Bug 549143 - fatvals
authorLuke Wagner <lw@mozilla.com>
Wed, 14 Jul 2010 23:19:36 -0700
changeset 48470 9c869e64ee269732a0c2109568d07f10e816fdba
parent 48469 21e90d198613910da42308d61d6d2cb74d4e5241
child 48471 47300d15cd1c7c5056766f9c03bcad2592639797
push idunknown
push userunknown
push dateunknown
bugs549143
milestone2.0b2pre
Bug 549143 - fatvals
caps/idl/nsIScriptSecurityManager.idl
caps/include/nsScriptSecurityManager.h
caps/src/nsScriptSecurityManager.cpp
content/base/public/nsContentUtils.h
content/base/src/nsContentUtils.cpp
content/base/src/nsFrameMessageManager.cpp
content/canvas/src/CustomQS_Canvas2D.h
content/canvas/src/CustomQS_WebGL.h
content/canvas/src/NativeJSContext.cpp
content/canvas/src/NativeJSContext.h
content/events/src/nsEventListenerManager.cpp
content/events/src/nsEventListenerManager.h
content/html/document/src/nsHTMLDocument.cpp
content/html/document/src/nsHTMLDocument.h
content/xbl/src/nsXBLBinding.cpp
content/xbl/src/nsXBLDocumentInfo.cpp
content/xul/document/src/nsXULPrototypeDocument.cpp
dom/base/nsDOMClassInfo.cpp
dom/base/nsDOMClassInfo.h
dom/base/nsJSEnvironment.cpp
dom/base/nsJSUtils.h
dom/indexedDB/IDBCursor.cpp
dom/indexedDB/IDBEvents.cpp
dom/indexedDB/IDBObjectStore.cpp
dom/src/threads/nsDOMWorker.cpp
dom/src/threads/nsDOMWorkerSecurityManager.cpp
dom/src/threads/nsDOMWorkerSecurityManager.h
extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp
ipc/testshell/TestShellParent.cpp
ipc/testshell/XPCShellEnvironment.cpp
js/ipc/ObjectWrapperChild.cpp
js/ipc/ObjectWrapperParent.cpp
js/ipc/ObjectWrapperParent.h
js/jetpack/Handle.h
js/jetpack/JetpackActorCommon.cpp
js/jetpack/JetpackChild.cpp
js/jetpack/JetpackParent.cpp
js/jsd/jsd.h
js/jsd/jsd_val.c
js/jsd/jsd_xpc.cpp
js/jsd/jsdebug.c
js/jsd/jsdebug.h
js/src/Makefile.in
js/src/builtins.tbl
js/src/configure.in
js/src/ctypes/CTypes.cpp
js/src/ctypes/CTypes.h
js/src/ctypes/Library.cpp
js/src/jsapi-tests/testClassGetter.cpp
js/src/jsapi-tests/testConservativeGC.cpp
js/src/jsapi-tests/testDefineGetterSetterNonEnumerable.cpp
js/src/jsapi-tests/testExtendedEq.cpp
js/src/jsapi-tests/testGCChunkAlloc.cpp
js/src/jsapi-tests/testIsAboutToBeFinalized.cpp
js/src/jsapi-tests/testLookup.cpp
js/src/jsapi-tests/testNewObject.cpp
js/src/jsapi-tests/testPropCache.cpp
js/src/jsapi-tests/testSameValue.cpp
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jsatominlines.h
js/src/jsbool.cpp
js/src/jsbool.h
js/src/jsbuiltins.cpp
js/src/jsbuiltins.h
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jsdate.cpp
js/src/jsdate.h
js/src/jsdbgapi.cpp
js/src/jsdbgapi.h
js/src/jsdtoa.cpp
js/src/jsdtracef.cpp
js/src/jsdtracef.h
js/src/jsemit.cpp
js/src/jsemit.h
js/src/jsexn.cpp
js/src/jsexn.h
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsgc.cpp
js/src/jsgc.h
js/src/jsgcchunk.h
js/src/jsinterp.cpp
js/src/jsinterp.h
js/src/jsiter.cpp
js/src/jsiter.h
js/src/jslock.cpp
js/src/jslock.h
js/src/jsmath.cpp
js/src/jsmath.h
js/src/jsnum.cpp
js/src/jsnum.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/json.cpp
js/src/json.h
js/src/jsopcode.cpp
js/src/jsopcode.h
js/src/jsops.cpp
js/src/jsparse.cpp
js/src/jsparse.h
js/src/jspropertycache.cpp
js/src/jspropertycache.h
js/src/jspropertytree.cpp
js/src/jsproxy.cpp
js/src/jsproxy.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsrecursion.cpp
js/src/jsregexp.cpp
js/src/jsregexp.h
js/src/jsscope.cpp
js/src/jsscope.h
js/src/jsscopeinlines.h
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsstr.cpp
js/src/jsstr.h
js/src/jstl.h
js/src/jstracer.cpp
js/src/jstracer.h
js/src/jstypedarray.cpp
js/src/jstypedarray.h
js/src/jstypes.h
js/src/jsval.h
js/src/jsvalue.h
js/src/jsvector.h
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxdrapi.cpp
js/src/jsxdrapi.h
js/src/jsxml.cpp
js/src/jsxml.h
js/src/shell/Makefile.in
js/src/shell/js.cpp
js/src/shell/jsworkers.cpp
js/src/tests/ecma_3/Operators/jstests.list
js/src/tests/js1_5/GC/regress-348532.js
js/src/trace-test/tests/basic/bug569651.js
js/src/trace-test/tests/basic/bug572229.js
js/src/trace-test/tests/basic/testIteratorReification.js
js/src/trace-test/tests/basic/testSuppressDeletedProperty.js
js/src/xpconnect/idl/nsIXPCScriptable.idl
js/src/xpconnect/idl/nsIXPCSecurityManager.idl
js/src/xpconnect/idl/nsIXPConnect.idl
js/src/xpconnect/loader/mozJSComponentLoader.cpp
js/src/xpconnect/public/nsAutoJSValHolder.h
js/src/xpconnect/public/xpc_map_end.h
js/src/xpconnect/shell/xpcshell.cpp
js/src/xpconnect/src/XPCChromeObjectWrapper.cpp
js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
js/src/xpconnect/src/XPCDispConvert.cpp
js/src/xpconnect/src/XPCDispInlines.h
js/src/xpconnect/src/XPCDispInterface.cpp
js/src/xpconnect/src/XPCDispObject.cpp
js/src/xpconnect/src/XPCDispPrivate.h
js/src/xpconnect/src/XPCDispTearOff.cpp
js/src/xpconnect/src/XPCDispTypeInfo.cpp
js/src/xpconnect/src/XPCIDispatchExtension.cpp
js/src/xpconnect/src/XPCNativeWrapper.cpp
js/src/xpconnect/src/XPCNativeWrapper.h
js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp
js/src/xpconnect/src/XPCSystemOnlyWrapper.cpp
js/src/xpconnect/src/XPCWrapper.cpp
js/src/xpconnect/src/XPCWrapper.h
js/src/xpconnect/src/dom_quickstubs.qsconf
js/src/xpconnect/src/nsXPConnect.cpp
js/src/xpconnect/src/qsgen.py
js/src/xpconnect/src/xpccallcontext.cpp
js/src/xpconnect/src/xpccomponents.cpp
js/src/xpconnect/src/xpcconvert.cpp
js/src/xpconnect/src/xpcinlines.h
js/src/xpconnect/src/xpcjsid.cpp
js/src/xpconnect/src/xpcjsruntime.cpp
js/src/xpconnect/src/xpcprivate.h
js/src/xpconnect/src/xpcquickstubs.cpp
js/src/xpconnect/src/xpcquickstubs.h
js/src/xpconnect/src/xpcruntimesvc.cpp
js/src/xpconnect/src/xpcstring.cpp
js/src/xpconnect/src/xpcthreadcontext.cpp
js/src/xpconnect/src/xpcthrower.cpp
js/src/xpconnect/src/xpcvariant.cpp
js/src/xpconnect/src/xpcwrappedjs.cpp
js/src/xpconnect/src/xpcwrappedjsclass.cpp
js/src/xpconnect/src/xpcwrappednative.cpp
js/src/xpconnect/src/xpcwrappednativeinfo.cpp
js/src/xpconnect/src/xpcwrappednativejsops.cpp
js/src/xpconnect/src/xpcwrappednativescope.cpp
js/src/xpconnect/tests/TestXPC.cpp
js/src/xpconnect/wrappers/AccessCheck.cpp
js/src/xpconnect/wrappers/FilteringWrapper.cpp
js/src/xpconnect/wrappers/FilteringWrapper.h
js/src/xpconnect/wrappers/XrayWrapper.cpp
js/src/xpconnect/wrappers/XrayWrapper.h
modules/plugin/base/src/nsJSNPRuntime.cpp
modules/plugin/base/src/nsNPAPIPlugin.cpp
modules/plugin/base/src/nsNPAPIPlugin.h
storage/src/mozStorageAsyncStatementJSHelper.cpp
storage/src/mozStorageAsyncStatementParams.cpp
storage/src/mozStoragePrivateHelpers.cpp
storage/src/mozStorageStatementJSHelper.cpp
storage/src/mozStorageStatementParams.cpp
storage/src/mozStorageStatementRow.cpp
xpcom/base/nsrootidl.idl
xpcom/typelib/xpidl/xpidl.h
xpcom/typelib/xpidl/xpidl_header.c
--- a/caps/idl/nsIScriptSecurityManager.idl
+++ b/caps/idl/nsIScriptSecurityManager.idl
@@ -46,17 +46,17 @@ interface nsIScriptSecurityManager : nsI
 {
     ///////////////// Security Checks //////////////////
     /**
      * Checks whether the running script is allowed to access aProperty.
      */
     [noscript] void checkPropertyAccess(in JSContextPtr aJSContext,
                                         in JSObjectPtr aJSObject,
                                         in string aClassName,
-                                        in jsval aProperty,
+                                        in jsid aProperty,
                                         in PRUint32 aAction);
 
     /**
      * Check that the script currently running in context "cx" can load "uri".
      *
      * Will return error code NS_ERROR_DOM_BAD_URI if the load request 
      * should be denied.
      *
--- a/caps/include/nsScriptSecurityManager.h
+++ b/caps/include/nsScriptSecurityManager.h
@@ -170,38 +170,38 @@ union SecurityLevel
 
 #define SECURITY_ACCESS_LEVEL_FLAG(_sl) \
            ((_sl.level == 0) || \
             (_sl.level & SCRIPT_SECURITY_ACCESS_IS_SET_BIT))
 
 
 struct PropertyPolicy : public PLDHashEntryHdr
 {
-    jsval          key;  // property name as jsval
+    JSString       *key;  // interned string
     SecurityLevel  mGet;
     SecurityLevel  mSet;
 };
 
 static PRBool
 InitPropertyPolicyEntry(PLDHashTable *table,
                      PLDHashEntryHdr *entry,
                      const void *key)
 {
     PropertyPolicy* pp = (PropertyPolicy*)entry;
-    pp->key = (jsval)key;
+    pp->key = (JSString *)key;
     pp->mGet.level = SCRIPT_SECURITY_UNDEFINED_ACCESS;
     pp->mSet.level = SCRIPT_SECURITY_UNDEFINED_ACCESS;
     return PR_TRUE;
 }
 
 static void
 ClearPropertyPolicyEntry(PLDHashTable *table, PLDHashEntryHdr *entry)
 {
     PropertyPolicy* pp = (PropertyPolicy*)entry;
-    pp->key = JSVAL_VOID;
+    pp->key = NULL;
 }
 
 // Class Policy
 #define NO_POLICY_FOR_CLASS (ClassPolicy*)1
 
 struct ClassPolicy : public PLDHashEntryHdr
 {
     char* key;
@@ -421,17 +421,17 @@ public:
 private:
 
     // GetScriptSecurityManager is the only call that can make one
     nsScriptSecurityManager();
     virtual ~nsScriptSecurityManager();
 
     static JSBool
     CheckObjectAccess(JSContext *cx, JSObject *obj,
-                      jsval id, JSAccessMode mode,
+                      jsid id, JSAccessMode mode,
                       jsval *vp);
 
     // Decides, based on CSP, whether or not eval() and stuff can be executed.
     static JSBool
     ContentSecurityPolicyPermitsJSAction(JSContext *cx);
 
     // Returns null if a principal cannot be found; generally callers
     // should error out at that point.
@@ -448,27 +448,27 @@ private:
     doGetSubjectPrincipal(nsresult* rv);
     
     nsresult
     CheckPropertyAccessImpl(PRUint32 aAction,
                             nsAXPCNativeCallContext* aCallContext,
                             JSContext* cx, JSObject* aJSObject,
                             nsISupports* aObj, nsIURI* aTargetURI,
                             nsIClassInfo* aClassInfo,
-                            const char* aClassName, jsval aProperty,
+                            const char* aClassName, jsid aProperty,
                             void** aCachedClassPolicy);
 
     nsresult
     CheckSameOriginDOMProp(nsIPrincipal* aSubject, 
                            nsIPrincipal* aObject,
                            PRUint32 aAction);
 
     nsresult
     LookupPolicy(nsIPrincipal* principal,
-                 ClassInfoData& aClassData, jsval aProperty,
+                 ClassInfoData& aClassData, jsid aProperty,
                  PRUint32 aAction,
                  ClassPolicy** aCachedClassPolicy,
                  SecurityLevel* result);
 
     nsresult
     CreateCodebasePrincipal(nsIURI* aURI, nsIPrincipal** result);
 
