
     }
-    Unary unaryOp(UnrootedScript script, jsbytecode *pc) {
+    Unary unaryOp(RawScript script, jsbytecode *pc) {
         Unary u;
         u.ival = MIRType_Int32;
         u.rval = MIRType_Int32;
         return u;
     }
-    Binary binaryOp(UnrootedScript script, jsbytecode *pc) {
+    Binary binaryOp(RawScript script, jsbytecode *pc) {
         Binary b;
         b.lhs = MIRType_Int32;
         b.rhs = MIRType_Int32;
         b.rval = MIRType_Int32;
         return b;
     }
 };
 
@@ -228,67 +228,67 @@ class TypeInferenceOracle : public TypeO
     MIRType getMIRType(types::StackTypeSet *types);
     MIRType getMIRType(types::HeapTypeSet *types);
 
   public:
     TypeInferenceOracle() : cx(NULL), script_(NULL) {}
 
     bool init(JSContext *cx, JSScript *script);
 
-    UnrootedScript script() { return script_.get(); }
+    RawScript script() { return script_.get(); }
 
-    UnaryTypes unaryTypes(UnrootedScript script, jsbytecode *pc);
-    BinaryTypes binaryTypes(UnrootedScript script, jsbytecode *pc);
-    Unary unaryOp(UnrootedScript script, jsbytecode *pc);
-    Binary binaryOp(UnrootedScript script, jsbytecode *pc);
-    types::StackTypeSet *thisTypeSet(UnrootedScript script);
+    UnaryTypes unaryTypes(RawScript script, jsbytecode *pc);
+    BinaryTypes binaryTypes(RawScript script, jsbytecode *pc);
+    Unary unaryOp(RawScript script, jsbytecode *pc);
+    Binary binaryOp(RawScript script, jsbytecode *pc);
+    types::StackTypeSet *thisTypeSet(RawScript script);
     bool getOsrTypes(jsbytecode *osrPc, Vector<MIRType> &slotTypes);
-    types::StackTypeSet *parameterTypeSet(UnrootedScript script, size_t index);
-    types::HeapTypeSet *globalPropertyTypeSet(UnrootedScript script, jsbytecode *pc, jsid id);
-    types::StackTypeSet *propertyRead(UnrootedScript script, jsbytecode *pc);
+    types::StackTypeSet *parameterTypeSet(RawScript script, size_t index);
+    types::HeapTypeSet *globalPropertyTypeSet(RawScript script, jsbytecode *pc, jsid id);
+    types::StackTypeSet *propertyRead(RawScript script, jsbytecode *pc);
     types::StackTypeSet *propertyReadBarrier(HandleScript script, jsbytecode *pc);
     bool propertyReadIdempotent(HandleScript script, jsbytecode *pc, HandleId id);
-    bool propertyReadAccessGetter(UnrootedScript script, jsbytecode *pc);
-    types::HeapTypeSet *globalPropertyWrite(UnrootedScript script, jsbytecode *pc, jsid id, bool *canSpecialize);
-    types::StackTypeSet *returnTypeSet(UnrootedScript script, jsbytecode *pc, types::StackTypeSet **barrier);
-    types::StackTypeSet *getCallTarget(UnrootedScript caller, uint32_t argc, jsbytecode *pc);
-    types::StackTypeSet *getCallArg(UnrootedScript caller, uint32_t argc, uint32_t arg, jsbytecode *pc);
-    types::StackTypeSet *getCallReturn(UnrootedScript caller, jsbytecode *pc);
+    bool propertyReadAccessGetter(RawScript script, jsbytecode *pc);
+    types::HeapTypeSet *globalPropertyWrite(RawScript script, jsbytecode *pc, jsid id, bool *canSpecialize);
+    types::StackTypeSet *returnTypeSet(RawScript script, jsbytecode *pc, types::StackTypeSet **barrier);
+    types::StackTypeSet *getCallTarget(RawScript caller, uint32_t argc, jsbytecode *pc);
+    types::StackTypeSet *getCallArg(RawScript caller, uint32_t argc, uint32_t arg, jsbytecode *pc);
+    types::StackTypeSet *getCallReturn(RawScript caller, jsbytecode *pc);
     bool inObjectIsDenseNativeWithoutExtraIndexedProperties(HandleScript script, jsbytecode *pc);
-    bool inArrayIsPacked(UnrootedScript script, jsbytecode *pc);
+    bool inArrayIsPacked(RawScript script, jsbytecode *pc);
     bool elementReadIsDenseNative(RawScript script, jsbytecode *pc);
     bool elementReadIsTypedArray(RawScript script, jsbytecode *pc, int *atype);
-    bool elementReadIsString(UnrootedScript script, jsbytecode *pc);
-    bool elementReadShouldAlwaysLoadDoubles(UnrootedScript script, jsbytecode *pc);
-    bool elementReadHasExtraIndexedProperty(UnrootedScript, jsbytecode *pc);
-    bool elementReadIsPacked(UnrootedScript script, jsbytecode *pc);
-    void elementReadGeneric(UnrootedScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex);
+    bool elementReadIsString(RawScript script, jsbytecode *pc);
+    bool elementReadShouldAlwaysLoadDoubles(RawScript script, jsbytecode *pc);
+    bool elementReadHasExtraIndexedProperty(RawScript, jsbytecode *pc);
+    bool elementReadIsPacked(RawScript script, jsbytecode *pc);
+    void elementReadGeneric(RawScript script, jsbytecode *pc, bool *cacheable, bool *monitorResult, bool *intIndex);
     bool elementWriteIsDenseNative(HandleScript script, jsbytecode *pc);
     bool elementWriteIsDenseNative(types::StackTypeSet *obj, types::StackTypeSet *id);
     bool elementWriteIsTypedArray(RawScript script, jsbytecode *pc, int *arrayType);
     bool elementWriteIsTypedArray(types::StackTypeSet *obj, types::StackTypeSet *id, int *arrayType);
-    bool elementWriteNeedsDoubleConversion(UnrootedScript script, jsbytecode *pc);
+    bool elementWriteNeedsDoubleConversion(RawScript script, jsbytecode *pc);
     bool elementWriteHasExtraIndexedProperty(RawScript script, jsbytecode *pc);
     bool elementWriteIsPacked(RawScript script, jsbytecode *pc);
-    bool arrayResultShouldHaveDoubleConversion(UnrootedScript script, jsbytecode *pc);
-    bool setElementHasWrittenHoles(UnrootedScript script, jsbytecode *pc);
-    bool propertyWriteCanSpecialize(UnrootedScript script, jsbytecode *pc);
-    bool propertyWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc, RawId id);
-    bool elementWriteNeedsBarrier(UnrootedScript script, jsbytecode *pc);
-    MIRType elementWrite(UnrootedScript script, jsbytecode *pc);
+    bool arrayResultShouldHaveDoubleConversion(RawScript script, jsbytecode *pc);
+    bool setElementHasWrittenHoles(RawScript script, jsbytecode *pc);
+    bool propertyWriteCanSpecialize(RawScript script, jsbytecode *pc);
+    bool propertyWriteNeedsBarrier(RawScript script, jsbytecode *pc, RawId id);
+    bool elementWriteNeedsBarrier(RawScript script, jsbytecode *pc);
+    MIRType elementWrite(RawScript script, jsbytecode *pc);
     bool canInlineCalls();
     bool canInlineCall(HandleScript caller, jsbytecode *pc);
     types::TypeBarrier *callArgsBarrier(HandleScript caller, jsbytecode *pc);
     bool canEnterInlinedFunction(RawScript caller, jsbytecode *pc, RawFunction callee);
-    types::StackTypeSet *aliasedVarBarrier(UnrootedScript script, jsbytecode *pc, types::StackTypeSet **barrier);
+    types::StackTypeSet *aliasedVarBarrier(RawScript script, jsbytecode *pc, types::StackTypeSet **barrier);
 
     LazyArgumentsType isArgumentObject(types::StackTypeSet *obj);
-    LazyArgumentsType propertyReadMagicArguments(UnrootedScript script, jsbytecode *pc);
-    LazyArgumentsType elementReadMagicArguments(UnrootedScript script, jsbytecode *pc);
-    LazyArgumentsType elementWriteMagicArguments(UnrootedScript script, jsbytecode *pc);
+    LazyArgumentsType propertyReadMagicArguments(RawScript script, jsbytecode *pc);
+    LazyArgumentsType elementReadMagicArguments(RawScript script, jsbytecode *pc);
+    LazyArgumentsType elementWriteMagicArguments(RawScript script, jsbytecode *pc);
 };
 
 static inline MIRType
 MIRTypeFromValueType(JSValueType type)
 {
     switch (type) {
       case JSVAL_TYPE_DOUBLE:
         return MIRType_Double;
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -68,17 +68,17 @@ InvokeFunction(JSContext *cx, HandleFunc
             fun = CloneFunctionAtCallsite(cx, fun0, script, pc);
             if (!fun)
                 return false;
         }
 
         // In order to prevent massive bouncing between Ion and JM, see if we keep
         // hitting functions that are uncompilable.
         if (cx->methodJitEnabled && !fun->nonLazyScript()->canIonCompile()) {
-            UnrootedScript script = GetTopIonJSScript(cx);
+            RawScript script = GetTopIonJSScript(cx);
             if (script->hasIonScript() &&
                 ++script->ion->slowCallCount >= js_IonOptions.slowCallLimit)
             {
                 AutoFlushCache afc("InvokeFunction");
 
                 // Poison the script so we don't try to run it again. This will
                 // trigger invalidation.
                 ForbidCompilation(cx, script);
--- a/js/src/ion/shared/Assembler-shared.h
+++ b/js/src/ion/shared/Assembler-shared.h
@@ -98,24 +98,16 @@ struct ImmWord
 struct ImmGCPtr
 {
     uintptr_t value;
 
     explicit ImmGCPtr(const gc::Cell *ptr) : value(reinterpret_cast<uintptr_t>(ptr))
     {
         JS_ASSERT(!IsPoisonedPtr(ptr));
     }
-
-    // ImmGCPtr is rooted so we can convert safely directly from Unrooted<T>.
-    template <typename T>
-    explicit ImmGCPtr(Unrooted<T> ptr)
-      : value(reinterpret_cast<uintptr_t>(static_cast<T>(ptr)))
-    {
-        JS_ASSERT(!IsPoisonedPtr(static_cast<T>(ptr)));
-    }
 };
 
 // Specifies a hardcoded, absolute address.
 struct AbsoluteAddress {
     void *addr;
 
     explicit AbsoluteAddress(void *addr)
       : addr(addr)
--- a/js/src/ion/shared/CodeGenerator-shared.h
+++ b/js/src/ion/shared/CodeGenerator-shared.h
@@ -370,24 +370,24 @@ class OutOfLineCode : public TempObject
         return &rejoin_;
     }
     void setFramePushed(uint32_t framePushed) {
         framePushed_ = framePushed;
     }
     uint32_t framePushed() const {
         return framePushed_;
     }
-    void setSource(UnrootedScript script, jsbytecode *pc) {
+    void setSource(RawScript script, jsbytecode *pc) {
         script_ = script;
         pc_ = pc;
     }
     jsbytecode *pc() {
         return pc_;
     }
-    UnrootedScript script() {
+    RawScript script() {
         return script_;
     }
 };
 
 // For OOL paths that want a specific-typed code generator.
 template <typename T>
 class OutOfLineCodeBase : public OutOfLineCode
 {
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -1951,17 +1951,17 @@ ScriptAnalysis::needsArgsObj(JSContext *
 }
 
 CrossSSAValue
 CrossScriptSSA::foldValue(const CrossSSAValue &cv)
 {
     const Frame &frame = getFrame(cv.frame);
     const SSAValue &v = cv.v;
 
-    UnrootedScript parentScript = NULL;
+    RawScript parentScript = NULL;
     ScriptAnalysis *parentAnalysis = NULL;
     if (frame.parent != INVALID_FRAME) {
         parentScript = getFrame(frame.parent).script;
         parentAnalysis = parentScript->analysis();
     }
 
     if (v.kind() == SSAValue::VAR && v.varInitial() && parentScript) {
         uint32_t slot = v.varSlot();
@@ -1984,17 +1984,17 @@ CrossScriptSSA::foldValue(const CrossSSA
             }
             break;
 
           case JSOP_CALL: {
             /*
              * If there is a single inline callee with a single return site,
              * propagate back to that.
              */
-            UnrootedScript callee = NULL;
+            RawScript callee = NULL;
             uint32_t calleeFrame = INVALID_FRAME;
             for (unsigned i = 0; i < numFrames(); i++) {
                 if (iterFrame(i).parent == cv.frame && iterFrame(i).parentpc == pc) {
                     if (callee)
                         return cv;  /* Multiple callees */
                     callee = iterFrame(i).script;
                     calleeFrame = iterFrame(i).index;
                 }
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -167,17 +167,17 @@ class Bytecode
     /* Types for all values pushed by this bytecode. */
     types::StackTypeSet *pushedTypes;
 
     /* Any type barriers in place at this bytecode. */
     types::TypeBarrier *typeBarriers;
 };
 
 static inline unsigned
-GetDefCount(UnrootedScript script, unsigned offset)
+GetDefCount(RawScript script, unsigned offset)
 {
     JS_ASSERT(offset < script->length);
     jsbytecode *pc = script->code + offset;
 
     /*
      * Add an extra pushed value for OR/AND opcodes, so that they are included
      * in the pushed array of stack values for type inference.
      */
@@ -194,17 +194,17 @@ GetDefCount(UnrootedScript script, unsig
          */
         return (pc[1] + 1);
       default:
         return StackDefs(script, pc);
     }
 }
 
 static inline unsigned
-GetUseCount(UnrootedScript script, unsigned offset)
+GetUseCount(RawScript script, unsigned offset)
 {
     JS_ASSERT(offset < script->length);
     jsbytecode *pc = script->code + offset;
 
     if (JSOp(*pc) == JSOP_PICK)
         return (pc[1] + 1);
     if (js_CodeSpec[*pc].nuses == -1)
         return StackUses(script, pc);
@@ -321,17 +321,17 @@ NegateCompareOp(JSOp op)
         return JSOP_STRICTNE;
       default:
         JS_NOT_REACHED("unrecognized op");
         return op;
     }
 }
 
 static inline unsigned
-FollowBranch(JSContext *cx, UnrootedScript script, unsigned offset)
+FollowBranch(JSContext *cx, RawScript script, unsigned offset)
 {
     /*
      * Get the target offset of a branch. For GOTO opcodes implementing
      * 'continue' statements, short circuit any artificial backwards jump
      * inserted by the emitter.
      */
     jsbytecode *pc = script->code + offset;
     unsigned targetOffset = offset + GET_JUMP_OFFSET(pc);
@@ -349,28 +349,28 @@ static inline uint32_t CalleeSlot() {
     return 0;
 }
 static inline uint32_t ThisSlot() {
     return 1;
 }
 static inline uint32_t ArgSlot(uint32_t arg) {
     return 2 + arg;
 }
-static inline uint32_t LocalSlot(UnrootedScript script, uint32_t local) {
+static inline uint32_t LocalSlot(RawScript script, uint32_t local) {
     return 2 + (script->function() ? script->function()->nargs : 0) + local;
 }
-static inline uint32_t TotalSlots(UnrootedScript script) {
+static inline uint32_t TotalSlots(RawScript script) {
     return LocalSlot(script, 0) + script->nfixed;
 }
 
-static inline uint32_t StackSlot(UnrootedScript script, uint32_t index) {
+static inline uint32_t StackSlot(RawScript script, uint32_t index) {
     return TotalSlots(script) + index;
 }
 
-static inline uint32_t GetBytecodeSlot(UnrootedScript script, jsbytecode *pc)
+static inline uint32_t GetBytecodeSlot(RawScript script, jsbytecode *pc)
 {
     switch (JSOp(*pc)) {
 
       case JSOP_GETARG:
       case JSOP_CALLARG:
       case JSOP_SETARG:
         return ArgSlot(GET_SLOTNO(pc));
 
@@ -536,17 +536,17 @@ struct LifetimeVariable
         }
         return UINT32_MAX;
     }
     uint32_t firstWrite(LoopAnalysis *loop) const {
         return firstWrite(loop->head, loop->backedge);
     }
 
     /* Return true if the variable cannot decrease during the body of a loop. */
-    bool nonDecreasing(UnrootedScript script, LoopAnalysis *loop) const {
+    bool nonDecreasing(RawScript script, LoopAnalysis *loop) const {
         Lifetime *segment = lifetime ? lifetime : saved;
         while (segment && segment->start <= loop->backedge) {
             if (segment->start >= loop->head && segment->write) {
                 switch (JSOp(script->code[segment->start])) {
                   case JSOP_INCLOCAL:
                   case JSOP_LOCALINC:
                   case JSOP_INCARG:
                   case JSOP_ARGINC:
@@ -853,17 +853,17 @@ class ScriptAnalysis
     uint32_t numReturnSites_;
 
     /* --------- Lifetime analysis --------- */
 
     LifetimeVariable *lifetimes;
 
   public:
 
-    ScriptAnalysis(UnrootedScript script) {
+    ScriptAnalysis(RawScript script) {
         PodZero(this);
         this->script_ = script;
 #ifdef DEBUG
         this->originalDebugMode_ = script_->compartment()->debugMode();
 #endif
     }
 
     bool ranBytecode() { return ranBytecode_; }
@@ -1226,17 +1226,17 @@ class CrossScriptSSA
 
     struct Frame {
         uint32_t index;
         JSScript *script;
         uint32_t depth;  /* Distance from outer frame to this frame, in sizeof(Value) */
         uint32_t parent;
         jsbytecode *parentpc;
 
-        Frame(uint32_t index, UnrootedScript script, uint32_t depth, uint32_t parent,
+        Frame(uint32_t index, RawScript script, uint32_t depth, uint32_t parent,
               jsbytecode *parentpc)
           : index(index), script(script), depth(depth), parent(parent), parentpc(parentpc)
         {}
     };
 
     const Frame &getFrame(uint32_t index) {
         if (index == OUTER_FRAME)
             return outerFrame;
@@ -1245,40 +1245,40 @@ class CrossScriptSSA
 
     unsigned numFrames() { return 1 + inlineFrames.length(); }
     const Frame &iterFrame(unsigned i) {
         if (i == 0)
             return outerFrame;
         return inlineFrames[i - 1];
     }
 
-    UnrootedScript outerScript() { return outerFrame.script; }
+    RawScript outerScript() { return outerFrame.script; }
 
     /* Total length of scripts preceding a frame. */
     size_t frameLength(uint32_t index) {
         if (index == OUTER_FRAME)
             return 0;
         size_t res = outerFrame.script->length;
         for (unsigned i = 0; i < index; i++)
             res += inlineFrames[i].script->length;
         return res;
     }
 
     types::StackTypeSet *getValueTypes(const CrossSSAValue &cv) {
         return getFrame(cv.frame).script->analysis()->getValueTypes(cv.v);
     }
 
-    bool addInlineFrame(UnrootedScript script, uint32_t depth, uint32_t parent,
+    bool addInlineFrame(RawScript script, uint32_t depth, uint32_t parent,
                         jsbytecode *parentpc)
     {
         uint32_t index = inlineFrames.length();
         return inlineFrames.append(Frame(index, script, depth, parent, parentpc));
     }
 
-    CrossScriptSSA(JSContext *cx, UnrootedScript outer)
+    CrossScriptSSA(JSContext *cx, RawScript outer)
         : outerFrame(OUTER_FRAME, outer, 0, INVALID_FRAME, NULL), inlineFrames(cx)
     {}
 
     CrossSSAValue foldValue(const CrossSSAValue &cv);
 
   private:
     Frame outerFrame;
     Vector<Frame> inlineFrames;
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4414,25 +4414,25 @@ JS_DeleteElement(JSContext *cx, JSObject
 
 JS_PUBLIC_API(JSBool)
 JS_DeleteProperty(JSContext *cx, JSObject *objArg, const char *name)
 {
     jsval junk;
     return JS_DeleteProperty2(cx, objArg, name, &junk);
 }
 
-static UnrootedShape
+static RawShape
 LastConfigurableShape(JSObject *obj)
 {
     for (Shape::Range r(obj->lastProperty()->all()); !r.empty(); r.popFront()) {
-        UnrootedShape shape = &r.front();
+        RawShape shape = &r.front();
         if (shape->configurable())
             return shape;
     }
-    return UnrootedShape(NULL);
+    return NULL;
 }
 
 JS_PUBLIC_API(void)
 JS_ClearNonGlobalObject(JSContext *cx, JSObject *objArg)
 {
     RootedObject obj(cx, objArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -4447,17 +4447,17 @@ JS_ClearNonGlobalObject(JSContext *cx, J
     RootedShape shape(cx);
     while ((shape = LastConfigurableShape(obj))) {
         if (!obj->removeProperty(cx, shape->propid()))
             return;
     }
 
     /* Set all remaining writable plain data properties to undefined. */
     for (Shape::Range r(obj->lastProperty()->all()); !r.empty(); r.popFront()) {
-        UnrootedShape shape = &r.front();
+        RawShape shape = &r.front();
         if (shape->isDataDescriptor() &&
             shape->writable() &&
             shape->hasDefaultSetter() &&
             shape->hasSlot())
         {
             obj->nativeSetSlot(shape->slot(), UndefinedValue());
         }
     }
@@ -4527,17 +4527,17 @@ prop_iter_trace(JSTracer *trc, RawObject
         return;
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() < 0) {
         /*
          * Native case: just mark the next property to visit. We don't need a
          * barrier here because the pointer is updated via setPrivate, which
          * always takes a barrier.
          */
-        UnrootedShape tmp = static_cast<RawShape>(pdata);
+        RawShape tmp = static_cast<RawShape>(pdata);
         MarkShapeUnbarriered(trc, &tmp, "prop iter shape");
         obj->setPrivateUnbarriered(tmp);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
         MarkIdRange(trc, ida->length, ida->vector, "prop iter");
     }
 }
@@ -4600,17 +4600,17 @@ JS_NextProperty(JSContext *cx, JSObject 
 
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, iterobj);
     int32_t i = iterobj->getSlot(JSSLOT_ITER_INDEX).toInt32();
     if (i < 0) {
         /* Native case: private data is a property tree node pointer. */
         JS_ASSERT(iterobj->getParent()->isNative());
-        UnrootedShape shape = static_cast<RawShape>(iterobj->getPrivate());
+        RawShape shape = static_cast<RawShape>(iterobj->getPrivate());
 
         while (shape->previous() && !shape->enumerable())
             shape = shape->previous();
 
         if (!shape->previous()) {
             JS_ASSERT(shape->isEmptyShape());
             *idp = JSID_VOID;
         } else {
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -143,24 +143,24 @@ js::StringIsArrayIndex(JSLinearString *s
         JS_ASSERT(index <= MAX_ARRAY_INDEX);
         *indexp = index;
         return true;
     }
 
     return false;
 }
 
-UnrootedShape
+RawShape
 js::GetDenseArrayShape(JSContext *cx, HandleObject globalObj)
 {
     JS_ASSERT(globalObj);
 
     JSObject *proto = globalObj->global().getOrCreateArrayPrototype(cx);
     if (!proto)
-        return UnrootedShape(NULL);
+        return NULL;
 
     return EmptyShape::getInitialShape(cx, &ArrayClass, proto, proto->getParent(),
                                        gc::FINALIZE_OBJECT0);
 }
 
 bool
 DoubleIndexToId(JSContext *cx, double index, MutableHandleId id)
 {
@@ -1339,17 +1339,17 @@ MatchNumericComparator(const Value &v)
     JSObject &obj = v.toObject();
     if (!obj.isFunction())
         return Match_None;
 
     JSFunction *fun = obj.toFunction();
     if (!fun->hasScript())
         return Match_None;
 
-    UnrootedScript script = fun->nonLazyScript();
+    RawScript script = fun->nonLazyScript();
     jsbytecode *pc = script->code;
 
     uint16_t arg0, arg1;
     if (JSOp(*pc) != JSOP_GETARG)
         return Match_None;
     arg0 = GET_ARGNO(pc);
     pc += JSOP_GETARG_LENGTH;
 
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -67,17 +67,17 @@ extern JSObject *
 NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset, RawObject proto = NULL);
 
 /* Create a dense array from the given array values, which must be rooted */
 extern JSObject *
 NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, RawObject proto = NULL,
                     NewObjectKind newKind = GenericObject);
 
 /* Get the common shape used by all dense arrays with a prototype at globalObj. */
-extern UnrootedShape
+extern RawShape
 GetDenseArrayShape(JSContext *cx, HandleObject globalObj);
 
 extern JSBool
 GetLengthProperty(JSContext *cx, HandleObject obj, uint32_t *lengthp);
 
 extern JSBool
 SetLengthProperty(JSContext *cx, HandleObject obj, double length);
 
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -234,103 +234,103 @@ enum OwnCharsBehavior
 };
 
 /*
  * When the jschars reside in a freshly allocated buffer the memory can be used
  * as a new JSAtom's storage without copying. The contract is that the caller no
  * longer owns the memory and this method is responsible for freeing the memory.
  */
 JS_ALWAYS_INLINE
-static UnrootedAtom
+static RawAtom
 AtomizeAndTakeOwnership(JSContext *cx, const jschar *tbchars, size_t length,
                            InternBehavior ib)
 {
     JS_ASSERT(tbchars[length] == 0);
 
-    if (UnrootedAtom s = cx->runtime->staticStrings.lookup(tbchars, length)) {
+    if (RawAtom s = cx->runtime->staticStrings.lookup(tbchars, length)) {
         js_free((void*)tbchars);
         return s;
     }
 
     /*
      * If a GC occurs at js_NewStringCopy then |p| will still have the correct
      * hash, allowing us to avoid rehashing it. Even though the hash is
      * unchanged, we need to re-lookup the table position because a last-ditch
      * GC will potentially free some table entries.
      */
     AtomHasher::Lookup lookup(tbchars, length);
     AtomSet::AddPtr p = cx->runtime->atoms.lookupForAdd(lookup);
     SkipRoot skipHash(cx, &p); /* Prevent the hash from being poisoned. */
     if (p) {
-        UnrootedAtom atom = p->asPtr();
+        RawAtom atom = p->asPtr();
         p->setTagged(bool(ib));
         js_free((void*)tbchars);
         return atom;
     }
 
     AutoEnterAtomsCompartment ac(cx);
 
-    UnrootedFlatString flat = js_NewString<CanGC>(cx, const_cast<jschar*>(tbchars), length);
+    RawFlatString flat = js_NewString<CanGC>(cx, const_cast<jschar*>(tbchars), length);
     if (!flat) {
         js_free((void*)tbchars);
-        return UnrootedAtom();
+        return NULL;
     }
 
-    UnrootedAtom atom = flat->morphAtomizedStringIntoAtom();
+    RawAtom atom = flat->morphAtomizedStringIntoAtom();
 
     if (!cx->runtime->atoms.relookupOrAdd(p, lookup, AtomStateEntry(atom, bool(ib)))) {
         JS_ReportOutOfMemory(cx); /* SystemAllocPolicy does not report OOM. */
-        return UnrootedAtom();
+        return NULL;
     }
 
     return atom;
 }
 
 /* |tbchars| must not point into an inline or short string. */
 template <AllowGC allowGC>
 JS_ALWAYS_INLINE
-static UnrootedAtom
+static RawAtom
 AtomizeAndCopyChars(JSContext *cx, const jschar *tbchars, size_t length, InternBehavior ib)
 {
-    if (UnrootedAtom s = cx->runtime->staticStrings.lookup(tbchars, length))
+    if (RawAtom s = cx->runtime->staticStrings.lookup(tbchars, length))
          return s;
 
     /*
      * If a GC occurs at js_NewStringCopy then |p| will still have the correct
      * hash, allowing us to avoid rehashing it. Even though the hash is
      * unchanged, we need to re-lookup the table position because a last-ditch
      * GC will potentially free some table entries.
      */
     AtomHasher::Lookup lookup(tbchars, length);
     AtomSet::AddPtr p = cx->runtime->atoms.lookupForAdd(lookup);
     SkipRoot skipHash(cx, &p); /* Prevent the hash from being poisoned. */
     if (p) {
-        UnrootedAtom atom = p->asPtr();
+        RawAtom atom = p->asPtr();
         p->setTagged(bool(ib));
         return atom;
     }
 
     AutoEnterAtomsCompartment ac(cx);
 
-    UnrootedFlatString flat = js_NewStringCopyN<allowGC>(cx, tbchars, length);
+    RawFlatString flat = js_NewStringCopyN<allowGC>(cx, tbchars, length);
     if (!flat)
-        return UnrootedAtom();
+        return NULL;
 
-    UnrootedAtom atom = flat->morphAtomizedStringIntoAtom();
+    RawAtom atom = flat->morphAtomizedStringIntoAtom();
 
     if (!cx->runtime->atoms.relookupOrAdd(p, lookup, AtomStateEntry(atom, bool(ib)))) {
         JS_ReportOutOfMemory(cx); /* SystemAllocPolicy does not report OOM. */
-        return UnrootedAtom();
+        return NULL;
     }
 
     return atom;
 }
 
 template <AllowGC allowGC>
-UnrootedAtom
+RawAtom
 js::AtomizeString(JSContext *cx, JSString *str, js::InternBehavior ib /* = js::DoNotInternAtom */)
 {
     AssertCanGC();
 
     if (str->isAtom()) {
         JSAtom &atom = str->asAtom();
         /* N.B. static atoms are effectively always interned. */
         if (ib != InternAtom || js::StaticStrings::isStatic(&atom))
@@ -357,23 +357,23 @@ js::AtomizeString(JSContext *cx, JSStrin
     JSLinearString *linear = str->ensureLinear(cx);
     if (!linear)
         return NULL;
 
     JS_ASSERT(linear->length() <= JSString::MAX_LENGTH);
     return AtomizeAndCopyChars<CanGC>(cx, linear->chars(), linear->length(), ib);
 }
 
-template UnrootedAtom
+template RawAtom
 js::AtomizeString<CanGC>(JSContext *cx, JSString *str, js::InternBehavior ib);
 
-template UnrootedAtom
+template RawAtom
 js::AtomizeString<NoGC>(JSContext *cx, JSString *str, js::InternBehavior ib);
 
-UnrootedAtom
+RawAtom
 js::Atomize(JSContext *cx, const char *bytes, size_t length, InternBehavior ib)
 {
     AssertCanGC();
     CHECK_REQUEST(cx);
 
     if (!JSString::validateLength(cx, length))
         return NULL;
 