     // This is just like the API method, but it doesn't check that the subject
@@ -607,17 +607,17 @@ private:
 
         ContextPrincipal *mNext;
         JSContext *mCx;
         JSStackFrame *mFp;
         nsCOMPtr<nsIPrincipal> mPrincipal;
     };
 
     // JS strings we need to clean up on shutdown
-    static jsval sEnabledID;
+    static jsid sEnabledID;
 
     inline void
     ScriptSecurityPrefChanged();
 
     static const char sJSEnabledPrefName[];
     static const char sFileOriginPolicyPrefName[];
 
     nsObjectHashtable* mOriginToPolicyMap;
--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -111,19 +111,25 @@ PRBool nsScriptSecurityManager::sStrictF
 static JSEqualityOp sXPCWrappedNativeEqualityOps;
 
 
 ///////////////////////////
 // Convenience Functions //
 ///////////////////////////
 // Result of this function should not be freed.
 static inline const PRUnichar *
-JSValIDToString(JSContext *cx, const jsval idval)
+IDToString(JSContext *cx, jsid id)
 {
+    if (JSID_IS_STRING(id))
+        return reinterpret_cast<PRUnichar*>(JS_GetStringChars(JSID_TO_STRING(id)));
+
     JSAutoRequest ar(cx);
+    jsval idval;
+    if (!JS_IdToValue(cx, id, &idval))
+        return nsnull;
     JSString *str = JS_ValueToString(cx, idval);
     if(!str)
         return nsnull;
     return reinterpret_cast<PRUnichar*>(JS_GetStringChars(str));
 }
 
 class nsAutoInPrincipalDomainOriginSetter {
 public:
@@ -560,17 +566,17 @@ nsScriptSecurityManager::ContentSecurity
     }
 
     return evalOK;
 }
 
 
 JSBool
 nsScriptSecurityManager::CheckObjectAccess(JSContext *cx, JSObject *obj,
-                                           jsval id, JSAccessMode mode,
+                                           jsid id, JSAccessMode mode,
                                            jsval *vp)
 {
     // Get the security manager
     nsScriptSecurityManager *ssm =
         nsScriptSecurityManager::GetScriptSecurityManager();
 
     NS_ASSERTION(ssm, "Failed to get security manager service");
     if (!ssm)
@@ -599,17 +605,17 @@ nsScriptSecurityManager::CheckObjectAcce
 
     return JS_TRUE;
 }
 
 NS_IMETHODIMP
 nsScriptSecurityManager::CheckPropertyAccess(JSContext* cx,
                                              JSObject* aJSObject,
                                              const char* aClassName,
-                                             jsval aProperty,
+                                             jsid aProperty,
                                              PRUint32 aAction)
 {
     return CheckPropertyAccessImpl(aAction, nsnull, cx, aJSObject,
                                    nsnull, nsnull, nsnull,
                                    aClassName, aProperty, nsnull);
 }
 
 NS_IMETHODIMP
@@ -679,17 +685,17 @@ nsScriptSecurityManager::CheckSameOrigin
 }
 
 nsresult
 nsScriptSecurityManager::CheckPropertyAccessImpl(PRUint32 aAction,
                                                  nsAXPCNativeCallContext* aCallContext,
                                                  JSContext* cx, JSObject* aJSObject,
                                                  nsISupports* aObj, nsIURI* aTargetURI,
                                                  nsIClassInfo* aClassInfo,
-                                                 const char* aClassName, jsval aProperty,
+                                                 const char* aClassName, jsid aProperty,
                                                  void** aCachedClassPolicy)
 {
     nsresult rv;
     nsIPrincipal* subjectPrincipal = GetSubjectPrincipal(cx, &rv);
     if (NS_FAILED(rv))
         return rv;
 
     if (!subjectPrincipal || subjectPrincipal == mSystemPrincipal)
@@ -698,17 +704,17 @@ nsScriptSecurityManager::CheckPropertyAc
 
     nsCOMPtr<nsIPrincipal> objectPrincipal;
 
     // Hold the class info data here so we don't have to go back to virtual
     // methods all the time
     ClassInfoData classInfoData(aClassInfo, aClassName);
 #ifdef DEBUG_CAPS_CheckPropertyAccessImpl
     nsCAutoString propertyName;
-    propertyName.AssignWithConversion((PRUnichar*)JSValIDToString(cx, aProperty));
+    propertyName.AssignWithConversion((PRUnichar*)IDToString(cx, aProperty));
     printf("### CanAccess(%s.%s, %i) ", classInfoData.GetName(), 
            propertyName.get(), aAction);
 #endif
 
     //-- Look up the security policy for this class and subject domain
     SecurityLevel securityLevel;
     rv = LookupPolicy(subjectPrincipal, classInfoData, aProperty, aAction, 
                       (ClassPolicy**)aCachedClassPolicy, &securityLevel);
@@ -820,27 +826,27 @@ nsScriptSecurityManager::CheckPropertyAc
         if (NS_SUCCEEDED(rv) && interfaceInfo)
             rv = interfaceInfo->GetIIDShared(&objIID);
         if (NS_SUCCEEDED(rv) && objIID)
         {
             switch (aAction)
             {
             case nsIXPCSecurityManager::ACCESS_GET_PROPERTY:
                 checkedComponent->CanGetProperty(objIID,
-                                                 JSValIDToString(cx, aProperty),
+                                                 IDToString(cx, aProperty),
                                                  getter_Copies(objectSecurityLevel));
                 break;
             case nsIXPCSecurityManager::ACCESS_SET_PROPERTY:
                 checkedComponent->CanSetProperty(objIID,
-                                                 JSValIDToString(cx, aProperty),
+                                                 IDToString(cx, aProperty),
                                                  getter_Copies(objectSecurityLevel));
                 break;
             case nsIXPCSecurityManager::ACCESS_CALL_METHOD:
                 checkedComponent->CanCallMethod(objIID,
-                                                JSValIDToString(cx, aProperty),
+                                                IDToString(cx, aProperty),
                                                 getter_Copies(objectSecurityLevel));
             }
         }
     }
     rv = CheckXPCPermissions(cx, aObj, aJSObject, subjectPrincipal,
                              objectSecurityLevel);
 #ifdef DEBUG_CAPS_CheckPropertyAccessImpl
     if(NS_SUCCEEDED(rv))
@@ -901,17 +907,17 @@ nsScriptSecurityManager::CheckPropertyAc
         NS_ConvertUTF8toUTF16 objectOriginUnicode(objectOrigin);
         NS_ConvertUTF8toUTF16 objectDomainUnicode(objectDomain);
 
         nsXPIDLString errorMsg;
         const PRUnichar *formatStrings[] =
         {
             subjectOriginUnicode.get(),
             className.get(),
-            JSValIDToString(cx, aProperty),
+            IDToString(cx, aProperty),
             objectOriginUnicode.get(),
             subjectDomainUnicode.get(),
             objectDomainUnicode.get()
         };
 
         PRUint32 length = NS_ARRAY_LENGTH(formatStrings);
 
         // XXXbz Our localization system is stupid and can't handle not showing
@@ -1070,17 +1076,17 @@ nsScriptSecurityManager::CheckSameOrigin
     ** Access tests failed, so now report error.
     */
     return NS_ERROR_DOM_PROP_ACCESS_DENIED;
 }
 
 nsresult
 nsScriptSecurityManager::LookupPolicy(nsIPrincipal* aPrincipal,
                                       ClassInfoData& aClassData,
-                                      jsval aProperty,
+                                      jsid aProperty,
                                       PRUint32 aAction,
                                       ClassPolicy** aCachedClassPolicy,
                                       SecurityLevel* result)
 {
     nsresult rv;
     result->level = SCRIPT_SECURITY_UNDEFINED_ACCESS;
 
     DomainPolicy* dpolicy = nsnull;
@@ -1181,39 +1187,48 @@ nsScriptSecurityManager::LookupPolicy(ns
 
         if (PL_DHASH_ENTRY_IS_FREE(cpolicy))
             cpolicy = NO_POLICY_FOR_CLASS;
 
         if ((dpolicy == mDefaultPolicy) && aCachedClassPolicy)
             *aCachedClassPolicy = cpolicy;
     }
 
+    NS_ASSERTION(JSID_IS_INT(aProperty) || JSID_IS_OBJECT(aProperty) ||
+                 JSID_IS_STRING(aProperty), "Property must be a valid id");
+
+    // Only atomized strings are stored in the policies' hash tables.
+    if (!JSID_IS_STRING(aProperty))
+        return NS_OK;
+
+    JSString *propertyKey = JSID_TO_STRING(aProperty);
+
     // We look for a PropertyPolicy in the following places:
     // 1)  The ClassPolicy for our class we got from our DomainPolicy
     // 2)  The mWildcardPolicy of our DomainPolicy
     // 3)  The ClassPolicy for our class we got from mDefaultPolicy
     // 4)  The mWildcardPolicy of our mDefaultPolicy
     PropertyPolicy* ppolicy = nsnull;
     if (cpolicy != NO_POLICY_FOR_CLASS)
     {
         ppolicy = static_cast<PropertyPolicy*>
                              (PL_DHashTableOperate(cpolicy->mPolicy,
-                                                      (void*)aProperty,
+                                                      propertyKey,
                                                       PL_DHASH_LOOKUP));
     }
 
     // If there is no class policy for this property, and we have a wildcard
     // policy, try that.
     if (dpolicy->mWildcardPolicy &&
         (!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy)))
     {
         ppolicy =
             static_cast<PropertyPolicy*>
                        (PL_DHashTableOperate(dpolicy->mWildcardPolicy->mPolicy,
-                                                (void*)aProperty,
+                                                propertyKey,
                                                 PL_DHASH_LOOKUP));
     }
 
     // If dpolicy is not the defauly policy and there's no class or wildcard
     // policy for this property, check the default policy for this class and
     // the default wildcard policy
     if (dpolicy != mDefaultPolicy &&
         (!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy)))
@@ -1223,27 +1238,27 @@ nsScriptSecurityManager::LookupPolicy(ns
                                                       aClassData.GetName(),
                                                       PL_DHASH_LOOKUP));
 
         if (PL_DHASH_ENTRY_IS_BUSY(cpolicy))
         {
             ppolicy =
                 static_cast<PropertyPolicy*>
                            (PL_DHashTableOperate(cpolicy->mPolicy,
-                                                    (void*)aProperty,
+                                                    propertyKey,
                                                     PL_DHASH_LOOKUP));
         }
 
         if ((!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy)) &&
             mDefaultPolicy->mWildcardPolicy)
         {
             ppolicy =
               static_cast<PropertyPolicy*>
                          (PL_DHashTableOperate(mDefaultPolicy->mWildcardPolicy->mPolicy,
-                                                  (void*)aProperty,
+                                                  propertyKey,
                                                   PL_DHASH_LOOKUP));
         }
     }
 
     if (!ppolicy || PL_DHASH_ENTRY_IS_FREE(ppolicy))
         return NS_OK;
 
     // Get the correct security level from the property policy
@@ -2363,17 +2378,17 @@ nsScriptSecurityManager::doGetObjectPrin
 {
     NS_ASSERTION(aObj, "Bad call to doGetObjectPrincipal()!");
     nsIPrincipal* result = nsnull;
 
 #ifdef DEBUG
     JSObject* origObj = aObj;
 #endif
     
-    const JSClass *jsClass = aObj->getClass();
+    js::Class *jsClass = aObj->getClass();
 
     // A common case seen in this code is that we enter this function
     // with aObj being a Function object, whose parent is a Call
     // object. Neither of those have object principals, so we can skip
     // those objects here before we enter the below loop. That way we
     // avoid wasting time checking properties of their classes etc in
     // the loop.
 