@@ -389,36 +389,36 @@ js::Atomize(JSContext *cx, const char *b
         jschar inflated[ATOMIZE_BUF_MAX];
         size_t inflatedLength = ATOMIZE_BUF_MAX - 1;
         InflateStringToBuffer(cx, bytes, length, inflated, &inflatedLength);
         return AtomizeAndCopyChars<CanGC>(cx, inflated, inflatedLength, ib);
     }
 
     jschar *tbcharsZ = InflateString(cx, bytes, &length);
     if (!tbcharsZ)
-        return UnrootedAtom();
+        return NULL;
     return AtomizeAndTakeOwnership(cx, tbcharsZ, length, ib);
 }
 
 template <AllowGC allowGC>
-UnrootedAtom
+RawAtom
 js::AtomizeChars(JSContext *cx, const jschar *chars, size_t length, InternBehavior ib)
 {
     CHECK_REQUEST(cx);
 
     if (!JSString::validateLength(cx, length))
         return NULL;
 
     return AtomizeAndCopyChars<allowGC>(cx, chars, length, ib);
 }
 
-template UnrootedAtom
+template RawAtom
 js::AtomizeChars<CanGC>(JSContext *cx, const jschar *chars, size_t length, InternBehavior ib);
 
-template UnrootedAtom
+template RawAtom
 js::AtomizeChars<NoGC>(JSContext *cx, const jschar *chars, size_t length, InternBehavior ib);
 
 template <AllowGC allowGC>
 bool
 js::IndexToIdSlow(JSContext *cx, uint32_t index,
                   typename MaybeRooted<jsid, allowGC>::MutableHandleType idp)
 {
     JS_ASSERT(index > JSID_INT_MAX);
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -217,27 +217,27 @@ FinishCommonNames(JSRuntime *rt);
 
 /* N.B. must correspond to boolean tagging behavior. */
 enum InternBehavior
 {
     DoNotInternAtom = false,
     InternAtom = true
 };
 
-extern UnrootedAtom
+extern RawAtom
 Atomize(JSContext *cx, const char *bytes, size_t length,
         js::InternBehavior ib = js::DoNotInternAtom);
 
 template <AllowGC allowGC>
-extern UnrootedAtom
+extern RawAtom
 AtomizeChars(JSContext *cx, const jschar *chars, size_t length,
              js::InternBehavior ib = js::DoNotInternAtom);
 
 template <AllowGC allowGC>
-extern UnrootedAtom
+extern RawAtom
 AtomizeString(JSContext *cx, JSString *str, js::InternBehavior ib = js::DoNotInternAtom);
 
 template <AllowGC allowGC>
 inline JSAtom *
 ToAtom(JSContext *cx, const js::Value &v);
 
 template <AllowGC allowGC>
 bool
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -588,17 +588,17 @@ static bool
 checkReportFlags(JSContext *cx, unsigned *flags)
 {
     if (JSREPORT_IS_STRICT_MODE_ERROR(*flags)) {
         /*
          * Error in strict code; warning with strict option; okay otherwise.
          * We assume that if the top frame is a native, then it is strict if
          * the nearest scripted frame is strict, see bug 536306.
          */
-        UnrootedScript script = cx->stack.currentScript();
+        RawScript script = cx->stack.currentScript();
         if (script && script->strict)
             *flags &= ~JSREPORT_WARNING;
         else if (cx->hasStrictOption())
             *flags |= JSREPORT_WARNING;
         else
             return true;
     } else if (JSREPORT_IS_STRICT(*flags)) {
         /* Warning/error only when JSOPTION_STRICT is set. */
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -232,17 +232,17 @@ struct EvalCacheLookup
     JSCompartment *compartment;
 };
 
 struct EvalCacheHashPolicy
 {
     typedef EvalCacheLookup Lookup;
 
     static HashNumber hash(const Lookup &l);
-    static bool match(UnrootedScript script, const EvalCacheLookup &l);
+    static bool match(RawScript script, const EvalCacheLookup &l);
 };
 
 typedef HashSet<RawScript, EvalCacheHashPolicy, SystemAllocPolicy> EvalCache;
 
 class NativeIterCache
 {
     static const size_t SIZE = size_t(1) << 8;
 
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -336,17 +336,17 @@ JSCompartment::wrap(JSContext *cx, Mutab
         return true;
     }
 
     if (vp.isString()) {
         Rooted<JSLinearString *> str(cx, vp.toString()->ensureLinear(cx));
         if (!str)
             return false;
 
-        UnrootedString wrapped = js_NewStringCopyN<CanGC>(cx, str->chars(), str->length());
+        RawString wrapped = js_NewStringCopyN<CanGC>(cx, str->chars(), str->length());
         if (!wrapped)
             return false;
 
         vp.setString(wrapped);
         if (!putWrapper(key, vp))
             return false;
 
         if (str->zone()->isGCMarking()) {
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -1182,21 +1182,21 @@ static JSBool
 date_parse(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 0) {
         vp->setDouble(js_NaN);
         return true;
     }
 
-    UnrootedString str = ToString<CanGC>(cx, args[0]);
+    RawString str = ToString<CanGC>(cx, args[0]);
     if (!str)
         return false;
 
-    UnrootedLinearString linearStr = str->ensureLinear(cx);
+    RawLinearString linearStr = str->ensureLinear(cx);
     if (!linearStr)
         return false;
 
     double result;
     if (!date_parseString(linearStr, &result, &cx->runtime->dateTimeInfo)) {
         vp->setDouble(js_NaN);
         return true;
     }
@@ -1410,17 +1410,17 @@ date_getTime(JSContext *cx, unsigned arg
     return CallNonGenericMethod<IsDate, date_getTime_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getYear_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     Value yearVal = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR);
     if (yearVal.isInt32()) {
         /* Follow ECMA-262 to the letter, contrary to IE JScript. */
         int year = yearVal.toInt32() - 1900;
         args.rval().setInt32(year);
     } else {
@@ -1437,17 +1437,17 @@ date_getYear(JSContext *cx, unsigned arg
     return CallNonGenericMethod<IsDate, date_getYear_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getFullYear_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR));
     return true;
 }
 
 static JSBool
 date_getFullYear(JSContext *cx, unsigned argc, Value *vp)
@@ -1476,17 +1476,17 @@ date_getUTCFullYear(JSContext *cx, unsig
     return CallNonGenericMethod<IsDate, date_getUTCFullYear_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getMonth_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MONTH));
     return true;
 }
 
 static JSBool
 date_getMonth(JSContext *cx, unsigned argc, Value *vp)
@@ -1512,17 +1512,17 @@ date_getUTCMonth(JSContext *cx, unsigned
     return CallNonGenericMethod<IsDate, date_getUTCMonth_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getDate_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DATE));
     return true;
 }
 
 static JSBool
 date_getDate(JSContext *cx, unsigned argc, Value *vp)
@@ -1551,17 +1551,17 @@ date_getUTCDate(JSContext *cx, unsigned 
     return CallNonGenericMethod<IsDate, date_getUTCDate_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getDay_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DAY));
     return true;
 }
 
 static JSBool
 date_getDay(JSContext *cx, unsigned argc, Value *vp)
@@ -1590,17 +1590,17 @@ date_getUTCDay(JSContext *cx, unsigned a
     return CallNonGenericMethod<IsDate, date_getUTCDay_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getHours_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_HOURS));
     return true;
 }
 
 static JSBool
 date_getHours(JSContext *cx, unsigned argc, Value *vp)
@@ -1629,17 +1629,17 @@ date_getUTCHours(JSContext *cx, unsigned
     return CallNonGenericMethod<IsDate, date_getUTCHours_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getMinutes_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MINUTES));
     return true;
 }
 
 static JSBool
 date_getMinutes(JSContext *cx, unsigned argc, Value *vp)
@@ -1670,17 +1670,17 @@ date_getUTCMinutes(JSContext *cx, unsign
 
 /* Date.getSeconds is mapped to getUTCSeconds */
 
 JS_ALWAYS_INLINE bool
 date_getUTCSeconds_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_SECONDS));
     return true;
 }
 
 static JSBool
 date_getUTCSeconds(JSContext *cx, unsigned argc, Value *vp)
@@ -1711,17 +1711,17 @@ date_getUTCMilliseconds(JSContext *cx, u
     return CallNonGenericMethod<IsDate, date_getUTCMilliseconds_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getTimezoneOffset_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
     double utctime = thisObj->getDateUTCTime().toNumber();
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, thisObj);
 
     /*
      * Return the time zone offset in minutes for the current locale that is
      * appropriate for this time. This value would be a constant except for
      * daylight savings time.
      */
@@ -2487,17 +2487,17 @@ date_toGMTString_impl(JSContext *cx, Cal
     double utctime = args.thisv().toObject().getDateUTCTime().toNumber();
 
     char buf[100];
     if (!MOZ_DOUBLE_IS_FINITE(utctime))
         JS_snprintf(buf, sizeof buf, js_NaN_date_str);
     else
         print_gmt_string(buf, sizeof buf, utctime);
 
-    UnrootedString str = JS_NewStringCopyZ(cx, buf);
+    RawString str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 /* ES5 15.9.5.43. */
 static JSBool
@@ -2516,17 +2516,17 @@ date_toISOString_impl(JSContext *cx, Cal
     if (!MOZ_DOUBLE_IS_FINITE(utctime)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_INVALID_DATE);
         return false;
     }
 
     char buf[100];
     print_iso_string(buf, sizeof buf, utctime);
 
-    UnrootedString str = JS_NewStringCopyZ(cx, buf);
+    RawString str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 
 }
 
 static JSBool
@@ -2713,17 +2713,17 @@ date_format(JSContext *cx, double date, 
                         int(SecFromTime(local)),
                         offset,
                         usetz ? " " : "",
                         usetz ? tzbuf : "");
             break;
         }
     }
 
-    UnrootedString str = JS_NewStringCopyZ(cx, buf);
+    RawString str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     rval.setString(str);
     return true;
 }
 
 static bool
 ToLocaleHelper(JSContext *cx, HandleObject obj, const char *format, MutableHandleValue rval)
@@ -2759,17 +2759,17 @@ ToLocaleHelper(JSContext *cx, HandleObje
                         "%d", js_DateGetYear(cx, obj));
         }
 
     }
 
     if (cx->runtime->localeCallbacks && cx->runtime->localeCallbacks->localeToUnicode)
         return cx->runtime->localeCallbacks->localeToUnicode(cx, buf, rval.address());
 
-    UnrootedString str = JS_NewStringCopyZ(cx, buf);
+    RawString str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     rval.setString(str);
     return true;
 }
 
 static bool
 ToLocaleStringHelper(JSContext *cx, HandleObject thisObj, MutableHandleValue rval)
@@ -2921,17 +2921,17 @@ date_toSource_impl(JSContext *cx, CallAr
     StringBuffer sb(cx);
     if (!sb.append("(new Date(") ||
         !NumberValueToStringBuffer(cx, args.thisv().toObject().getDateUTCTime(), sb) ||
         !sb.append("))"))
     {
         return false;
     }
 
-    UnrootedString str = sb.finishString();
+    RawString str = sb.finishString();
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 static JSBool
 date_toSource(JSContext *cx, unsigned argc, Value *vp)
@@ -2956,17 +2956,17 @@ date_toString(JSContext *cx, unsigned ar
     return CallNonGenericMethod<IsDate, date_toString_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_valueOf_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    UnrootedObject thisObj = &args.thisv().toObject();
+    RawObject thisObj = &args.thisv().toObject();
 
     args.rval().set(thisObj->getDateUTCTime());
     return true;
 }
 
 static JSBool
 date_valueOf(JSContext *cx, unsigned argc, Value *vp)
 {
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -510,17 +510,17 @@ JS_ReleaseFunctionLocalNameArray(JSConte
 JS_PUBLIC_API(JSScript *)
 JS_GetFunctionScript(JSContext *cx, JSFunction *fun)
 {
     if (fun->isNative())
         return NULL;
     if (fun->isInterpretedLazy()) {
         RootedFunction rootedFun(cx, fun);
         AutoCompartment funCompartment(cx, rootedFun);
-        UnrootedScript script = rootedFun->getOrCreateScript(cx);
+        RawScript script = rootedFun->getOrCreateScript(cx);
         if (!script)
             MOZ_CRASH();
         return script;
     }
     return fun->nonLazyScript();
 }
 
 JS_PUBLIC_API(JSNative)
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -679,18 +679,16 @@ class ProfileEntry
 
 JS_FRIEND_API(void)
 SetRuntimeProfilingStack(JSRuntime *rt, ProfileEntry *stack, uint32_t *size,
                          uint32_t max);
 
 JS_FRIEND_API(void)
 EnableRuntimeProfilingStack(JSRuntime *rt, bool enabled);
 
-// Use RawScript rather than UnrootedScript because it may be called from a
-// signal handler
 JS_FRIEND_API(jsbytecode*)
 ProfilingGetPC(JSRuntime *rt, RawScript script, void *ip);
 
 #ifdef JS_THREADSAFE
 JS_FRIEND_API(void *)
 GetOwnerThread(const JSContext *cx);
 
 JS_FRIEND_API(bool)
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -133,17 +133,17 @@ fun_getProperty(JSContext *cx, HandleObj
         if (!argsobj)
             return false;
 
 #ifdef JS_ION
         // Disabling compiling of this script in IonMonkey.
         // IonMonkey does not guarantee |f.arguments| can be
         // fully recovered, so we try to mitigate observing this behavior by
         // detecting its use early.
-        UnrootedScript script = iter.script();
+        RawScript script = iter.script();
         ion::ForbidCompilation(cx, script);
 #endif
 
         vp.setObject(*argsobj);
         return true;
     }
 
 #ifdef JS_METHODJIT
@@ -1118,17 +1118,17 @@ fun_isGenerator(JSContext *cx, unsigned 
     RawFunction fun;
     if (!IsFunctionObject(vp[1], &fun)) {
         JS_SET_RVAL(cx, vp, BooleanValue(false));
         return true;
     }
 
     bool result = false;
     if (fun->hasScript()) {
-        UnrootedScript script = fun->nonLazyScript();
+        RawScript script = fun->nonLazyScript();
         JS_ASSERT(script->length != 0);
         result = script->isGenerator;
     }
 
     JS_SET_RVAL(cx, vp, BooleanValue(result));
     return true;
 }
 #endif
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -159,17 +159,17 @@ class JSFunction : public JSObject
         flags |= INTERPRETED;
         flags &= ~INTERPRETED_LAZY;
     }
 
     JSAtom *atom() const { return hasGuessedAtom() ? NULL : atom_.get(); }
     inline void initAtom(JSAtom *atom);
     JSAtom *displayAtom() const { return atom_; }
 
-    inline void setGuessedAtom(js::UnrootedAtom atom);
+    inline void setGuessedAtom(js::RawAtom atom);
 
     /* uint16_t representation bounds number of call object dynamic slots. */
     enum { MAX_ARGS_AND_VARS = 2 * ((1U << 16) - 1) };
 
     /*
      * For an interpreted function, accessors for the initial scope object of
      * activations (stack frames) of the function.
      */
@@ -177,23 +177,23 @@ class JSFunction : public JSObject
     inline void setEnvironment(JSObject *obj);
     inline void initEnvironment(JSObject *obj);
 
     static inline size_t offsetOfEnvironment() { return offsetof(JSFunction, u.i.env_); }
     static inline size_t offsetOfAtom() { return offsetof(JSFunction, atom_); }
 
     bool initializeLazyScript(JSContext *cx);
 
-    js::UnrootedScript getOrCreateScript(JSContext *cx) {
+    js::RawScript getOrCreateScript(JSContext *cx) {
         JS_ASSERT(isInterpreted());
         if (isInterpretedLazy()) {
             js::RootedFunction self(cx, this);
             js::MaybeCheckStackRoots(cx);
             if (!self->initializeLazyScript(cx))
-                return js::UnrootedScript(NULL);
+                return NULL;
             return self->u.i.script_;
         }
         JS_ASSERT(hasScript());
         return u.i.script_;
     }
 
     static bool maybeGetOrCreateScript(JSContext *cx, js::HandleFunction fun,
                                        js::MutableHandle<JSScript*> script)
@@ -201,23 +201,23 @@ class JSFunction : public JSObject
         if (fun->isNative()) {
             script.set(NULL);
             return true;
         }
         script.set(fun->getOrCreateScript(cx));
         return fun->hasScript();
     }
 
-    js::UnrootedScript nonLazyScript() const {
+    js::RawScript nonLazyScript() const {
         JS_ASSERT(hasScript());
         return JS::HandleScript::fromMarkedLocation(&u.i.script_);
     }
 
-    js::UnrootedScript maybeNonLazyScript() const {
-        return isInterpreted() ? nonLazyScript() : js::UnrootedScript(NULL);
+    js::RawScript maybeNonLazyScript() const {
+        return isInterpreted() ? nonLazyScript() : NULL;
     }
 
     js::HeapPtrScript &mutableScript() {
         JS_ASSERT(isInterpreted());
         return *(js::HeapPtrScript *)&u.i.script_;
     }
 
     inline void setScript(JSScript *script_);
--- a/js/src/jsfuninlines.h
+++ b/js/src/jsfuninlines.h
@@ -24,17 +24,17 @@ JSFunction::strict() const
 
 inline void
 JSFunction::initAtom(JSAtom *atom)
 {
     atom_.init(atom);
 }
 
 inline void
-JSFunction::setGuessedAtom(js::UnrootedAtom atom)
+JSFunction::setGuessedAtom(js::RawAtom atom)
 {
     JS_ASSERT(atom_ == NULL);
     JS_ASSERT(atom != NULL);
     JS_ASSERT(!hasGuessedAtom());
     atom_ = atom;
     flags |= HAS_GUESSED_ATOM;
 }
 
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -595,24 +595,24 @@ js_NewGCExternalString(JSContext *cx)
 
 inline JSScript *
 js_NewGCScript(JSContext *cx)
 {
     return js::gc::NewGCThing<JSScript, js::CanGC>(cx, js::gc::FINALIZE_SCRIPT,
                                                    sizeof(JSScript), js::gc::TenuredHeap);
 }
 
-inline js::UnrootedShape
+inline js::RawShape
 js_NewGCShape(JSContext *cx)
 {
     return js::gc::NewGCThing<js::Shape, js::CanGC>(cx, js::gc::FINALIZE_SHAPE,
                                                     sizeof(js::Shape), js::gc::TenuredHeap);
 }
 
 template <js::AllowGC allowGC>
-inline js::UnrootedBaseShape
+inline js::RawBaseShape
 js_NewGCBaseShape(JSContext *cx)
 {
     return js::gc::NewGCThing<js::BaseShape, allowGC>(cx, js::gc::FINALIZE_BASE_SHAPE,
                                                       sizeof(js::BaseShape), js::gc::TenuredHeap);
 }
 
 #endif /* jsgcinlines_h___ */
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -580,17 +580,17 @@ class TypeConstraintProp : public TypeCo
      * If assign is true, the target is used to update a property of the object.
      * If assign is false, the target is assigned the value of the property.
      */
     StackTypeSet *target;
 
     /* Property being accessed. This is unrooted. */
     RawId id;
 
-    TypeConstraintProp(UnrootedScript script, jsbytecode *pc, StackTypeSet *target, RawId id)
+    TypeConstraintProp(RawScript script, jsbytecode *pc, StackTypeSet *target, RawId id)
         : script_(script), pc(pc), target(target), id(id)
     {
         JS_ASSERT(script && pc && target);
     }
 
     const char *kind() { return "prop"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
@@ -641,17 +641,17 @@ class TypeConstraintCallProp : public Ty
     RawScript script_;
 
   public:
     jsbytecode *callpc;
 
     /* Property being accessed. */
     jsid id;
 
-    TypeConstraintCallProp(UnrootedScript script, jsbytecode *callpc, jsid id)
+    TypeConstraintCallProp(RawScript script, jsbytecode *callpc, jsid id)
         : script_(script), callpc(callpc), id(id)
     {
         JS_ASSERT(script && callpc);
     }
 
     const char *kind() { return "callprop"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
@@ -686,17 +686,17 @@ class TypeConstraintSetElement : public 
     RawScript script_;
 
   public:
     jsbytecode *pc;
 
     StackTypeSet *objectTypes;
     StackTypeSet *valueTypes;
 
-    TypeConstraintSetElement(UnrootedScript script, jsbytecode *pc,
+    TypeConstraintSetElement(RawScript script, jsbytecode *pc,
                              StackTypeSet *objectTypes, StackTypeSet *valueTypes)
         : script_(script), pc(pc),
           objectTypes(objectTypes), valueTypes(valueTypes)
     {
         JS_ASSERT(script && pc);
     }
 
     const char *kind() { return "setelement"; }
@@ -748,17 +748,17 @@ class TypeConstraintArith : public TypeC
     jsbytecode *pc;
 
     /* Type set receiving the result of the arithmetic. */
     TypeSet *target;
 
     /* For addition operations, the other operand. */
     TypeSet *other;
 
-    TypeConstraintArith(UnrootedScript script, jsbytecode *pc, TypeSet *target, TypeSet *other)
+    TypeConstraintArith(RawScript script, jsbytecode *pc, TypeSet *target, TypeSet *other)
         : script_(script), pc(pc), target(target), other(other)
     {
         JS_ASSERT(target);
     }
 
     const char *kind() { return "arith"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
@@ -774,17 +774,17 @@ StackTypeSet::addArith(JSContext *cx, JS
 /* Subset constraint which transforms primitive values into appropriate objects. */
 class TypeConstraintTransformThis : public TypeConstraint
 {
     RawScript script_;
 
   public:
     TypeSet *target;
 
-    TypeConstraintTransformThis(UnrootedScript script, TypeSet *target)
+    TypeConstraintTransformThis(RawScript script, TypeSet *target)
         : script_(script), target(target)
     {}
 
     const char *kind() { return "transformthis"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
@@ -802,17 +802,17 @@ class TypeConstraintPropagateThis : publ
 {
     RawScript script_;
 
   public:
     jsbytecode *callpc;
     Type type;
     StackTypeSet *types;
 
-    TypeConstraintPropagateThis(UnrootedScript script, jsbytecode *callpc, Type type, StackTypeSet *types)
+    TypeConstraintPropagateThis(RawScript script, jsbytecode *callpc, Type type, StackTypeSet *types)
         : script_(script), callpc(callpc), type(type), types(types)
     {}
 
     const char *kind() { return "propagatethis"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
     bool newCallee(JSContext *cx, HandleFunction callee);
 };
@@ -847,42 +847,42 @@ class TypeConstraintFilterPrimitive : pu
 
 void
 HeapTypeSet::addFilterPrimitives(JSContext *cx, TypeSet *target)
 {
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintFilterPrimitive>(target));
 }
 
 /* If id is a normal slotful 'own' property of an object, get its shape. */
-static inline UnrootedShape
+static inline RawShape
 GetSingletonShape(JSContext *cx, RawObject obj, RawId idArg)
 {
     if (!obj->isNative())
-        return UnrootedShape(NULL);
+        return NULL;
     RootedId id(cx, idArg);
-    UnrootedShape shape = DropUnrooted(obj)->nativeLookup(cx, id);
+    RawShape shape = obj->nativeLookup(cx, id);
     if (shape && shape->hasDefaultGetter() && shape->hasSlot())
         return shape;
-    return UnrootedShape(NULL);
+    return NULL;
 }
 
 void
 ScriptAnalysis::pruneTypeBarriers(JSContext *cx, uint32_t offset)
 {
     TypeBarrier **pbarrier = &getCode(offset).typeBarriers;
     while (*pbarrier) {
         TypeBarrier *barrier = *pbarrier;
         if (barrier->target->hasType(barrier->type)) {
             /* Barrier is now obsolete, it can be removed. */
             *pbarrier = barrier->next;
             continue;
         }
         if (barrier->singleton) {
             JS_ASSERT(barrier->type.isPrimitive(JSVAL_TYPE_UNDEFINED));
-            UnrootedShape shape = GetSingletonShape(cx, barrier->singleton, barrier->singletonId);
+            RawShape shape = GetSingletonShape(cx, barrier->singleton, barrier->singletonId);
             if (shape && !barrier->singleton->nativeGetSlot(shape->slot()).isUndefined()) {
                 /*
                  * When we analyzed the script the singleton had an 'own'
                  * property which was undefined (probably a 'var' variable
                  * added to a global object), but now it is defined. The only
                  * way it can become undefined again is if an explicit assign
                  * or deletion on the property occurs, which will update the
                  * type set for the property directly and trigger construction
@@ -961,17 +961,17 @@ void ScriptAnalysis::breakTypeBarriersSS
  */
 class TypeConstraintSubsetBarrier : public TypeConstraint
 {
   public:
     RawScript script;
     jsbytecode *pc;
     TypeSet *target;
 
-    TypeConstraintSubsetBarrier(UnrootedScript script, jsbytecode *pc, TypeSet *target)
+    TypeConstraintSubsetBarrier(RawScript script, jsbytecode *pc, TypeSet *target)
         : script(script), pc(pc), target(target)
     {}
 
     const char *kind() { return "subsetBarrier"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
         if (!target->hasType(type)) {
@@ -2245,17 +2245,17 @@ enum RecompileKind {
 /*
  * Whether all jitcode for a given pc was compiled with monitoring or barriers.
  * If we reanalyze the script after generating jitcode, new monitoring and
  * barriers will be added which may be duplicating information available when
  * the script was originally compiled, and which should not invalidate that
  * compilation.
  */
 static inline bool
-JITCodeHasCheck(UnrootedScript script, jsbytecode *pc, RecompileKind kind)
+JITCodeHasCheck(RawScript script, jsbytecode *pc, RecompileKind kind)
 {
     if (kind == RECOMPILE_NONE)
         return false;
 
 #ifdef JS_METHODJIT
     for (int constructing = 0; constructing <= 1; constructing++) {
         for (int barriers = 0; barriers <= 1; barriers++) {
             mjit::JITScript *jit = script->getJIT((bool) constructing, (bool) barriers);
@@ -2287,17 +2287,17 @@ JITCodeHasCheck(UnrootedScript script, j
     return true;
 }
 
 /*
  * Force recompilation of any jitcode for script at pc, or of any other script
  * which this script was inlined into.
  */
 static inline void
-AddPendingRecompile(JSContext *cx, UnrootedScript script, jsbytecode *pc,
+AddPendingRecompile(JSContext *cx, RawScript script, jsbytecode *pc,
                     RecompileKind kind = RECOMPILE_NONE)
 {
     /*
      * Trigger recompilation of the script itself, if code was not previously
      * compiled with the specified information.
      */
     if (!JITCodeHasCheck(script, pc, kind))
         cx->compartment->types.addPendingRecompile(cx, script, pc);
@@ -2335,17 +2335,17 @@ AddPendingRecompile(JSContext *cx, Unroo
  * added for stack types within a script. Applies to all compilations of the
  * script, not just a single one.
  */
 class TypeConstraintFreezeStack : public TypeConstraint
 {
     RawScript script_;
 
   public:
-    TypeConstraintFreezeStack(UnrootedScript script)
+    TypeConstraintFreezeStack(RawScript script)
         : script_(script)
     {}
 
     const char *kind() { return "freezeStack"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
         /*
@@ -2555,17 +2555,17 @@ TypeCompartment::addAllocationSiteTypeOb
         cx->compartment->types.setPendingNukeTypes(cx);
         return NULL;
     }
 
     return res;
 }
 
 static inline RawId
-GetAtomId(JSContext *cx, UnrootedScript script, const jsbytecode *pc, unsigned offset)
+GetAtomId(JSContext *cx, RawScript script, const jsbytecode *pc, unsigned offset)
 {
     PropertyName *name = script->getName(GET_UINT32_INDEX(pc + offset));
     return IdToTypeId(NameToId(name));
 }
 
 bool
 types::UseNewType(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
@@ -2860,17 +2860,17 @@ TypeCompartment::addPendingRecompile(JSC
         cx->compartment->types.setPendingNukeTypes(cx);
         return;
     }
 
     co->setPendingRecompilation();
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, UnrootedScript script, jsbytecode *pc)
+TypeCompartment::addPendingRecompile(JSContext *cx, RawScript script, jsbytecode *pc)
 {
     JS_ASSERT(script);
     if (!constrainedOutputs)
         return;
 
 #ifdef JS_METHODJIT
     for (int constructing = 0; constructing <= 1; constructing++) {
         for (int barriers = 0; barriers <= 1; barriers++) {
@@ -3293,17 +3293,17 @@ struct types::ObjectTableKey
     }
 
     static inline bool match(const ObjectTableKey &v, RawObject obj) {
         if (obj->slotSpan() != v.nslots ||
             obj->numFixedSlots() != v.nfixed ||
             obj->getTaggedProto() != v.proto) {
             return false;
         }
-        UnrootedShape shape = obj->lastProperty();
+        RawShape shape = obj->lastProperty();
         obj = NULL;
         while (!shape->isEmptyShape()) {
             if (shape->propid() != v.ids[shape->slot()])
                 return false;
             shape = shape->previous();
         }
         return true;
     }
@@ -3459,17 +3459,17 @@ TypeObject::getFromPrototypes(JSContext 
         return;
 
     protoTypes->addSubset(cx, types);
 
     protoType->getFromPrototypes(cx, id, protoTypes);
 }
 
 static inline void
-UpdatePropertyType(JSContext *cx, TypeSet *types, UnrootedObject obj, UnrootedShape shape,
+UpdatePropertyType(JSContext *cx, TypeSet *types, RawObject obj, RawShape shape,
                    bool force)
 {
     types->setOwnProperty(cx, false);
     if (!shape->writable())
         types->setOwnProperty(cx, true);
 
     if (shape->hasGetterValue() || shape->hasSetterValue()) {
         types->setOwnProperty(cx, true);
@@ -3522,17 +3522,17 @@ TypeObject::addProperty(JSContext *cx, R
                 if (!value.isMagic(JS_ELEMENTS_HOLE)) {
                     Type type = GetValueType(cx, value);
                     base->types.setOwnProperty(cx, false);
                     base->types.addType(cx, type);
                 }
             }
         } else if (!JSID_IS_EMPTY(id)) {
             RootedId rootedId(cx, id);
-            UnrootedShape shape = singleton->nativeLookup(cx, rootedId);
+            RawShape shape = singleton->nativeLookup(cx, rootedId);
             if (shape)
                 UpdatePropertyType(cx, &base->types, rSingleton, shape, false);
         }
 
         if (singleton->watched()) {
             /*
              * Mark the property as configured, to inhibit optimizations on it
              * and avoid bypassing the watchpoint handler.
@@ -3582,17 +3582,17 @@ TypeObject::matchDefiniteProperties(Hand
     for (unsigned i = 0; i < count; i++) {
         Property *prop = getProperty(i);
         if (!prop)
             continue;
         if (prop->types.definiteProperty()) {
             unsigned slot = prop->types.definiteSlot();
 
             bool found = false;
-            UnrootedShape shape = obj->lastProperty();
+            RawShape shape = obj->lastProperty();
             while (!shape->isEmptyShape()) {
                 if (shape->slot() == slot && shape->propid() == prop->id) {
                     found = true;
                     break;
                 }
                 shape = shape->previous();
             }
             if (!found)
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -1148,17 +1148,17 @@ struct TypeCallsite
     StackTypeSet **argumentTypes;
 