@@ -3036,21 +3051,21 @@ nsScriptSecurityManager::CheckComponentP
 
 #ifdef DEBUG_CAPS_CheckComponentPermissions
     printf("### CheckComponentPermissions(ClassID.%s) ",cid.get());
 #endif
 
     // Look up the policy for this class.
     // while this isn't a property we'll treat it as such, using ACCESS_CALL_METHOD
     JSAutoRequest ar(cx);
-    jsval cidVal = STRING_TO_JSVAL(::JS_InternString(cx, cid.get()));
+    jsid cidId = INTERNED_STRING_TO_JSID(::JS_InternString(cx, cid.get()));
 
     ClassInfoData nameData(nsnull, "ClassID");
     SecurityLevel securityLevel;
-    rv = LookupPolicy(subjectPrincipal, nameData, cidVal,
+    rv = LookupPolicy(subjectPrincipal, nameData, cidId,
                       nsIXPCSecurityManager::ACCESS_CALL_METHOD, 
                       nsnull, &securityLevel);
     if (NS_FAILED(rv))
         return rv;
 
     // If there's no policy stored, use the "security.classID.allowByDefault" pref 
     if (securityLevel.level == SCRIPT_SECURITY_UNDEFINED_ACCESS)
         securityLevel.level = mXPCDefaultGrantAll ? SCRIPT_SECURITY_ALL_ACCESS :
@@ -3143,17 +3158,17 @@ nsScriptSecurityManager::CanGetService(J
 
 NS_IMETHODIMP
 nsScriptSecurityManager::CanAccess(PRUint32 aAction,
                                    nsAXPCNativeCallContext* aCallContext,
                                    JSContext* cx,
                                    JSObject* aJSObject,
                                    nsISupports* aObj,
                                    nsIClassInfo* aClassInfo,
-                                   jsval aPropertyName,
+                                   jsid aPropertyName,
                                    void** aPolicy)
 {
     return CheckPropertyAccessImpl(aAction, aCallContext, cx,
                                    aJSObject, aObj, nsnull, aClassInfo,
                                    nsnull, aPropertyName, aPolicy);
 }
 
 nsresult
@@ -3343,18 +3358,18 @@ nsresult nsScriptSecurityManager::Init()
 
     NS_ADDREF(sXPConnect = xpconnect);
     NS_ADDREF(sJSContextStack = xpconnect);
 
     JSContext* cx = GetSafeJSContext();
     if (!cx) return NS_ERROR_FAILURE;   // this can happen of xpt loading fails
     
     ::JS_BeginRequest(cx);
-    if (sEnabledID == JSVAL_VOID)
-        sEnabledID = STRING_TO_JSVAL(::JS_InternString(cx, "enabled"));
+    if (sEnabledID == JSID_VOID)
+        sEnabledID = INTERNED_STRING_TO_JSID(::JS_InternString(cx, "enabled"));
     ::JS_EndRequest(cx);
 
     InitPrefs();
 
     nsresult rv = CallGetService(NS_IOSERVICE_CONTRACTID, &sIOService);
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsIStringBundleService> bundleService =
@@ -3397,17 +3412,17 @@ nsresult nsScriptSecurityManager::Init()
     NS_ASSERTION(!oldcallbacks, "Someone else set security callbacks!");
 
     sXPConnect->GetXPCWrappedNativeJSClassInfo(&sXPCWrappedNativeEqualityOps);
     return NS_OK;
 }
 
 static nsScriptSecurityManager *gScriptSecMan = nsnull;
 
-jsval nsScriptSecurityManager::sEnabledID   = JSVAL_VOID;
+jsid nsScriptSecurityManager::sEnabledID   = JSID_VOID;
 
 nsScriptSecurityManager::~nsScriptSecurityManager(void)
 {
     NS_ASSERTION(!mContextPrincipals, "Leaking mContextPrincipals");
     delete mOriginToPolicyMap;
     if(mDefaultPolicy)
         mDefaultPolicy->Drop();
     delete mCapabilities;
@@ -3416,17 +3431,17 @@ nsScriptSecurityManager::~nsScriptSecuri
 
 void
 nsScriptSecurityManager::Shutdown()
 {
     if (sRuntime) {
         JS_SetRuntimeSecurityCallbacks(sRuntime, NULL);
         sRuntime = nsnull;
     }
-    sEnabledID = JSVAL_VOID;
+    sEnabledID = JSID_VOID;
 
     NS_IF_RELEASE(sIOService);
     NS_IF_RELEASE(sXPConnect);
     NS_IF_RELEASE(sJSContextStack);
     NS_IF_RELEASE(sStrBundle);
 }
 
 nsScriptSecurityManager *
@@ -3746,21 +3761,19 @@ nsScriptSecurityManager::InitDomainPolic
 
         JSAutoRequest ar(cx);
 
         JSString* propertyKey = ::JS_InternString(cx, start);
         if (!propertyKey)
             return NS_ERROR_OUT_OF_MEMORY;
 
         // Store this property in the class policy
-        const void* ppkey =
-          reinterpret_cast<const void*>(STRING_TO_JSVAL(propertyKey));
         PropertyPolicy* ppolicy = 
           static_cast<PropertyPolicy*>
-                     (PL_DHashTableOperate(cpolicy->mPolicy, ppkey,
+                     (PL_DHashTableOperate(cpolicy->mPolicy, propertyKey,
                                               PL_DHASH_ADD));
         if (!ppolicy)
             break;
 
         if (end) // The pref specifies an access mode
         {
             start = end + 1;
             if (PL_strcasecmp(start, "set") == 0)
@@ -4018,17 +4031,17 @@ static PLDHashOperator
 PrintPropertyPolicy(PLDHashTable *table, PLDHashEntryHdr *entry,
                     PRUint32 number, void *arg)
 {
     PropertyPolicy* pp = (PropertyPolicy*)entry;
     nsCAutoString prop("        ");
     JSContext* cx = (JSContext*)arg;
     prop.AppendInt((PRUint32)pp->key);
     prop += ' ';
-    prop.AppendWithConversion((PRUnichar*)JSValIDToString(cx, pp->key));
+    prop.AppendWithConversion((PRUnichar*)JS_GetStringChars(pp->key));
     prop += ": Get=";
     if (SECURITY_ACCESS_LEVEL_FLAG(pp->mGet))
         prop.AppendInt(pp->mGet.level);
     else
         prop += pp->mGet.capability;
 
     prop += " Set=";
     if (SECURITY_ACCESS_LEVEL_FLAG(pp->mSet))
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -1798,17 +1798,17 @@ public:
     mPtr(aPtr), mRootType(RootType_Object)
   {
     MOZILLA_GUARD_OBJECT_NOTIFIER_INIT;
     mResult = *aResult = AddJSGCRoot(aPtr, RootType_Object, "nsAutoGCRoot");
   }
 
   ~nsAutoGCRoot() {
     if (NS_SUCCEEDED(mResult)) {
-      RemoveJSGCRoot(mPtr, mRootType);
+      RemoveJSGCRoot((jsval *)mPtr, mRootType);
     }
   }
 
   static void Shutdown();
 
 private:
   enum RootType { RootType_JSVal, RootType_Object };
   static nsresult AddJSGCRoot(void *aPtr, RootType aRootType, const char* aName);
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5614,25 +5614,16 @@ CloneSimpleValues(JSContext* cx,
 {
   *wasCloned = PR_TRUE;
 
   // No cloning necessary for these non-GC'd jsvals.
   if (!JSVAL_IS_GCTHING(val) || JSVAL_IS_NULL(val)) {
     return SetPropertyOnValueOrObject(cx, val, rval, robj, rid);
   }
 
-  // Clone doubles.
-  if (JSVAL_IS_DOUBLE(val)) {
-    jsval newVal;
-    if (!JS_NewDoubleValue(cx, *JSVAL_TO_DOUBLE(val), &newVal)) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-    return SetPropertyOnValueOrObject(cx, newVal, rval, robj, rid);
-  }
-
   // We'll use immutable strings to prevent copying if we can.
   if (JSVAL_IS_STRING(val)) {
     if (!JS_MakeStringImmutable(cx, JSVAL_TO_STRING(val))) {
       return NS_ERROR_FAILURE;
     }
     return SetPropertyOnValueOrObject(cx, val, rval, robj, rid);
   }
 
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -417,21 +417,21 @@ nsFrameMessageManager::ReceiveMessage(ns
           thisValue = OBJECT_TO_JSVAL(object);
         }
 
         jsval rval = JSVAL_VOID;
         nsAutoGCRoot resultGCRoot4(&rval, &rv);
         NS_ENSURE_SUCCESS(rv, rv);
 
         js::AutoValueRooter argv(ctx);
-        argv.setObject(param);
+        argv.set(OBJECT_TO_JSVAL(param));
 
         JSObject* thisObject = JSVAL_TO_OBJECT(thisValue);
         JS_CallFunctionValue(ctx, thisObject,
-                             funval, 1, argv.addr(), &rval);
+                             funval, 1, argv.jsval_addr(), &rval);
         if (aJSONRetVal) {
           nsString json;
           if (JS_TryJSON(ctx, &rval) &&
               JS_Stringify(ctx, &rval, nsnull, JSVAL_NULL,
                            JSONCreator, &json)) {
             aJSONRetVal->AppendElement(json);
           }
         }
--- a/content/canvas/src/CustomQS_Canvas2D.h
+++ b/content/canvas/src/CustomQS_Canvas2D.h
@@ -39,24 +39,24 @@
 
 #include "nsDOMError.h"
 #include "nsIDOMCanvasRenderingContext2D.h"
 
 typedef nsresult (NS_STDCALL nsIDOMCanvasRenderingContext2D::*CanvasStyleSetterType)(const nsAString &, nsISupports *);
 typedef nsresult (NS_STDCALL nsIDOMCanvasRenderingContext2D::*CanvasStyleGetterType)(nsAString &, nsISupports **, PRInt32 *);
 
 static JSBool
-Canvas2D_SetStyleHelper(JSContext *cx, JSObject *obj, jsval id, jsval *vp,
+Canvas2D_SetStyleHelper(JSContext *cx, JSObject *obj, jsid id, jsval *vp,
                         CanvasStyleSetterType setfunc)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     nsIDOMCanvasRenderingContext2D *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     nsresult rv;
 
     if (JSVAL_IS_STRING(*vp)) {
         xpc_qsDOMString arg0(cx, *vp, vp,
                              xpc_qsDOMString::eDefaultNullBehavior,
                              xpc_qsDOMString::eDefaultUndefinedBehavior);
@@ -64,34 +64,34 @@ Canvas2D_SetStyleHelper(JSContext *cx, J
             return JS_FALSE;
 
         rv = (self->*setfunc)(arg0, nsnull);
     } else {
         nsISupports *arg0;
         xpc_qsSelfRef arg0ref;
         rv = xpc_qsUnwrapArg<nsISupports>(cx, *vp, &arg0, &arg0ref.ptr, vp);
         if (NS_FAILED(rv)) {
-            xpc_qsThrowBadSetterValue(cx, rv, JSVAL_TO_OBJECT(*tvr.addr()), id);
+            xpc_qsThrowBadSetterValue(cx, rv, JSVAL_TO_OBJECT(*tvr.jsval_addr()), id);
             return JS_FALSE;
         }
 
         nsString voidStr;
         voidStr.SetIsVoid(PR_TRUE);
 
         rv = (self->*setfunc)(voidStr, arg0);
     }
 
     if (NS_FAILED(rv))
-        return xpc_qsThrowGetterSetterFailed(cx, rv, JSVAL_TO_OBJECT(*tvr.addr()), id);
+        return xpc_qsThrowGetterSetterFailed(cx, rv, JSVAL_TO_OBJECT(*tvr.jsval_addr()), id);
 
     return JS_TRUE;
 }
 
 static JSBool
-Canvas2D_GetStyleHelper(JSContext *cx, JSObject *obj, jsval id, jsval *vp,
+Canvas2D_GetStyleHelper(JSContext *cx, JSObject *obj, jsid id, jsval *vp,
                         CanvasStyleGetterType getfunc)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     nsIDOMCanvasRenderingContext2D *self;
     xpc_qsSelfRef selfref;
     XPCLazyCallContext lccx(JS_CALLER, cx, obj);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, vp, &lccx))
         return JS_FALSE;
@@ -117,35 +117,35 @@ Canvas2D_GetStyleHelper(JSContext *cx, J
                                         &NS_GET_IID(nsIDOMCanvasGradient), &interfaces[k_nsIDOMCanvasGradient], vp);
 
     default:
         return xpc_qsThrowGetterSetterFailed(cx, NS_ERROR_FAILURE, JSVAL_TO_OBJECT(*vp), id);
     }
 }
 
 static JSBool
-nsIDOMCanvasRenderingContext2D_SetStrokeStyle(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+nsIDOMCanvasRenderingContext2D_SetStrokeStyle(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     return Canvas2D_SetStyleHelper(cx, obj, id, vp, &nsIDOMCanvasRenderingContext2D::SetStrokeStyle_multi);
 }
 
 static JSBool
-nsIDOMCanvasRenderingContext2D_GetStrokeStyle(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+nsIDOMCanvasRenderingContext2D_GetStrokeStyle(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     return Canvas2D_GetStyleHelper(cx, obj, id, vp, &nsIDOMCanvasRenderingContext2D::GetStrokeStyle_multi);
 }
 
 static JSBool
-nsIDOMCanvasRenderingContext2D_SetFillStyle(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+nsIDOMCanvasRenderingContext2D_SetFillStyle(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     return Canvas2D_SetStyleHelper(cx, obj, id, vp, &nsIDOMCanvasRenderingContext2D::SetFillStyle_multi);
 }
 
 static JSBool
-nsIDOMCanvasRenderingContext2D_GetFillStyle(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+nsIDOMCanvasRenderingContext2D_GetFillStyle(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     return Canvas2D_GetStyleHelper(cx, obj, id, vp, &nsIDOMCanvasRenderingContext2D::GetFillStyle_multi);
 }
 
 static JSBool
 nsIDOMCanvasRenderingContext2D_CreateImageData(JSContext *cx, uintN argc, jsval *vp)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
@@ -174,24 +174,24 @@ nsIDOMCanvasRenderingContext2D_CreateIma
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
     uint32 len = len0 * 4;
     if (len / 4 != len0)
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
     // create the fast typed array; it's initialized to 0 by default
     JSObject *darray = js_CreateTypedArray(cx, js::TypedArray::TYPE_UINT8_CLAMPED, len);
-    js::AutoValueRooter rd(cx, darray);
+    js::AutoObjectRooter rd(cx, darray);
     if (!darray)
         return JS_FALSE;
 