     /* Types of the this variable. */
     StackTypeSet *thisTypes;
 
     /* Type set receiving the return value of this call. */
     StackTypeSet *returnTypes;
 
-    inline TypeCallsite(JSContext *cx, UnrootedScript script, jsbytecode *pc,
+    inline TypeCallsite(JSContext *cx, RawScript script, jsbytecode *pc,
                         bool isNew, unsigned argumentCount);
 };
 
 /* Persistent type information for a script, retained across GCs. */
 class TypeScript
 {
     friend class ::JSScript;
 
@@ -1174,17 +1174,17 @@ class TypeScript
      * Generated the first time the script is analyzed by inference and kept
      * after analysis purges.
      */
     HeapTypeSet *propertyReadTypes;
 
     /* Array of type type sets for variables and JOF_TYPESET ops. */
     TypeSet *typeArray() { return (TypeSet *) (uintptr_t(this) + sizeof(TypeScript)); }
 
-    static inline unsigned NumTypeSets(UnrootedScript script);
+    static inline unsigned NumTypeSets(RawScript script);
 
     static inline HeapTypeSet  *ReturnTypes(RawScript script);
     static inline StackTypeSet *ThisTypes(RawScript script);
     static inline StackTypeSet *ArgTypes(RawScript script, unsigned i);
     static inline StackTypeSet *LocalTypes(RawScript script, unsigned i);
 
     /* Follows slot layout in jsanalyze.h, can get this/arg/local type sets. */
     static inline StackTypeSet *SlotTypes(RawScript script, unsigned slot);
@@ -1423,17 +1423,17 @@ struct TypeCompartment
     void processPendingRecompiles(FreeOp *fop);
 
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(JSContext *cx);
     void setPendingNukeTypesNoReport();
 
     /* Mark a script as needing recompilation once inference has finished. */
     void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, UnrootedScript script, jsbytecode *pc);
+    void addPendingRecompile(JSContext *cx, RawScript script, jsbytecode *pc);
 
     /* Monitor future effects on a bytecode. */
     void monitorBytecode(JSContext *cx, JSScript *script, uint32_t offset,
                          bool returnOnly = false);
 
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -409,17 +409,17 @@ struct AutoEnterCompilation
       : cx(cx),
         info(cx->compartment->types.compiledInfo),
         kind(kind)
     {
         JS_ASSERT(cx->compartment->activeAnalysis);
         JS_ASSERT(info.outputIndex == RecompileInfo::NoCompilerRunning);
     }
 
-    bool init(UnrootedScript script, bool constructing, unsigned chunkIndex)
+    bool init(RawScript script, bool constructing, unsigned chunkIndex)
     {
         CompilerOutput co;
         co.script = script;
         co.setKind(kind);
         co.constructing = constructing;
         co.barriers = cx->zone()->compileBarriers();
         co.chunkIndex = chunkIndex;
 
@@ -585,17 +585,17 @@ TypeMonitorCall(JSContext *cx, const js:
                 TypeMonitorCallSlow(cx, &args.callee(), args, constructing);
         }
     }
 
     return true;
 }
 
 inline bool
-TrackPropertyTypes(JSContext *cx, UnrootedObject obj, RawId id)
+TrackPropertyTypes(JSContext *cx, RawObject obj, RawId id)
 {
     AutoAssertNoGC nogc;
 
     if (!cx->typeInferenceEnabled() || obj->hasLazyType() || obj->type()->unknownProperties())
         return false;
 
     if (obj->hasSingletonType() && !obj->type()->maybeGetProperty(id, cx))
         return false;
@@ -756,17 +756,17 @@ UseNewTypeForClone(JSFunction *fun)
      *
      * Each instance of the innermost function will have a different wrapped
      * initialize method. We capture this, along with similar cases, by looking
      * for short scripts which use both .apply and arguments. For such scripts,
      * whenever creating a new instance of the function we both give that
      * instance a singleton type and clone the underlying script.
      */
 
-    UnrootedScript script = fun->nonLazyScript();
+    RawScript script = fun->nonLazyScript();
 
     if (script->length >= 50)
         return false;
 
     if (script->hasConsts() || script->hasObjects() || script->hasRegexps() || fun->isHeavyweight())
         return false;
 
     bool hasArguments = false;
@@ -785,17 +785,17 @@ UseNewTypeForClone(JSFunction *fun)
     return hasArguments && hasApply;
 }
 
 /////////////////////////////////////////////////////////////////////
 // Script interface functions
 /////////////////////////////////////////////////////////////////////
 
 /* static */ inline unsigned
-TypeScript::NumTypeSets(UnrootedScript script)
+TypeScript::NumTypeSets(RawScript script)
 {
     return script->nTypeSets + analyze::TotalSlots(script);
 }
 
 /* static */ inline HeapTypeSet *
 TypeScript::ReturnTypes(RawScript script)
 {
     AutoAssertNoGC nogc;
@@ -1535,17 +1535,17 @@ TypeSet::getTypeObject(unsigned i) const
     return (key && !(uintptr_t(key) & 1)) ? (TypeObject *) key : NULL;
 }
 
 /////////////////////////////////////////////////////////////////////
 // TypeCallsite
 /////////////////////////////////////////////////////////////////////
 
 inline
-TypeCallsite::TypeCallsite(JSContext *cx, UnrootedScript script, jsbytecode *pc,
+TypeCallsite::TypeCallsite(JSContext *cx, RawScript script, jsbytecode *pc,
                            bool isNew, unsigned argumentCount)
     : script(script), pc(pc), isNew(isNew), argumentCount(argumentCount),
       thisTypes(NULL), returnTypes(NULL)
 {
     /* Caller must check for failure. */
     argumentTypes = cx->analysisLifoAlloc().newArray<StackTypeSet*>(argumentCount);
 }
 
--- a/js/src/jsmemorymetrics.cpp
+++ b/js/src/jsmemorymetrics.cpp
@@ -181,17 +181,17 @@ StatsCellCallback(JSRuntime *rt, void *d
         } else {
             cStats->gcHeapStringsNormal += thingSize;
             cStats->stringCharsNonHuge += strSize;
         }
         break;
     }
     case JSTRACE_SHAPE:
     {
-        UnrootedShape shape = static_cast<RawShape>(thing);
+        RawShape shape = static_cast<RawShape>(thing);
         size_t propTableSize, kidsSize;
         shape->sizeOfExcludingThis(rtStats->mallocSizeOf_, &propTableSize, &kidsSize);
         if (shape->inDictionary()) {
             cStats->gcHeapShapesDict += thingSize;
             cStats->shapesExtraDictTables += propTableSize;
             JS_ASSERT(kidsSize == 0);
         } else {
             if (shape->base()->getObjectParent() == shape->compartment()->maybeGlobal()) {
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1393,17 +1393,17 @@ js::NewReshapedObject(JSContext *cx, Han
 
     /* Get all the ids in the object, in order. */
     js::AutoIdVector ids(cx);
     {
         for (unsigned i = 0; i <= shape->slot(); i++) {
             if (!ids.append(JSID_VOID))
                 return NULL;
         }
-        UnrootedShape nshape = shape;
+        RawShape nshape = shape;
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()] = nshape->propid();
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape. */
     RootedId id(cx);
@@ -1510,17 +1510,17 @@ js::CreateThisForFunction(JSContext *cx,
 }
 
 /*
  * Given pc pointing after a property accessing bytecode, return true if the
  * access is "object-detecting" in the sense used by web scripts, e.g., when
  * checking whether document.all is defined.
  */
 static bool
-Detecting(JSContext *cx, UnrootedScript script, jsbytecode *pc)
+Detecting(JSContext *cx, RawScript script, jsbytecode *pc)
 {
     /* General case: a branch or equality op follows the access. */
     JSOp op = JSOp(*pc);
     if (js_CodeSpec[op].format & JOF_DETECTING)
         return true;
 
     jsbytecode *endpc = script->code + script->length;
     JS_ASSERT(script->code <= pc && pc < endpc);
@@ -1561,17 +1561,17 @@ Detecting(JSContext *cx, UnrootedScript 
 unsigned
 js_InferFlags(JSContext *cx, unsigned defaultFlags)
 {
     /*
      * We intentionally want to look across compartment boundaries to correctly
      * handle the case of cross-compartment property access.
      */
     jsbytecode *pc;
-    UnrootedScript script = cx->stack.currentScript(&pc, ContextStack::ALLOW_CROSS_COMPARTMENT);
+    RawScript script = cx->stack.currentScript(&pc, ContextStack::ALLOW_CROSS_COMPARTMENT);
     if (!script)
         return defaultFlags;
 
     uint32_t format = js_CodeSpec[*pc].format;
     unsigned flags = 0;
     if (format & JOF_SET)
         flags |= JSRESOLVE_ASSIGNING;
     return flags;
@@ -3096,30 +3096,30 @@ js_PurgeScopeChainHelper(JSContext *cx, 
             if (!PurgeProtoChain(cx, obj, id))
                 return false;
         }
     }
 
     return true;
 }
 
-UnrootedShape
+RawShape
 js_AddNativeProperty(JSContext *cx, HandleObject obj, HandleId id,
                      PropertyOp getter, StrictPropertyOp setter, uint32_t slot,
                      unsigned attrs, unsigned flags, int shortid)
 {
     /*
      * Purge the property cache of now-shadowed id in obj's scope chain. Do
      * this optimistically (assuming no failure below) before locking obj, so
      * we can lock the shadowed scope.
      */
     if (!js_PurgeScopeChain(cx, obj, id))
-        return UnrootedShape(NULL);
-
-    UnrootedShape shape =
+        return NULL;
+
+    RawShape shape =
         JSObject::putProperty(cx, obj, id, getter, setter, slot, attrs, flags, shortid);
     if (!shape)
         return shape;
 
     if (JSID_IS_INT(id))
         JSObject::removeDenseElementForSparseIndex(cx, obj, JSID_TO_INT(id));
 
     return shape;
@@ -3433,17 +3433,17 @@ CallResolveOp(JSContext *cx, HandleObjec
         objp.set(obj);
     }
 
     if (JSID_IS_INT(id) && objp->containsDenseElement(JSID_TO_INT(id))) {
         MarkDenseElementFound<CanGC>(propp);
         return true;
     }
 
-    UnrootedShape shape;
+    RawShape shape;
     if (!objp->nativeEmpty() && (shape = objp->nativeLookup(cx, id)))
         propp.set(shape);
     else
         objp.set(NULL);
 
     return true;
 }
 
@@ -3466,17 +3466,17 @@ LookupPropertyWithFlagsInline(JSContext 
         /* Search for a native dense element or property. */
         {
             if (JSID_IS_INT(id) && current->containsDenseElement(JSID_TO_INT(id))) {
                 objp.set(current);
                 MarkDenseElementFound<allowGC>(propp);
                 return true;
             }
 
-            UnrootedShape shape = current->nativeLookup(cx, id);
+            RawShape shape = current->nativeLookup(cx, id);
             if (shape) {
                 objp.set(current);
                 propp.set(shape);
                 return true;
             }
         }
 
         /* Try obj's class resolve hook if id was not found in obj's scope. */
@@ -3653,17 +3653,17 @@ NativeGetInline(JSContext *cx,
     } else {
         vp.setUndefined();
     }
     if (shape->hasDefaultGetter())
         return true;
 
     {
         jsbytecode *pc;
-        UnrootedScript script = cx->stack.currentScript(&pc);
+        RawScript script = cx->stack.currentScript(&pc);
         if (script && script->hasAnalysis()) {
             analyze::Bytecode *code = script->analysis()->maybeCode(pc);
             if (code)
                 code->accessGetter = true;
         }
     }
 
     if (!allowGC)
@@ -3913,17 +3913,17 @@ js::GetMethod(JSContext *cx, HandleObjec
 
     return op(cx, obj, obj, id, vp);
 }
 
 static bool
 MaybeReportUndeclaredVarAssignment(JSContext *cx, JSString *propname)
 {
     {
-        UnrootedScript script = cx->stack.currentScript(NULL, ContextStack::ALLOW_CROSS_COMPARTMENT);
+        RawScript script = cx->stack.currentScript(NULL, ContextStack::ALLOW_CROSS_COMPARTMENT);
         if (!script)
             return true;
 
         /* If neither cx nor the code is strict, then no check is needed. */
         if (!script->strict && !cx->hasStrictOption())
             return true;
     }
 
@@ -3936,17 +3936,17 @@ MaybeReportUndeclaredVarAssignment(JSCon
                                         JSMSG_UNDECLARED_VAR, bytes.ptr());
 }
 
 bool
 js::ReportIfUndeclaredVarAssignment(JSContext *cx, HandleString propname)
 {
     {
         jsbytecode *pc;
-        UnrootedScript script = cx->stack.currentScript(&pc, ContextStack::ALLOW_CROSS_COMPARTMENT);
+        RawScript script = cx->stack.currentScript(&pc, ContextStack::ALLOW_CROSS_COMPARTMENT);
         if (!script)
             return true;
 
         /* If neither cx nor the code is strict, then no check is needed. */
         if (!script->strict && !cx->hasStrictOption())
             return true;
 
         /*
@@ -4361,17 +4361,17 @@ js::HasDataProperty(JSContext *cx, JSObj
 {
     AutoAssertNoGC nogc;
 
     if (JSID_IS_INT(id) && obj->containsDenseElement(JSID_TO_INT(id))) {
         *vp = obj->getDenseElement(JSID_TO_INT(id));
         return true;
     }
 
-    if (UnrootedShape shape = obj->nativeLookup(cx, id)) {
+    if (RawShape shape = obj->nativeLookup(cx, id)) {
         if (shape->hasDefaultGetter() && shape->hasSlot()) {
             *vp = obj->nativeGetSlot(shape->slot());
             return true;
         }
     }
 
     return false;
 }
@@ -4716,17 +4716,17 @@ js_ValueToNonNullObject(JSContext *cx, c
 void
 js_GetObjectSlotName(JSTracer *trc, char *buf, size_t bufsize)
 {
     JS_ASSERT(trc->debugPrinter == js_GetObjectSlotName);
 
     JSObject *obj = (JSObject *)trc->debugPrintArg;
     uint32_t slot = uint32_t(trc->debugPrintIndex);
 
-    UnrootedShape shape;
+    RawShape shape;
     if (obj->isNative()) {
         shape = obj->lastProperty();
         while (shape && (!shape->hasSlot() || shape->slot() != slot))
             shape = shape->previous();
     } else {
         shape = NULL;
     }
 
@@ -4798,17 +4798,17 @@ dumpValue(const Value &v)
         JSFunction *fun = v.toObject().toFunction();
         if (fun->displayAtom()) {
             fputs("<function ", stderr);
             FileEscapedString(stderr, fun->displayAtom(), 0);
         } else {
             fputs("<unnamed function", stderr);
         }
         if (fun->hasScript()) {
-            UnrootedScript script = fun->nonLazyScript();
+            RawScript script = fun->nonLazyScript();
             fprintf(stderr, " (%s:%u)",
                     script->filename ? script->filename : "", script->lineno);
         }
         fprintf(stderr, " at %p>", (void *) fun);
     } else if (v.isObject()) {
         JSObject *obj = &v.toObject();
         Class *clasp = obj->getClass();
         fprintf(stderr, "<%s%s at %p>",
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -289,17 +289,17 @@ class JSObject : public js::ObjectImpl
   public:
     /*
      * Update the last property, keeping the number of allocated slots in sync
      * with the object's new slot span.
      */
     static bool setLastProperty(JSContext *cx, JS::HandleObject obj, js::HandleShape shape);
 
     /* As above, but does not change the slot span. */
-    inline void setLastPropertyInfallible(js::UnrootedShape shape);
+    inline void setLastPropertyInfallible(js::RawShape shape);
 
     /* Make a non-array object with the specified initial state. */
     static inline JSObject *create(JSContext *cx,
                                    js::gc::AllocKind kind,
                                    js::gc::InitialHeap heap,
                                    js::HandleShape shape,
                                    js::HandleTypeObject type,
                                    js::HeapSlot *slots);
@@ -730,85 +730,85 @@ class JSObject : public js::ObjectImpl
      * given arguments, providing this object as |this|. If the property isn't
      * callable a TypeError will be thrown. On success the value returned by
      * the call is stored in *vp.
      */
     bool callMethod(JSContext *cx, js::HandleId id, unsigned argc, js::Value *argv,
                     js::MutableHandleValue vp);
 
   private:
-    static js::UnrootedShape getChildProperty(JSContext *cx, JS::HandleObject obj,
-                                                   js::HandleShape parent, js::StackShape &child);
+    static js::RawShape getChildProperty(JSContext *cx, JS::HandleObject obj,
+                                         js::HandleShape parent, js::StackShape &child);
 
   protected:
     /*
      * Internal helper that adds a shape not yet mapped by this object.
      *
      * Notes:
      * 1. getter and setter must be normalized based on flags (see jsscope.cpp).
      * 2. !isExtensible() checking must be done by callers.
      */
-    static js::UnrootedShape addPropertyInternal(JSContext *cx,
-                                                 JS::HandleObject obj, JS::HandleId id,
-                                                 JSPropertyOp getter, JSStrictPropertyOp setter,
-                                                 uint32_t slot, unsigned attrs,
-                                                 unsigned flags, int shortid, js::Shape **spp,
-                                                 bool allowDictionary);
+    static js::RawShape addPropertyInternal(JSContext *cx,
+                                            JS::HandleObject obj, JS::HandleId id,
+                                            JSPropertyOp getter, JSStrictPropertyOp setter,
+                                            uint32_t slot, unsigned attrs,
+                                            unsigned flags, int shortid, js::Shape **spp,
+                                            bool allowDictionary);
 
   private:
     bool toDictionaryMode(JSContext *cx);
 
     struct TradeGutsReserved;
     static bool ReserveForTradeGuts(JSContext *cx, JSObject *a, JSObject *b,
                                     TradeGutsReserved &reserved);
 
     static void TradeGuts(JSContext *cx, JSObject *a, JSObject *b,
                           TradeGutsReserved &reserved);
 
   public:
     /* Add a property whose id is not yet in this scope. */
-    static js::UnrootedShape addProperty(JSContext *cx, JS::HandleObject, JS::HandleId id,
-                                         JSPropertyOp getter, JSStrictPropertyOp setter,
-                                         uint32_t slot, unsigned attrs, unsigned flags,
-                                         int shortid, bool allowDictionary = true);
+    static js::RawShape addProperty(JSContext *cx, JS::HandleObject, JS::HandleId id,
+                                    JSPropertyOp getter, JSStrictPropertyOp setter,
+                                    uint32_t slot, unsigned attrs, unsigned flags,
+                                    int shortid, bool allowDictionary = true);
 
     /* Add a data property whose id is not yet in this scope. */
-    js::UnrootedShape addDataProperty(JSContext *cx, jsid id_, uint32_t slot, unsigned attrs) {
+    js::RawShape addDataProperty(JSContext *cx, jsid id_, uint32_t slot, unsigned attrs) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
         js::RootedObject self(cx, this);
         js::RootedId id(cx, id_);
         return addProperty(cx, self, id, NULL, NULL, slot, attrs, 0, 0);
     }
 
-    js::UnrootedShape addDataProperty(JSContext *cx, js::HandlePropertyName name, uint32_t slot, unsigned attrs) {
+    js::RawShape addDataProperty(JSContext *cx, js::HandlePropertyName name, uint32_t slot, unsigned attrs) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
         js::RootedObject self(cx, this);
         js::RootedId id(cx, NameToId(name));
         return addProperty(cx, self, id, NULL, NULL, slot, attrs, 0, 0);
     }
 
     /* Add or overwrite a property for id in this scope. */
-    static js::UnrootedShape putProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
-                                         JSPropertyOp getter, JSStrictPropertyOp setter,
-                                         uint32_t slot, unsigned attrs,
-                                         unsigned flags, int shortid);
-    static js::UnrootedShape putProperty(JSContext *cx, JS::HandleObject obj,
-                                         js::PropertyName *name,
-                                         JSPropertyOp getter, JSStrictPropertyOp setter,
-                                         uint32_t slot, unsigned attrs,
-                                         unsigned flags, int shortid)
+    static js::RawShape putProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
+                                    JSPropertyOp getter, JSStrictPropertyOp setter,
+                                    uint32_t slot, unsigned attrs,
+                                    unsigned flags, int shortid);
+    static js::RawShape putProperty(JSContext *cx, JS::HandleObject obj,
+                                    js::PropertyName *name,
+                                    JSPropertyOp getter, JSStrictPropertyOp setter,
+                                    uint32_t slot, unsigned attrs,
+                                    unsigned flags, int shortid)
     {
         js::RootedId id(cx, js::NameToId(name));
         return putProperty(cx, obj, id, getter, setter, slot, attrs, flags, shortid);
     }
 
     /* Change the given property into a sibling with the same id in this scope. */
-    static js::UnrootedShape changeProperty(JSContext *cx, js::HandleObject obj,
-                                            js::HandleShape shape, unsigned attrs, unsigned mask,
-                                            JSPropertyOp getter, JSStrictPropertyOp setter);
+    static js::RawShape changeProperty(JSContext *cx, js::HandleObject obj,
+                                       js::HandleShape shape, unsigned attrs, unsigned mask,
+                                       JSPropertyOp getter, JSStrictPropertyOp setter);
 
     static inline bool changePropertyAttributes(JSContext *cx, js::HandleObject obj,
                                                 js::HandleShape shape, unsigned attrs);
 
     /* Remove the property named by id from this object. */
     bool removeProperty(JSContext *cx, jsid id);
 
     /* Clear the scope, making it empty. */
@@ -1159,17 +1159,17 @@ js_IdentifyClassPrototype(JSObject *obj)
 bool
 js_FindClassObject(JSContext *cx, JSProtoKey protoKey, js::MutableHandleValue vp,
                    js::Class *clasp = NULL);
 
 /*
  * Find or create a property named by id in obj's scope, with the given getter
  * and setter, slot, attributes, and other members.
  */
-extern js::UnrootedShape
+extern js::RawShape
 js_AddNativeProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
                      JSPropertyOp getter, JSStrictPropertyOp setter, uint32_t slot,
                      unsigned attrs, unsigned flags, int shortid);
 
 extern JSBool
 js_DefineOwnProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
                      const JS::Value &descriptor, JSBool *bp);
 
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -278,17 +278,17 @@ JSObject::isFixedSlot(size_t slot)
 inline size_t
 JSObject::dynamicSlotIndex(size_t slot)
 {
     JS_ASSERT(slot >= numFixedSlots());
     return slot - numFixedSlots();
 }
 
 inline void
-JSObject::setLastPropertyInfallible(js::UnrootedShape shape)
+JSObject::setLastPropertyInfallible(js::RawShape shape)
 {
     JS_ASSERT(!shape->inDictionary());
     JS_ASSERT(shape->compartment() == compartment());
     JS_ASSERT(!inDictionaryMode());
     JS_ASSERT(slotSpan() == shape->slotSpan());
     JS_ASSERT(numFixedSlots() == shape->numFixedSlots());
 
     shape_ = shape;
@@ -309,17 +309,17 @@ JSObject::canRemoveLastProperty()
     /*
      * Check that the information about the object stored in the last
      * property's base shape is consistent with that stored in the previous
      * shape. If not consistent, then the last property cannot be removed as it
      * will induce a change in the object itself, and the object must be
      * converted to dictionary mode instead. See BaseShape comment in jsscope.h
      */
     JS_ASSERT(!inDictionaryMode());
-    js::UnrootedShape previous = lastProperty()->previous().get();
+    js::RawShape previous = lastProperty()->previous().get();
     return previous->getObjectParent() == lastProperty()->getObjectParent()
         && previous->getObjectFlags() == lastProperty()->getObjectFlags();
 }
 
 inline const js::HeapSlot *
 JSObject::getRawSlots()
 {
     JS_ASSERT(isGlobal());
@@ -1728,17 +1728,17 @@ GuessArrayGCKind(size_t numSlots)
     return gc::FINALIZE_OBJECT8;
 }
 
 /*
  * Fill slots with the initial slot array to use for a newborn object which
  * may or may not need dynamic slots.
  */
 inline bool
-PreallocateObjectDynamicSlots(JSContext *cx, UnrootedShape shape, HeapSlot **slots)
+PreallocateObjectDynamicSlots(JSContext *cx, RawShape shape, HeapSlot **slots)
 {
     if (size_t count = JSObject::dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan())) {
         *slots = cx->pod_malloc<HeapSlot>(count);
         if (!*slots)
             return false;
         Debug_SetSlotRangeToCrashOnTouch(*slots, count);
         return true;
     }
--- a/js/src/jsonparser.cpp
+++ b/js/src/jsonparser.cpp
@@ -83,19 +83,19 @@ JSONParser::readString()
         if (start < current && !buffer.append(start.get(), current.get()))
             return token(OOM);
 
         if (current >= end)
             break;
 
         jschar c = *current++;
         if (c == '"') {
-            UnrootedFlatString str = (ST == JSONParser::PropertyName)
-                                      ? UnrootedFlatString(buffer.finishAtom())
-                                      : buffer.finishString();
+            RawFlatString str = (ST == JSONParser::PropertyName)
+                                 ? buffer.finishAtom()
+                                 : buffer.finishString();
             if (!str)
                 return token(OOM);
             return stringToken(str);
         }
 
         if (c != '\\') {
             error("bad character in string literal");
             return token(Error);
--- a/js/src/jsprobes.cpp
+++ b/js/src/jsprobes.cpp
@@ -68,17 +68,17 @@ void
 Probes::discardMJITCode(FreeOp *fop, mjit::JITScript *jscr, mjit::JITChunk *chunk, void* address)
 {
     if (fop->runtime()->spsProfiler.enabled())
         fop->runtime()->spsProfiler.discardMJITCode(jscr, chunk, address);
 }
 
 bool
 Probes::registerICCode(JSContext *cx,
-                       mjit::JITChunk *chunk, UnrootedScript script, jsbytecode* pc,
+                       mjit::JITChunk *chunk, RawScript script, jsbytecode* pc,
                        void *start, size_t size)
 {
     if (cx->runtime->spsProfiler.enabled() &&
         !cx->runtime->spsProfiler.registerICCode(chunk, script, pc, start, size))
     {
         return false;
     }
     return true;
@@ -144,64 +144,64 @@ Probes::shutdown()
         ok = false;
 #endif
 
     return ok;
 }
 
 #ifdef INCLUDE_MOZILLA_DTRACE
 static const char *
-ScriptFilename(const UnrootedScript script)
+ScriptFilename(const RawScript script)
 {
     if (!script)
         return Probes::nullName;
     if (!script->filename)
         return Probes::anonymousName;
     return script->filename;
 }
 
 static const char *
-FunctionName(JSContext *cx, UnrootedFunction fun, JSAutoByteString* bytes)
+FunctionName(JSContext *cx, RawFunction fun, JSAutoByteString* bytes)
 {
     if (!fun)
         return Probes::nullName;
     if (!fun->displayAtom())
         return Probes::anonymousName;
     return bytes->encodeLatin1(cx, fun->displayAtom()) ? bytes->ptr() : Probes::nullName;
 }
 
 /*
  * These functions call the DTrace macros for the JavaScript USDT probes.
  * Originally this code was inlined in the JavaScript code; however since
  * a number of operations are called, these have been placed into functions
  * to reduce any negative compiler optimization effect that the addition of
  * a number of usually unused lines of code would cause.
  */
 void
-Probes::DTraceEnterJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script)
+Probes::DTraceEnterJSFun(JSContext *cx, RawFunction fun, RawScript script)
 {
     JSAutoByteString funNameBytes;
     JAVASCRIPT_FUNCTION_ENTRY(ScriptFilename(script), Probes::nullName,
                               FunctionName(cx, fun, &funNameBytes));
 }
 
 void
-Probes::DTraceExitJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script)
+Probes::DTraceExitJSFun(JSContext *cx, RawFunction fun, RawScript script)
 {
     JSAutoByteString funNameBytes;
     JAVASCRIPT_FUNCTION_RETURN(ScriptFilename(script), Probes::nullName,
                                FunctionName(cx, fun, &funNameBytes));
 }
 #endif
 
 #ifdef MOZ_ETW
 static void
 current_location(JSContext *cx, int* lineno, char const **filename)
 {
-    UnrootedScript script = cx->stack.currentScript()
+    RawScript script = cx->stack.currentScript()
     if (! script) {
         *lineno = -1;
         *filename = "(uninitialized)";
         return;
     }
     *lineno = js_PCToLineNumber(cx, script, js_GetCurrentBytecodePC(cx));
     *filename = ScriptFilename(script);
 }
@@ -238,80 +238,80 @@ Probes::ETWDestroyRuntime(JSRuntime *rt)
 bool
 Probes::ETWShutdown()
 {
     EventUnregisterMozillaSpiderMonkey();
     return true;
 }
 
 bool
-Probes::ETWEnterJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script, int counter)
+Probes::ETWEnterJSFun(JSContext *cx, RawFunction fun, RawScript script, int counter)
 {
     int lineno = script ? script->lineno : -1;
     JSAutoByteString bytes;
     return (EventWriteEvtFunctionEntry(ScriptFilename(script), lineno,
                                        ObjectClassname((JSObject *)fun),
                                        FunctionName(cx, fun, &bytes)) == ERROR_SUCCESS);
 }
 
 bool
-Probes::ETWExitJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script, int counter)
+Probes::ETWExitJSFun(JSContext *cx, RawFunction fun, RawScript script, int counter)
 {
     int lineno = script ? script->lineno : -1;
     JSAutoByteString bytes;
     return (EventWriteEvtFunctionExit(ScriptFilename(script), lineno,
                                       ObjectClassname((JSObject *)fun),
                                       FunctionName(cx, fun, &bytes)) == ERROR_SUCCESS);
 }
 
 bool
-Probes::ETWCreateObject(JSContext *cx, UnrootedObject obj)
+Probes::ETWCreateObject(JSContext *cx, RawObject obj)
 {
     int lineno;
     const char * script_filename;
     current_location(cx, &lineno, &script_filename);
 
     return EventWriteEvtObjectCreate(script_filename, lineno,
                                      ObjectClassname(obj), reinterpret_cast<uint64_t_t>(obj),
                                      obj ? obj->computedSizeOfIncludingThis() : 0) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWFinalizeObject(UnrootedObject obj)
+Probes::ETWFinalizeObject(RawObject obj)
 {
     return EventWriteEvtObjectFinalize(ObjectClassname(obj),
                                        reinterpret_cast<uint64_t_t>(obj)) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWResizeObject(JSContext *cx, UnrootedObject obj, size_t oldSize, size_t newSize)
+Probes::ETWResizeObject(JSContext *cx, RawObject obj, size_t oldSize, size_t newSize)
 {
     int lineno;
     const char *script_filename;
     current_location(cx, &lineno, &script_filename);
 
     return EventWriteEvtObjectResize(script_filename, lineno,
                                      ObjectClassname(obj), reinterpret_cast<uint64_t_t>(obj),
                                      oldSize, newSize) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWCreateString(JSContext *cx, UnrootedString string, size_t length)
+Probes::ETWCreateString(JSContext *cx, RawString string, size_t length)
 {
     int lineno;
     const char *script_filename;
     current_location(cx, &lineno, &script_filename);
 
     return EventWriteEvtStringCreate(script_filename, lineno,
                                      reinterpret_cast<uint64_t_t>(string), length) ==
            ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWFinalizeString(UnrootedString string)
+Probes::ETWFinalizeString(RawString string)
 {
     return EventWriteEvtStringFinalize(reinterpret_cast<uint64_t>(string),
                                        string->length()) == ERROR_SUCCESS;
 }
 
 bool
 Probes::ETWCompileScriptBegin(const char *filename, int lineno)
 {
@@ -320,31 +320,31 @@ Probes::ETWCompileScriptBegin(const char
 
 bool
 Probes::ETWCompileScriptEnd(const char *filename, int lineno)
 {
     return EventWriteEvtScriptCompileEnd(filename, lineno) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWCalloutBegin(JSContext *cx, UnrootedFunction fun)
+Probes::ETWCalloutBegin(JSContext *cx, RawFunction fun)
 {
     const char *script_filename;
     int lineno;
     JSAutoByteString bytes;
     current_location(cx, &lineno, &script_filename);
 
     return EventWriteEvtCalloutBegin(script_filename,
                                      lineno,
                                      ObjectClassname((JSObject *)fun),
                                      FunctionName(cx, fun, &bytes)) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWCalloutEnd(JSContext *cx, UnrootedFunction fun)
+Probes::ETWCalloutEnd(JSContext *cx, RawFunction fun)
 {
         const char *script_filename;
         int lineno;
         JSAutoByteString bytes;
         current_location(cx, &lineno, &script_filename);
 
         return EventWriteEvtCalloutEnd(script_filename,
                                        lineno,
@@ -401,17 +401,17 @@ Probes::ETWGCStartSweepPhase(JSCompartme
 
 bool
 Probes::ETWGCEndSweepPhase(JSCompartment *compartment)
 {
     return EventWriteEvtGCEndSweepPhase(reinterpret_cast<uint64_t>(compartment)) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWCustomMark(UnrootedString string)
+Probes::ETWCustomMark(RawString string)
 {
     const jschar *chars = string->getCharsZ(NULL);
     return !chars || EventWriteEvtCustomString(chars) == ERROR_SUCCESS;
 }
 
 bool
 Probes::ETWCustomMark(const char *string)
 {
@@ -420,24 +420,24 @@ Probes::ETWCustomMark(const char *string
 
 bool
 Probes::ETWCustomMark(int marker)
 {
     return EventWriteEvtCustomInt(marker) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWStartExecution(UnrootedScript script)
+Probes::ETWStartExecution(RawScript script)
 {
     int lineno = script ? script->lineno : -1;
     return EventWriteEvtExecuteStart(ScriptFilename(script), lineno) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWStopExecution(UnrootedScript script)
+Probes::ETWStopExecution(RawScript script)
 {
     int lineno = script ? script->lineno : -1;
     return EventWriteEvtExecuteDone(ScriptFilename(script), lineno) == ERROR_SUCCESS;
 }
 
 bool
 Probes::ETWResizeHeap(JS::Zone *zone, size_t oldSize, size_t newSize)
 {
--- a/js/src/jsprobes.h
+++ b/js/src/jsprobes.h
@@ -87,26 +87,26 @@ bool callTrackingActive(JSContext *);
 
 /*
  * Test whether anything is looking for JIT native code registration events.
  * This information will not be collected otherwise.
  */
 bool wantNativeAddressInfo(JSContext *);
 
 /* Entering a JS function */
-bool enterScript(JSContext *, UnrootedScript, UnrootedFunction , StackFrame *);
+bool enterScript(JSContext *, RawScript, RawFunction , StackFrame *);
 
 /* About to leave a JS function */
-bool exitScript(JSContext *, UnrootedScript, UnrootedFunction , StackFrame *);
+bool exitScript(JSContext *, RawScript, RawFunction , StackFrame *);
 
 /* Executing a script */
-bool startExecution(UnrootedScript script);
+bool startExecution(RawScript script);
 
 /* Script has completed execution */
-bool stopExecution(UnrootedScript script);
+bool stopExecution(RawScript script);
 
 /* Heap has been resized */
 bool resizeHeap(JS::Zone *zone, size_t oldSize, size_t newSize);
 
 /*
  * Object has been created. |obj| must exist (its class and size are read)
  */
 bool createObject(JSContext *cx, JSObject *obj);
@@ -142,20 +142,20 @@ bool finalizeString(JSString *string);
 
 /* Script is about to be compiled */
 bool compileScriptBegin(const char *filename, int lineno);
 
 /* Script has just finished compilation */
 bool compileScriptEnd(const char *filename, int lineno);
 
 /* About to make a call from JS into native code */
-bool calloutBegin(JSContext *cx, UnrootedFunction fun);
+bool calloutBegin(JSContext *cx, RawFunction fun);
 
 /* Native code called by JS has terminated */
-bool calloutEnd(JSContext *cx, UnrootedFunction fun);
+bool calloutEnd(JSContext *cx, RawFunction fun);
 
 /* Unimplemented */
 bool acquireMemory(JSContext *cx, void *address, size_t nbytes);
 bool releaseMemory(JSContext *cx, void *address, size_t nbytes);
 
 /*
  * Garbage collection probes
  *
@@ -218,69 +218,69 @@ registerMJITCode(JSContext *cx, js::mjit
 void
 discardMJITCode(FreeOp *fop, mjit::JITScript *jscr, mjit::JITChunk *chunk, void* address);
 
 /*
  * IC code has been allocated within the given JITChunk
  */
 bool
 registerICCode(JSContext *cx,
-               mjit::JITChunk *chunk, UnrootedScript script, jsbytecode* pc,
+               mjit::JITChunk *chunk, RawScript script, jsbytecode* pc,
                void *start, size_t size);
 #endif /* JS_METHODJIT */
 
 /*
  * A whole region of code has been deallocated, containing any number of ICs.
  * (ICs are unregistered in a batch, so individual ICs are not registered.)
  */
 void
 discardExecutableRegion(void *start, size_t size);
 
 /*
  * Internal: DTrace-specific functions to be called during Probes::enterScript
  * and Probes::exitScript. These will not be inlined, but the argument
  * marshalling required for these probe points is expensive enough that it
  * shouldn't really matter.
  */
-void DTraceEnterJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script);
-void DTraceExitJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script);
+void DTraceEnterJSFun(JSContext *cx, RawFunction fun, RawScript script);
+void DTraceExitJSFun(JSContext *cx, RawFunction fun, RawScript script);
 
 /*
  * Internal: ETW-specific probe functions
  */
 #ifdef MOZ_ETW
 // ETW Handlers
 bool ETWCreateRuntime(JSRuntime *rt);
 bool ETWDestroyRuntime(JSRuntime *rt);
 bool ETWShutdown();
 bool ETWCallTrackingActive();
-bool ETWEnterJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script, int counter);
-bool ETWExitJSFun(JSContext *cx, UnrootedFunction fun, UnrootedScript script, int counter);
+bool ETWEnterJSFun(JSContext *cx, RawFunction fun, RawScript script, int counter);
+bool ETWExitJSFun(JSContext *cx, RawFunction fun, RawScript script, int counter);
 bool ETWCreateObject(JSContext *cx, JSObject *obj);
 bool ETWFinalizeObject(JSObject *obj);
 bool ETWResizeObject(JSContext *cx, JSObject *obj, size_t oldSize, size_t newSize);
 bool ETWCreateString(JSContext *cx, JSString *string, size_t length);
 bool ETWFinalizeString(JSString *string);
 bool ETWCompileScriptBegin(const char *filename, int lineno);
 bool ETWCompileScriptEnd(const char *filename, int lineno);
-bool ETWCalloutBegin(JSContext *cx, UnrootedFunction fun);
-bool ETWCalloutEnd(JSContext *cx, UnrootedFunction fun);
+bool ETWCalloutBegin(JSContext *cx, RawFunction fun);
+bool ETWCalloutEnd(JSContext *cx, RawFunction fun);
 bool ETWAcquireMemory(JSContext *cx, void *address, size_t nbytes);
 bool ETWReleaseMemory(JSContext *cx, void *address, size_t nbytes);
 bool ETWGCStart();
 bool ETWGCEnd();
 bool ETWGCStartMarkPhase();
 bool ETWGCEndMarkPhase();
 bool ETWGCStartSweepPhase();
 bool ETWGCEndSweepPhase();
 bool ETWCustomMark(JSString *string);
 bool ETWCustomMark(const char *string);
 bool ETWCustomMark(int marker);
-bool ETWStartExecution(UnrootedScript script);
-bool ETWStopExecution(JSContext *cx, UnrootedScript script);
+bool ETWStartExecution(RawScript script);
+bool ETWStopExecution(JSContext *cx, RawScript script);
 bool ETWResizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize);
 #endif
 
 } /* namespace Probes */
 
 /*
  * Many probe handlers are implemented inline for minimal performance impact,
  * especially important when no backends are enabled.
@@ -307,17 +307,17 @@ Probes::callTrackingActive(JSContext *cx
 inline bool
 Probes::wantNativeAddressInfo(JSContext *cx)
 {
     return (cx->reportGranularity >= JITREPORT_GRANULARITY_FUNCTION &&
             JITGranularityRequested(cx) >= JITREPORT_GRANULARITY_FUNCTION);
 }
 
 inline bool
-Probes::enterScript(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun,
+Probes::enterScript(JSContext *cx, RawScript script, RawFunction maybeFun,
                     StackFrame *fp)
 {
     bool ok = true;
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_FUNCTION_ENTRY_ENABLED())
         DTraceEnterJSFun(cx, maybeFun, script);
 #endif
 #ifdef MOZ_TRACE_JSCALLS
@@ -334,17 +334,17 @@ Probes::enterScript(JSContext *cx, Unroo
         JS_ASSERT_IF(!fp->isGeneratorFrame(), !fp->hasPushedSPSFrame());
         fp->setPushedSPSFrame();
     }
 
     return ok;
 }
 
 inline bool
-Probes::exitScript(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun,
+Probes::exitScript(JSContext *cx, RawScript script, RawFunction maybeFun,
                    StackFrame *fp)
 {
     bool ok = true;
 
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_FUNCTION_RETURN_ENABLED())
         DTraceExitJSFun(cx, maybeFun, script);
 #endif
@@ -507,30 +507,30 @@ Probes::compileScriptEnd(const char *fil
     if (ProfilingActive && !ETWCompileScriptEnd(filename, lineno))
         ok = false;
 #endif
 
     return ok;
 }
 
 inline bool
-Probes::calloutBegin(JSContext *cx, UnrootedFunction fun)
+Probes::calloutBegin(JSContext *cx, RawFunction fun)
 {
     bool ok = true;
 
 #ifdef MOZ_ETW
     if (ProfilingActive && !ETWCalloutBegin(cx, fun))
         ok = false;
 #endif
 
     return ok;
 }
 
 inline bool
-Probes::calloutEnd(JSContext *cx, UnrootedFunction fun)
+Probes::calloutEnd(JSContext *cx, RawFunction fun)
 {
     bool ok = true;
 
 #ifdef MOZ_ETW
     if (ProfilingActive && !ETWCalloutEnd(cx, fun))
         ok = false;
 #endif
 
@@ -676,17 +676,17 @@ Probes::CustomMark(int marker)
     if (ProfilingActive && !ETWCustomMark(marker))
         ok = false;
 #endif
 
     return ok;
 }
 
 inline bool
-Probes::startExecution(UnrootedScript script)
+Probes::startExecution(RawScript script)
 {
     bool ok = true;
 
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_EXECUTE_START_ENABLED())
         JAVASCRIPT_EXECUTE_START((script->filename ? (char *)script->filename : nullName),
                                  script->lineno);
 #endif
@@ -694,17 +694,17 @@ Probes::startExecution(UnrootedScript sc
     if (ProfilingActive && !ETWStartExecution(script))
         ok = false;
 #endif
 
     return ok;
 }
 
 inline bool
-Probes::stopExecution(UnrootedScript script)
+Probes::stopExecution(RawScript script)
 {
     bool ok = true;
 
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_EXECUTE_DONE_ENABLED())
         JAVASCRIPT_EXECUTE_DONE((script->filename ? (char *)script->filename : nullName),
                                 script->lineno);
 #endif
--- a/js/src/jspropertycacheinlines.h
+++ b/js/src/jspropertycacheinlines.h
@@ -31,17 +31,17 @@
 JS_ALWAYS_INLINE void
 js::PropertyCache::test(JSContext *cx, jsbytecode *pc, JSObject **obj,
                         JSObject **pobj, PropertyCacheEntry **entry, PropertyName **name)
 {
     AutoAssertNoGC nogc;
 
     JS_ASSERT(this == &cx->propertyCache());
 
-    UnrootedShape kshape = (*obj)->lastProperty();
+    RawShape kshape = (*obj)->lastProperty();
     *entry = &table[hash(pc, kshape)];
     PCMETER(pctestentry = *entry);
     PCMETER(tests++);
     JS_ASSERT(obj != pobj);
     if ((*entry)->kpc == pc && (*entry)->kshape == kshape) {
         JSObject *tmp;
         *pobj = *obj;
         if ((*entry)->isPrototypePropertyHit() &&
@@ -64,17 +64,17 @@ js::PropertyCache::test(JSContext *cx, j
 JS_ALWAYS_INLINE bool
 js::PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
                               PropertyCacheEntry **entryp, JSObject **obj2p, PropertyName **namep)
 {
     AutoAssertNoGC nogc;
 
     JS_ASSERT(this == &cx->propertyCache());
 
-    UnrootedShape kshape = obj->lastProperty();
+    RawShape kshape = obj->lastProperty();
     PropertyCacheEntry *entry = &table[hash(pc, kshape)];
     *entryp = entry;
     PCMETER(pctestentry = entry);
     PCMETER(tests++);
     PCMETER(settests++);
     if (entry->kpc == pc && entry->kshape == kshape)
         return true;
 
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -27,58 +27,58 @@ ShapeHasher::hash(const Lookup &l)
 }
 
 inline bool
 ShapeHasher::match(const Key k, const Lookup &l)
 {
     return k->matches(l);
 }
 
-UnrootedShape
+RawShape
 PropertyTree::newShape(JSContext *cx)
 {
-    UnrootedShape shape = js_NewGCShape(cx);
+    RawShape shape = js_NewGCShape(cx);
     if (!shape)
         JS_ReportOutOfMemory(cx);
     return shape;
 }
 
 static KidsHash *
-HashChildren(UnrootedShape kid1, UnrootedShape kid2)
+HashChildren(RawShape kid1, RawShape kid2)
 {
     KidsHash *hash = js_new<KidsHash>();
     if (!hash || !hash->init(2)) {
         js_delete(hash);
         return NULL;
     }
 
     JS_ALWAYS_TRUE(hash->putNew(kid1, kid1));
     JS_ALWAYS_TRUE(hash->putNew(kid2, kid2));
     return hash;
 }
 
 bool
-PropertyTree::insertChild(JSContext *cx, UnrootedShape parent, UnrootedShape child)
+PropertyTree::insertChild(JSContext *cx, RawShape parent, RawShape child)
 {
     JS_ASSERT(!parent->inDictionary());
     JS_ASSERT(!child->parent);
     JS_ASSERT(!child->inDictionary());
     JS_ASSERT(cx->compartment == compartment);
     JS_ASSERT(child->compartment() == parent->compartment());
 
     KidsPointer *kidp = &parent->kids;
 
     if (kidp->isNull()) {
         child->setParent(parent);
         kidp->setShape(child);
         return true;
     }
 
     if (kidp->isShape()) {
-        UnrootedShape shape = kidp->toShape();
+        RawShape shape = kidp->toShape();
         JS_ASSERT(shape != child);
         JS_ASSERT(!shape->matches(child));
 
         KidsHash *hash = HashChildren(shape, child);
         if (!hash) {
             JS_ReportOutOfMemory(cx);
             return false;
         }
@@ -92,17 +92,17 @@ PropertyTree::insertChild(JSContext *cx,
         return false;
     }
 
     child->setParent(parent);
     return true;
 }
 
 void
-Shape::removeChild(UnrootedShape child)
+Shape::removeChild(RawShape child)
 {
     JS_ASSERT(!child->inDictionary());
     JS_ASSERT(child->parent == this);
 
     KidsPointer *kidp = &kids;
 
     if (kidp->isShape()) {
         JS_ASSERT(kidp->toShape() == child);
@@ -122,37 +122,37 @@ Shape::removeChild(UnrootedShape child)
         KidsHash::Range r = hash->all();
         Shape *otherChild = r.front();
         JS_ASSERT((r.popFront(), r.empty()));    /* No more elements! */
         kidp->setShape(otherChild);
         js_delete(hash);
     }
 }
 
-UnrootedShape
+RawShape
 PropertyTree::getChild(JSContext *cx, Shape *parent_, uint32_t nfixed, const StackShape &child)
 {
     AssertCanGC();
 
     {
-        UnrootedShape shape = NULL;
+        RawShape shape = NULL;
 
         JS_ASSERT(parent_);
 
         /*
          * The property tree has extremely low fan-out below its root in
          * popular embeddings with real-world workloads. Patterns such as
          * defining closures that capture a constructor's environment as
          * getters or setters on the new object that is passed in as
          * |this| can significantly increase fan-out below the property
          * tree root -- see bug 335700 for details.
          */
         KidsPointer *kidp = &parent_->kids;
         if (kidp->isShape()) {
-            UnrootedShape kid = kidp->toShape();
+            RawShape kid = kidp->toShape();
             if (kid->matches(child))
                 shape = kid;
         } else if (kidp->isHash()) {
             if (KidsHash::Ptr p = kidp->toHash()->lookup(child))
                 shape = *p;
         } else {
             /* If kidp->isNull(), we always insert. */
         }
@@ -184,24 +184,24 @@ PropertyTree::getChild(JSContext *cx, Sh
 
         if (shape)
             return shape;
     }
 
     StackShape::AutoRooter childRoot(cx, &child);
     RootedShape parent(cx, parent_);
 
-    UnrootedShape shape = newShape(cx);
+    RawShape shape = newShape(cx);
     if (!shape)
-        return UnrootedShape(NULL);
+        return NULL;
 
     new (shape) Shape(child, nfixed);
 
     if (!insertChild(cx, parent, shape))
-        return UnrootedShape(NULL);
+        return NULL;
 
     return shape;
 }
 
 void
 Shape::sweep()
 {
     if (inDictionary())
@@ -238,17 +238,17 @@ Shape::finalize(FreeOp *fop)
 {
     if (!inDictionary() && kids.isHash())
         fop->delete_(kids.toHash());
 }
 
 #ifdef DEBUG
 
 void
-KidsPointer::checkConsistency(UnrootedShape aKid) const
+KidsPointer::checkConsistency(RawShape aKid) const
 {
     if (isShape()) {
         JS_ASSERT(toShape() == aKid);
     } else {
         JS_ASSERT(isHash());
         KidsHash *hash = toHash();
         KidsHash::Ptr ptr = hash->lookup(aKid);
         JS_ASSERT(*ptr == aKid);
@@ -323,17 +323,17 @@ Shape::dumpSubtree(JSContext *cx, int le
     } else {
         fprintf(fp, "%*sid ", level, "");
         dump(cx, fp);
     }
 
     if (!kids.isNull()) {
         ++level;
         if (kids.isShape()) {
-            UnrootedShape kid = kids.toShape();
+            RawShape kid = kids.toShape();
             JS_ASSERT(kid->parent == this);
             kid->dumpSubtree(cx, level, fp);
         } else {
             const KidsHash &hash = *kids.toHash();
             for (KidsHash::Range range = hash.all(); !range.empty(); range.popFront()) {
                 RawShape kid = range.front();
 
                 JS_ASSERT(kid->parent == this);
--- a/js/src/jspropertytree.h
+++ b/js/src/jspropertytree.h
@@ -34,21 +34,21 @@ class KidsPointer {
 
     uintptr_t w;
 
   public:
     bool isNull() const { return !w; }
     void setNull() { w = 0; }
 
     bool isShape() const { return (w & TAG) == SHAPE && !isNull(); }
-    UnrootedShape toShape() const {
+    RawShape toShape() const {
         JS_ASSERT(isShape());
         return reinterpret_cast<RawShape>(w & ~uintptr_t(TAG));
     }
-    void setShape(UnrootedShape shape) {
+    void setShape(RawShape shape) {
         JS_ASSERT(shape);
         JS_ASSERT((reinterpret_cast<uintptr_t>(static_cast<RawShape>(shape)) & TAG) == 0);
         w = reinterpret_cast<uintptr_t>(static_cast<RawShape>(shape)) | SHAPE;
     }
 
     bool isHash() const { return (w & TAG) == HASH; }
     KidsHash *toHash() const {
         JS_ASSERT(isHash());
@@ -56,40 +56,40 @@ class KidsPointer {
     }
     void setHash(KidsHash *hash) {
         JS_ASSERT(hash);
         JS_ASSERT((reinterpret_cast<uintptr_t>(hash) & TAG) == 0);
         w = reinterpret_cast<uintptr_t>(hash) | HASH;
     }
 
 #ifdef DEBUG
-    void checkConsistency(UnrootedShape aKid) const;
+    void checkConsistency(RawShape aKid) const;
 #endif
 };
 
 class PropertyTree
 {
     friend class ::JSFunction;
 
     JSCompartment *compartment;
 
-    bool insertChild(JSContext *cx, UnrootedShape parent, UnrootedShape child);
+    bool insertChild(JSContext *cx, RawShape parent, RawShape child);
 
     PropertyTree();
 
   public:
     enum { MAX_HEIGHT = 128 };
 
     PropertyTree(JSCompartment *comp)
         : compartment(comp)
     {
     }
 
-    UnrootedShape newShape(JSContext *cx);
-    UnrootedShape getChild(JSContext *cx, Shape *parent, uint32_t nfixed, const StackShape &child);
+    RawShape newShape(JSContext *cx);
+    RawShape getChild(JSContext *cx, Shape *parent, uint32_t nfixed, const StackShape &child);
 
 #ifdef DEBUG
     static void dumpShapes(JSRuntime *rt);
 #endif
 };
 
 } /* namespace js */
 
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -22,32 +22,32 @@
 #include "jsobjinlines.h"
 
 #include "vm/RegExpObject-inl.h"
 
 using namespace js;
 using namespace js::gc;
 
 static inline HeapSlot &
-GetCall(UnrootedObject proxy)
+GetCall(RawObject proxy)
 {
     JS_ASSERT(IsFunctionProxy(proxy));
     return proxy->getSlotRef(JSSLOT_PROXY_CALL);
 }
 
 static inline Value
-GetConstruct(UnrootedObject proxy)
+GetConstruct(RawObject proxy)
 {
     if (proxy->slotSpan() <= JSSLOT_PROXY_CONSTRUCT)
         return UndefinedValue();
     return proxy->getSlot(JSSLOT_PROXY_CONSTRUCT);
 }
 
 static inline HeapSlot &
-GetFunctionProxyConstruct(UnrootedObject proxy)
+GetFunctionProxyConstruct(RawObject proxy)
 {
     JS_ASSERT(IsFunctionProxy(proxy));
     JS_ASSERT(proxy->slotSpan() > JSSLOT_PROXY_CONSTRUCT);
     return proxy->getSlotRef(JSSLOT_PROXY_CONSTRUCT);
 }
 
 void
 js::AutoEnterPolicy::reportError(JSContext *cx, jsid id)
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -118,28 +118,27 @@ Bindings::initWithTemporaryStorage(JSCon
         /* The caller ensures no duplicate aliased names. */
         JS_ASSERT(!added.has(bi->name()));
         if (!added.put(bi->name()))
             return false;
 #endif
 
         StackBaseShape base(&CallClass, cx->global(), BaseShape::VAROBJ | BaseShape::DELEGATE);
 
-        UnrootedUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
+        RawUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
             return false;
 
         RootedId id(cx, NameToId(bi->name()));
         unsigned attrs = JSPROP_PERMANENT | JSPROP_ENUMERATE |
                          (bi->kind() == CONSTANT ? JSPROP_READONLY : 0);
         unsigned frameIndex = bi.frameIndex();
         StackShape child(nbase, id, slot++, 0, attrs, Shape::HAS_SHORTID, frameIndex);
-        DropUnrooted(nbase);
-
-        UnrootedShape shape = self->callObjShape_->getChildBinding(cx, child);
+
+        RawShape shape = self->callObjShape_->getChildBinding(cx, child);
         if (!shape)
             return false;
 
         self->callObjShape_ = shape;
     }
     JS_ASSERT(!bi);
 
     return true;
@@ -861,17 +860,17 @@ JSScript::initScriptCounts(JSContext *cx
     /* Enable interrupts in any interpreter frames running on this script. */
     InterpreterFrames *frames;
     for (frames = cx->runtime->interpreterFrames; frames; frames = frames->older)
         frames->enableInterruptsIfRunning(this);
 
     return true;
 }
 
-static inline ScriptCountsMap::Ptr GetScriptCountsMapEntry(UnrootedScript script)
+static inline ScriptCountsMap::Ptr GetScriptCountsMapEntry(RawScript script)
 {
     JS_ASSERT(script->hasScriptCounts);
     ScriptCountsMap *map = script->compartment()->scriptCountsMap;
     ScriptCountsMap::Ptr p = map->lookup(script);
     JS_ASSERT(p);
     return p;
 }
 
@@ -1688,24 +1687,24 @@ ScriptDataSize(uint32_t nbindings, uint3
         size += sizeof(ObjectArray) + nregexps * sizeof(JSObject *);
     if (ntrynotes != 0)
         size += sizeof(TryNoteArray) + ntrynotes * sizeof(JSTryNote);
 
     size += nbindings * sizeof(Binding);
     return size;
 }
 
-UnrootedScript
+RawScript
 JSScript::Create(JSContext *cx, HandleObject enclosingScope, bool savedCallerFun,
                  const CompileOptions &options, unsigned staticLevel,
                  ScriptSource *ss, uint32_t bufStart, uint32_t bufEnd)
 {
     RootedScript script(cx, js_NewGCScript(cx));
     if (!script)
-        return UnrootedScript(NULL);
+        return NULL;
 
     PodZero(script.get());
     new (&script->bindings) Bindings;
 
     script->enclosingScopeOrOriginalFunction_ = enclosingScope;
     script->savedCallerFun = savedCallerFun;
 
     /* Establish invariant: principals implies originPrincipals. */
@@ -1726,17 +1725,17 @@ JSScript::Create(JSContext *cx, HandleOb
     JS_ASSERT(script->getVersion() == options.version);     // assert that no overflow occurred
 
     // This is an unsigned-to-uint16_t conversion, test for too-high values.
     // In practice, recursion in Parser and/or BytecodeEmitter will blow the
     // stack if we nest functions more than a few hundred deep, so this will
     // never trigger.  Oh well.
     if (staticLevel > UINT16_MAX) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_TOO_DEEP, js_function_str);
-        return UnrootedScript(NULL);
+        return NULL;
     }
     script->staticLevel = uint16_t(staticLevel);
 
     script->setScriptSource(ss);
     script->sourceStart = bufStart;
     script->sourceEnd = bufEnd;
     script->userBit = options.userBit;
 
@@ -2274,56 +2273,56 @@ js::CurrentScriptFileLineOriginSlow(JSCo
 
     if (iter.done()) {
         *file = NULL;
         *linenop = 0;
         *origin = NULL;
         return;
     }
 
-    UnrootedScript script = iter.script();
+    RawScript script = iter.script();
     *file = script->filename;
     *linenop = PCToLineNumber(iter.script(), iter.pc());
     *origin = script->originPrincipals;
 }
 
 template <class T>
 static inline T *
 Rebase(RawScript dst, RawScript src, T *srcp)
 {
     size_t off = reinterpret_cast<uint8_t *>(srcp) - src->data;
     return reinterpret_cast<T *>(dst->data + off);
 }
 
-UnrootedScript
+RawScript
 js::CloneScript(JSContext *cx, HandleObject enclosingScope, HandleFunction fun, HandleScript src)
 {
     AssertCanGC();
 
     /* NB: Keep this in sync with XDRScript. */
 
     uint32_t nconsts   = src->hasConsts()   ? src->consts()->length   : 0;
     uint32_t nobjects  = src->hasObjects()  ? src->objects()->length  : 0;
     uint32_t nregexps  = src->hasRegexps()  ? src->regexps()->length  : 0;
     uint32_t ntrynotes = src->hasTrynotes() ? src->trynotes()->length : 0;
 
     /* Script data */
 
     size_t size = src->dataSize;
     uint8_t *data = AllocScriptData(cx, size);
     if (!data)
-        return UnrootedScript(NULL);
+        return NULL;
 
     /* Bindings */
 
     Rooted<Bindings> bindings(cx);
     InternalHandle<Bindings*> bindingsHandle =
         InternalHandle<Bindings*>::fromMarkedLocation(bindings.address());
     if (!Bindings::clone(cx, bindingsHandle, data, src))
-        return UnrootedScript(NULL);
+        return NULL;
 
     /* Objects */
 
     AutoObjectVector objects(cx);
     if (nobjects != 0) {
         HeapPtrObject *vector = src->objects()->vector;
         for (unsigned i = 0; i < nobjects; i++) {
             RootedObject obj(cx, vector[i]);
@@ -2354,29 +2353,29 @@ js::CloneScript(JSContext *cx, HandleObj
                  * Clone object literals emitted for the JSOP_NEWOBJECT opcode. We only emit that
                  * instead of the less-optimized JSOP_NEWINIT for self-hosted code or code compiled
                  * with JSOPTION_COMPILE_N_GO set. As we don't clone the latter type of code, this
                  * case should only ever be hit when cloning objects from self-hosted code.
                  */
                 clone = CloneObjectLiteral(cx, cx->global(), obj);
             }
             if (!clone || !objects.append(clone))
-                return UnrootedScript(NULL);
+                return NULL;
         }
     }
 