     // Do JS_NewObject after CreateTypedArray, so that gc will get
     // triggered here if necessary
     JSObject *result = JS_NewObject(cx, NULL, NULL, NULL);
-    js::AutoValueRooter rr(cx, result);
+    js::AutoObjectRooter rr(cx, result);
     if (!result)
         return JS_FALSE;
 
     if (!JS_DefineProperty(cx, result, "width", INT_TO_JSVAL(w), NULL, NULL, JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT) ||
         !JS_DefineProperty(cx, result, "height", INT_TO_JSVAL(h), NULL, NULL, JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT) ||
         !JS_DefineProperty(cx, result, "data", OBJECT_TO_JSVAL(darray), NULL, NULL, JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT))
         return JS_FALSE;
 
@@ -208,17 +208,17 @@ nsIDOMCanvasRenderingContext2D_GetImageD
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsIDOMCanvasRenderingContext2D *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 4)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     int32 x, y;
@@ -241,31 +241,31 @@ nsIDOMCanvasRenderingContext2D_GetImageD
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
     uint32 len = len0 * 4;
     if (len / 4 != len0)
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
     // create the fast typed array
     JSObject *darray = js_CreateTypedArray(cx, js::TypedArray::TYPE_UINT8_CLAMPED, len);
-    js::AutoValueRooter rd(cx, darray);
+    js::AutoObjectRooter rd(cx, darray);
     if (!darray)
         return JS_FALSE;
 
     js::TypedArray *tdest = js::TypedArray::fromJSObject(darray);
 
     // make the call
     rv = self->GetImageData_explicit(x, y, w, h, (PRUint8*) tdest->data, tdest->byteLength);
     if (NS_FAILED(rv))
         return xpc_qsThrowMethodFailed(cx, rv, vp);
 
     // Do JS_NewObject after CreateTypedArray, so that gc will get
     // triggered here if necessary
     JSObject *result = JS_NewObject(cx, NULL, NULL, NULL);
-    js::AutoValueRooter rr(cx, result);
+    js::AutoObjectRooter rr(cx, result);
     if (!result)
         return JS_FALSE;
 
     if (!JS_DefineProperty(cx, result, "width", INT_TO_JSVAL(w), NULL, NULL, JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT) ||
         !JS_DefineProperty(cx, result, "height", INT_TO_JSVAL(h), NULL, NULL, JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT) ||
         !JS_DefineProperty(cx, result, "data", OBJECT_TO_JSVAL(darray), NULL, NULL, JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT))
         return JS_FALSE;
 
@@ -282,17 +282,17 @@ nsIDOMCanvasRenderingContext2D_PutImageD
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsIDOMCanvasRenderingContext2D *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 3)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     if (JSVAL_IS_PRIMITIVE(argv[0]))
@@ -305,49 +305,49 @@ nsIDOMCanvasRenderingContext2D_PutImageD
         return JS_FALSE;
 
     int32 wi, hi;
     JSObject *darray;
 
     // grab width, height, and the dense array from the dataObject
     js::AutoValueRooter tv(cx);
 
-    if (!JS_GetProperty(cx, dataObject, "width", tv.addr()) ||
-        !JS_ValueToECMAInt32(cx, tv.value(), &wi))
+    if (!JS_GetProperty(cx, dataObject, "width", tv.jsval_addr()) ||
+        !JS_ValueToECMAInt32(cx, tv.jsval_value(), &wi))
         return JS_FALSE;
 
-    if (!JS_GetProperty(cx, dataObject, "height", tv.addr()) ||
-        !JS_ValueToECMAInt32(cx, tv.value(), &hi))
+    if (!JS_GetProperty(cx, dataObject, "height", tv.jsval_addr()) ||
+        !JS_ValueToECMAInt32(cx, tv.jsval_value(), &hi))
         return JS_FALSE;
 
     if (wi <= 0 || hi <= 0)
         return xpc_qsThrow(cx, NS_ERROR_DOM_INDEX_SIZE_ERR);
 
     uint32 w = (uint32) wi;
     uint32 h = (uint32) hi;
 
-    if (!JS_GetProperty(cx, dataObject, "data", tv.addr()) ||
-        JSVAL_IS_PRIMITIVE(tv.value()))
+    if (!JS_GetProperty(cx, dataObject, "data", tv.jsval_addr()) ||
+        JSVAL_IS_PRIMITIVE(tv.jsval_value()))
         return JS_FALSE;
-    darray = JSVAL_TO_OBJECT(tv.value());
+    darray = JSVAL_TO_OBJECT(tv.jsval_value());
 
     js::AutoValueRooter tsrc_tvr(cx);
 
     js::TypedArray *tsrc = NULL;
     if (darray->getClass() == &js::TypedArray::fastClasses[js::TypedArray::TYPE_UINT8] ||
         darray->getClass() == &js::TypedArray::fastClasses[js::TypedArray::TYPE_UINT8_CLAMPED])
     {
         tsrc = js::TypedArray::fromJSObject(darray);
     } else if (JS_IsArrayObject(cx, darray) || js_IsTypedArray(darray)) {
         // ugh, this isn't a uint8 typed array, someone made their own object; convert it to a typed array
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_UINT8, darray);
         if (!nobj)
             return JS_FALSE;
 
-        *tsrc_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *tsrc_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         tsrc = js::TypedArray::fromJSObject(nobj);
     } else {
         // yeah, no.
         return xpc_qsThrow(cx, NS_ERROR_DOM_TYPE_MISMATCH_ERR);
     }
 
     // make the call
     rv = self->PutImageData_explicit(x, y, w, h, (PRUint8*) tsrc->data, tsrc->byteLength);
--- a/content/canvas/src/CustomQS_WebGL.h
+++ b/content/canvas/src/CustomQS_WebGL.h
@@ -87,17 +87,17 @@ nsICanvasRenderingContextWebGL_BufferDat
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
     if (!obj)
         return JS_FALSE;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 3)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     int32 target;
@@ -153,17 +153,17 @@ nsICanvasRenderingContextWebGL_BufferSub
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
     if (!obj)
         return JS_FALSE;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 3)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     int32 target;
@@ -221,17 +221,17 @@ nsICanvasRenderingContextWebGL_ReadPixel
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     // XXX we currently allow passing only 6 args to support the API. Eventually drop that.
     if (argc < 6)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
@@ -318,17 +318,17 @@ nsICanvasRenderingContextWebGL_TexImage2
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     // XXX we currently allow passing only 3 args to support the API. Eventually drop that.
     // if (argc < 6 || argc == 7 || argc == 8)
     if (argc < 3)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
@@ -442,17 +442,17 @@ nsICanvasRenderingContextWebGL_TexSubIma
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 7 || argc == 8)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     // arguments common to all cases
@@ -543,17 +543,17 @@ helper_nsICanvasRenderingContextWebGL_Un
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 2)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     nsIWebGLUniformLocation *location;
@@ -579,17 +579,17 @@ helper_nsICanvasRenderingContextWebGL_Un
         wa = js::TypedArray::fromJSObject(arg1);
     }  else if (JS_IsArrayObject(cx, arg1)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_INT32, arg1);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             return JS_FALSE;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
 
     if (nElements == 1) {
         rv = self->Uniform1iv_array(location, wa);
@@ -617,17 +617,17 @@ helper_nsICanvasRenderingContextWebGL_Un
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 2)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     nsIWebGLUniformLocation *location;
@@ -653,17 +653,17 @@ helper_nsICanvasRenderingContextWebGL_Un
         wa = js::TypedArray::fromJSObject(arg1);
     }  else if (JS_IsArrayObject(cx, arg1)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg1);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             return JS_FALSE;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
 
     if (nElements == 1) {
         rv = self->Uniform1fv_array(location, wa);
@@ -691,17 +691,17 @@ helper_nsICanvasRenderingContextWebGL_Un
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 3)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     nsIWebGLUniformLocation *location;
@@ -731,17 +731,17 @@ helper_nsICanvasRenderingContextWebGL_Un
         wa = js::TypedArray::fromJSObject(arg2);
     }  else if (JS_IsArrayObject(cx, arg2)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg2);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             return JS_FALSE;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 2);
         return JS_FALSE;
     }
 
     if (nElements == 2) {
         rv = self->UniformMatrix2fv_array(location, transpose ? 1 : 0, wa);
@@ -766,17 +766,17 @@ helper_nsICanvasRenderingContextWebGL_Ve
     if (!obj)
         return JS_FALSE;
 
     nsresult rv;
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     js::AutoValueRooter tvr(cx);
-    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.addr(), nsnull))
+    if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, tvr.jsval_addr(), nsnull))
         return JS_FALSE;
 
     if (argc < 2)
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     uint32 location;
@@ -798,17 +798,17 @@ helper_nsICanvasRenderingContextWebGL_Ve
         wa = js::TypedArray::fromJSObject(arg1);
     }  else if (JS_IsArrayObject(cx, arg1)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg1);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             return JS_FALSE;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
 
     if (nElements == 1) {
         rv = self->VertexAttrib1fv_array(location, wa);
@@ -914,59 +914,59 @@ nsICanvasRenderingContextWebGL_VertexAtt
 static JSBool
 nsICanvasRenderingContextWebGL_VertexAttrib4fv(JSContext *cx, uintN argc, jsval *vp)
 {
     return helper_nsICanvasRenderingContextWebGL_VertexAttrib_x_fv(cx, argc, vp, 4);
 }
 
 #ifdef JS_TRACER
 
-static inline jsval FASTCALL
+static inline void FASTCALL
 helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
                                                       JSObject *arg, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<3> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     nsresult rv_convert_arg0
         = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
     if (NS_FAILED(rv_convert_arg0)) {
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     js::TypedArray *wa = 0;
 
     if (helper_isInt32Array(arg)) {
         wa = js::TypedArray::fromJSObject(arg);
     }  else if (JS_IsArrayObject(cx, arg)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_INT32, arg);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             js_SetTraceableNativeFailed(cx);
-            return JSVAL_VOID;
+            return;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNiv");
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     nsresult rv;
 
     if (nElements == 1) {
         rv = self->Uniform1iv_array(location, wa);
     } else if (nElements == 2) {
         rv = self->Uniform2iv_array(location, wa);
@@ -975,63 +975,61 @@ helper_nsICanvasRenderingContextWebGL_Un
     } else if (nElements == 4) {
         rv = self->Uniform4iv_array(location, wa);
     }
 
     if (NS_FAILED(rv)) {
         xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformNiv");
         js_SetTraceableNativeFailed(cx);
     }
-
-    return JSVAL_VOID;
 }
 
-static inline jsval FASTCALL
+static inline void FASTCALL
 helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
                                                       JSObject *arg, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<3> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     nsresult rv_convert_arg0
         = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
     if (NS_FAILED(rv_convert_arg0)) {
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     js::TypedArray *wa = 0;
 
     if (helper_isFloat32Array(arg)) {
         wa = js::TypedArray::fromJSObject(arg);
     }  else if (JS_IsArrayObject(cx, arg)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             js_SetTraceableNativeFailed(cx);
-            return JSVAL_VOID;
+            return;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNfv");
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     nsresult rv;
 
     if (nElements == 1) {
         rv = self->Uniform1fv_array(location, wa);
     } else if (nElements == 2) {
         rv = self->Uniform2fv_array(location, wa);
@@ -1041,173 +1039,204 @@ helper_nsICanvasRenderingContextWebGL_Un
         rv = self->Uniform4fv_array(location, wa);
     }
 
     if (NS_FAILED(rv)) {
         xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformNfv");
         js_SetTraceableNativeFailed(cx);
     }
 
-    return JSVAL_VOID;
+    return;
 }
 
-static inline jsval FASTCALL
+static inline void FASTCALL
 helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(JSContext *cx, JSObject *obj, JSObject *locationobj,
                                                             JSBool transpose, JSObject *arg, int nElements)
 {
     XPC_QS_ASSERT_CONTEXT_OK(cx);
 
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<4> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     nsresult rv_convert_arg0
         = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
     if (NS_FAILED(rv_convert_arg0)) {
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     js::TypedArray *wa = 0;
 
     if (helper_isFloat32Array(arg)) {
         wa = js::TypedArray::fromJSObject(arg);
     }  else if (JS_IsArrayObject(cx, arg)) {
         JSObject *nobj = js_CreateTypedArrayWithArray(cx, js::TypedArray::TYPE_FLOAT32, arg);
         if (!nobj) {
             // XXX this will likely return a strange error message if it goes wrong
             js_SetTraceableNativeFailed(cx);
-            return JSVAL_VOID;
+            return;
         }
 
-        *obj_tvr.addr() = OBJECT_TO_JSVAL(nobj);
+        *obj_tvr.jsval_addr() = OBJECT_TO_JSVAL(nobj);
         wa = js::TypedArray::fromJSObject(nobj);
     } else {
         xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
         js_SetTraceableNativeFailed(cx);
-        return JSVAL_VOID;
+        return;
     }
 
     nsresult rv;
     if (nElements == 2) {
         rv = self->UniformMatrix2fv_array(location, transpose, wa);
     } else if (nElements == 3) {
         rv = self->UniformMatrix3fv_array(location, transpose, wa);
     } else if (nElements == 4) {
         rv = self->UniformMatrix4fv_array(location, transpose, wa);
     }
 
     if (NS_FAILED(rv)) {
         xpc_qsThrowMethodFailedWithDetails(cx, rv, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
         js_SetTraceableNativeFailed(cx);
     }
-
-    return JSVAL_VOID;
 }
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform1iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 1);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 1);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform1iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform1iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform1iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform2iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 2);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 2);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform2iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform2iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform2iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform3iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 3);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 3);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform3iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform3iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform3iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform4iv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 4);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_iv_tn(cx, obj, location, arg, 4);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform4iv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform4iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform4iv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform1fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 1);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 1);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform1fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform1fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform1fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform2fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 2);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 2);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform2fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform2fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform2fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform3fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 3);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 3);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform3fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform3fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform3fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_Uniform4fv_tn(JSContext *cx, JSObject *obj, JSObject *location, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 4);
+    helper_nsICanvasRenderingContextWebGL_Uniform_x_fv_tn(cx, obj, location, arg, 4);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_Uniform4fv,
-    (4, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_Uniform4fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (4, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_Uniform4fv_tn, CONTEXT, THIS, OBJECT, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 2);
+    helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 2);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix2fv,
-    (5, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (5, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix2fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 3);
+    helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 3);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix3fv,
-    (5, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (5, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix3fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
-static jsval FASTCALL
+// FIXME This should return void, not uint32
+//       (waiting for https://bugzilla.mozilla.org/show_bug.cgi?id=572798)
+static uint32 FASTCALL
 nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn(JSContext *cx, JSObject *obj, JSObject *loc, JSBool transpose, JSObject *arg)
 {
-    return helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 4);
+    helper_nsICanvasRenderingContextWebGL_UniformMatrix_x_fv_tn(cx, obj, loc, transpose, arg, 4);
+    return 0;
 }
 
 JS_DEFINE_TRCINFO_1(nsICanvasRenderingContextWebGL_UniformMatrix4fv,
-    (5, (static, JSVAL_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
+    (5, (static, UINT32_FAIL, nsICanvasRenderingContextWebGL_UniformMatrix4fv_tn, CONTEXT, THIS, OBJECT, BOOL, OBJECT, 0, nanojit::ACC_STORE_ANY)))
 
 #endif /* JS_TRACER */
--- a/content/canvas/src/NativeJSContext.cpp
+++ b/content/canvas/src/NativeJSContext.cpp
@@ -10,11 +10,10 @@ NativeJSContext::AddGCRoot(JSObject **aP
   PRBool ok;
   return ok = ::JS_AddNamedObjectRoot(ctx, aPtr, aName);
 }
 
 void
 NativeJSContext::ReleaseGCRoot(JSObject **aPtr)
 {
   NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
-
   ::JS_RemoveObjectRoot(ctx, aPtr);
 }
--- a/content/canvas/src/NativeJSContext.h
+++ b/content/canvas/src/NativeJSContext.h
@@ -62,108 +62,92 @@ public:
         return PR_FALSE;
     }
 
     PRBool AddGCRoot (JSObject **aPtr, const char *aName);
     void ReleaseGCRoot (JSObject **aPtr);
 
     void SetRetVal (PRInt32 val) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
-        if (INT_FITS_IN_JSVAL(val))
-            SetRetValAsJSVal(INT_TO_JSVAL(val));
-        else
-            SetRetVal((double) val);
+        SetRetValAsJSVal(INT_TO_JSVAL(val));
     }
 
     void SetRetVal (PRUint32 val) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
-        if (INT_FITS_IN_JSVAL(val))
-            SetRetValAsJSVal(INT_TO_JSVAL((int) val));
-        else
-            SetRetVal((double) val);
+        SetRetValAsJSVal(UINT_TO_JSVAL(val));
     }
 
     void SetRetVal (double val) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
-        jsval *vp;
-        ncc->GetRetValPtr(&vp);
-        JS_NewDoubleValue(ctx, val, vp);
+        SetRetValAsJSVal(DOUBLE_TO_JSVAL(val));
     }
 
     void SetBoolRetVal (PRBool val) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
-        if (val)
-            SetRetValAsJSVal(JSVAL_TRUE);
-        else
-            SetRetValAsJSVal(JSVAL_FALSE);
+        SetRetValAsJSVal(BOOLEAN_TO_JSVAL(val));
     }
 
     void SetRetVal (PRInt32 *vp, PRUint32 len) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
-        for (PRUint32 i = 0; i < len; i++) {
-            if (INT_FITS_IN_JSVAL(vp[i])) {
-                jsvector[i] = INT_TO_JSVAL(vp[i]);
-            } else {
-                JS_NewDoubleValue(ctx, vp[i], &jsvector[i]);
-            }
-        }
+        for (PRUint32 i = 0; i < len; i++)
+            jsvector[i] = INT_TO_JSVAL(vp[i]);
 
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetVal (PRUint32 *vp, PRUint32 len) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
-        for (PRUint32 i = 0; i < len; i++) {
-            JS_NewNumberValue(ctx, vp[i], &jsvector[i]);
-        }
+        for (PRUint32 i = 0; i < len; i++)
+            jsvector[i] = UINT_TO_JSVAL(vp[i]);
 
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetVal (double *dp, PRUint32 len) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
         for (PRUint32 i = 0; i < len; i++)
-            JS_NewDoubleValue(ctx, (jsdouble) dp[i], &jsvector[i]);
-            
+            jsvector[i] = DOUBLE_TO_JSVAL(dp[i]);
+
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetVal (float *fp, PRUint32 len) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
         for (PRUint32 i = 0; i < len; i++)
-            JS_NewDoubleValue(ctx, (jsdouble) fp[i], &jsvector[i]);
+            jsvector[i] = DOUBLE_TO_JSVAL(fp[i]);
+
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetValAsJSVal (jsval val) {
         NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
@@ -337,35 +321,31 @@ public:
     PRBool DefineProperty(const char *name, PRUint32 val) {
         // XXX handle too big ints
         if (!JS_DefineProperty(mCtx->ctx, mObject, name, INT_TO_JSVAL((int)val), NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;
         return PR_TRUE;
     }
 
     PRBool DefineProperty(const char *name, double val) {
-        jsval dv;
-
-        if (!JS_NewDoubleValue(mCtx->ctx, val, &dv))
-            return PR_FALSE;
-
+        jsval dv = DOUBLE_TO_JSVAL(val);
         if (!JS_DefineProperty(mCtx->ctx, mObject, name, dv, NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;
         return PR_TRUE;
     }
 
     PRBool DefineProperty(const char *name, JSObject *val) {
         if (!JS_DefineProperty(mCtx->ctx, mObject, name, OBJECT_TO_JSVAL(val), NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;
         return PR_TRUE;
     }
 
     // Blah.  We can't name this DefineProperty also because PRBool is the same as PRInt32
     PRBool DefineBoolProperty(const char *name, PRBool val) {
-        if (!JS_DefineProperty(mCtx->ctx, mObject, name, val ? JS_TRUE : JS_FALSE, NULL, NULL, JSPROP_ENUMERATE))
+        if (!JS_DefineProperty(mCtx->ctx, mObject, name, val ? JSVAL_TRUE : JSVAL_FALSE, NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;
         return PR_TRUE;
     }
 
     // We can't use ns*Substring, because we don't have internal linkage
 #if 0
     PRBool DefineProperty(const char *name, const nsCSubstring& val) {
         JSString *jsstr = JS_NewStringCopyN(mCtx->ctx, val.BeginReading(), val.Length());
--- a/content/events/src/nsEventListenerManager.cpp
+++ b/content/events/src/nsEventListenerManager.cpp
@@ -306,17 +306,17 @@ nsEventListenerManager::RemoveAllListene
   mListeners.Clear();
   return NS_OK;
 }
 
 void
 nsEventListenerManager::Shutdown()
 {
   NS_IF_RELEASE(gSystemEventGroup);
-  sAddListenerID = JSVAL_VOID;
+  sAddListenerID = JSID_VOID;
   nsDOMEvent::Shutdown();
 }
 
 nsIDOMEventGroup*
 nsEventListenerManager::GetSystemEventGroup()
 {
   if (!gSystemEventGroup) {
     CallCreateInstance(kDOMEventGroupCID, &gSystemEventGroup);
@@ -836,18 +836,18 @@ nsEventListenerManager::RemoveScriptEven
     mListeners.RemoveElementAt(PRUint32(ls - &mListeners.ElementAt(0)));
     mNoListenerForEvent = NS_EVENT_TYPE_NULL;
     mNoListenerForEventAtom = nsnull;
   }
 
   return NS_OK;
 }
 
-jsval
-nsEventListenerManager::sAddListenerID = JSVAL_VOID;
+jsid
+nsEventListenerManager::sAddListenerID = JSID_VOID;
 
 NS_IMETHODIMP
 nsEventListenerManager::RegisterScriptEventListener(nsIScriptContext *aContext,
                                                     void *aScope,
                                                     nsISupports *aObject, 
                                                     nsIAtom *aName)
 {
   // Check that we have access to set an event listener. Prevents
@@ -861,20 +861,20 @@ nsEventListenerManager::RegisterScriptEv
     do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
   if (NS_FAILED(rv))
     return rv;
   JSContext *cx;
   if (NS_FAILED(rv = stack->Peek(&cx)))
     return rv;
 
   if (cx) {
-    if (sAddListenerID == JSVAL_VOID) {
+    if (sAddListenerID == JSID_VOID) {
       JSAutoRequest ar(cx);
       sAddListenerID =
-        STRING_TO_JSVAL(::JS_InternString(cx, "addEventListener"));
+        INTERNED_STRING_TO_JSID(::JS_InternString(cx, "addEventListener"));
     }
 
     if (aContext->GetScriptTypeID() == nsIProgrammingLanguage::JAVASCRIPT) {
         nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
         jsval v;
         rv = nsContentUtils::WrapNative(cx, (JSObject *)aScope, aObject, &v,
                                         getter_AddRefs(holder));
         NS_ENSURE_SUCCESS(rv, rv);
--- a/content/events/src/nsEventListenerManager.h
+++ b/content/events/src/nsEventListenerManager.h
@@ -226,15 +226,15 @@ protected:
   PRBool ListenerCanHandle(nsListenerStruct* aLs, nsEvent* aEvent);
   nsPIDOMWindow* GetInnerWindowForTarget();
 
   nsAutoTObserverArray<nsListenerStruct, 2> mListeners;
   nsISupports*                              mTarget;  //WEAK
   nsCOMPtr<nsIAtom>                         mNoListenerForEventAtom;
 
   static PRUint32                           mInstanceCount;
-  static jsval                              sAddListenerID;
+  static jsid                               sAddListenerID;
 
   friend class nsEventTargetChainItem;
   static PRUint32                           sCreatedCount;
 };
 
 #endif // nsEventListenerManager_h__
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -3630,20 +3630,20 @@ ConvertToMidasInternalCommand(const nsAS
   nsCAutoString dummyCString;
   nsAutoString dummyString;
   PRBool dummyBool;
   return ConvertToMidasInternalCommandInner(inCommandID, dummyString,
                                             outCommandID, dummyCString,
                                             dummyBool, dummyBool, PR_TRUE);
 }
 
-jsval
-nsHTMLDocument::sCutCopyInternal_id = JSVAL_VOID;
-jsval
-nsHTMLDocument::sPasteInternal_id = JSVAL_VOID;
+jsid
+nsHTMLDocument::sCutCopyInternal_id = JSID_VOID;
+jsid
+nsHTMLDocument::sPasteInternal_id = JSID_VOID;
 
 /* Helper function to check security of clipboard commands. If aPaste is */
 /* true, we check paste, else we check cutcopy */
 nsresult
 nsHTMLDocument::DoClipboardSecurityCheck(PRBool aPaste)
 {
   nsresult rv = NS_ERROR_FAILURE;
 
@@ -3659,27 +3659,27 @@ nsHTMLDocument::DoClipboardSecurityCheck
 
     JSAutoRequest ar(cx);
 
     NS_NAMED_LITERAL_CSTRING(classNameStr, "Clipboard");
 
     nsIScriptSecurityManager *secMan = nsContentUtils::GetSecurityManager();
 
     if (aPaste) {
-      if (nsHTMLDocument::sPasteInternal_id == JSVAL_VOID) {
+      if (nsHTMLDocument::sPasteInternal_id == JSID_VOID) {
         nsHTMLDocument::sPasteInternal_id =
-          STRING_TO_JSVAL(::JS_InternString(cx, "paste"));
+          INTERNED_STRING_TO_JSID(::JS_InternString(cx, "paste"));
       }
       rv = secMan->CheckPropertyAccess(cx, nsnull, classNameStr.get(),
                                        nsHTMLDocument::sPasteInternal_id,
                                        nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
     } else {
-      if (nsHTMLDocument::sCutCopyInternal_id == JSVAL_VOID) {
+      if (nsHTMLDocument::sCutCopyInternal_id == JSID_VOID) {
         nsHTMLDocument::sCutCopyInternal_id =
-          STRING_TO_JSVAL(::JS_InternString(cx, "cutcopy"));
+          INTERNED_STRING_TO_JSID(::JS_InternString(cx, "cutcopy"));
       }
       rv = secMan->CheckPropertyAccess(cx, nsnull, classNameStr.get(),
                                        nsHTMLDocument::sCutCopyInternal_id,
                                        nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
     }
   }
   return rv;
 }
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@@ -366,18 +366,18 @@ protected:
   nsresult TurnEditingOff();
   nsresult EditingStateChanged();
   void MaybeEditingStateChanged();
 
   PRUint32 mContentEditableCount;
   EditingState mEditingState;
 
   nsresult   DoClipboardSecurityCheck(PRBool aPaste);
-  static jsval       sCutCopyInternal_id;
-  static jsval       sPasteInternal_id;
+  static jsid        sCutCopyInternal_id;
+  static jsid        sPasteInternal_id;
 
   // When false, the .cookies property is completely disabled
   PRBool mDisableCookieAccess;
 
   // Parser used for constructing document fragments.
   nsCOMPtr<nsIParser> mFragmentParser;
 };
 
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -118,30 +118,30 @@ XBLFinalize(JSContext *cx, JSObject *obj
     static_cast<nsIXBLDocumentInfo*>(::JS_GetPrivate(cx, obj));
   NS_RELEASE(docInfo);
   
   nsXBLJSClass* c = static_cast<nsXBLJSClass*>(::JS_GET_CLASS(cx, obj));
   c->Drop();
 }
 
 static JSBool
-XBLResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
+XBLResolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
            JSObject **objp)
 {
   // Note: if we get here, that means that the implementation for some binding
   // was installed, which means that AllowScripts() tested true.  Hence no need
   // to do checks like that here.
   