     /* RegExps */
 
     AutoObjectVector regexps(cx);
     for (unsigned i = 0; i < nregexps; i++) {
         HeapPtrObject *vector = src->regexps()->vector;
         for (unsigned i = 0; i < nregexps; i++) {
             RawObject clone = CloneScriptRegExpObject(cx, vector[i]->asRegExp());
             if (!clone || !regexps.append(clone))
-                return UnrootedScript(NULL);
+                return NULL;
         }
     }
 
     /* Now that all fallible allocation is complete, create the GC thing. */
 
     CompileOptions options(cx);
     options.setPrincipals(cx->compartment->principals)
            .setOriginPrincipals(src->originPrincipals)
@@ -2384,17 +2383,17 @@ js::CloneScript(JSContext *cx, HandleObj
            .setNoScriptRval(src->noScriptRval)
            .setVersion(src->getVersion())
            .setUserBit(src->userBit);
     RootedScript dst(cx, JSScript::Create(cx, enclosingScope, src->savedCallerFun,
                                           options, src->staticLevel,
                                           src->scriptSource(), src->sourceStart, src->sourceEnd));
     if (!dst) {
         js_free(data);
-        return UnrootedScript(NULL);
+        return NULL;
     }
     AutoAssertNoGC nogc;
 
     dst->bindings = bindings;
 
     /* This assignment must occur before all the Rebase calls. */
     dst->data = data;
     dst->dataSize = size;
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -186,17 +186,17 @@ class Bindings
     static bool clone(JSContext *cx, InternalBindingsHandle self, uint8_t *dstScriptData,
                       HandleScript srcScript);
 
     unsigned numArgs() const { return numArgs_; }
     unsigned numVars() const { return numVars_; }
     unsigned count() const { return numArgs() + numVars(); }
 
     /* Return the initial shape of call objects created for this scope. */
-    UnrootedShape callObjShape() const { return callObjShape_.get(); }
+    RawShape callObjShape() const { return callObjShape_; }
 
     /* Convenience method to get the var index of 'arguments'. */
     static unsigned argumentsVarIndex(JSContext *cx, InternalBindingsHandle);
 
     /* Return whether the binding at bindingIndex is aliased. */
     bool bindingIsAliased(unsigned bindingIndex);
 
     /* Return whether this scope has any aliased bindings. */
@@ -521,19 +521,19 @@ class JSScript : public js::gc::Cell
     bool            needsArgsAnalysis_:1;
     bool            needsArgsObj_:1;
 
     //
     // End of fields.  Start methods.
     //
 
   public:
-    static js::UnrootedScript Create(JSContext *cx, js::HandleObject enclosingScope, bool savedCallerFun,
-                                    const JS::CompileOptions &options, unsigned staticLevel,
-                                    js::ScriptSource *ss, uint32_t sourceStart, uint32_t sourceEnd);
+    static js::RawScript Create(JSContext *cx, js::HandleObject enclosingScope, bool savedCallerFun,
+                                const JS::CompileOptions &options, unsigned staticLevel,
+                                js::ScriptSource *ss, uint32_t sourceStart, uint32_t sourceEnd);
 
     // Three ways ways to initialize a JSScript. Callers of partiallyInit()
     // and fullyInitTrivial() are responsible for notifying the debugger after
     // successfully creating any kind (function or other) of new JSScript.
     // However, callers of fullyInitFromEmitter() do not need to do this.
     static bool partiallyInit(JSContext *cx, JS::Handle<JSScript*> script,
                               uint32_t nobjects, uint32_t nregexps,
                               uint32_t ntrynotes, uint32_t nconsts, uint32_t nTypeSets);
@@ -786,17 +786,17 @@ class JSScript : public js::gc::Cell
 
     uint32_t numNotes();  /* Number of srcnote slots in the srcnotes section */
 
     /* Script notes are allocated right after the code. */
     jssrcnote *notes() { return (jssrcnote *)(code + length); }
 
     bool hasArray(ArrayKind kind)           { return (hasArrayBits & (1 << kind)); }
     void setHasArray(ArrayKind kind)        { hasArrayBits |= (1 << kind); }
-    void cloneHasArray(js::UnrootedScript script) { hasArrayBits = script->hasArrayBits; }
+    void cloneHasArray(js::RawScript script) { hasArrayBits = script->hasArrayBits; }
 
     bool hasConsts()        { return hasArray(CONSTS);      }
     bool hasObjects()       { return hasArray(OBJECTS);     }
     bool hasRegexps()       { return hasArray(REGEXPS);     }
     bool hasTrynotes()      { return hasArray(TRYNOTES);    }
 
     #define OFF(fooOff, hasFoo, t)   (fooOff() + (hasFoo() ? sizeof(t) : 0))
 
@@ -935,18 +935,18 @@ class JSScript : public js::gc::Cell
     bool stepModeEnabled() { return hasDebugScript && !!debugScript()->stepMode; }
 
 #ifdef DEBUG
     uint32_t stepModeCount() { return hasDebugScript ? (debugScript()->stepMode & stepCountMask) : 0; }
 #endif
 
     void finalize(js::FreeOp *fop);
 
-    static inline void writeBarrierPre(js::UnrootedScript script);
-    static inline void writeBarrierPost(js::UnrootedScript script, void *addr);
+    static inline void writeBarrierPre(js::RawScript script);
+    static inline void writeBarrierPost(js::RawScript script, void *addr);
 
     static inline js::ThingRootKind rootKind() { return js::THING_ROOT_SCRIPT; }
 
     static JSPrincipals *normalizeOriginPrincipals(JSPrincipals *principals,
                                                    JSPrincipals *originPrincipals) {
         return originPrincipals ? originPrincipals : principals;
     }
 
@@ -1012,17 +1012,17 @@ class AliasedFormalIter
     unsigned slot_;
 
     void settle() {
         while (p_ != end_ && !p_->aliased())
             p_++;
     }
 
   public:
-    explicit inline AliasedFormalIter(js::UnrootedScript script);
+    explicit inline AliasedFormalIter(js::RawScript script);
 
     bool done() const { return p_ == end_; }
     operator bool() const { return !done(); }
     void operator++(int) { JS_ASSERT(!done()); p_++; slot_++; settle(); }
 
     const Binding &operator*() const { JS_ASSERT(!done()); return *p_; }
     const Binding *operator->() const { JS_ASSERT(!done()); return p_; }
     unsigned frameIndex() const { JS_ASSERT(!done()); return p_ - begin_; }
@@ -1370,17 +1370,17 @@ CurrentLine(JSContext *cx);
 enum LineOption {
     CALLED_FROM_JSOP_EVAL,
     NOT_CALLED_FROM_JSOP_EVAL
 };
 
 inline void
 CurrentScriptFileLineOrigin(JSContext *cx, unsigned *linenop, LineOption = NOT_CALLED_FROM_JSOP_EVAL);
 
-extern UnrootedScript
+extern RawScript
 CloneScript(JSContext *cx, HandleObject enclosingScope, HandleFunction fun, HandleScript script);
 
 bool
 CloneFunctionScript(JSContext *cx, HandleFunction original, HandleFunction clone);
 
 /*
  * NB: after a successful XDR_DECODE, XDRScript callers must do any required
  * subsequent set-up of owning function or script object and then call
--- a/js/src/jsscriptinlines.h
+++ b/js/src/jsscriptinlines.h
@@ -23,17 +23,17 @@
 namespace js {
 
 inline
 Bindings::Bindings()
     : callObjShape_(NULL), bindingArrayAndFlag_(TEMPORARY_STORAGE_BIT), numArgs_(0), numVars_(0)
 {}
 
 inline
-AliasedFormalIter::AliasedFormalIter(js::UnrootedScript script)
+AliasedFormalIter::AliasedFormalIter(js::RawScript script)
   : begin_(script->bindings.bindingArray()),
     p_(begin_),
     end_(begin_ + (script->funHasAnyAliasedFormal ? script->bindings.numArgs() : 0)),
     slot_(CallObject::RESERVED_SLOTS)
 {
     settle();
 }
 
@@ -174,34 +174,34 @@ inline void
 JSScript::destroyMJITInfo(js::FreeOp *fop)
 {
     fop->delete_(mJITInfo);
     mJITInfo = NULL;
 }
 #endif /* JS_METHODJIT */
 
 inline void
-JSScript::writeBarrierPre(js::UnrootedScript script)
+JSScript::writeBarrierPre(js::RawScript script)
 {
 #ifdef JSGC_INCREMENTAL
     if (!script)
         return;
 
     JS::Zone *zone = script->zone();
     if (zone->needsBarrier()) {
         JS_ASSERT(!zone->rt->isHeapBusy());
-        js::UnrootedScript tmp = script;
+        js::RawScript tmp = script;
         MarkScriptUnbarriered(zone->barrierTracer(), &tmp, "write barrier");
         JS_ASSERT(tmp == script);
     }
 #endif
 }
 
 inline void
-JSScript::writeBarrierPost(js::UnrootedScript script, void *addr)
+JSScript::writeBarrierPost(js::RawScript script, void *addr)
 {
 }
 
 inline JSPrincipals *
 JSScript::principals()
 {
     return compartment()->principals;
 }
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -2621,17 +2621,17 @@ LambdaIsGetElem(JSObject &lambda)
 
     if (!lambda.isFunction())
         return NULL;
 
     JSFunction *fun = lambda.toFunction();
     if (!fun->hasScript())
         return NULL;
 
-    UnrootedScript script = fun->nonLazyScript();
+    RawScript script = fun->nonLazyScript();
     jsbytecode *pc = script->code;
 
     /*
      * JSOP_GETALIASEDVAR tells us exactly where to find the base object 'b'.
      * Rule out the (unlikely) possibility of a heavyweight function since it
      * would make our scope walk off by 1.
      */
     if (JSOp(*pc) != JSOP_GETALIASEDVAR || fun->isHeavyweight())
@@ -3488,17 +3488,17 @@ js::str_fromCharCode(JSContext *cx, unsi
     return JS_TRUE;
 }
 
 static JSFunctionSpec string_static_methods[] = {
     JS_FN("fromCharCode", js::str_fromCharCode, 1, 0),
     JS_FS_END
 };
 
-UnrootedShape
+RawShape
 StringObject::assignInitialShape(JSContext *cx)
 {
     JS_ASSERT(nativeEmpty());
 
     return addDataProperty(cx, cx->names().length, LENGTH_SLOT,
                            JSPROP_PERMANENT | JSPROP_READONLY);
 }
 
@@ -4242,17 +4242,17 @@ const bool js_isspace[] = {
 
 #undef ____
 
 #define URI_CHUNK 64U
 
 static inline bool
 TransferBufferToString(StringBuffer &sb, MutableHandleValue rval)
 {
-    UnrootedString str = sb.finishString();
+    RawString str = sb.finishString();
     if (!str)
         return false;
     rval.setString(str);
     return true;
 }
 
 /*
  * ECMA 3, 15.1.3 URI Handling Function Properties
--- a/js/src/jswatchpoint.cpp
+++ b/js/src/jswatchpoint.cpp
@@ -131,17 +131,17 @@ WatchpointMap::triggerWatchpoint(JSConte
     /* Copy the entry, since GC would invalidate p. */
     JSWatchPointHandler handler = p->value.handler;
     RootedObject closure(cx, p->value.closure);
 
     /* Determine the property's old value. */
     Value old;
     old.setUndefined();
     if (obj->isNative()) {
-        if (UnrootedShape shape = obj->nativeLookup(cx, id)) {
+        if (RawShape shape = obj->nativeLookup(cx, id)) {
             if (shape->hasSlot())
                 old = obj->nativeGetSlot(shape->slot());
         }
     }
 
     // Read barrier to prevent an incorrectly gray closure from escaping the
     // watchpoint. See the comment before UnmarkGrayChildren in gc/Marking.cpp
     ExposeGCThingToActiveJS(closure, JSTRACE_OBJECT);
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -195,17 +195,17 @@ static const JSC::MacroAssembler::Regist
     void loadPtrFromImm(void *ptr, RegisterID reg) {
         loadPtr(ptr, reg);
     }
 
     void loadShape(RegisterID obj, RegisterID shape) {
         loadPtr(Address(obj, JSObject::offsetOfShape()), shape);
     }
 
-    Jump guardShape(RegisterID objReg, UnrootedShape shape) {
+    Jump guardShape(RegisterID objReg, RawShape shape) {
         return branchPtr(NotEqual, Address(objReg, JSObject::offsetOfShape()), ImmPtr(shape));
     }
 
     Jump guardShape(RegisterID objReg, JSObject *obj) {
         return guardShape(objReg, obj->lastProperty());
     }
 
     /*
@@ -979,17 +979,17 @@ static const JSC::MacroAssembler::Regist
 
     void loadDynamicSlot(RegisterID objReg, uint32_t index,
                          RegisterID typeReg, RegisterID dataReg) {
         loadPtr(Address(objReg, JSObject::offsetOfSlots()), dataReg);
         loadValueAsComponents(Address(dataReg, index * sizeof(Value)), typeReg, dataReg);
     }
 
     void loadObjProp(JSObject *obj, RegisterID objReg,
-                     js::UnrootedShape shape,
+                     js::RawShape shape,
                      RegisterID typeReg, RegisterID dataReg)
     {
         if (obj->isFixedSlot(shape->slot()))
             loadInlineSlot(objReg, shape->slot(), typeReg, dataReg);
         else
             loadDynamicSlot(objReg, obj->dynamicSlotIndex(shape->slot()), typeReg, dataReg);
     }
 
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -6094,17 +6094,17 @@ mjit::Compiler::jsop_aliasedArg(unsigned
 void
 mjit::Compiler::jsop_aliasedVar(ScopeCoordinate sc, bool get, bool poppedAfter)
 {
     RegisterID reg = frame.allocReg(Registers::SavedRegs).reg();
     masm.loadPtr(Address(JSFrameReg, StackFrame::offsetOfScopeChain()), reg);
     for (unsigned i = 0; i < sc.hops; i++)
         masm.loadPayload(Address(reg, ScopeObject::offsetOfEnclosingScope()), reg);
 
-    UnrootedShape shape = ScopeCoordinateToStaticScopeShape(cx, script_, PC);
+    RawShape shape = ScopeCoordinateToStaticScopeShape(cx, script_, PC);
     Address addr;
     if (shape->numFixedSlots() <= sc.slot) {
         masm.loadPtr(Address(reg, JSObject::offsetOfSlots()), reg);
         addr = Address(reg, (sc.slot - shape->numFixedSlots()) * sizeof(Value));
     } else {
         addr = Address(reg, JSObject::getFixedSlotOffset(sc.slot));
     }
 
@@ -6551,19 +6551,19 @@ mjit::Compiler::jsop_getgname(uint32_t i
             return false;
 
         /*
          * If we are accessing a defined global which is a normal data property
          * then bake its address into the jitcode and guard against future
          * reallocation of the global object's slots.
          */
         RootedId id(cx, NameToId(name));
-        UnrootedShape shape = globalObj->nativeLookup(cx, id);
+        RawShape shape = globalObj->nativeLookup(cx, id);
         if (shape && shape->hasDefaultGetter() && shape->hasSlot()) {
-            HeapSlot *value = &globalObj->getSlotRef(DropUnrooted(shape)->slot());
+            HeapSlot *value = &globalObj->getSlotRef(shape->slot());
             if (!value->isUndefined() && !propertyTypes->isOwnProperty(cx, globalType, true)) {
                 if (!watchGlobalReallocation())
                     return false;
                 RegisterID reg = frame.allocReg();
                 masm.move(ImmPtr(value), reg);
 
                 BarrierState barrier = pushAddressMaybeBarrier(Address(reg), type, true);
                 finishBarrier(barrier, REJOIN_GETTER, 0);
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -1469,17 +1469,17 @@ mjit::Compiler::jsop_setelem(bool popGua
     ic.fastPathStart = masm.label();
 
     // Create the common out-of-line sync block, taking care to link previous
     // guards here after.
     RESERVE_OOL_SPACE(stubcc.masm);
     ic.slowPathStart = stubcc.syncExit(Uses(3));
 
     // Guard obj is a dense array.
-    UnrootedShape shape = GetDenseArrayShape(cx, globalObj);
+    RawShape shape = GetDenseArrayShape(cx, globalObj);
     if (!shape)
         return false;
     ic.shapeGuard = masm.guardShape(ic.objReg, shape);
     stubcc.linkExitDirect(ic.shapeGuard, ic.slowPathStart);
 
     // Load the dynamic elements vector.
     masm.loadPtr(Address(ic.objReg, JSObject::offsetOfElements()), ic.objReg);
 
@@ -2049,17 +2049,17 @@ mjit::Compiler::jsop_getelem()
     if (id->mightBeType(JSVAL_TYPE_INT32)) {
         // Always test the type first (see comment in PolyIC.h).
         if (!id->isTypeKnown()) {
             ic.typeGuard = masm.testInt32(Assembler::NotEqual, ic.typeReg);
             stubcc.linkExitDirect(ic.typeGuard.get(), ic.slowPathStart);
         }
 
         // Guard obj is a dense array.
-        UnrootedShape shape = GetDenseArrayShape(cx, globalObj);
+        RawShape shape = GetDenseArrayShape(cx, globalObj);
         if (!shape)
             return false;
         ic.shapeGuard = masm.guardShape(ic.objReg, shape);
         stubcc.linkExitDirect(ic.shapeGuard, ic.slowPathStart);
 
         Int32Key key = id->isConstant()
                        ? Int32Key::FromConstant(id->getValue().toInt32())
                        : Int32Key::FromRegister(ic.id.dataReg());
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1398,22 +1398,22 @@ GetPIC(JSContext *cx, JSScript *script, 
     for (uint32_t i = 0; i < chunk->nPICs; i++) {
         if (pics[i].pc == pc)
             return &pics[i];
     }
 
     return NULL;
 }
 
-UnrootedShape
+RawShape
 mjit::GetPICSingleShape(JSContext *cx, JSScript *script, jsbytecode *pc, bool constructing)
 {
     ic::PICInfo *pic = GetPIC(cx, script, pc, constructing);
     if (!pic)
-        return UnrootedShape(NULL);
+        return NULL;
     return pic->getSingleShape();
 }
 
 void
 JITScript::purgeCaches()
 {
     for (unsigned i = 0; i < nchunks; i++) {
         ChunkDescriptor &desc = chunkDescriptor(i);
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -1030,17 +1030,17 @@ IsLowerableFunCallOrApply(jsbytecode *pc
 #ifdef JS_MONOIC
     return (*pc == JSOP_FUNCALL && GET_ARGC(pc) >= 1) ||
            (*pc == JSOP_FUNAPPLY && GET_ARGC(pc) == 2);
 #else
     return false;
 #endif
 }
 
-UnrootedShape
+RawShape
 GetPICSingleShape(JSContext *cx, JSScript *script, jsbytecode *pc, bool constructing);
 
 static inline void
 PurgeCaches(JSScript *script)
 {
     for (int constructing = 0; constructing <= 1; constructing++) {
         for (int barriers = 0; barriers <= 1; barriers++) {
             mjit::JITScript *jit = script->getJIT((bool) constructing, (bool) barriers);
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -114,24 +114,24 @@ PatchSetFallback(VMFrame &f, ic::SetGlob
 {
     Repatcher repatch(f.chunk());
     VoidStubSetGlobal stub = DisabledSetGlobal;
     JSC::FunctionPtr fptr(JS_FUNC_TO_DATA_PTR(void *, stub));
     repatch.relink(ic->slowPathCall, fptr);
 }
 
 void
-SetGlobalNameIC::patchInlineShapeGuard(Repatcher &repatcher, UnrootedShape shape)
+SetGlobalNameIC::patchInlineShapeGuard(Repatcher &repatcher, RawShape shape)
 {
     JSC::CodeLocationDataLabelPtr label = fastPathStart.dataLabelPtrAtOffset(shapeOffset);
     repatcher.repatch(label, shape);
 }
 
 static LookupStatus
-UpdateSetGlobalName(VMFrame &f, ic::SetGlobalNameIC *ic, JSObject *obj, UnrootedShape shape)
+UpdateSetGlobalName(VMFrame &f, ic::SetGlobalNameIC *ic, JSObject *obj, RawShape shape)
 {
     /* Give globals a chance to appear. */
     if (!shape)
         return Lookup_Uncacheable;
 
     if (!shape->hasDefaultSetter() ||
         !shape->writable() ||
         !shape->hasSlot() ||
@@ -161,17 +161,17 @@ ic::SetGlobalName(VMFrame &f, ic::SetGlo
 
     RootedObject obj(f.cx, &f.fp()->global());
     RootedPropertyName name(f.cx, f.script()->getName(GET_UINT32_INDEX(f.pc())));
 
     RecompilationMonitor monitor(f.cx);
 
     {
         RootedId id(f.cx, NameToId(name));
-        UnrootedShape shape = obj->nativeLookup(f.cx, id);
+        RawShape shape = obj->nativeLookup(f.cx, id);
 
         if (!monitor.recompiled()) {
             LookupStatus status = UpdateSetGlobalName(f, ic, obj, shape);
             if (status == Lookup_Error)
                 THROW();
         }
     }
 
@@ -1317,17 +1317,17 @@ class CallCompiler : public BaseCompiler
                 if (!generateIonStub())
                     THROWV(NULL);
             }
 #endif
             return NULL;
         }
 
         JS_ASSERT(fun);
-        UnrootedScript script = fun->nonLazyScript();
+        RawScript script = fun->nonLazyScript();
         JS_ASSERT(script);
 
         uint32_t flags = callingNew ? StackFrame::CONSTRUCTING : 0;
 
         if (!ic.hit) {
             ic.hit = true;
             return ucr.codeAddr;
         }
@@ -1498,17 +1498,17 @@ void
 ic::GenerateArgumentCheckStub(VMFrame &f)
 {
     AutoAssertNoGC nogc;
     JS_ASSERT(f.cx->typeInferenceEnabled());
 
     JITScript *jit = f.jit();
     StackFrame *fp = f.fp();
     JSFunction *fun = fp->fun();
-    UnrootedScript script = fun->nonLazyScript();
+    RawScript script = fun->nonLazyScript();
 
     if (jit->argsCheckPool)
         jit->resetArgsCheck();
 
     Assembler masm;
     Vector<Jump> mismatches(f.cx);
 
     if (!f.fp()->isConstructing()) {
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -111,17 +111,17 @@ struct SetGlobalNameIC : public GlobalNa
     RegisterID objReg   : 5;    /* Register for object, if objConst is false. */
     RegisterID shapeReg : 5;    /* Register for shape; volatile. */
 
     int32_t fastRejoinOffset : 16;  /* Offset from fastPathStart to rejoin. */
 
     /* SET only. */
     ValueRemat vr;              /* RHS value. */
 
-    void patchInlineShapeGuard(Repatcher &repatcher, UnrootedShape shape);
+    void patchInlineShapeGuard(Repatcher &repatcher, RawShape shape);
 };
 
 void JS_FASTCALL GetGlobalName(VMFrame &f, ic::GetGlobalNameIC *ic);
 void JS_FASTCALL SetGlobalName(VMFrame &f, ic::SetGlobalNameIC *ic);
 
 struct EqualityICInfo {
     typedef JSC::MacroAssembler::RegisterID RegisterID;
 
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -188,17 +188,17 @@ class SetPropCompiler : public PICStubCo
                           NULL);
         repatcher.relink(labels.getInlineShapeJump(pic.fastPathStart.labelAtOffset(pic.shapeGuard)),
                          pic.slowPathStart);
 
         FunctionPtr target(JS_FUNC_TO_DATA_PTR(void *, ic::SetPropOrName));
         repatcher.relink(pic.slowPathCall, target);
     }
 
-    LookupStatus patchInline(UnrootedShape shape)
+    LookupStatus patchInline(RawShape shape)
     {
         JS_ASSERT(!pic.inlinePathPatched);
         JaegerSpew(JSpew_PICs, "patch setprop inline at %p\n", pic.fastPathStart.executableAddress());
 
         Repatcher repatcher(f.chunk());
         SetPropLabels &labels = pic.setPropLabels();
 
         int32_t offset;
@@ -765,17 +765,17 @@ struct GetPropHelper {
         return testForGet();
     }
 };
 
 namespace js {
 namespace mjit {
 
 inline void
-MarkNotIdempotent(UnrootedScript script, jsbytecode *pc)
+MarkNotIdempotent(RawScript script, jsbytecode *pc)
 {
     if (!script->hasAnalysis())
         return;
     analyze::Bytecode *code = script->analysis()->maybeCode(pc);
     if (!code)
         return;
     code->notIdempotent = true;
 }
@@ -1009,17 +1009,17 @@ class GetPropCompiler : public PICStubCo
             repatcher.relink(pic.getPropLabels().getInlineTypeJump(pic.fastPathStart), start);
         }
 
         disable("generated string length stub");
 
         return Lookup_Cacheable;
     }
 
-    LookupStatus patchInline(JSObject *holder, UnrootedShape shape)
+    LookupStatus patchInline(JSObject *holder, RawShape shape)
     {
         spew("patch", "inline");
         Repatcher repatcher(f.chunk());
         GetPropLabels &labels = pic.getPropLabels();
 
         int32_t offset;
         if (holder->isFixedSlot(shape->slot())) {
             CodeLocationInstruction istr = labels.getDslotsLoad(pic.fastPathRejoin);
@@ -1044,17 +1044,17 @@ class GetPropCompiler : public PICStubCo
         repatcher.patchAddressOffsetForValueLoad(labels.getValueLoad(pic.fastPathRejoin), offset);
 
         pic.inlinePathPatched = true;
 
         return Lookup_Cacheable;
     }
 
     /* For JSPropertyOp getters. */
-    void generateGetterStub(Assembler &masm, UnrootedShape shape, jsid userid,
+    void generateGetterStub(Assembler &masm, RawShape shape, jsid userid,
                             Label start, Vector<Jump, 8> &shapeMismatches)
     {
         AutoAssertNoGC nogc;
 
         /*
          * Getter hook needs to be called from the stub. The state is fully
          * synced and no registers are live except the result registers.
          */
@@ -1156,17 +1156,17 @@ class GetPropCompiler : public PICStubCo
         }
 
         linker.patchJump(pic.fastPathRejoin);
 
         linkerEpilogue(linker, start, shapeMismatches);
     }
 
     /* For getters backed by a JSNative. */
-    void generateNativeGetterStub(Assembler &masm, UnrootedShape shape,
+    void generateNativeGetterStub(Assembler &masm, RawShape shape,
                                   Label start, Vector<Jump, 8> &shapeMismatches)
     {
         AutoAssertNoGC nogc;
 
         /*
          * Getter hook needs to be called from the stub. The state is fully
          * synced and no registers are live except the result registers.
          */
@@ -1675,17 +1675,17 @@ class ScopeNameCompiler : public PICStub
 
         /* For GETXPROP, the object is already in objReg. */
         if (pic.kind == ic::PICInfo::NAME)
             masm.loadPtr(Address(JSFrameReg, StackFrame::offsetOfScopeChain()), pic.objReg);
 
         JS_ASSERT(obj == getprop.holder);
         JS_ASSERT(getprop.holder != &scopeChain->global());
 
-        UnrootedShape shape = getprop.shape;
+        RawShape shape = getprop.shape;
         if (!shape->hasDefaultGetter())
             return disable("unhandled callobj sprop getter");
 
         LookupStatus status = walkScopeChain(masm, fails);
         if (status != Lookup_Cacheable)
             return status;
 
         /* If a scope chain walk was required, the final object needs a NULL test. */
@@ -2191,17 +2191,17 @@ frameCountersOffset(VMFrame &f)
         offset += cx->fp()->script()->length;
         uint32_t index = cx->regs().inlined()->inlineIndex;
         InlineFrame *frames = f.chunk()->inlineFrames();
         for (unsigned i = 0; i < index; i++)
             offset += frames[i].fun->nonLazyScript()->length;
     }
 
     jsbytecode *pc;
-    UnrootedScript script = cx->stack.currentScript(&pc);
+    RawScript script = cx->stack.currentScript(&pc);
     offset += pc - script->code;
 
     return offset;
 }
 
 LookupStatus
 BaseIC::disable(VMFrame &f, const char *reason, void *stub)
 {
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -483,24 +483,24 @@ struct PICInfo : public BasePolyIC {
     PropertyName *name;
 
   private:
     Shape *inlinePathShape_;
 
   public:
     void purge(Repatcher &repatcher);
 
-    void setInlinePathShape(UnrootedShape shape) {
+    void setInlinePathShape(RawShape shape) {
         JS_ASSERT(!inlinePathShape_);
         inlinePathShape_ = shape;
     }
 
-    UnrootedShape getSingleShape() {
+    RawShape getSingleShape() {
         if (disabled || hadUncacheable || stubsGenerated > 0)
-            return UnrootedShape(NULL);
+            return NULL;
         return inlinePathShape_;
     }
 
   protected:
     // Reset the data members to the state of a fresh PIC before any patching
     // or stub generation was done.
     void reset() {
         BasePolyIC::reset();
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -1554,17 +1554,17 @@ stubs::CheckArgumentTypes(VMFrame &f)
 
 #ifdef DEBUG
 void JS_FASTCALL
 stubs::AssertArgumentTypes(VMFrame &f)
 {
     AutoAssertNoGC nogc;
     StackFrame *fp = f.fp();
     JSFunction *fun = fp->fun();
-    UnrootedScript script = fun->nonLazyScript();
+    RawScript script = fun->nonLazyScript();
 
     /*
      * Don't check the type of 'this' for constructor frames, the 'this' value
      * has not been constructed yet.
      */
     if (!fp->isConstructing()) {
         Type type = GetValueType(f.cx, fp->thisValue());
         if (!TypeScript::ThisTypes(script)->hasType(type))
@@ -1599,17 +1599,17 @@ stubs::InvariantFailure(VMFrame &f, void
      * recompilation we will return to the call's rejoin point.
      */
     void *repatchCode = f.scratch;
     JS_ASSERT(repatchCode);
     void **frameAddr = f.returnAddressLocation();
     *frameAddr = repatchCode;
 
     /* Recompile the outermost script, and don't hoist any bounds checks. */
-    UnrootedScript script = f.fp()->script();
+    RawScript script = f.fp()->script();
     JS_ASSERT(!script->failedBoundsCheck);
     script->failedBoundsCheck = true;
 
     ExpandInlineFrames(f.cx->compartment);
 
     mjit::Recompiler::clearStackReferences(f.cx->runtime->defaultFreeOp(), script);
     mjit::ReleaseScriptCode(f.cx->runtime->defaultFreeOp(), script);
 