   // Default to not resolving things.
   NS_ASSERTION(*objp, "Must have starting object");
 
   JSObject* origObj = *objp;
   *objp = NULL;
 
-  if (!JSVAL_IS_STRING(id)) {
+  if (!JSID_IS_STRING(id)) {
     return JS_TRUE;
   }
 
   nsDependentJSString fieldName(id);
 
   jsval slotVal;
   ::JS_GetReservedSlot(cx, obj, 0, &slotVal);
   NS_ASSERTION(!JSVAL_IS_VOID(slotVal), "How did that happen?");
--- a/content/xbl/src/nsXBLDocumentInfo.cpp
+++ b/content/xbl/src/nsXBLDocumentInfo.cpp
@@ -76,17 +76,17 @@ public:
   virtual nsIScriptContext *GetContext();
   virtual JSObject *GetGlobalJSObject();
   virtual void OnFinalize(PRUint32 aLangID, void *aScriptGlobal);
   virtual void SetScriptsEnabled(PRBool aEnabled, PRBool aFireTimeouts);
 
   // nsIScriptObjectPrincipal methods
   virtual nsIPrincipal* GetPrincipal();
 
-  static JSBool doCheckAccess(JSContext *cx, JSObject *obj, jsval id,
+  static JSBool doCheckAccess(JSContext *cx, JSObject *obj, jsid id,
                               PRUint32 accessType);
 
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXBLDocGlobalObject,
                                            nsIScriptGlobalObject)
 
   void ClearGlobalObjectOwner();
 
 protected:
@@ -99,17 +99,17 @@ protected:
   nsCOMPtr<nsIScriptContext> mScriptContext;
   JSObject *mJSObject;    // XXX JS language rabies bigotry badness
 
   nsIScriptGlobalObjectOwner* mGlobalObjectOwner; // weak reference
   static JSClass gSharedGlobalClass;
 };
 
 JSBool
-nsXBLDocGlobalObject::doCheckAccess(JSContext *cx, JSObject *obj, jsval id, PRUint32 accessType)
+nsXBLDocGlobalObject::doCheckAccess(JSContext *cx, JSObject *obj, jsid id, PRUint32 accessType)
 {
   nsIScriptSecurityManager *ssm = nsContentUtils::GetSecurityManager();
   if (!ssm) {
     ::JS_ReportError(cx, "Unable to verify access to a global object property.");
     return JS_FALSE;
   }
 
   // Make sure to actually operate on our object, and not some object further
@@ -124,32 +124,32 @@ nsXBLDocGlobalObject::doCheckAccess(JSCo
 
   nsresult rv = ssm->CheckPropertyAccess(cx, obj, JS_GET_CLASS(cx, obj)->name,
                                          id, accessType);
   return NS_SUCCEEDED(rv);
 }
 
 static JSBool
 nsXBLDocGlobalObject_getProperty(JSContext *cx, JSObject *obj,
-                                 jsval id, jsval *vp)
+                                 jsid id, jsval *vp)
 {
   return nsXBLDocGlobalObject::
     doCheckAccess(cx, obj, id, nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
 }
 
 static JSBool
 nsXBLDocGlobalObject_setProperty(JSContext *cx, JSObject *obj,
-                                 jsval id, jsval *vp)
+                                 jsid id, jsval *vp)
 {
   return nsXBLDocGlobalObject::
     doCheckAccess(cx, obj, id, nsIXPCSecurityManager::ACCESS_SET_PROPERTY);
 }
 
 static JSBool
-nsXBLDocGlobalObject_checkAccess(JSContext *cx, JSObject *obj, jsval id,
+nsXBLDocGlobalObject_checkAccess(JSContext *cx, JSObject *obj, jsid id,
                                  JSAccessMode mode, jsval *vp)
 {
   PRUint32 translated;
   if (mode & JSACC_WRITE) {
     translated = nsIXPCSecurityManager::ACCESS_SET_PROPERTY;
   } else {
     translated = nsIXPCSecurityManager::ACCESS_GET_PROPERTY;
   }
@@ -168,17 +168,17 @@ nsXBLDocGlobalObject_finalize(JSContext 
   if (sgo)
     sgo->OnFinalize(nsIProgrammingLanguage::JAVASCRIPT, obj);
 
   // The addref was part of JSObject construction
   NS_RELEASE(nativeThis);
 }
 
 static JSBool
-nsXBLDocGlobalObject_resolve(JSContext *cx, JSObject *obj, jsval id)
+nsXBLDocGlobalObject_resolve(JSContext *cx, JSObject *obj, jsid id)
 {
   JSBool did_resolve = JS_FALSE;
   return JS_ResolveStandardClass(cx, obj, id, &did_resolve);
 }
 
 
 JSClass nsXBLDocGlobalObject::gSharedGlobalClass = {
     "nsXBLPrototypeScript compilation scope",
--- a/content/xul/document/src/nsXULPrototypeDocument.cpp
+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
@@ -127,17 +127,17 @@ nsXULPDGlobalObject_finalize(JSContext *
     }
 
     // The addref was part of JSObject construction
     NS_RELEASE(nativeThis);
 }
 
 
 JSBool
-nsXULPDGlobalObject_resolve(JSContext *cx, JSObject *obj, jsval id)
+nsXULPDGlobalObject_resolve(JSContext *cx, JSObject *obj, jsid id)
 {
     JSBool did_resolve = JS_FALSE;
 
     return JS_ResolveStandardClass(cx, obj, id, &did_resolve);
 }
 
 
 JSClass nsXULPDGlobalObject::gSharedGlobalClass = {
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1495,101 +1495,101 @@ static const nsConstructorFuncMapData kC
 
 nsIXPConnect *nsDOMClassInfo::sXPConnect = nsnull;
 nsIScriptSecurityManager *nsDOMClassInfo::sSecMan = nsnull;
 PRBool nsDOMClassInfo::sIsInitialized = PR_FALSE;
 PRBool nsDOMClassInfo::sDisableDocumentAllSupport = PR_FALSE;
 PRBool nsDOMClassInfo::sDisableGlobalScopePollutionSupport = PR_FALSE;
 
 
-jsval nsDOMClassInfo::sTop_id             = JSVAL_VOID;
-jsval nsDOMClassInfo::sParent_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sScrollbars_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sLocation_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sConstructor_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::s_content_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sContent_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sMenubar_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sToolbar_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sLocationbar_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sPersonalbar_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sStatusbar_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sDialogArguments_id = JSVAL_VOID;
-jsval nsDOMClassInfo::sControllers_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sLength_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sInnerHeight_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sInnerWidth_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOuterHeight_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOuterWidth_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sScreenX_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sScreenY_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sStatus_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sName_id            = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnmousedown_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnmouseup_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnclick_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndblclick_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOncontextmenu_id   = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnmouseover_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnmouseout_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnkeydown_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnkeyup_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnkeypress_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnmousemove_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnfocus_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnblur_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnsubmit_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnreset_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnchange_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnselect_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnload_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnpopstate_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnbeforeunload_id  = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnunload_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnhashchange_id    = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnreadystatechange_id = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnpageshow_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnpagehide_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnabort_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnerror_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnpaint_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnresize_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnscroll_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndrag_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndragend_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndragenter_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndragleave_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndragover_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndragstart_id     = JSVAL_VOID;
-jsval nsDOMClassInfo::sOndrop_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sScrollX_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sScrollY_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sScrollMaxX_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sScrollMaxY_id      = JSVAL_VOID;
-jsval nsDOMClassInfo::sOpen_id            = JSVAL_VOID;
-jsval nsDOMClassInfo::sItem_id            = JSVAL_VOID;
-jsval nsDOMClassInfo::sNamedItem_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sEnumerate_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sNavigator_id       = JSVAL_VOID;
-jsval nsDOMClassInfo::sDocument_id        = JSVAL_VOID;
-jsval nsDOMClassInfo::sWindow_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sFrames_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sSelf_id            = JSVAL_VOID;
-jsval nsDOMClassInfo::sOpener_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sAll_id             = JSVAL_VOID;
-jsval nsDOMClassInfo::sTags_id            = JSVAL_VOID;
-jsval nsDOMClassInfo::sAddEventListener_id= JSVAL_VOID;
-jsval nsDOMClassInfo::sBaseURIObject_id   = JSVAL_VOID;
-jsval nsDOMClassInfo::sNodePrincipal_id   = JSVAL_VOID;
-jsval nsDOMClassInfo::sDocumentURIObject_id=JSVAL_VOID;
-jsval nsDOMClassInfo::sOncopy_id          = JSVAL_VOID;
-jsval nsDOMClassInfo::sOncut_id           = JSVAL_VOID;
-jsval nsDOMClassInfo::sOnpaste_id         = JSVAL_VOID;
-jsval nsDOMClassInfo::sJava_id            = JSVAL_VOID;
-jsval nsDOMClassInfo::sPackages_id        = JSVAL_VOID;
+jsid nsDOMClassInfo::sTop_id             = JSID_VOID;
+jsid nsDOMClassInfo::sParent_id          = JSID_VOID;
+jsid nsDOMClassInfo::sScrollbars_id      = JSID_VOID;
+jsid nsDOMClassInfo::sLocation_id        = JSID_VOID;
+jsid nsDOMClassInfo::sConstructor_id     = JSID_VOID;
+jsid nsDOMClassInfo::s_content_id        = JSID_VOID;
+jsid nsDOMClassInfo::sContent_id         = JSID_VOID;
+jsid nsDOMClassInfo::sMenubar_id         = JSID_VOID;
+jsid nsDOMClassInfo::sToolbar_id         = JSID_VOID;
+jsid nsDOMClassInfo::sLocationbar_id     = JSID_VOID;
+jsid nsDOMClassInfo::sPersonalbar_id     = JSID_VOID;
+jsid nsDOMClassInfo::sStatusbar_id       = JSID_VOID;
+jsid nsDOMClassInfo::sDialogArguments_id = JSID_VOID;
+jsid nsDOMClassInfo::sControllers_id     = JSID_VOID;
+jsid nsDOMClassInfo::sLength_id          = JSID_VOID;
+jsid nsDOMClassInfo::sInnerHeight_id     = JSID_VOID;
+jsid nsDOMClassInfo::sInnerWidth_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOuterHeight_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOuterWidth_id      = JSID_VOID;
+jsid nsDOMClassInfo::sScreenX_id         = JSID_VOID;
+jsid nsDOMClassInfo::sScreenY_id         = JSID_VOID;
+jsid nsDOMClassInfo::sStatus_id          = JSID_VOID;
+jsid nsDOMClassInfo::sName_id            = JSID_VOID;
+jsid nsDOMClassInfo::sOnmousedown_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOnmouseup_id       = JSID_VOID;
+jsid nsDOMClassInfo::sOnclick_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOndblclick_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOncontextmenu_id   = JSID_VOID;
+jsid nsDOMClassInfo::sOnmouseover_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOnmouseout_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOnkeydown_id       = JSID_VOID;
+jsid nsDOMClassInfo::sOnkeyup_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOnkeypress_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOnmousemove_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOnfocus_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOnblur_id          = JSID_VOID;
+jsid nsDOMClassInfo::sOnsubmit_id        = JSID_VOID;
+jsid nsDOMClassInfo::sOnreset_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOnchange_id        = JSID_VOID;
+jsid nsDOMClassInfo::sOnselect_id        = JSID_VOID;
+jsid nsDOMClassInfo::sOnload_id          = JSID_VOID;
+jsid nsDOMClassInfo::sOnpopstate_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOnbeforeunload_id  = JSID_VOID;
+jsid nsDOMClassInfo::sOnunload_id        = JSID_VOID;
+jsid nsDOMClassInfo::sOnhashchange_id    = JSID_VOID;
+jsid nsDOMClassInfo::sOnreadystatechange_id = JSID_VOID;
+jsid nsDOMClassInfo::sOnpageshow_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOnpagehide_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOnabort_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOnerror_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOnpaint_id         = JSID_VOID;
+jsid nsDOMClassInfo::sOnresize_id        = JSID_VOID;
+jsid nsDOMClassInfo::sOnscroll_id        = JSID_VOID;
+jsid nsDOMClassInfo::sOndrag_id          = JSID_VOID;
+jsid nsDOMClassInfo::sOndragend_id       = JSID_VOID;
+jsid nsDOMClassInfo::sOndragenter_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOndragleave_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOndragover_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOndragstart_id     = JSID_VOID;
+jsid nsDOMClassInfo::sOndrop_id          = JSID_VOID;
+jsid nsDOMClassInfo::sScrollX_id         = JSID_VOID;
+jsid nsDOMClassInfo::sScrollY_id         = JSID_VOID;
+jsid nsDOMClassInfo::sScrollMaxX_id      = JSID_VOID;
+jsid nsDOMClassInfo::sScrollMaxY_id      = JSID_VOID;
+jsid nsDOMClassInfo::sOpen_id            = JSID_VOID;
+jsid nsDOMClassInfo::sItem_id            = JSID_VOID;
+jsid nsDOMClassInfo::sNamedItem_id       = JSID_VOID;
+jsid nsDOMClassInfo::sEnumerate_id       = JSID_VOID;
+jsid nsDOMClassInfo::sNavigator_id       = JSID_VOID;
+jsid nsDOMClassInfo::sDocument_id        = JSID_VOID;
+jsid nsDOMClassInfo::sWindow_id          = JSID_VOID;
+jsid nsDOMClassInfo::sFrames_id          = JSID_VOID;
+jsid nsDOMClassInfo::sSelf_id            = JSID_VOID;
+jsid nsDOMClassInfo::sOpener_id          = JSID_VOID;
+jsid nsDOMClassInfo::sAll_id             = JSID_VOID;
+jsid nsDOMClassInfo::sTags_id            = JSID_VOID;
+jsid nsDOMClassInfo::sAddEventListener_id= JSID_VOID;
+jsid nsDOMClassInfo::sBaseURIObject_id   = JSID_VOID;
+jsid nsDOMClassInfo::sNodePrincipal_id   = JSID_VOID;
+jsid nsDOMClassInfo::sDocumentURIObject_id=JSID_VOID;
+jsid nsDOMClassInfo::sOncopy_id          = JSID_VOID;
+jsid nsDOMClassInfo::sOncut_id           = JSID_VOID;
+jsid nsDOMClassInfo::sOnpaste_id         = JSID_VOID;
+jsid nsDOMClassInfo::sJava_id            = JSID_VOID;
+jsid nsDOMClassInfo::sPackages_id        = JSID_VOID;
 