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1310,22 +1310,22 @@ AssertEq(JSContext *cx, unsigned argc, j
                                  actual, expected, bytes2.ptr());
         }
         return false;
     }
     JS_SET_RVAL(cx, vp, UndefinedValue());
     return true;
 }
 
-static UnrootedScript
+static RawScript
 ValueToScript(JSContext *cx, jsval v, JSFunction **funp = NULL)
 {
     RootedFunction fun(cx, JS_ValueToFunction(cx, v));
     if (!fun)
-        return UnrootedScript(NULL);
+        return NULL;
 
     RootedScript script(cx);
     JSFunction::maybeGetOrCreateScript(cx, fun, &script);
     if (!script)
         JS_ReportErrorNumber(cx, my_GetErrorMessage, NULL, JSSMSG_SCRIPTS_ONLY);
 
     if (fun && funp)
         *funp = fun;
@@ -1351,17 +1351,17 @@ SetDebug(JSContext *cx, unsigned argc, j
      */
 
     bool ok = !!JS_SetDebugMode(cx, JSVAL_TO_BOOLEAN(argv[0]));
     if (ok)
         JS_SET_RVAL(cx, vp, BooleanValue(true));
     return ok;
 }
 
-static UnrootedScript
+static RawScript
 GetTopScript(JSContext *cx)
 {
     RootedScript script(cx);
     JS_DescribeScriptedCaller(cx, script.address(), NULL);
     return script;
 }
 
 static JSBool
--- a/js/src/vm/ArgumentsObject.cpp
+++ b/js/src/vm/ArgumentsObject.cpp
@@ -43,17 +43,17 @@ CopyStackFrameArguments(const AbstractFr
         while (src != end)
             (dst++)->init(*src++);
     }
 }
 
 /* static */ void
 ArgumentsObject::MaybeForwardToCallObject(AbstractFramePtr frame, JSObject *obj, ArgumentsData *data)
 {
-    UnrootedScript script = frame.script();
+    RawScript script = frame.script();
     if (frame.fun()->isHeavyweight() && script->argsObjAliasesFormals()) {
         obj->initFixedSlot(MAYBE_CALL_SLOT, ObjectValue(frame.callObj()));
         for (AliasedFormalIter fi(script); fi; fi++)
             data->args[fi.frameIndex()] = MagicValue(JS_FORWARD_TO_CALL_OBJECT);
     }
 }
 
 struct CopyFrameArgs
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -1234,18 +1234,18 @@ Debugger::onSingleStep(JSContext *cx, Mu
      * anyway, to make sure the count has the correct non-zero value.
      *
      * The converse --- ensuring that we do receive traps when we should --- can
      * be done with unit tests.
      */
     {
         AutoAssertNoGC nogc;
         uint32_t stepperCount = 0;
-        UnrootedScript trappingScript = iter.script();
-        Unrooted<GlobalObject*> global = cx->global();
+        RawScript trappingScript = iter.script();
+        GlobalObject *global = cx->global();
         if (GlobalObject::DebuggerVector *debuggers = global->getDebuggers()) {
             for (Debugger **p = debuggers->begin(); p != debuggers->end(); p++) {
                 Debugger *dbg = *p;
                 for (FrameMap::Range r = dbg->frames.all(); !r.empty(); r.popFront()) {
                     AbstractFramePtr frame = r.front().key;
                     JSObject *frameobj = r.front().value;
                     if (frame.script() == trappingScript &&
                         !frameobj->getReservedSlot(JSSLOT_DEBUGFRAME_ONSTEP_HANDLER).isUndefined())
@@ -3734,17 +3734,17 @@ DebuggerFrame_getScript(JSContext *cx, u
     return true;
 }
 
 static JSBool
 DebuggerFrame_getOffset(JSContext *cx, unsigned argc, Value *vp)
 {
     THIS_FRAME(cx, argc, vp, "get offset", args, thisobj, iter);
     AutoAssertNoGC nogc;
-    UnrootedScript script = iter.script();
+    RawScript script = iter.script();
     iter.updatePcQuadratic();
     jsbytecode *pc = iter.pc();
     JS_ASSERT(script->code <= pc);
     JS_ASSERT(pc < script->code + script->length);
     size_t offset = pc - script->code;
     args.rval().setNumber(double(offset));
     return true;
 }
--- a/js/src/vm/ObjectImpl-inl.h
+++ b/js/src/vm/ObjectImpl-inl.h
@@ -35,23 +35,23 @@ Debug_SetSlotRangeToCrashOnTouch(HeapSlo
 {
 #ifdef DEBUG
     Debug_SetValueRangeToCrashOnTouch((Value *) begin, end - begin);
 #endif
 }
 
 } // namespace js
 
-inline js::UnrootedShape
+inline js::RawShape
 js::ObjectImpl::nativeLookup(JSContext *cx, PropertyId pid)
 {
     return nativeLookup(cx, pid.asId());
 }
 
-inline js::UnrootedShape
+inline js::RawShape
 js::ObjectImpl::nativeLookup(JSContext *cx, PropertyName *name)
 {
     return nativeLookup(cx, NameToId(name));
 }
 
 inline bool
 js::ObjectImpl::nativeContains(JSContext *cx, jsid id)
 {
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -192,18 +192,18 @@ js::ObjectImpl::checkShapeConsistency()
         if (throttle < 0)
             throttle = 0;
     }
     if (throttle == 0)
         return;
 
     MOZ_ASSERT(isNative());
 
-    UnrootedShape shape = lastProperty();
-    UnrootedShape prev = NULL;
+    RawShape shape = lastProperty();
+    RawShape prev = NULL;
 
     if (inDictionaryMode()) {
         MOZ_ASSERT(shape->hasTable());
 
         ShapeTable &table = shape->table();
         for (uint32_t fslot = table.freelist; fslot != SHAPE_INVALID_SLOT;
              fslot = getSlot(fslot).toPrivateUint32()) {
             MOZ_ASSERT(fslot < slotSpan());
@@ -285,17 +285,17 @@ js::ObjectImpl::slotInRange(uint32_t slo
 #if defined(_MSC_VER) && _MSC_VER >= 1500
 /*
  * Work around a compiler bug in MSVC9 and above, where inlining this function
  * causes stack pointer offsets to go awry and spp to refer to something higher
  * up the stack.
  */
 MOZ_NEVER_INLINE
 #endif
-UnrootedShape
+RawShape
 js::ObjectImpl::nativeLookup(JSContext *cx, jsid id)
 {
     AutoAssertNoGC nogc;
     MOZ_ASSERT(isNative());
     Shape **spp;
     return Shape::search(cx, lastProperty(), id, &spp);
 }
 
--- a/js/src/vm/ObjectImpl.h
+++ b/js/src/vm/ObjectImpl.h
@@ -445,17 +445,17 @@ class DenseElementsHeader : public Eleme
 
     DenseElementsHeader(const DenseElementsHeader &other) MOZ_DELETE;
     void operator=(const DenseElementsHeader &other) MOZ_DELETE;
 };
 
 class SparseElementsHeader : public ElementsHeader
 {
   public:
-    UnrootedShape shape() {
+    RawShape shape() {
         MOZ_ASSERT(ElementsHeader::isSparseElements());
         return sparse.shape;
     }
 
     uint32_t length() const {
         MOZ_ASSERT(ElementsHeader::isSparseElements());
         return ElementsHeader::length;
     }
@@ -1227,19 +1227,19 @@ class ObjectImpl : public gc::Cell
      */
     bool hasLazyType() const { return type_->lazy(); }
 
     inline uint32_t slotSpan() const;
 
     /* Compute dynamicSlotsCount() for this object. */
     inline uint32_t numDynamicSlots() const;
 
-    UnrootedShape nativeLookup(JSContext *cx, jsid id);
-    inline UnrootedShape nativeLookup(JSContext *cx, PropertyId pid);
-    inline UnrootedShape nativeLookup(JSContext *cx, PropertyName *name);
+    RawShape nativeLookup(JSContext *cx, jsid id);
+    inline RawShape nativeLookup(JSContext *cx, PropertyId pid);
+    inline RawShape nativeLookup(JSContext *cx, PropertyName *name);
 
     inline bool nativeContains(JSContext *cx, jsid id);
     inline bool nativeContains(JSContext *cx, PropertyName* name);
     inline bool nativeContains(JSContext *cx, Shape* shape);
 
     inline JSClass *getJSClass() const;
     inline bool hasClass(const Class *c) const;
     inline const ObjectOps *getOps() const;
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -261,45 +261,45 @@ RegExpObject::createShared(JSContext *cx
     JS_ASSERT(!maybeShared());
     if (!cx->compartment->regExps.get(cx, getSource(), getFlags(), g))
         return false;
 
     self->setShared(cx, **g);
     return true;
 }
 
-UnrootedShape
+RawShape
 RegExpObject::assignInitialShape(JSContext *cx)
 {
     JS_ASSERT(isRegExp());
     JS_ASSERT(nativeEmpty());
 
     JS_STATIC_ASSERT(LAST_INDEX_SLOT == 0);
     JS_STATIC_ASSERT(SOURCE_SLOT == LAST_INDEX_SLOT + 1);
     JS_STATIC_ASSERT(GLOBAL_FLAG_SLOT == SOURCE_SLOT + 1);
     JS_STATIC_ASSERT(IGNORE_CASE_FLAG_SLOT == GLOBAL_FLAG_SLOT + 1);
     JS_STATIC_ASSERT(MULTILINE_FLAG_SLOT == IGNORE_CASE_FLAG_SLOT + 1);
     JS_STATIC_ASSERT(STICKY_FLAG_SLOT == MULTILINE_FLAG_SLOT + 1);
 
     RootedObject self(cx, this);
 
     /* The lastIndex property alone is writable but non-configurable. */
     if (!addDataProperty(cx, cx->names().lastIndex, LAST_INDEX_SLOT, JSPROP_PERMANENT))
-        return UnrootedShape(NULL);
+        return NULL;
 
     /* Remaining instance properties are non-writable and non-configurable. */
     unsigned attrs = JSPROP_PERMANENT | JSPROP_READONLY;
     if (!self->addDataProperty(cx, cx->names().source, SOURCE_SLOT, attrs))
-        return UnrootedShape(NULL);
+        return NULL;
     if (!self->addDataProperty(cx, cx->names().global, GLOBAL_FLAG_SLOT, attrs))
-        return UnrootedShape(NULL);
+        return NULL;
     if (!self->addDataProperty(cx, cx->names().ignoreCase, IGNORE_CASE_FLAG_SLOT, attrs))
-        return UnrootedShape(NULL);
+        return NULL;
     if (!self->addDataProperty(cx, cx->names().multiline, MULTILINE_FLAG_SLOT, attrs))
-        return UnrootedShape(NULL);
+        return NULL;
     return self->addDataProperty(cx, cx->names().sticky, STICKY_FLAG_SLOT, attrs);
 }
 
 bool
 RegExpObject::init(JSContext *cx, HandleAtom source, RegExpFlag flags)
 {
     Rooted<RegExpObject *> self(cx, this);
 
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -349,17 +349,17 @@ class RegExpObject : public JSObject
   private:
     friend class RegExpObjectBuilder;
 
     /*
      * Compute the initial shape to associate with fresh RegExp objects,
      * encoding their initial properties. Return the shape after
      * changing this regular expression object's last property to it.
      */
-    UnrootedShape assignInitialShape(JSContext *cx);
+    RawShape assignInitialShape(JSContext *cx);
 
     bool init(JSContext *cx, HandleAtom source, RegExpFlag flags);
 
     /*
      * Precondition: the syntax for |source| has already been validated.
      * Side effect: sets the private field.
      */
     bool createShared(JSContext *cx, RegExpGuard *g);
--- a/js/src/vm/RegExpStatics-inl.h
+++ b/js/src/vm/RegExpStatics-inl.h
@@ -206,17 +206,17 @@ SizeOfRegExpStaticsData(const JSObject *
 inline bool
 RegExpStatics::createDependent(JSContext *cx, size_t start, size_t end, MutableHandleValue out)
 {
     /* Private function: caller must perform lazy evaluation. */
     JS_ASSERT(!pendingLazyEvaluation);
 
     JS_ASSERT(start <= end);
     JS_ASSERT(end <= matchesInput->length());
-    UnrootedString str = js_NewDependentString(cx, matchesInput, start, end - start);
+    RawString str = js_NewDependentString(cx, matchesInput, start, end - start);
     if (!str)
         return false;
     out.setString(str);
     return true;
 }
 
 inline bool
 RegExpStatics::createPendingInput(JSContext *cx, MutableHandleValue out)
--- a/js/src/vm/SPSProfiler.cpp
+++ b/js/src/vm/SPSProfiler.cpp
@@ -65,34 +65,34 @@ SPSProfiler::enable(bool enabled)
      * Ensure all future generated code will be instrumented, or that all
      * currently instrumented code is discarded
      */
     ReleaseAllJITCode(rt->defaultFreeOp());
 }
 
 /* Lookup the string for the function/script, creating one if necessary */
 const char*
-SPSProfiler::profileString(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun)
+SPSProfiler::profileString(JSContext *cx, RawScript script, RawFunction maybeFun)
 {
     JS_ASSERT(strings.initialized());
     ProfileStringMap::AddPtr s = strings.lookupForAdd(script);
     if (s)
         return s->value;
     const char *str = allocProfileString(cx, script, maybeFun);
     if (str == NULL)
         return NULL;
     if (!strings.add(s, script, str)) {
         js_free(const_cast<char *>(str));
         return NULL;
     }
     return str;
 }
 
 void
-SPSProfiler::onScriptFinalized(UnrootedScript script)
+SPSProfiler::onScriptFinalized(RawScript script)
 {
     /*
      * This function is called whenever a script is destroyed, regardless of
      * whether profiling has been turned on, so don't invoke a function on an
      * invalid hash set. Also, even if profiling was enabled but then turned
      * off, we still want to remove the string, so no check of enabled() is
      * done.
      */
@@ -101,30 +101,30 @@ SPSProfiler::onScriptFinalized(UnrootedS
     if (ProfileStringMap::Ptr entry = strings.lookup(script)) {
         const char *tofree = entry->value;
         strings.remove(entry);
         js_free(const_cast<char *>(tofree));
     }
 }
 
 bool
-SPSProfiler::enter(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun)
+SPSProfiler::enter(JSContext *cx, RawScript script, RawFunction maybeFun)
 {
     const char *str = profileString(cx, script, maybeFun);
     if (str == NULL)
         return false;
 
     JS_ASSERT_IF(*size_ > 0 && *size_ - 1 < max_ && stack_[*size_ - 1].js(),
                  stack_[*size_ - 1].pc() != NULL);
     push(str, NULL, script, script->code);
     return true;
 }
 
 void
-SPSProfiler::exit(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun)
+SPSProfiler::exit(JSContext *cx, RawScript script, RawFunction maybeFun)
 {
     pop();
 
 #ifdef DEBUG
     /* Sanity check to make sure push/pop balanced */
     if (*size_ < max_) {
         const char *str = profileString(cx, script, maybeFun);
         /* Can't fail lookup because we should already be in the set */
@@ -147,17 +147,17 @@ SPSProfiler::exit(JSContext *cx, Unroote
         JS_ASSERT(strcmp((const char*) stack_[*size_].label(), str) == 0);
         stack_[*size_].setLabel(NULL);
         stack_[*size_].setPC(NULL);
     }
 #endif
 }
 
 void
-SPSProfiler::push(const char *string, void *sp, UnrootedScript script, jsbytecode *pc)
+SPSProfiler::push(const char *string, void *sp, RawScript script, jsbytecode *pc)
 {
     /* these operations cannot be re-ordered, so volatile-ize operations */
     volatile ProfileEntry *stack = stack_;
     volatile uint32_t *size = size_;
     uint32_t current = *size;
 
     JS_ASSERT(enabled());
     if (current < max_) {
@@ -179,17 +179,17 @@ SPSProfiler::pop()
 
 /*
  * Serializes the script/function pair into a "descriptive string" which is
  * allowed to fail. This function cannot trigger a GC because it could finalize
  * some scripts, resize the hash table of profile strings, and invalidate the
  * AddPtr held while invoking allocProfileString.
  */
 const char*
-SPSProfiler::allocProfileString(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun)
+SPSProfiler::allocProfileString(JSContext *cx, RawScript script, RawFunction maybeFun)
 {
     DebugOnly<uint64_t> gcBefore = cx->runtime->gcNumber;
     StringBuffer buf(cx);
     bool hasAtom = maybeFun != NULL && maybeFun->displayAtom() != NULL;
     if (hasAtom) {
         if (!buf.append(maybeFun->displayAtom()))
             return NULL;
         if (!buf.append(" ("))
@@ -231,18 +231,16 @@ JMChunkInfo::JMChunkInfo(mjit::JSActiveF
   : mainStart(frame->mainCodeStart),
     mainEnd(frame->mainCodeEnd),
     stubStart(frame->stubCodeStart),
     stubEnd(frame->stubCodeEnd),
     pcLengths(pcLengths),
     chunk(chunk)
 {}
 
-// Use RawScript instead of UnrootedScript because this may be called from a
-// signal handler.
 jsbytecode*
 SPSProfiler::ipToPC(RawScript script, size_t ip)
 {
     if (!jminfo.initialized())
         return NULL;
 
     JITInfoMap::Ptr ptr = jminfo.lookup(script);
     if (!ptr)
@@ -261,18 +259,16 @@ SPSProfiler::ipToPC(RawScript script, si
         jsbytecode *pc = info->chunks[i].convert(script, ip);
         if (pc != NULL)
             return pc;
     }
 
     return NULL;
 }
 
-// Use RawScript instead of UnrootedScript because this may be called from a
-// signal handler.
 jsbytecode*
 JMChunkInfo::convert(RawScript script, size_t ip)
 {
     if (mainStart <= ip && ip < mainEnd) {
         size_t offset = 0;
         uint32_t i;
         for (i = 0; i < script->length - 1; i++) {
             offset += (uint32_t) pcLengths[i].inlineLength;
@@ -362,17 +358,17 @@ SPSProfiler::registerScript(mjit::JSActi
     }
     if (!info->chunks.append(JMChunkInfo(frame, entries, chunk)))
         return NULL;
     return info->chunks.end() - 1;
 }
 
 bool
 SPSProfiler::registerICCode(mjit::JITChunk *chunk,
-                            UnrootedScript script, jsbytecode *pc,
+                            RawScript script, jsbytecode *pc,
                             void *base, size_t size)
 {
     JS_ASSERT(jminfo.initialized());
     JITInfoMap::Ptr ptr = jminfo.lookup(script);
     JS_ASSERT(ptr);
     return ptr->value->ics.append(ICInfo(base, size, pc));
 }
 
@@ -385,17 +381,17 @@ SPSProfiler::discardMJITCode(mjit::JITSc
         return;
 
     unregisterScript(jscr->script, chunk);
     for (unsigned i = 0; i < chunk->nInlineFrames; i++)
         unregisterScript(chunk->inlineFrames()[i].fun->nonLazyScript(), chunk);
 }
 
 void
-SPSProfiler::unregisterScript(UnrootedScript script, mjit::JITChunk *chunk)
+SPSProfiler::unregisterScript(RawScript script, mjit::JITChunk *chunk)
 {
     JITInfoMap::Ptr ptr = jminfo.lookup(script);
     if (!ptr)
         return;
     JMScriptInfo *info = ptr->value;
     for (unsigned i = 0; i < info->chunks.length(); i++) {
         if (info->chunks[i].chunk == chunk) {
             info->chunks.erase(&info->chunks[i]);
--- a/js/src/vm/SPSProfiler.h
+++ b/js/src/vm/SPSProfiler.h
@@ -131,19 +131,19 @@ class SPSProfiler
     JSRuntime            *rt;
     ProfileStringMap     strings;
     ProfileEntry         *stack_;
     uint32_t             *size_;
     uint32_t             max_;
     bool                 slowAssertions;
     bool                 enabled_;
 
-    const char *allocProfileString(JSContext *cx, UnrootedScript script,
-                                   UnrootedFunction function);
-    void push(const char *string, void *sp, UnrootedScript script, jsbytecode *pc);
+    const char *allocProfileString(JSContext *cx, RawScript script,
+                                   RawFunction function);
+    void push(const char *string, void *sp, RawScript script, jsbytecode *pc);
     void pop();
 
   public:
     SPSProfiler(JSRuntime *rt);
     ~SPSProfiler();
 
     uint32_t *sizePointer() { return size_; }
     uint32_t maxSize() { return max_; }
@@ -160,19 +160,19 @@ class SPSProfiler
      * Functions which are the actual instrumentation to track run information
      *
      *   - enter: a function has started to execute
      *   - updatePC: updates the pc information about where a function
      *               is currently executing
      *   - exit: this function has ceased execution, and no further
      *           entries/exits will be made
      */
-    bool enter(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun);
-    void exit(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun);
-    void updatePC(UnrootedScript script, jsbytecode *pc) {
+    bool enter(JSContext *cx, RawScript script, RawFunction maybeFun);
+    void exit(JSContext *cx, RawScript script, RawFunction maybeFun);
+    void updatePC(RawScript script, jsbytecode *pc) {
         if (enabled() && *size_ - 1 < max_) {
             JS_ASSERT(*size_ > 0);
             JS_ASSERT(stack_[*size_ - 1].script() == script);
             stack_[*size_ - 1].setPC(pc);
         }
     }
 
 #ifdef JS_METHODJIT
@@ -228,33 +228,33 @@ class SPSProfiler
      */
     JITInfoMap jminfo;
 
     bool registerMJITCode(mjit::JITChunk *chunk,
                           mjit::JSActiveFrame *outerFrame,
                           mjit::JSActiveFrame **inlineFrames);
     void discardMJITCode(mjit::JITScript *jscr,
                          mjit::JITChunk *chunk, void* address);
-    bool registerICCode(mjit::JITChunk *chunk, UnrootedScript script, jsbytecode* pc,
+    bool registerICCode(mjit::JITChunk *chunk, RawScript script, jsbytecode* pc,
                         void *start, size_t size);
     jsbytecode *ipToPC(RawScript script, size_t ip);
 
   private:
     JMChunkInfo *registerScript(mjit::JSActiveFrame *frame,
                                 mjit::PCLengthEntry *lenths,
                                 mjit::JITChunk *chunk);
-    void unregisterScript(UnrootedScript script, mjit::JITChunk *chunk);
+    void unregisterScript(RawScript script, mjit::JITChunk *chunk);
   public:
 #else
     jsbytecode *ipToPC(RawScript script, size_t ip) { return NULL; }
 #endif
 
     void setProfilingStack(ProfileEntry *stack, uint32_t *size, uint32_t max);
-    const char *profileString(JSContext *cx, UnrootedScript script, UnrootedFunction maybeFun);
-    void onScriptFinalized(UnrootedScript script);
+    const char *profileString(JSContext *cx, RawScript script, RawFunction maybeFun);
+    void onScriptFinalized(RawScript script);
 
     /* meant to be used for testing, not recommended to call in normal code */
     size_t stringsCount() { return strings.count(); }
     void stringsReset() { strings.clear(); }
 };
 
 /*
  * This class is used in RunScript() to push the marker onto the sampling stack
@@ -366,45 +366,45 @@ class SPSInstrumentation
         frame->skipNext = true;
     }
 
     /*
      * In some cases, a frame needs to be flagged as having been pushed, but no
      * instrumentation should be emitted. This updates internal state to flag
      * that further instrumentation should actually be emitted.
      */
-    void setPushed(UnrootedScript script) {
+    void setPushed(RawScript script) {
         if (!enabled())
             return;
         JS_ASSERT(frame->left == 0);
         frame->script = script;
     }
 
     /*
      * Flags entry into a JS function for the first time. Before this is called,
      * no instrumentation is emitted, but after this instrumentation is emitted.
      */
-    bool push(JSContext *cx, UnrootedScript script, Assembler &masm, Register scratch) {
+    bool push(JSContext *cx, RawScript script, Assembler &masm, Register scratch) {
         if (!enabled())
             return true;
         const char *string = profiler_->profileString(cx, script,
                                                       script->function());
         if (string == NULL)
             return false;
         masm.spsPushFrame(profiler_, string, script, scratch);
         setPushed(script);
         return true;
     }
 
     /*
      * Signifies that C++ performed the push() for this function. C++ always
      * sets the current PC to something non-null, however, so as soon as JIT
      * code is reentered this updates the current pc to NULL.
      */
-    void pushManual(UnrootedScript script, Assembler &masm, Register scratch) {
+    void pushManual(RawScript script, Assembler &masm, Register scratch) {
         if (!enabled())
             return;
         masm.spsUpdatePCIdx(profiler_, ProfileEntry::NullPCIndex, scratch);
         setPushed(script);
     }
 
     /*
      * Signals that the current function is leaving for a function call. This
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -53,23 +53,23 @@ StaticScopeIter::operator++(int)
 bool
 StaticScopeIter::hasDynamicScopeObject() const
 {
     return obj->isStaticBlock()
            ? obj->asStaticBlock().needsClone()
            : obj->toFunction()->isHeavyweight();
 }
 
-UnrootedShape
+RawShape
 StaticScopeIter::scopeShape() const
 {
     JS_ASSERT(hasDynamicScopeObject());
     JS_ASSERT(type() != NAMED_LAMBDA);
     return type() == BLOCK
-           ? UnrootedShape(block().lastProperty())
+           ? block().lastProperty()
            : funScript()->bindings.callObjShape();
 }
 
 StaticScopeIter::Type
 StaticScopeIter::type() const
 {
     if (onNamedLambda)
         return NAMED_LAMBDA;
@@ -78,26 +78,26 @@ StaticScopeIter::type() const
 
 StaticBlockObject &
 StaticScopeIter::block() const
 {
     JS_ASSERT(type() == BLOCK);
     return obj->asStaticBlock();
 }
 
-UnrootedScript
+RawScript
 StaticScopeIter::funScript() const
 {
     JS_ASSERT(type() == FUNCTION);
     return obj->toFunction()->nonLazyScript();
 }
 
 /*****************************************************************************/
 
-UnrootedShape
+RawShape
 js::ScopeCoordinateToStaticScopeShape(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(pc >= script->code && pc < script->code + script->length);
     JS_ASSERT(JOF_OPTYPE(*pc) == JOF_SCOPECOORD);
 
     uint32_t blockIndex = GET_UINT32_INDEX(pc + 2 * sizeof(uint16_t));
     RootedObject innermostStaticScope(cx, NULL);
     if (blockIndex == UINT32_MAX)
@@ -682,29 +682,29 @@ StaticBlockObject::create(JSContext *cx)
 
     JSObject *obj = JSObject::create(cx, FINALIZE_KIND, gc::TenuredHeap, emptyBlockShape, type, NULL);
     if (!obj)
         return NULL;
 
     return &obj->asStaticBlock();
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 StaticBlockObject::addVar(JSContext *cx, Handle<StaticBlockObject*> block, HandleId id,
                           int index, bool *redeclared)
 {
     JS_ASSERT(JSID_IS_ATOM(id) || (JSID_IS_INT(id) && JSID_TO_INT(id) == index));
 
     *redeclared = false;
 
     /* Inline JSObject::addProperty in order to trap the redefinition case. */
     Shape **spp;
     if (Shape::search(cx, block->lastProperty(), id, &spp, true)) {
         *redeclared = true;
-        return UnrootedShape(NULL);
+        return NULL;
     }
 
     /*
      * Don't convert this object to dictionary mode so that we can clone the
      * block's shape later.
      */
     uint32_t slot = JSSLOT_FREE(&BlockClass) + index;
     return JSObject::addPropertyInternal(cx, block, id, /* getter = */ NULL, /* setter = */ NULL,
@@ -793,17 +793,17 @@ js::XDRStaticBlockObject(XDRState<mode> 
             obj->setAliased(i, !!aliased);
         }
     } else {
         AutoShapeVector shapes(cx);
         if (!shapes.growBy(count))
             return false;
 
         for (Shape::Range r(obj->lastProperty()); !r.empty(); r.popFront()) {
-            UnrootedShape shape = &r.front();
+            RawShape shape = &r.front();
             shapes[shape->shortid()] = shape;
         }
 
         /*
          * XDR the block object's properties. We know that there are 'count'
          * properties to XDR, stored as id/shortid pairs.
          */
         RootedShape shape(cx);
@@ -1224,27 +1224,27 @@ class DebugScopeProxy : public BaseProxy
             }
 
             return true;
         }
 
         /* Handle unaliased let and catch bindings at block scope. */
         if (scope->isClonedBlock()) {
             Rooted<ClonedBlockObject *> block(cx, &scope->asClonedBlock());
-            UnrootedShape shape = block->lastProperty()->search(cx, id);
+            RawShape shape = block->lastProperty()->search(cx, id);
             if (!shape)
                 return false;
 
             AutoAssertNoGC nogc;
             unsigned i = shape->shortid();
             if (block->staticBlock().isAliased(i))
                 return false;
 
             if (maybeframe) {
-                UnrootedScript script = maybeframe.script();
+                RawScript script = maybeframe.script();
                 unsigned local = block->slotToLocalIndex(script->bindings, shape->slot());
                 if (action == GET)
                     *vp = maybeframe.unaliasedLocal(local);
                 else
                     maybeframe.unaliasedLocal(local) = *vp;
                 JS_ASSERT(analyze::LocalSlot(script, local) >= analyze::TotalSlots(script));
             } else {
                 if (action == GET)
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -62,23 +62,23 @@ class StaticScopeIter
   public:
     explicit StaticScopeIter(JSContext *cx, HandleObject obj);
 
     bool done() const;
     void operator++(int);
 
     /* Return whether this static scope will be on the dynamic scope chain. */
     bool hasDynamicScopeObject() const;
-    UnrootedShape scopeShape() const;
+    RawShape scopeShape() const;
 
     enum Type { BLOCK, FUNCTION, NAMED_LAMBDA };
     Type type() const;
 
     StaticBlockObject &block() const;
-    UnrootedScript funScript() const;
+    RawScript funScript() const;
 };
 
 /*****************************************************************************/
 
 /*
  * A "scope coordinate" describes how to get from head of the scope chain to a
  * given lexically-enclosing variable. A scope coordinate has two dimensions:
  *  - hops: the number of scope objects on the scope chain to skip
@@ -95,17 +95,17 @@ struct ScopeCoordinate
     inline ScopeCoordinate(jsbytecode *pc);
     inline ScopeCoordinate() {}
 };
 
 /*
  * Return a shape representing the static scope containing the variable
  * accessed by the ALIASEDVAR op at 'pc'.
  */
-extern UnrootedShape
+extern RawShape
 ScopeCoordinateToStaticScopeShape(JSContext *cx, JSScript *script, jsbytecode *pc);
 
 /* Return the name being accessed by the given ALIASEDVAR op. */
 extern PropertyName *
 ScopeCoordinateName(JSContext *cx, JSScript *script, jsbytecode *pc);
 
 /*****************************************************************************/
 
@@ -343,18 +343,18 @@ class StaticBlockObject : public BlockOb
      * The parser uses 'enclosingBlock' as the prev-link in the pc->blockChain
      * stack. Note: in the case of hoisting, this prev-link will not ultimately
      * be the same as enclosingBlock, initEnclosingStaticScope must be called
      * separately in the emitter. 'reset' is just for asserting stackiness.
      */
     void initPrevBlockChainFromParser(StaticBlockObject *prev);
     void resetPrevBlockChainFromParser();
 
-    static UnrootedShape addVar(JSContext *cx, Handle<StaticBlockObject*> block, HandleId id,
-                                int index, bool *redeclared);
+    static RawShape addVar(JSContext *cx, Handle<StaticBlockObject*> block, HandleId id,
+                           int index, bool *redeclared);
 };
 
 class ClonedBlockObject : public BlockObject
 {
   public:
     static ClonedBlockObject *create(JSContext *cx, Handle<StaticBlockObject *> block,
                                      AbstractFramePtr frame);
 
--- a/js/src/vm/Shape-inl.h
+++ b/js/src/vm/Shape-inl.h
@@ -118,17 +118,17 @@ BaseShape::operator=(const BaseShape &ot
 
 inline bool
 BaseShape::matchesGetterSetter(PropertyOp rawGetter, StrictPropertyOp rawSetter) const
 {
     return rawGetter == this->rawGetter && rawSetter == this->rawSetter;
 }
 
 inline
-StackBaseShape::StackBaseShape(UnrootedShape shape)
+StackBaseShape::StackBaseShape(RawShape shape)
   : flags(shape->getObjectFlags()),
     clasp(shape->getObjectClass()),
     parent(shape->getObjectParent())
 {
     updateGetterSetter(shape->attrs, shape->getter(), shape->setter());
 }
 
 inline void
@@ -146,17 +146,17 @@ StackBaseShape::updateGetterSetter(uint8
         flags |= BaseShape::HAS_SETTER_OBJECT;
     }
 
     this->rawGetter = rawGetter;
     this->rawSetter = rawSetter;
 }
 
 inline void
-BaseShape::adoptUnowned(UnrootedUnownedBaseShape other)
+BaseShape::adoptUnowned(RawUnownedBaseShape other)
 {
     /*
      * This is a base shape owned by a dictionary object, update it to reflect the
      * unowned base shape of a new last property.
      */
     JS_ASSERT(isOwned());
 
     uint32_t span = slotSpan();
@@ -166,28 +166,28 @@ BaseShape::adoptUnowned(UnrootedUnownedB
     setOwned(other);
     setTable(table);
     setSlotSpan(span);
 
     assertConsistency();
 }
 
 inline void
-BaseShape::setOwned(UnrootedUnownedBaseShape unowned)
+BaseShape::setOwned(RawUnownedBaseShape unowned)
 {
     flags |= OWNED_SHAPE;
     this->unowned_ = unowned;
 }
 
 inline void
 BaseShape::assertConsistency()
 {
 #ifdef DEBUG
     if (isOwned()) {
-        UnrootedUnownedBaseShape unowned = baseUnowned();
+        RawUnownedBaseShape unowned = baseUnowned();
         JS_ASSERT(hasGetterObject() == unowned->hasGetterObject());
         JS_ASSERT(hasSetterObject() == unowned->hasSetterObject());
         JS_ASSERT_IF(hasGetterObject(), getterObject() == unowned->getterObject());
         JS_ASSERT_IF(hasSetterObject(), setterObject() == unowned->setterObject());
         JS_ASSERT(getObjectParent() == unowned->getObjectParent());
         JS_ASSERT(getObjectFlags() == unowned->getObjectFlags());
     }
 #endif
@@ -202,17 +202,17 @@ Shape::Shape(const StackShape &other, ui
     flags(other.flags),
     shortid_(other.shortid),
     parent(NULL)
 {
     kids.setNull();
 }
 
 inline
-Shape::Shape(UnrootedUnownedBaseShape base, uint32_t nfixed)
+Shape::Shape(RawUnownedBaseShape base, uint32_t nfixed)
   : base_(base),
     propid_(JSID_EMPTY),
     slotInfo(SHAPE_INVALID_SLOT | (nfixed << FIXED_SLOTS_SHIFT)),
     attrs(JSPROP_SHARED),
     flags(0),
     shortid_(0),
     parent(NULL)
 {
@@ -230,32 +230,32 @@ StackShape::hash() const
     hash = JS_ROTATE_LEFT32(hash, 4) ^ attrs;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ shortid;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ slot_;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ JSID_BITS(propid);
     return hash;
 }
 
 inline bool
-Shape::matches(const UnrootedShape other) const
+Shape::matches(const RawShape other) const
 {
     return propid_.get() == other->propid_.get() &&
            matchesParamsAfterId(other->base(), other->maybeSlot(), other->attrs,
                                 other->flags, other->shortid_);
 }
 
 inline bool
 Shape::matches(const StackShape &other) const
 {
     return propid_.get() == other.propid &&
            matchesParamsAfterId(other.base, other.slot_, other.attrs, other.flags, other.shortid);
 }
 
 inline bool
-Shape::matchesParamsAfterId(UnrootedBaseShape base, uint32_t aslot,
+Shape::matchesParamsAfterId(RawBaseShape base, uint32_t aslot,
                             unsigned aattrs, unsigned aflags, int ashortid) const
 {
     return base->unowned() == this->base()->unowned() &&
            maybeSlot() == aslot &&
            attrs == aattrs &&
            ((flags ^ aflags) & PUBLIC_FLAGS) == 0 &&
            shortid_ == ashortid;
 }
@@ -326,17 +326,17 @@ Shape::set(JSContext* cx, HandleObject o
         RootedObject nobj(cx, &obj->asWith().object());
         return CallJSPropertyOpSetter(cx, self->setterOp(), nobj, id, strict, vp);
     }
 
     return CallJSPropertyOpSetter(cx, self->setterOp(), obj, id, strict, vp);
 }
 
 inline void
-Shape::setParent(UnrootedShape p)
+Shape::setParent(RawShape p)
 {
     JS_ASSERT_IF(p && !p->hasMissingSlot() && !inDictionary(),
                  p->maybeSlot() <= maybeSlot());
     JS_ASSERT_IF(p && !inDictionary(),
                  hasSlot() == (p->maybeSlot() != maybeSlot()));
     parent = p;
 }
 
@@ -383,52 +383,52 @@ Shape::initDictionaryShape(const StackSh
     new (this) Shape(child, nfixed);
     this->flags |= IN_DICTIONARY;
 
     this->listp = NULL;
     insertIntoDictionary(dictp);
 }
 
 inline
-EmptyShape::EmptyShape(UnrootedUnownedBaseShape base, uint32_t nfixed)
+EmptyShape::EmptyShape(RawUnownedBaseShape base, uint32_t nfixed)
   : js::Shape(base, nfixed)
 {
     /* Only empty shapes can be NON_NATIVE. */
     if (!getObjectClass()->isNative())
         flags |= NON_NATIVE;
 }
 
 inline void
-Shape::writeBarrierPre(UnrootedShape shape)
+Shape::writeBarrierPre(RawShape shape)
 {
 #ifdef JSGC_INCREMENTAL
     if (!shape)
         return;
 
     JS::Zone *zone = shape->zone();
     if (zone->needsBarrier()) {
-        UnrootedShape tmp = shape;
+        RawShape tmp = shape;
         MarkShapeUnbarriered(zone->barrierTracer(), &tmp, "write barrier");
         JS_ASSERT(tmp == shape);
     }
 #endif
 }
 
 inline void
 Shape::writeBarrierPost(RawShape shape, void *addr)
 {
 }
 
 inline void
-Shape::readBarrier(UnrootedShape shape)
+Shape::readBarrier(RawShape shape)
 {
 #ifdef JSGC_INCREMENTAL
     JS::Zone *zone = shape->zone();
     if (zone->needsBarrier()) {
-        UnrootedShape tmp = shape;
+        RawShape tmp = shape;
         MarkShapeUnbarriered(zone->barrierTracer(), &tmp, "read barrier");
         JS_ASSERT(tmp == shape);
     }
 #endif
 }
 
 inline void
 Shape::markChildren(JSTracer *trc)
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -35,17 +35,17 @@
 #include "vm/Shape-inl.h"
 
 using namespace js;
 using namespace js::gc;
 
 using mozilla::DebugOnly;
 
 bool
-ShapeTable::init(JSRuntime *rt, UnrootedShape lastProp)
+ShapeTable::init(JSRuntime *rt, RawShape lastProp)
 {
     /*
      * Either we're creating a table for a large scope that was populated
      * via property cache hit logic under JSOP_INITPROP, JSOP_SETNAME, or
      * JSOP_SETPROP; or else calloc failed at least once already. In any
      * event, let's try to grow, overallocating to hold at least twice the
      * current population.
      */
@@ -77,40 +77,40 @@ ShapeTable::init(JSRuntime *rt, Unrooted
 }
 
 bool
 Shape::makeOwnBaseShape(JSContext *cx)
 {
     JS_ASSERT(!base()->isOwned());
     assertSameCompartmentDebugOnly(cx, compartment());
 
-    UnrootedBaseShape nbase = js_NewGCBaseShape<NoGC>(cx);
+    RawBaseShape nbase = js_NewGCBaseShape<NoGC>(cx);
     if (!nbase)
         return false;
 
     new (nbase) BaseShape(StackBaseShape(this));
     nbase->setOwned(base()->toUnowned());
 
     this->base_ = nbase;
 
     return true;
 }
 
 void
-Shape::handoffTableTo(UnrootedShape shape)
+Shape::handoffTableTo(RawShape shape)
 {
     AutoAssertNoGC nogc;
     JS_ASSERT(inDictionary() && shape->inDictionary());
 
     if (this == shape)
         return;
 
     JS_ASSERT(base()->isOwned() && !shape->base()->isOwned());
 
-    UnrootedBaseShape nbase = base();
+    RawBaseShape nbase = base();
 
     JS_ASSERT_IF(shape->hasSlot(), nbase->slotSpan() > shape->slot());
 
     this->base_ = nbase->baseUnowned();
     nbase->adoptUnowned(shape->base()->toUnowned());
 
     shape->base_ = nbase;
 }
@@ -271,107 +271,107 @@ ShapeTable::grow(JSContext *cx)
 
     if (!change(delta, cx) && entryCount + removedCount == size - 1) {
         JS_ReportOutOfMemory(cx);
         return false;
     }
     return true;
 }
 
-UnrootedShape
+RawShape
 Shape::getChildBinding(JSContext *cx, const StackShape &child)
 {
     AssertCanGC();
     JS_ASSERT(!inDictionary());
 
     /* Try to allocate all slots inline. */
     uint32_t slots = child.slotSpan();
     gc::AllocKind kind = gc::GetGCObjectKind(slots);
     uint32_t nfixed = gc::GetGCKindSlots(kind);
 
     return cx->propertyTree().getChild(cx, this, nfixed, child);
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 Shape::replaceLastProperty(JSContext *cx, const StackBaseShape &base,
                            TaggedProto proto, HandleShape shape)
 {
     JS_ASSERT(!shape->inDictionary());
 
     if (!shape->parent) {
         /* Treat as resetting the initial property of the shape hierarchy. */
         AllocKind kind = gc::GetGCObjectKind(shape->numFixedSlots());
         return EmptyShape::getInitialShape(cx, base.clasp, proto,
                                            base.parent, kind,
                                            base.flags & BaseShape::OBJECT_FLAG_MASK);
     }
 
     StackShape child(shape);
     StackShape::AutoRooter childRoot(cx, &child);
     {
-        UnrootedUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
+        RawUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
-            return UnrootedShape(NULL);
+            return NULL;
 
         child.base = nbase;
     }
 
     return cx->propertyTree().getChild(cx, shape->parent, shape->numFixedSlots(), child);
 }
 
 /*
  * Get or create a property-tree or dictionary child property of |parent|,
  * which must be lastProperty() if inDictionaryMode(), else parent must be
  * one of lastProperty() or lastProperty()->parent.
  */
-/* static */ UnrootedShape
+/* static */ RawShape
 JSObject::getChildProperty(JSContext *cx, HandleObject obj, HandleShape parent, StackShape &child)
 {
     /*
      * Shared properties have no slot, but slot_ will reflect that of parent.
      * Unshared properties allocate a slot here but may lose it due to a
      * JS_ClearScope call.
      */
     if (!child.hasSlot()) {
         child.setSlot(parent->maybeSlot());
     } else {
         if (child.hasMissingSlot()) {
             uint32_t slot;
             if (!allocSlot(cx, obj, &slot))
-                return UnrootedShape(NULL);
+                return NULL;
             child.setSlot(slot);
         } else {
             /* Slots can only be allocated out of order on objects in dictionary mode. */
             JS_ASSERT(obj->inDictionaryMode() ||
                       parent->hasMissingSlot() ||
                       child.slot() == parent->maybeSlot() + 1);
         }
     }
 
     RootedShape shape(cx);
 
     if (obj->inDictionaryMode()) {
         JS_ASSERT(parent == obj->lastProperty());
         StackShape::AutoRooter childRoot(cx, &child);
         shape = js_NewGCShape(cx);
         if (!shape)
-            return UnrootedShape(NULL);
+            return NULL;
         if (child.hasSlot() && child.slot() >= obj->lastProperty()->base()->slotSpan()) {
             if (!JSObject::setSlotSpan(cx, obj, child.slot() + 1))
-                return UnrootedShape(NULL);
+                return NULL;
         }
         shape->initDictionaryShape(child, obj->numFixedSlots(), &obj->shape_);
     } else {
         shape = cx->propertyTree().getChild(cx, parent, obj->numFixedSlots(), child);
         if (!shape)
-            return UnrootedShape(NULL);
+            return NULL;
         //JS_ASSERT(shape->parent == parent);
         //JS_ASSERT_IF(parent != lastProperty(), parent == lastProperty()->parent);
         if (!JSObject::setLastProperty(cx, obj, shape))
-            return UnrootedShape(NULL);
+            return NULL;
     }
 
     return shape;
 }
 
 bool
 JSObject::toDictionaryMode(JSContext *cx)
 {
@@ -392,17 +392,17 @@ JSObject::toDictionaryMode(JSContext *cx
      */
     RootedShape root(cx);
     RootedShape dictionaryShape(cx);
 
     RootedShape shape(cx, lastProperty());
     while (shape) {
         JS_ASSERT(!shape->inDictionary());
 
-        UnrootedShape dprop = js_NewGCShape(cx);
+        RawShape dprop = js_NewGCShape(cx);
         if (!dprop) {
             js_ReportOutOfMemory(cx);
             return false;
         }
 
         HeapPtrShape *listp = dictionaryShape
                               ? &dictionaryShape->parent
                               : (HeapPtrShape *) root.address();
@@ -447,40 +447,40 @@ NormalizeGetterAndSetter(JSObject *obj,
     if (getter == JS_PropertyStub) {
         JS_ASSERT(!(attrs & JSPROP_GETTER));
         getter = NULL;
     }
 
     return true;
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 JSObject::addProperty(JSContext *cx, HandleObject obj, HandleId id,
                       PropertyOp getter, StrictPropertyOp setter,
                       uint32_t slot, unsigned attrs,
                       unsigned flags, int shortid, bool allowDictionary)
 {
     JS_ASSERT(!JSID_IS_VOID(id));
 
     if (!obj->isExtensible()) {
         obj->reportNotExtensible(cx);
-        return UnrootedShape(NULL);
+        return NULL;
     }
 
     NormalizeGetterAndSetter(obj, id, attrs, flags, getter, setter);
 
     Shape **spp = NULL;
     if (obj->inDictionaryMode())
         spp = obj->lastProperty()->table().search(id, true);
 
     return addPropertyInternal(cx, obj, id, getter, setter, slot, attrs, flags, shortid,
                                spp, allowDictionary);
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 JSObject::addPropertyInternal(JSContext *cx, HandleObject obj, HandleId id,
                               PropertyOp getter, StrictPropertyOp setter,
                               uint32_t slot, unsigned attrs,
                               unsigned flags, int shortid, Shape **spp,
                               bool allowDictionary)
 {
     AssertCanGC();
     JS_ASSERT_IF(!allowDictionary, !obj->inDictionaryMode());
@@ -492,25 +492,25 @@ JSObject::addPropertyInternal(JSContext 
         bool stableSlot =
             (slot == SHAPE_INVALID_SLOT) ||
             obj->lastProperty()->hasMissingSlot() ||
             (slot == obj->lastProperty()->maybeSlot() + 1);
         JS_ASSERT_IF(!allowDictionary, stableSlot);
         if (allowDictionary &&
             (!stableSlot || obj->lastProperty()->entryCount() >= PropertyTree::MAX_HEIGHT)) {
             if (!obj->toDictionaryMode(cx))
-                return UnrootedShape(NULL);
+                return NULL;
             table = &obj->lastProperty()->table();
             spp = table->search(id, true);
         }
     } else {
         table = &obj->lastProperty()->table();
         if (table->needsToGrow()) {
             if (!table->grow(cx))
-                return UnrootedShape(NULL);
+                return NULL;
             spp = table->search(id, true);
             JS_ASSERT(!SHAPE_FETCH(spp));
         }
     }
 
     JS_ASSERT(!!table == !!spp);
 
     /* Find or create a property tree node labeled by our arguments. */
@@ -526,17 +526,17 @@ JSObject::addPropertyInternal(JSContext 
             nbase = last->base()->unowned();
         } else {
             StackBaseShape base(last->base());
             base.updateGetterSetter(attrs, getter, setter);
             if (indexed)
                 base.flags |= BaseShape::INDEXED;
             nbase = BaseShape::getUnowned(cx, base);
             if (!nbase)
-                return UnrootedShape(NULL);
+                return NULL;
         }
 
         StackShape child(nbase, id, slot, obj->numFixedSlots(), attrs, flags, shortid);
         shape = getChildProperty(cx, obj, last, child);
     }
 
     if (shape) {
         JS_ASSERT(shape == obj->lastProperty());
@@ -551,17 +551,17 @@ JSObject::addPropertyInternal(JSContext 
             shape->parent->handoffTableTo(shape);
         }
 
         obj->checkShapeConsistency();
         return shape;
     }
 
     obj->checkShapeConsistency();
-    return UnrootedShape(NULL);
+    return NULL;
 }
 
 /*
  * Check and adjust the new attributes for the shape to make sure that our
  * slot access optimizations are sound. It is responsibility of the callers to
  * enforce all restrictions from ECMA-262 v5 8.12.9 [[DefineOwnProperty]].
  */
 inline bool
@@ -578,17 +578,17 @@ CheckCanChangeAttrs(JSContext *cx, JSObj
         (*attrsp & (JSPROP_GETTER | JSPROP_SETTER | JSPROP_SHARED))) {
         obj->reportNotConfigurable(cx, shape->propid());
         return false;
     }
 
     return true;
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 JSObject::putProperty(JSContext *cx, HandleObject obj, HandleId id,
                       PropertyOp getter, StrictPropertyOp setter,
                       uint32_t slot, unsigned attrs,
                       unsigned flags, int shortid)
 {
     JS_ASSERT(!JSID_IS_VOID(id));
 
     NormalizeGetterAndSetter(obj, id, attrs, flags, getter, setter);
@@ -600,27 +600,27 @@ JSObject::putProperty(JSContext *cx, Han
     RootedShape shape(cx, Shape::search(cx, obj->lastProperty(), id, &spp, true));
     if (!shape) {
         /*
          * You can't add properties to a non-extensible object, but you can change
          * attributes of properties in such objects.
          */
         if (!obj->isExtensible()) {
             obj->reportNotExtensible(cx);
-            return UnrootedShape(NULL);
+            return NULL;
         }
 
         return addPropertyInternal(cx, obj, id, getter, setter, slot, attrs, flags, shortid, spp, true);
     }
 
     /* Property exists: search must have returned a valid *spp. */
     JS_ASSERT_IF(spp, !SHAPE_IS_REMOVED(*spp));
 
     if (!CheckCanChangeAttrs(cx, obj, shape, &attrs))
-        return UnrootedShape(NULL);
+        return NULL;
 
     /*
      * If the caller wants to allocate a slot, but doesn't care which slot,
      * copy the existing shape's slot into slot so we can match shape, if all
      * other members match.
      */
     bool hadSlot = shape->hasSlot();
     uint32_t oldSlot = shape->maybeSlot();
@@ -632,58 +632,58 @@ JSObject::putProperty(JSContext *cx, Han
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
         StackBaseShape base(obj->lastProperty()->base());
         base.updateGetterSetter(attrs, getter, setter);
         if (indexed)
             base.flags |= BaseShape::INDEXED;
         nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
-            return UnrootedShape(NULL);
+            return NULL;
     }
 
     /*
      * Now that we've possibly preserved slot, check whether all members match.
      * If so, this is a redundant "put" and we can return without more work.
      */
     if (shape->matchesParamsAfterId(nbase, slot, attrs, flags, shortid))
         return shape;
 
     /*
      * Overwriting a non-last property requires switching to dictionary mode.
      * The shape tree is shared immutable, and we can't removeProperty and then
      * addPropertyInternal because a failure under add would lose data.
      */
     if (shape != obj->lastProperty() && !obj->inDictionaryMode()) {
         if (!obj->toDictionaryMode(cx))
-            return UnrootedShape(NULL);
+            return NULL;
         spp = obj->lastProperty()->table().search(shape->propid(), false);
         shape = SHAPE_FETCH(spp);
     }
 
     JS_ASSERT_IF(shape->hasSlot() && !(attrs & JSPROP_SHARED), shape->slot() == slot);
 
     if (obj->inDictionaryMode()) {
         /*
          * Updating some property in a dictionary-mode object. Create a new
          * shape for the existing property, and also generate a new shape for
          * the last property of the dictionary (unless the modified property
          * is also the last property).
          */
         bool updateLast = (shape == obj->lastProperty());
         shape = obj->replaceWithNewEquivalentShape(cx, shape);
         if (!shape)
-            return UnrootedShape(NULL);
+            return NULL;
         if (!updateLast && !obj->generateOwnShape(cx))
-            return UnrootedShape(NULL);
+            return NULL;
 
         /* FIXME bug 593129 -- slot allocation and JSObject *this must move out of here! */
         if (slot == SHAPE_INVALID_SLOT && !(attrs & JSPROP_SHARED)) {
             if (!allocSlot(cx, obj, &slot))
-                return UnrootedShape(NULL);
+                return NULL;
         }
 
         if (updateLast)
             shape->base()->adoptUnowned(nbase);
         else
             shape->base_ = nbase;
 
         shape->setSlot(slot);
@@ -693,31 +693,30 @@ JSObject::putProperty(JSContext *cx, Han
     } else {
         /*
          * Updating the last property in a non-dictionary-mode object. Find an
          * alternate shared child of the last property's previous shape.
          */
         StackBaseShape base(obj->lastProperty()->base());
         base.updateGetterSetter(attrs, getter, setter);
 
-        UnrootedUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
+        RawUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
-            return UnrootedShape(NULL);
+            return NULL;
 
         JS_ASSERT(shape == obj->lastProperty());
 
         /* Find or create a property tree node labeled by our arguments. */
         StackShape child(nbase, id, slot, obj->numFixedSlots(), attrs, flags, shortid);
-        DropUnrooted(nbase);
         RootedShape parent(cx, shape->parent);
-        UnrootedShape newShape = JSObject::getChildProperty(cx, obj, parent, child);
+        RawShape newShape = JSObject::getChildProperty(cx, obj, parent, child);
 
         if (!newShape) {
             obj->checkShapeConsistency();
-            return UnrootedShape(NULL);
+            return NULL;
         }
 
         shape = newShape;
     }
 
     /*
      * Can't fail now, so free the previous incarnation's slot if the new shape
      * has no slot. But we do not need to free oldSlot (and must not, as trying
@@ -730,17 +729,17 @@ JSObject::putProperty(JSContext *cx, Han
         ++cx->runtime->propertyRemovals;
     }
 
     obj->checkShapeConsistency();
 
     return shape;
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 JSObject::changeProperty(JSContext *cx, HandleObject obj, HandleShape shape, unsigned attrs,
                          unsigned mask, PropertyOp getter, StrictPropertyOp setter)
 {
     JS_ASSERT(obj->nativeContains(cx, shape));
 
     attrs |= shape->attrs & mask;
 
     /* Allow only shared (slotless) => unshared (slotful) transition. */
@@ -752,30 +751,30 @@ JSObject::changeProperty(JSContext *cx, 
         types::AddTypePropertyId(cx, obj, shape->propid(), types::Type::UnknownType());
 
     if (getter == JS_PropertyStub)
         getter = NULL;
     if (setter == JS_StrictPropertyStub)
         setter = NULL;
 
     if (!CheckCanChangeAttrs(cx, obj, shape, &attrs))
-        return UnrootedShape(NULL);
+        return NULL;
 
     if (shape->attrs == attrs && shape->getter() == getter && shape->setter() == setter)
         return shape;
 
     /*
      * Let JSObject::putProperty handle this |overwriting| case, including
      * the conservation of shape->slot (if it's valid). We must not call
      * removeProperty because it will free an allocated shape->slot, and
      * putProperty won't re-allocate it.
      */
     RootedId propid(cx, shape->propid());
-    UnrootedShape newShape = putProperty(cx, obj, propid, getter, setter, shape->maybeSlot(),
-                                         attrs, shape->flags, shape->maybeShortid());
+    RawShape newShape = putProperty(cx, obj, propid, getter, setter, shape->maybeSlot(),
+                                    attrs, shape->flags, shape->maybeShortid());
 
     obj->checkShapeConsistency();
     return newShape;
 }
 
 bool
 JSObject::removeProperty(JSContext *cx, jsid id_)
 {
@@ -816,17 +815,17 @@ JSObject::removeProperty(JSContext *cx, 
              * Get an up to date unowned base shape for the new last property
              * when removing the dictionary's last property. Information in
              * base shapes for non-last properties may be out of sync with the
              * object's state.
              */
             RootedShape previous(cx, self->lastProperty()->parent);
             StackBaseShape base(self->lastProperty()->base());
             base.updateGetterSetter(previous->attrs, previous->getter(), previous->setter());
-            UnrootedBaseShape nbase = BaseShape::getUnowned(cx, base);
+            RawBaseShape nbase = BaseShape::getUnowned(cx, base);
             if (!nbase)
                 return false;
             previous->base_ = nbase;
         }
     }
 
     /* If shape has a slot, free its slot number. */
     if (shape->hasSlot()) {
@@ -851,25 +850,25 @@ JSObject::removeProperty(JSContext *cx, 
             --table.entryCount;
 
 #ifdef DEBUG
             /*
              * Check the consistency of the table but limit the number of
              * checks not to alter significantly the complexity of the
              * delete in debug builds, see bug 534493.
              */
-            UnrootedShape aprop = self->lastProperty();
+            RawShape aprop = self->lastProperty();
             for (int n = 50; --n >= 0 && aprop->parent; aprop = aprop->parent)
                 JS_ASSERT_IF(aprop != shape, self->nativeContains(cx, aprop));
 #endif
         }
 
         {
             /* Remove shape from its non-circular doubly linked list. */
-            UnrootedShape oldLastProp = self->lastProperty();
+            RawShape oldLastProp = self->lastProperty();
             shape->removeFromDictionary(self);
 
             /* Hand off table from the old to new last property. */
             oldLastProp->handoffTableTo(self->lastProperty());
         }
 
         /* Generate a new shape for the object, infallibly. */
         JS_ALWAYS_TRUE(self->generateOwnShape(cx, spare));
@@ -1000,33 +999,33 @@ JSObject::clearParent(JSContext *cx, Han
 JSObject::setParent(JSContext *cx, HandleObject obj, HandleObject parent)
 {
     if (parent && !parent->setDelegate(cx))
         return false;
 
     if (obj->inDictionaryMode()) {
         StackBaseShape base(obj->lastProperty());
         base.parent = parent;
-        UnrootedUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
+        RawUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
             return false;
 
         obj->lastProperty()->base()->adoptUnowned(nbase);
         return true;
     }
 
-    UnrootedShape newShape = Shape::setObjectParent(cx, parent, obj->getTaggedProto(), obj->shape_);
+    RawShape newShape = Shape::setObjectParent(cx, parent, obj->getTaggedProto(), obj->shape_);
     if (!newShape)
         return false;
 
     obj->shape_ = newShape;
     return true;
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 Shape::setObjectParent(JSContext *cx, JSObject *parent, TaggedProto proto, Shape *last)
 {
     if (last->getObjectParent() == parent)
         return last;
 
     StackBaseShape base(last);
     base.parent = parent;
 
@@ -1071,25 +1070,25 @@ JSObject::setFlag(JSContext *cx, /*BaseS
 
     RootedObject self(cx, this);
 
     if (inDictionaryMode()) {
         if (generateShape == GENERATE_SHAPE && !generateOwnShape(cx))
             return false;
         StackBaseShape base(self->lastProperty());
         base.flags |= flag;
-        UnrootedUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
+        RawUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
             return false;
 
         self->lastProperty()->base()->adoptUnowned(nbase);
         return true;
     }
 
-    UnrootedShape newShape = Shape::setObjectFlag(cx, flag, getTaggedProto(), lastProperty());
+    RawShape newShape = Shape::setObjectFlag(cx, flag, getTaggedProto(), lastProperty());
     if (!newShape)
         return false;
 
     self->shape_ = newShape;
     return true;
 }
 
 bool
@@ -1097,25 +1096,25 @@ JSObject::clearFlag(JSContext *cx, /*Bas
 {
     JS_ASSERT(inDictionaryMode());
     JS_ASSERT(lastProperty()->getObjectFlags() & flag);
 
     RootedObject self(cx, this);
 
     StackBaseShape base(self->lastProperty());
     base.flags &= ~flag;
-    UnrootedUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
+    RawUnownedBaseShape nbase = BaseShape::getUnowned(cx, base);
     if (!nbase)
         return false;
 
     self->lastProperty()->base()->adoptUnowned(nbase);
     return true;
 }
 
-/* static */ UnrootedShape
+/* static */ RawShape
 Shape::setObjectFlag(JSContext *cx, BaseShape::Flag flag, TaggedProto proto, Shape *last)
 {
     if (last->getObjectFlags() & flag)
         return last;
 
     StackBaseShape base(last);
     base.flags |= flag;
 
@@ -1154,23 +1153,23 @@ BaseShape::getUnowned(JSContext *cx, con
 
     BaseShapeSet::AddPtr p = table.lookupForAdd(&base);
 
     if (p)
         return *p;
 