 static const JSClass *sObjectClass = nsnull;
 JSPropertyOp nsDOMClassInfo::sXPCNativeWrapperGetPropertyOp = nsnull;
 JSPropertyOp nsDOMClassInfo::sXrayWrapperPropertyHolderGetPropertyOp = nsnull;
 
 /**
  * Set our JSClass pointer for the Object class
  */
@@ -1599,17 +1599,17 @@ FindObjectClass(JSObject* aGlobalObject)
   NS_ASSERTION(!sObjectClass,
                "Double set of sObjectClass");
   JSObject *obj, *proto = aGlobalObject;
   do {
     obj = proto;
     proto = obj->getProto();
   } while (proto);
 
-  sObjectClass = obj->getClass();
+  sObjectClass = obj->getJSClass();
 }
 
 static void
 PrintWarningOnConsole(JSContext *cx, const char *stringBundleProperty)
 {
   nsCOMPtr<nsIStringBundleService> stringService =
     mozilla::services::GetStringBundleService();
   if (!stringService) {
@@ -1667,132 +1667,131 @@ PrintWarningOnConsole(JSContext *cx, con
                                   0, // column for error is not available
                                   nsIScriptError::warningFlag,
                                   "DOM:HTML");
   if (NS_SUCCEEDED(rv)){
     consoleService->LogMessage(scriptError);
   }
 }
 
-static jsval
-GetInternedJSVal(JSContext *cx, const char *str)
-{
-  JSString *s = ::JS_InternString(cx, str);
-
-  if (!s) {
-    return JSVAL_VOID;
-  }
-
-  return STRING_TO_JSVAL(s);
+static inline JSString *
+IdToString(JSContext *cx, jsid id)
+{
+  if (JSID_IS_STRING(id))
+    return JSID_TO_STRING(id);
+  jsval idval;
+  if (!::JS_IdToValue(cx, id, &idval))
+    return nsnull;
+  return JS_ValueToString(cx, idval);
 }
 
 // static
 
 nsISupports *
 nsDOMClassInfo::GetNative(nsIXPConnectWrappedNative *wrapper, JSObject *obj)
 {
   return wrapper ? wrapper->Native() : static_cast<nsISupports*>(obj->getPrivate());
 }
 
 nsresult
 nsDOMClassInfo::DefineStaticJSVals(JSContext *cx)
 {
-#define SET_JSVAL_TO_STRING(_val, _cx, _str)                                  \
-  _val = GetInternedJSVal(_cx, _str);                                         \
-  if (!JSVAL_IS_STRING(_val)) {                                               \
-    return NS_ERROR_OUT_OF_MEMORY;                                            \
-  }
+#define SET_JSID_TO_STRING(_id, _cx, _str)                                    \
+  if (JSString *str = ::JS_InternString(_cx, _str))                           \
+      _id = INTERNED_STRING_TO_JSID(str);                                     \
+  else                                                                        \
+      return NS_ERROR_OUT_OF_MEMORY;
 
   JSAutoRequest ar(cx);
 
-  SET_JSVAL_TO_STRING(sTop_id,             cx, "top");
-  SET_JSVAL_TO_STRING(sParent_id,          cx, "parent");
-  SET_JSVAL_TO_STRING(sScrollbars_id,      cx, "scrollbars");
-  SET_JSVAL_TO_STRING(sLocation_id,        cx, "location");
-  SET_JSVAL_TO_STRING(sConstructor_id,     cx, "constructor");
-  SET_JSVAL_TO_STRING(s_content_id,        cx, "_content");
-  SET_JSVAL_TO_STRING(sContent_id,         cx, "content");
-  SET_JSVAL_TO_STRING(sMenubar_id,         cx, "menubar");
-  SET_JSVAL_TO_STRING(sToolbar_id,         cx, "toolbar");
-  SET_JSVAL_TO_STRING(sLocationbar_id,     cx, "locationbar");
-  SET_JSVAL_TO_STRING(sPersonalbar_id,     cx, "personalbar");
-  SET_JSVAL_TO_STRING(sStatusbar_id,       cx, "statusbar");
-  SET_JSVAL_TO_STRING(sDialogArguments_id, cx, "dialogArguments");
-  SET_JSVAL_TO_STRING(sControllers_id,     cx, "controllers");
-  SET_JSVAL_TO_STRING(sLength_id,          cx, "length");
-  SET_JSVAL_TO_STRING(sInnerHeight_id,     cx, "innerHeight");
-  SET_JSVAL_TO_STRING(sInnerWidth_id,      cx, "innerWidth");
-  SET_JSVAL_TO_STRING(sOuterHeight_id,     cx, "outerHeight");
-  SET_JSVAL_TO_STRING(sOuterWidth_id,      cx, "outerWidth");
-  SET_JSVAL_TO_STRING(sScreenX_id,         cx, "screenX");
-  SET_JSVAL_TO_STRING(sScreenY_id,         cx, "screenY");
-  SET_JSVAL_TO_STRING(sStatus_id,          cx, "status");
-  SET_JSVAL_TO_STRING(sName_id,            cx, "name");
-  SET_JSVAL_TO_STRING(sOnmousedown_id,     cx, "onmousedown");
-  SET_JSVAL_TO_STRING(sOnmouseup_id,       cx, "onmouseup");
-  SET_JSVAL_TO_STRING(sOnclick_id,         cx, "onclick");
-  SET_JSVAL_TO_STRING(sOndblclick_id,      cx, "ondblclick");
-  SET_JSVAL_TO_STRING(sOncontextmenu_id,   cx, "oncontextmenu");
-  SET_JSVAL_TO_STRING(sOnmouseover_id,     cx, "onmouseover");
-  SET_JSVAL_TO_STRING(sOnmouseout_id,      cx, "onmouseout");
-  SET_JSVAL_TO_STRING(sOnkeydown_id,       cx, "onkeydown");
-  SET_JSVAL_TO_STRING(sOnkeyup_id,         cx, "onkeyup");
-  SET_JSVAL_TO_STRING(sOnkeypress_id,      cx, "onkeypress");
-  SET_JSVAL_TO_STRING(sOnmousemove_id,     cx, "onmousemove");
-  SET_JSVAL_TO_STRING(sOnfocus_id,         cx, "onfocus");
-  SET_JSVAL_TO_STRING(sOnblur_id,          cx, "onblur");
-  SET_JSVAL_TO_STRING(sOnsubmit_id,        cx, "onsubmit");
-  SET_JSVAL_TO_STRING(sOnreset_id,         cx, "onreset");
-  SET_JSVAL_TO_STRING(sOnchange_id,        cx, "onchange");
-  SET_JSVAL_TO_STRING(sOnselect_id,        cx, "onselect");
-  SET_JSVAL_TO_STRING(sOnload_id,          cx, "onload");
-  SET_JSVAL_TO_STRING(sOnpopstate_id,      cx, "onpopstate");
-  SET_JSVAL_TO_STRING(sOnbeforeunload_id,  cx, "onbeforeunload");
-  SET_JSVAL_TO_STRING(sOnunload_id,        cx, "onunload");
-  SET_JSVAL_TO_STRING(sOnhashchange_id,    cx, "onhashchange");
-  SET_JSVAL_TO_STRING(sOnreadystatechange_id, cx, "onreadystatechange");
-  SET_JSVAL_TO_STRING(sOnpageshow_id,      cx, "onpageshow");
-  SET_JSVAL_TO_STRING(sOnpagehide_id,      cx, "onpagehide");
-  SET_JSVAL_TO_STRING(sOnabort_id,         cx, "onabort");
-  SET_JSVAL_TO_STRING(sOnerror_id,         cx, "onerror");
-  SET_JSVAL_TO_STRING(sOnpaint_id,         cx, "onpaint");
-  SET_JSVAL_TO_STRING(sOnresize_id,        cx, "onresize");
-  SET_JSVAL_TO_STRING(sOnscroll_id,        cx, "onscroll");
-  SET_JSVAL_TO_STRING(sOndrag_id,          cx, "ondrag");
-  SET_JSVAL_TO_STRING(sOndragend_id,       cx, "ondragend");
-  SET_JSVAL_TO_STRING(sOndragenter_id,     cx, "ondragenter");
-  SET_JSVAL_TO_STRING(sOndragleave_id,     cx, "ondragleave");
-  SET_JSVAL_TO_STRING(sOndragover_id,      cx, "ondragover");
-  SET_JSVAL_TO_STRING(sOndragstart_id,     cx, "ondragstart");
-  SET_JSVAL_TO_STRING(sOndrop_id,          cx, "ondrop");
-  SET_JSVAL_TO_STRING(sScrollX_id,         cx, "scrollX");
-  SET_JSVAL_TO_STRING(sScrollY_id,         cx, "scrollY");
-  SET_JSVAL_TO_STRING(sScrollMaxX_id,      cx, "scrollMaxX");
-  SET_JSVAL_TO_STRING(sScrollMaxY_id,      cx, "scrollMaxY");
-  SET_JSVAL_TO_STRING(sOpen_id,            cx, "open");
-  SET_JSVAL_TO_STRING(sItem_id,            cx, "item");
-  SET_JSVAL_TO_STRING(sNamedItem_id,       cx, "namedItem");
-  SET_JSVAL_TO_STRING(sEnumerate_id,       cx, "enumerateProperties");
-  SET_JSVAL_TO_STRING(sNavigator_id,       cx, "navigator");
-  SET_JSVAL_TO_STRING(sDocument_id,        cx, "document");
-  SET_JSVAL_TO_STRING(sWindow_id,          cx, "window");
-  SET_JSVAL_TO_STRING(sFrames_id,          cx, "frames");
-  SET_JSVAL_TO_STRING(sSelf_id,            cx, "self");
-  SET_JSVAL_TO_STRING(sOpener_id,          cx, "opener");
-  SET_JSVAL_TO_STRING(sAll_id,             cx, "all");
-  SET_JSVAL_TO_STRING(sTags_id,            cx, "tags");
-  SET_JSVAL_TO_STRING(sAddEventListener_id,cx, "addEventListener");
-  SET_JSVAL_TO_STRING(sBaseURIObject_id,   cx, "baseURIObject");
-  SET_JSVAL_TO_STRING(sNodePrincipal_id,   cx, "nodePrincipal");
-  SET_JSVAL_TO_STRING(sDocumentURIObject_id,cx,"documentURIObject");
-  SET_JSVAL_TO_STRING(sOncopy_id,          cx, "oncopy");
-  SET_JSVAL_TO_STRING(sOncut_id,           cx, "oncut");
-  SET_JSVAL_TO_STRING(sOnpaste_id,         cx, "onpaste");
-  SET_JSVAL_TO_STRING(sJava_id,            cx, "java");
-  SET_JSVAL_TO_STRING(sPackages_id,        cx, "Packages");
+  SET_JSID_TO_STRING(sTop_id,             cx, "top");
+  SET_JSID_TO_STRING(sParent_id,          cx, "parent");
+  SET_JSID_TO_STRING(sScrollbars_id,      cx, "scrollbars");
+  SET_JSID_TO_STRING(sLocation_id,        cx, "location");
+  SET_JSID_TO_STRING(sConstructor_id,     cx, "constructor");
+  SET_JSID_TO_STRING(s_content_id,        cx, "_content");
+  SET_JSID_TO_STRING(sContent_id,         cx, "content");
+  SET_JSID_TO_STRING(sMenubar_id,         cx, "menubar");
+  SET_JSID_TO_STRING(sToolbar_id,         cx, "toolbar");
+  SET_JSID_TO_STRING(sLocationbar_id,     cx, "locationbar");
+  SET_JSID_TO_STRING(sPersonalbar_id,     cx, "personalbar");
+  SET_JSID_TO_STRING(sStatusbar_id,       cx, "statusbar");
+  SET_JSID_TO_STRING(sDialogArguments_id, cx, "dialogArguments");
+  SET_JSID_TO_STRING(sControllers_id,     cx, "controllers");
+  SET_JSID_TO_STRING(sLength_id,          cx, "length");
+  SET_JSID_TO_STRING(sInnerHeight_id,     cx, "innerHeight");
+  SET_JSID_TO_STRING(sInnerWidth_id,      cx, "innerWidth");
+  SET_JSID_TO_STRING(sOuterHeight_id,     cx, "outerHeight");
+  SET_JSID_TO_STRING(sOuterWidth_id,      cx, "outerWidth");
+  SET_JSID_TO_STRING(sScreenX_id,         cx, "screenX");
+  SET_JSID_TO_STRING(sScreenY_id,         cx, "screenY");
+  SET_JSID_TO_STRING(sStatus_id,          cx, "status");
+  SET_JSID_TO_STRING(sName_id,            cx, "name");
+  SET_JSID_TO_STRING(sOnmousedown_id,     cx, "onmousedown");
+  SET_JSID_TO_STRING(sOnmouseup_id,       cx, "onmouseup");
+  SET_JSID_TO_STRING(sOnclick_id,         cx, "onclick");
+  SET_JSID_TO_STRING(sOndblclick_id,      cx, "ondblclick");
+  SET_JSID_TO_STRING(sOncontextmenu_id,   cx, "oncontextmenu");
+  SET_JSID_TO_STRING(sOnmouseover_id,     cx, "onmouseover");
+  SET_JSID_TO_STRING(sOnmouseout_id,      cx, "onmouseout");
+  SET_JSID_TO_STRING(sOnkeydown_id,       cx, "onkeydown");
+  SET_JSID_TO_STRING(sOnkeyup_id,         cx, "onkeyup");
+  SET_JSID_TO_STRING(sOnkeypress_id,      cx, "onkeypress");
+  SET_JSID_TO_STRING(sOnmousemove_id,     cx, "onmousemove");
+  SET_JSID_TO_STRING(sOnfocus_id,         cx, "onfocus");
+  SET_JSID_TO_STRING(sOnblur_id,          cx, "onblur");
+  SET_JSID_TO_STRING(sOnsubmit_id,        cx, "onsubmit");
+  SET_JSID_TO_STRING(sOnreset_id,         cx, "onreset");
+  SET_JSID_TO_STRING(sOnchange_id,        cx, "onchange");
+  SET_JSID_TO_STRING(sOnselect_id,        cx, "onselect");
+  SET_JSID_TO_STRING(sOnload_id,          cx, "onload");
+  SET_JSID_TO_STRING(sOnpopstate_id,      cx, "onpopstate");
+  SET_JSID_TO_STRING(sOnbeforeunload_id,  cx, "onbeforeunload");
+  SET_JSID_TO_STRING(sOnunload_id,        cx, "onunload");
+  SET_JSID_TO_STRING(sOnhashchange_id,    cx, "onhashchange");
+  SET_JSID_TO_STRING(sOnreadystatechange_id, cx, "onreadystatechange");
+  SET_JSID_TO_STRING(sOnpageshow_id,      cx, "onpageshow");
+  SET_JSID_TO_STRING(sOnpagehide_id,      cx, "onpagehide");
+  SET_JSID_TO_STRING(sOnabort_id,         cx, "onabort");
+  SET_JSID_TO_STRING(sOnerror_id,         cx, "onerror");
+  SET_JSID_TO_STRING(sOnpaint_id,         cx, "onpaint");
+  SET_JSID_TO_STRING(sOnresize_id,        cx, "onresize");
+  SET_JSID_TO_STRING(sOnscroll_id,        cx, "onscroll");
+  SET_JSID_TO_STRING(sOndrag_id,          cx, "ondrag");
+  SET_JSID_TO_STRING(sOndragend_id,       cx, "ondragend");
+  SET_JSID_TO_STRING(sOndragenter_id,     cx, "ondragenter");
+  SET_JSID_TO_STRING(sOndragleave_id,     cx, "ondragleave");
+  SET_JSID_TO_STRING(sOndragover_id,      cx, "ondragover");
+  SET_JSID_TO_STRING(sOndragstart_id,     cx, "ondragstart");
+  SET_JSID_TO_STRING(sOndrop_id,          cx, "ondrop");
+  SET_JSID_TO_STRING(sScrollX_id,         cx, "scrollX");
+  SET_JSID_TO_STRING(sScrollY_id,         cx, "scrollY");
+  SET_JSID_TO_STRING(sScrollMaxX_id,      cx, "scrollMaxX");
+  SET_JSID_TO_STRING(sScrollMaxY_id,      cx, "scrollMaxY");
+  SET_JSID_TO_STRING(sOpen_id,            cx, "open");
+  SET_JSID_TO_STRING(sItem_id,            cx, "item");
+  SET_JSID_TO_STRING(sNamedItem_id,       cx, "namedItem");
+  SET_JSID_TO_STRING(sEnumerate_id,       cx, "enumerateProperties");
+  SET_JSID_TO_STRING(sNavigator_id,       cx, "navigator");
+  SET_JSID_TO_STRING(sDocument_id,        cx, "document");
+  SET_JSID_TO_STRING(sWindow_id,          cx, "window");
+  SET_JSID_TO_STRING(sFrames_id,          cx, "frames");
+  SET_JSID_TO_STRING(sSelf_id,            cx, "self");
+  SET_JSID_TO_STRING(sOpener_id,          cx, "opener");
+  SET_JSID_TO_STRING(sAll_id,             cx, "all");
+  SET_JSID_TO_STRING(sTags_id,            cx, "tags");
+  SET_JSID_TO_STRING(sAddEventListener_id,cx, "addEventListener");
+  SET_JSID_TO_STRING(sBaseURIObject_id,   cx, "baseURIObject");
+  SET_JSID_TO_STRING(sNodePrincipal_id,   cx, "nodePrincipal");
+  SET_JSID_TO_STRING(sDocumentURIObject_id,cx,"documentURIObject");
+  SET_JSID_TO_STRING(sOncopy_id,          cx, "oncopy");
+  SET_JSID_TO_STRING(sOncut_id,           cx, "oncut");
+  SET_JSID_TO_STRING(sOnpaste_id,         cx, "onpaste");
+  SET_JSID_TO_STRING(sJava_id,            cx, "java");
+  SET_JSID_TO_STRING(sPackages_id,        cx, "Packages");
 