     StackBaseShape::AutoRooter root(cx, &base);
 
-    UnrootedBaseShape nbase_ = js_NewGCBaseShape<CanGC>(cx);
+    RawBaseShape nbase_ = js_NewGCBaseShape<CanGC>(cx);
     if (!nbase_)
         return NULL;
 
     new (nbase_) BaseShape(base);
 
-    UnrootedUnownedBaseShape nbase = static_cast<UnrootedUnownedBaseShape>(nbase_);
+    RawUnownedBaseShape nbase = static_cast<RawUnownedBaseShape>(nbase_);
 
     if (!table.relookupOrAdd(p, &base, nbase))
         return NULL;
 
     return nbase;
 }
 
 void
@@ -1257,17 +1256,17 @@ EmptyShape::getInitialShape(JSContext *c
     Rooted<TaggedProto> protoRoot(cx, lookup.proto);
     RootedObject parentRoot(cx, lookup.parent);
 
     StackBaseShape base(clasp, parent, objectFlags);
     Rooted<UnownedBaseShape*> nbase(cx, BaseShape::getUnowned(cx, base));
     if (!nbase)
         return NULL;
 
-    UnrootedShape shape = cx->propertyTree().newShape(cx);
+    RawShape shape = cx->propertyTree().newShape(cx);
     if (!shape)
         return NULL;
     new (shape) EmptyShape(nbase, nfixed);
 
     lookup.proto = protoRoot;
     lookup.parent = parentRoot;
 
     if (!table.relookupOrAdd(p, lookup, InitialShapeEntry(shape, lookup.proto)))
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -160,17 +160,17 @@ struct ShapeTable {
      */
     bool grow(JSContext *cx);
 
     /*
      * NB: init and change are fallible but do not report OOM, so callers can
      * cope or ignore. They do however use JSRuntime's calloc_ method in order
      * to update the malloc counter on success.
      */
-    bool            init(JSRuntime *rt, UnrootedShape lastProp);
+    bool            init(JSRuntime *rt, RawShape lastProp);
     bool            change(int log2Delta, JSContext *cx);
     Shape           **search(jsid id, bool adding);
 };
 
 /*
  * Reuse the API-only JSPROP_INDEX attribute to mean shadowability.
  */
 #define JSPROP_SHADOWABLE       JSPROP_INDEX
@@ -303,18 +303,18 @@ class BaseShape : public js::gc::Cell
 
     inline BaseShape &operator=(const BaseShape &other);
 
     bool isOwned() const { return !!(flags & OWNED_SHAPE); }
 
     inline bool matchesGetterSetter(PropertyOp rawGetter,
                                     StrictPropertyOp rawSetter) const;
 
-    inline void adoptUnowned(UnrootedUnownedBaseShape other);
-    inline void setOwned(UnrootedUnownedBaseShape unowned);
+    inline void adoptUnowned(RawUnownedBaseShape other);
+    inline void setOwned(RawUnownedBaseShape unowned);
 
     JSObject *getObjectParent() const { return parent; }
     uint32_t getObjectFlags() const { return flags & OBJECT_FLAG_MASK; }
 
     bool hasGetterObject() const { return !!(flags & HAS_GETTER_OBJECT); }
     JSObject *getterObject() const { JS_ASSERT(hasGetterObject()); return getterObj; }
 
     bool hasSetterObject() const { return !!(flags & HAS_SETTER_OBJECT); }
@@ -386,33 +386,33 @@ struct StackBaseShape
     typedef const StackBaseShape *Lookup;
 
     uint32_t flags;
     Class *clasp;
     JSObject *parent;
     PropertyOp rawGetter;
     StrictPropertyOp rawSetter;
 
-    explicit StackBaseShape(UnrootedBaseShape base)
+    explicit StackBaseShape(RawBaseShape base)
       : flags(base->flags & BaseShape::OBJECT_FLAG_MASK),
         clasp(base->clasp),
         parent(base->parent),
         rawGetter(NULL),
         rawSetter(NULL)
     {}
 
     StackBaseShape(Class *clasp, JSObject *parent, uint32_t objectFlags)
       : flags(objectFlags),
         clasp(clasp),
         parent(parent),
         rawGetter(NULL),
         rawSetter(NULL)
     {}
 
-    inline StackBaseShape(UnrootedShape shape);
+    inline StackBaseShape(RawShape shape);
 
     inline void updateGetterSetter(uint8_t attrs,
                                    PropertyOp rawGetter,
                                    StrictPropertyOp rawSetter);
 
     static inline HashNumber hash(const StackBaseShape *lookup);
     static inline bool match(RawUnownedBaseShape key, const StackBaseShape *lookup);
 
@@ -491,35 +491,35 @@ class Shape : public js::gc::Cell
         KidsPointer kids;       /* null, single child, or a tagged ptr
                                    to many-kids data structure */
         HeapPtrShape *listp;    /* dictionary list starting at shape_
                                    has a double-indirect back pointer,
                                    either to the next shape's parent if not
                                    last, else to obj->shape_ */
     };
 
-    static inline UnrootedShape search(JSContext *cx, Shape *start, jsid id,
-                                       Shape ***pspp, bool adding = false);
+    static inline RawShape search(JSContext *cx, Shape *start, jsid id,
+                                  Shape ***pspp, bool adding = false);
 
     inline void removeFromDictionary(JSObject *obj);
     inline void insertIntoDictionary(HeapPtrShape *dictp);
 
     inline void initDictionaryShape(const StackShape &child, uint32_t nfixed,
                                     HeapPtrShape *dictp);
 
-    UnrootedShape getChildBinding(JSContext *cx, const StackShape &child);
+    RawShape getChildBinding(JSContext *cx, const StackShape &child);
 
     /* Replace the base shape of the last shape in a non-dictionary lineage with base. */
-    static UnrootedShape replaceLastProperty(JSContext *cx, const StackBaseShape &base,
-                                             TaggedProto proto, HandleShape shape);
+    static RawShape replaceLastProperty(JSContext *cx, const StackBaseShape &base,
+                                        TaggedProto proto, HandleShape shape);
 
     static bool hashify(JSContext *cx, Shape *shape);
-    void handoffTableTo(UnrootedShape newShape);
+    void handoffTableTo(RawShape newShape);
 
-    inline void setParent(UnrootedShape p);
+    inline void setParent(RawShape p);
 
     bool ensureOwnBaseShape(JSContext *cx) {
         if (base()->isOwned())
             return true;
         return makeOwnBaseShape(cx);
     }
 
     bool makeOwnBaseShape(JSContext *cx);
@@ -548,17 +548,17 @@ class Shape : public js::gc::Cell
     class Range {
       protected:
         friend class Shape;
 
         /* |cursor| is rooted manually when necessary using Range::AutoRooter. */
         RawShape cursor;
 
       public:
-        Range(UnrootedShape shape) : cursor(shape) { }
+        Range(RawShape shape) : cursor(shape) { }
 
         bool empty() const {
             return !cursor || cursor->isEmptyShape();
         }
 
         Shape &front() const {
             JS_ASSERT(!empty());
             return *cursor;
@@ -591,18 +591,18 @@ class Shape : public js::gc::Cell
 
     Range all() {
         return Range(this);
     }
 
     Class *getObjectClass() const { return base()->clasp; }
     JSObject *getObjectParent() const { return base()->parent; }
 
-    static UnrootedShape setObjectParent(JSContext *cx, JSObject *obj, TaggedProto proto, Shape *last);
-    static UnrootedShape setObjectFlag(JSContext *cx, BaseShape::Flag flag, TaggedProto proto, Shape *last);
+    static RawShape setObjectParent(JSContext *cx, JSObject *obj, TaggedProto proto, Shape *last);
+    static RawShape setObjectFlag(JSContext *cx, BaseShape::Flag flag, TaggedProto proto, Shape *last);
 
     uint32_t getObjectFlags() const { return base()->getObjectFlags(); }
     bool hasObjectFlag(BaseShape::Flag flag) const {
         JS_ASSERT(!(flag & ~BaseShape::OBJECT_FLAG_MASK));
         return !!(base()->flags & flag);
     }
 
   protected:
@@ -620,17 +620,17 @@ class Shape : public js::gc::Cell
 
         UNUSED_BITS     = 0x3C
     };
 
     /* Get a shape identical to this one, without parent/kids information. */
     Shape(const StackShape &other, uint32_t nfixed);
 
     /* Used by EmptyShape (see jsscopeinlines.h). */
-    Shape(UnrootedUnownedBaseShape base, uint32_t nfixed);
+    Shape(RawUnownedBaseShape base, uint32_t nfixed);
 
     /* Copy constructor disabled, to avoid misuse of the above form. */
     Shape(const Shape &other) MOZ_DELETE;
 
     /*
      * Whether this shape has a valid slot value. This may be true even if
      * !hasSlot() (see SlotInfo comment above), and may be false even if
      * hasSlot() if the shape is being constructed and has not had a slot
@@ -680,19 +680,19 @@ class Shape : public js::gc::Cell
     Value setterOrUndefined() const {
         return (hasSetterValue() && base()->setterObj)
                ? ObjectValue(*base()->setterObj)
                : UndefinedValue();
     }
 
     void update(PropertyOp getter, StrictPropertyOp setter, uint8_t attrs);
 
-    inline bool matches(const UnrootedShape other) const;
+    inline bool matches(const RawShape other) const;
     inline bool matches(const StackShape &other) const;
-    inline bool matchesParamsAfterId(UnrootedBaseShape base,
+    inline bool matchesParamsAfterId(RawBaseShape base,
                                      uint32_t aslot, unsigned aattrs, unsigned aflags,
                                      int ashortid) const;
 
     bool get(JSContext* cx, HandleObject receiver, JSObject *obj, JSObject *pobj, MutableHandleValue vp);
     bool set(JSContext* cx, HandleObject obj, HandleObject receiver, bool strict, MutableHandleValue vp);
 
     RawBaseShape base() const { return base_.get(); }
 
@@ -791,59 +791,59 @@ class Shape : public js::gc::Cell
         JS_ASSERT_IF(isDataDescriptor(), writable());
         return hasSlot() || (attrs & JSPROP_SHADOWABLE);
     }
 
     uint32_t entryCount() {
         if (hasTable())
             return table().entryCount;
 
-        UnrootedShape shape = this;
+        RawShape shape = this;
         uint32_t count = 0;
         for (Shape::Range r = shape->all(); !r.empty(); r.popFront())
             ++count;
         return count;
     }
 
     bool isBigEnoughForAShapeTable() {
         JS_ASSERT(!hasTable());
-        UnrootedShape shape = this;
+        RawShape shape = this;
         uint32_t count = 0;
         for (Shape::Range r = shape->all(); !r.empty(); r.popFront()) {
             ++count;
             if (count >= ShapeTable::MIN_ENTRIES)
                 return true;
         }
         return false;
     }
 
 #ifdef DEBUG
     void dump(JSContext *cx, FILE *fp) const;
     void dumpSubtree(JSContext *cx, int level, FILE *fp) const;
 #endif
 
     void sweep();
     void finalize(FreeOp *fop);
-    void removeChild(UnrootedShape child);
+    void removeChild(RawShape child);
 
-    static inline void writeBarrierPre(UnrootedShape shape);
+    static inline void writeBarrierPre(RawShape shape);
     static inline void writeBarrierPost(RawShape shape, void *addr);
 
     /*
      * All weak references need a read barrier for incremental GC. This getter
      * method implements the read barrier. It's used to obtain initial shapes
      * from the compartment.
      */
-    static inline void readBarrier(UnrootedShape shape);
+    static inline void readBarrier(RawShape shape);
 
     static inline ThingRootKind rootKind() { return THING_ROOT_SHAPE; }
 
     inline void markChildren(JSTracer *trc);
 
-    inline UnrootedShape search(JSContext *cx, jsid id) {
+    inline RawShape search(JSContext *cx, jsid id) {
         Shape **_;
         return search(cx, this, id, &_);
     }
 
     /* For JIT usage */
     static inline size_t offsetOfBase() { return offsetof(Shape, base_); }
 
   private:
@@ -892,17 +892,17 @@ class AutoRooterGetterSetter
 
   private:
     mozilla::Maybe<Inner> inner;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 struct EmptyShape : public js::Shape
 {
-    EmptyShape(UnrootedUnownedBaseShape base, uint32_t nfixed);
+    EmptyShape(RawUnownedBaseShape base, uint32_t nfixed);
 
     /*
      * Lookup an initial shape matching the given parameters, creating an empty
      * shape if none was found.
      */
     static Shape *getInitialShape(JSContext *cx, Class *clasp, TaggedProto proto,
                                   JSObject *parent, gc::AllocKind kind, uint32_t objectFlags = 0);
 
@@ -963,31 +963,31 @@ struct StackShape
     /* For performance, StackShape only roots when absolutely necessary. */
     RawUnownedBaseShape base;
     RawId               propid;
     uint32_t            slot_;
     uint8_t             attrs;
     uint8_t             flags;
     int16_t             shortid;
 
-    explicit StackShape(UnrootedUnownedBaseShape base, jsid propid, uint32_t slot,
+    explicit StackShape(RawUnownedBaseShape base, jsid propid, uint32_t slot,
                         uint32_t nfixed, unsigned attrs, unsigned flags, int shortid)
       : base(base),
         propid(propid),
         slot_(slot),
         attrs(uint8_t(attrs)),
         flags(uint8_t(flags)),
         shortid(int16_t(shortid))
     {
         JS_ASSERT(base);
         JS_ASSERT(!JSID_IS_VOID(propid));
         JS_ASSERT(slot <= SHAPE_INVALID_SLOT);
     }
 
-    StackShape(const UnrootedShape &shape)
+    StackShape(const RawShape &shape)
       : base(shape->base()->unowned()),
         propid(shape->propidRef()),
         slot_(shape->slotInfo & Shape::SLOT_MASK),
         attrs(shape->attrs),
         flags(shape->flags),
         shortid(shape->shortid_)
     {}
 
@@ -1046,17 +1046,17 @@ struct StackShape
 #define SHAPE_CLEAR_COLLISION(shape)                                          \
     ((RawShape) (uintptr_t(shape) & ~SHAPE_COLLISION))
 
 #define SHAPE_STORE_PRESERVING_COLLISION(spp, shape)                          \
     (*(spp) = (RawShape) (uintptr_t(shape) | SHAPE_HAD_COLLISION(*(spp))))
 
 namespace js {
 
-inline UnrootedShape
+inline RawShape
 Shape::search(JSContext *cx, Shape *start, jsid id, Shape ***pspp, bool adding)
 {
     AutoAssertNoGC nogc;
 
     if (start->inDictionary()) {
         *pspp = start->table().search(id, adding);
         return SHAPE_FETCH(*pspp);
     }
@@ -1079,22 +1079,22 @@ Shape::search(JSContext *cx, Shape *star
          * No table built -- there weren't enough entries, or OOM occurred.
          * Don't increment numLinearSearches, to keep hasTable() false.
          */
         JS_ASSERT(!start->hasTable());
     } else {
         start->incrementNumLinearSearches();
     }
 
-    for (UnrootedShape shape = start; shape; shape = shape->parent) {
+    for (RawShape shape = start; shape; shape = shape->parent) {
         if (shape->propidRef() == id)
             return shape;
     }
 
-    return UnrootedShape(NULL);
+    return NULL;
 }
 
 template<> struct RootKind<Shape *> : SpecificRootKind<Shape *, THING_ROOT_SHAPE> {};
 template<> struct RootKind<BaseShape *> : SpecificRootKind<BaseShape *, THING_ROOT_BASE_SHAPE> {};
 
 } // namespace js
 
 #ifdef _MSC_VER
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -127,17 +127,17 @@ StackFrame::resetInlinePrev(StackFrame *
     flags_ |= StackFrame::HAS_PREVPC;
     prev_ = prevfp;
     prevpc_ = prevpc;
     prevInline_ = NULL;
 }
 
 inline void
 StackFrame::initCallFrame(JSContext *cx, JSFunction &callee,
-                          UnrootedScript script, uint32_t nactual, StackFrame::Flags flagsArg)
+                          RawScript script, uint32_t nactual, StackFrame::Flags flagsArg)
 {
     JS_ASSERT((flagsArg & ~(CONSTRUCTING |
                             LOWERED_CALL_APPLY |
                             OVERFLOW_ARGS |
                             UNDERFLOW_ARGS)) == 0);
     JS_ASSERT(callee.nonLazyScript() == script);
 
     /* Initialize stack frame members. */
@@ -538,17 +538,17 @@ inline void
 ContextStack::popFrameAfterOverflow()
 {
     /* Restore the regs to what they were on entry to JSOP_CALL. */
     FrameRegs &regs = seg_->regs();
     StackFrame *fp = regs.fp();
     regs.popFrame(fp->actuals() + fp->numActualArgs());
 }
 
-inline UnrootedScript
+inline RawScript
 ContextStack::currentScript(jsbytecode **ppc,
                             MaybeAllowCrossCompartment allowCrossCompartment) const
 {
     AutoAssertNoGC nogc;
 
     if (ppc)
         *ppc = NULL;
 
@@ -558,39 +558,39 @@ ContextStack::currentScript(jsbytecode *
     FrameRegs &regs = this->regs();
     StackFrame *fp = regs.fp();
 
 #ifdef JS_ION
     if (fp->beginsIonActivation()) {
         JSScript *script = NULL;
         ion::GetPcScript(cx_, &script, ppc);
         if (!allowCrossCompartment && script->compartment() != cx_->compartment)
-            return UnrootedScript(NULL);
+            return NULL;
         return script;
     }
 #endif
 
 #ifdef JS_METHODJIT
     mjit::CallSite *inlined = regs.inlined();
     if (inlined) {
         mjit::JITChunk *chunk = fp->jit()->chunk(regs.pc);
         JS_ASSERT(inlined->inlineIndex < chunk->nInlineFrames);
         mjit::InlineFrame *frame = &chunk->inlineFrames()[inlined->inlineIndex];
-        UnrootedScript script = frame->fun->nonLazyScript();
+        RawScript script = frame->fun->nonLazyScript();
         if (!allowCrossCompartment && script->compartment() != cx_->compartment)
-            return UnrootedScript(NULL);
+            return NULL;
         if (ppc)
             *ppc = script->code + inlined->pcOffset;
         return script;
     }
 #endif
 
-    UnrootedScript script = fp->script();
+    RawScript script = fp->script();
     if (!allowCrossCompartment && script->compartment() != cx_->compartment)
-        return UnrootedScript(NULL);
+        return NULL;
 
     if (ppc)
         *ppc = fp->pcQuadratic(*this);
     return script;
 }
 
 inline HandleObject
 ContextStack::currentScriptedScopeChain() const
@@ -632,17 +632,17 @@ AbstractFramePtr::setReturnValue(const V
 {
     if (isStackFrame()) {
         asStackFrame()->setReturnValue(rval);
         return;
     }
     JS_NOT_REACHED("Invalid frame");
 }
 
-inline UnrootedObject
+inline RawObject
 AbstractFramePtr::scopeChain() const
 {
     if (isStackFrame())
         return asStackFrame()->scopeChain();
     JS_NOT_REACHED("Invalid frame");
     return NULL;
 }
 
@@ -790,17 +790,17 @@ AbstractFramePtr::isFramePushedByExecute
 inline bool
 AbstractFramePtr::isDebuggerFrame() const
 {
     if (isStackFrame())
         return asStackFrame()->isDebuggerFrame();
     JS_NOT_REACHED("Invalid frame");
     return false;
 }
-inline UnrootedScript
+inline RawScript
 AbstractFramePtr::script() const
 {
     if (isStackFrame())
         return asStackFrame()->script();
     JS_NOT_REACHED("Invalid frame");
     return NULL;
 }
 inline JSFunction *
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -46,17 +46,17 @@
 
 using namespace js;
 
 using mozilla::DebugOnly;
 
 /*****************************************************************************/
 
 void
-StackFrame::initExecuteFrame(UnrootedScript script, StackFrame *prevLink, AbstractFramePtr prev,
+StackFrame::initExecuteFrame(RawScript script, StackFrame *prevLink, AbstractFramePtr prev,
                              FrameRegs *regs, const Value &thisv, JSObject &scopeChain,
                              ExecuteType type)
 {
      /*
      * If |prev| is an interpreter frame, we can always prev-link to it.
      * If |prev| is a baseline JIT frame, we prev-link to its entry frame.
      */
     JS_ASSERT_IF(prev.isStackFrame(), prev.asStackFrame() == prevLink);
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -258,31 +258,31 @@ class AbstractFramePtr
 
     bool operator ==(const AbstractFramePtr &other) const { return ptr_ == other.ptr_; }
     bool operator !=(const AbstractFramePtr &other) const { return ptr_ != other.ptr_; }
 
     operator bool() const { return !!ptr_; }
 
     inline JSGenerator *maybeSuspendedGenerator(JSRuntime *rt) const;
 
-    inline UnrootedObject scopeChain() const;
+    inline RawObject scopeChain() const;
     inline CallObject &callObj() const;
     inline JSCompartment *compartment() const;
 
     inline StaticBlockObject *maybeBlockChain() const;
     inline bool hasCallObj() const;
     inline bool isGeneratorFrame() const;
     inline bool isYielding() const;
     inline bool isFunctionFrame() const;
     inline bool isGlobalFrame() const;
     inline bool isEvalFrame() const;
     inline bool isFramePushedByExecute() const;
     inline bool isDebuggerFrame() const;
 
-    inline UnrootedScript script() const;
+    inline RawScript script() const;
     inline JSFunction *fun() const;
     inline JSFunction *maybeFun() const;
     inline JSFunction &callee() const;
     inline Value calleev() const;
     inline Value &thisValue() const;
 
     inline bool isNonEvalFunctionFrame() const;
     inline bool isNonStrictDirectEvalFrame() const;
@@ -460,23 +460,23 @@ class StackFrame
 
     /*
      * Frame initialization, called by ContextStack operations after acquiring
      * the raw memory for the frame:
      */
 
     /* Used for Invoke, Interpret, trace-jit LeaveTree, and method-jit stubs. */
     void initCallFrame(JSContext *cx, JSFunction &callee,
-                       UnrootedScript script, uint32_t nactual, StackFrame::Flags flags);
+                       RawScript script, uint32_t nactual, StackFrame::Flags flags);
 
     /* Used for getFixupFrame (for FixupArity). */
     void initFixupFrame(StackFrame *prev, StackFrame::Flags flags, void *ncode, unsigned nactual);
 
     /* Used for eval. */
-    void initExecuteFrame(UnrootedScript script, StackFrame *prevLink, AbstractFramePtr prev,
+    void initExecuteFrame(RawScript script, StackFrame *prevLink, AbstractFramePtr prev,
                           FrameRegs *regs, const Value &thisv, JSObject &scopeChain,
                           ExecuteType type);
 
   public:
     /*
      * Frame prologue/epilogue
      *
      * Every stack frame must have 'prologue' called before executing the
@@ -722,21 +722,21 @@ class StackFrame
      * point of the outermost call. Inlined frame invariants:
      *
      * - Inlined frames have the same scope chain as the outer frame.
      * - Inlined frames have the same strictness as the outer frame.
      * - Inlined frames can only make calls to other JIT frames associated with
      *   the same VMFrame. Other calls force expansion of the inlined frames.
      */
 
-    UnrootedScript script() const {
+    RawScript script() const {
         return isFunctionFrame()
                ? isEvalFrame()
                  ? u.evalScript
-                 : (RawScript)fun()->nonLazyScript()
+                 : fun()->nonLazyScript()
                : exec.script;
     }
 
     /*
      * Get the frame's current bytecode, assuming 'this' is in 'stack'. Beware,
      * as the name implies, pcQuadratic can lead to quadratic behavior in loops
      * such as:
      *
@@ -1300,25 +1300,25 @@ class FrameRegs
     }
 
     /* For EnterMethodJIT: */
     void refreshFramePointer(StackFrame *fp) {
         fp_ = fp;
     }
 
     /* For stubs::CompileFunction, ContextStack: */
-    void prepareToRun(StackFrame &fp, UnrootedScript script) {
+    void prepareToRun(StackFrame &fp, RawScript script) {
         pc = script->code;
         sp = fp.slots() + script->nfixed;
         fp_ = &fp;
         inlined_ = NULL;
     }
 
     void setToEndOfScript() {
-        UnrootedScript script = fp()->script();
+        RawScript script = fp()->script();
         sp = fp()->base();
         pc = script->code + script->length - JSOP_STOP_LENGTH;
         JS_ASSERT(*pc == JSOP_STOP);
     }
 
     /* For expandInlineFrames: */
     void expandInline(StackFrame *innerfp, jsbytecode *innerpc) {
         pc = innerpc;
@@ -1728,18 +1728,18 @@ class ContextStack
      * function only returns a JSScript in the current compartment, returning
      * NULL if the current script is in a different compartment. This behavior
      * can be overridden by passing ALLOW_CROSS_COMPARTMENT.
      */
     enum MaybeAllowCrossCompartment {
         DONT_ALLOW_CROSS_COMPARTMENT = false,
         ALLOW_CROSS_COMPARTMENT = true
     };
-    inline UnrootedScript currentScript(jsbytecode **pc = NULL,
-                                        MaybeAllowCrossCompartment = DONT_ALLOW_CROSS_COMPARTMENT) const;
+    inline RawScript currentScript(jsbytecode **pc = NULL,
+                                   MaybeAllowCrossCompartment = DONT_ALLOW_CROSS_COMPARTMENT) const;
 
     /* Get the scope chain for the topmost scripted call on the stack. */
     inline HandleObject currentScriptedScopeChain() const;
 
     /*
      * Called by the methodjit for an arity mismatch. Arity mismatch can be
      * hot, so getFixupFrame avoids doing call setup performed by jit code when
      * FixupArity returns.
@@ -1921,17 +1921,17 @@ class StackIter
     bool isScript() const {
         JS_ASSERT(!done());
 #ifdef JS_ION
         if (data_.state_ == ION)
             return data_.ionFrames_.isScripted();
 #endif
         return data_.state_ == SCRIPTED;
     }
-    UnrootedScript script() const {
+    RawScript script() const {
         JS_ASSERT(isScript());
         if (data_.state_ == SCRIPTED)
             return interpFrame()->script();
 #ifdef JS_ION
         JS_ASSERT(data_.state_ == ION);
         return ionInlineFrames_.script();
 #else
         return NULL;
--- a/js/src/vm/String-inl.h
+++ b/js/src/vm/String-inl.h
@@ -22,19 +22,19 @@
 namespace js {
 
 template <AllowGC allowGC>
 static JS_ALWAYS_INLINE JSInlineString *
 NewShortString(JSContext *cx, Latin1Chars chars)
 {
     size_t len = chars.length();
     JS_ASSERT(JSShortString::lengthFits(len));
-    UnrootedInlineString str = JSInlineString::lengthFits(len)
-                               ? JSInlineString::new_<allowGC>(cx)
-                               : JSShortString::new_<allowGC>(cx);
+    RawInlineString str = JSInlineString::lengthFits(len)
+                          ? JSInlineString::new_<allowGC>(cx)
+                          : JSShortString::new_<allowGC>(cx);
     if (!str)
         return NULL;
 
     jschar *p = str->init(len);
     for (size_t i = 0; i < len; ++i)
         p[i] = static_cast<jschar>(chars[i]);
     p[len] = '\0';
     Probes::createString(cx, str, len);
--- a/js/src/vm/StringBuffer.cpp
+++ b/js/src/vm/StringBuffer.cpp
@@ -33,55 +33,55 @@ StringBuffer::extractWellSized()
             return NULL;
         }
         buf = tmp;
     }
 
     return buf;
 }
 
-UnrootedFlatString
+RawFlatString
 StringBuffer::finishString()
 {
     JSContext *cx = context();
     if (cb.empty())
-        return UnrootedFlatString(cx->names().empty);
+        return cx->names().empty;
 
     size_t length = cb.length();
     if (!JSString::validateLength(cx, length))
-        return UnrootedFlatString();
+        return NULL;
 
     JS_STATIC_ASSERT(JSShortString::MAX_SHORT_LENGTH < CharBuffer::InlineLength);
     if (JSShortString::lengthFits(length))
         return NewShortString<CanGC>(cx, TwoByteChars(cb.begin(), length));
 
     if (!cb.append('\0'))
-        return UnrootedFlatString();
+        return NULL;
 
     jschar *buf = extractWellSized();
     if (!buf)
-        return UnrootedFlatString();
+        return NULL;
 
     JSFlatString *str = js_NewString<CanGC>(cx, buf, length);
     if (!str)
         js_free(buf);
     return str;
 }
 
-UnrootedAtom
+RawAtom
 StringBuffer::finishAtom()
 {
     AssertCanGC();
     JSContext *cx = context();
 
     size_t length = cb.length();
     if (length == 0)
-        return UnrootedAtom(cx->names().empty);
+        return cx->names().empty;
 
-    UnrootedAtom atom = AtomizeChars<CanGC>(cx, cb.begin(), length);
+    RawAtom atom = AtomizeChars<CanGC>(cx, cb.begin(), length);
     cb.clear();
     return atom;
 }
 
 bool
 js::ValueToStringBufferSlow(JSContext *cx, const Value &arg, StringBuffer &sb)
 {
     RootedValue v(cx, arg);
--- a/js/src/vm/StringBuffer.h
+++ b/js/src/vm/StringBuffer.h
@@ -84,20 +84,20 @@ class StringBuffer
     const jschar *end() const { return cb.end(); }
     bool empty() const { return cb.empty(); }
     size_t length() const { return cb.length(); }
 
     /*
      * Creates a string from the characters in this buffer, then (regardless
      * whether string creation succeeded or failed) empties the buffer.
      */
-    js::UnrootedFlatString finishString();
+    js::RawFlatString finishString();
 
     /* Identical to finishString() except that an atom is created. */
-    js::UnrootedAtom finishAtom();
+    js::RawAtom finishAtom();
 
     /*
      * Creates a raw string from the characters in this buffer.  The string is
      * exactly the characters in this buffer: it is *not* null-terminated
      * unless the last appended character was |(jschar)0|.
      */
     jschar *extractWellSized();
 };
--- a/js/src/vm/StringObject.h
+++ b/js/src/vm/StringObject.h
@@ -55,14 +55,14 @@ class StringObject : public JSObject
     friend JSObject *
     ::js_InitStringClass(JSContext *cx, js::HandleObject global);
 
     /*
      * Compute the initial shape to associate with fresh String objects, which
      * encodes the initial length property. Return the shape after changing
      * this String object's last property to it.
      */
-    UnrootedShape assignInitialShape(JSContext *cx);
+    RawShape assignInitialShape(JSContext *cx);
 };
 
 } // namespace js
 
 #endif /* StringObject_h__ */