   return NS_OK;
 }
 
 static nsresult
 CreateExceptionFromResult(JSContext *cx, nsresult aResult)
 {
   nsCOMPtr<nsIExceptionService> xs =
@@ -1857,17 +1856,17 @@ nsDOMClassInfo::ObjectIsNativeWrapper(JS
     nsIScriptContext *scx = GetScriptContextFromJSContext(cx);
 
     NS_PRECONDITION(!scx || !scx->IsContextInitialized() ||
                     sXPCNativeWrapperGetPropertyOp,
                     "Must know what the XPCNativeWrapper class GetProperty op is!");
   }
 #endif
 
-  JSPropertyOp op = obj->getClass()->getProperty;
+  JSPropertyOp op = obj->getJSClass()->getProperty;
   return !!op && (op == sXPCNativeWrapperGetPropertyOp ||
                   op == sXrayWrapperPropertyHolderGetPropertyOp);
 }
 
 nsDOMClassInfo::nsDOMClassInfo(nsDOMClassInfoData* aData) : mData(aData)
 {
 }
 
@@ -4097,34 +4096,35 @@ nsDOMClassInfo::Init()
 
   sIsInitialized = PR_TRUE;
 
   return NS_OK;
 }
 
 // static
 PRInt32
-nsDOMClassInfo::GetArrayIndexFromId(JSContext *cx, jsval id, PRBool *aIsNumber)
-{
-  jsdouble array_index;
-
+nsDOMClassInfo::GetArrayIndexFromId(JSContext *cx, jsid id, PRBool *aIsNumber)
+{
   if (aIsNumber) {
     *aIsNumber = PR_FALSE;
   }
 
-  JSAutoRequest ar(cx);
-
-  if (!::JS_ValueToNumber(cx, id, &array_index)) {
-    return -1;
-  }
-
-  jsint i = -1;
-
-  if (!::JS_DoubleIsInt32(array_index, &i)) {
-    return -1;
+  jsint i;
+  if (JSID_IS_INT(id)) {
+      i = JSID_TO_INT(id);
+  } else {
+      JSAutoRequest ar(cx);
+
+      jsval idval;
+      jsdouble array_index;
+      if (!::JS_IdToValue(cx, id, &idval) ||
+          !::JS_ValueToNumber(cx, idval, &array_index) ||
+          !::JS_DoubleIsInt32(array_index, &i)) {
+        return -1;
+      }
   }
 
   if (aIsNumber) {
     *aIsNumber = PR_TRUE;
   }
 
   return i;
 }
@@ -4276,47 +4276,47 @@ nsDOMClassInfo::PostCreate(nsIXPConnectW
 {
   NS_WARNING("nsDOMClassInfo::PostCreate Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval id, jsval *vp,
+                            JSObject *obj, jsid id, jsval *vp,
                             PRBool *_retval)
 {
   NS_WARNING("nsDOMClassInfo::AddProperty Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::DelProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval id, jsval *vp,
+                            JSObject *obj, jsid id, jsval *vp,
                             PRBool *_retval)
 {
   NS_WARNING("nsDOMClassInfo::DelProperty Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval id, jsval *vp,
+                            JSObject *obj, jsid id, jsval *vp,
                             PRBool *_retval)
 {
   NS_WARNING("nsDOMClassInfo::GetProperty Don't call me!");
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval id, jsval *vp,
+                            JSObject *obj, jsid id, jsval *vp,
                             PRBool *_retval)
 {
   NS_WARNING("nsDOMClassInfo::SetProperty Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
@@ -4364,32 +4364,30 @@ nsDOMClassInfo::ResolveConstructor(JSCon
   }
 
   if (!JSVAL_IS_PRIMITIVE(val)) {
     // If val is not an (non-null) object there either is no
     // constructor for this class, or someone messed with
     // window.classname, just fall through and let the JS engine
     // return the Object constructor.
 
-    JSString *str = JSVAL_TO_STRING(sConstructor_id);
-    if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                               ::JS_GetStringLength(str), val, nsnull, nsnull,
-                               JSPROP_ENUMERATE)) {
+    if (!::JS_DefinePropertyById(cx, obj, sConstructor_id, val, nsnull, nsnull,
+                                 JSPROP_ENUMERATE)) {
       return NS_ERROR_UNEXPECTED;
     }
 
     *objp = obj;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                           JSObject *obj, jsval id, PRUint32 flags,
+                           JSObject *obj, jsid id, PRUint32 flags,
                            JSObject **objp, PRBool *_retval)
 {
   if (id == sConstructor_id && !(flags & JSRESOLVE_ASSIGNING)) {
     return ResolveConstructor(cx, obj, objp);
   }
 
   return NS_OK;
 }
@@ -4410,17 +4408,17 @@ nsDOMClassInfo::Finalize(nsIXPConnectWra
 {
   NS_WARNING("nsDOMClassInfo::Finalize Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::CheckAccess(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval id, PRUint32 mode,
+                            JSObject *obj, jsid id, PRUint32 mode,
                             jsval *vp, PRBool *_retval)
 {
   PRUint32 mode_type = mode & JSACC_TYPEMASK;
 
   if ((mode_type == JSACC_WATCH ||
        mode_type == JSACC_PROTO ||
        mode_type == JSACC_PARENT) &&
       sSecMan) {
@@ -4465,17 +4463,17 @@ nsDOMClassInfo::Construct(nsIXPConnectWr
 {
   NS_WARNING("nsDOMClassInfo::Construct Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::HasInstance(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval val, PRBool *bp,
+                            JSObject *obj, const jsval &val, PRBool *bp,
                             PRBool *_retval)
 {
   NS_WARNING("nsDOMClassInfo::HasInstance Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
@@ -4484,17 +4482,17 @@ nsDOMClassInfo::Trace(nsIXPConnectWrappe
 {
   NS_WARNING("nsDOMClassInfo::Trace Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::Equality(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                         JSObject * obj, jsval val, PRBool *bp)
+                         JSObject * obj, const jsval &val, PRBool *bp)
 {
   NS_WARNING("nsDOMClassInfo::Equality Don't call me!");
 
   return NS_ERROR_UNEXPECTED;
 }
 
 NS_IMETHODIMP
 nsDOMClassInfo::OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
@@ -4728,99 +4726,99 @@ nsDOMClassInfo::ShutDown()
   if (sClassInfoData[0].u.mConstructorFptr) {
     PRUint32 i;
 
     for (i = 0; i < eDOMClassInfoIDCount; i++) {
       NS_IF_RELEASE(sClassInfoData[i].mCachedClassInfo);
     }
   }
 
-  sTop_id             = JSVAL_VOID;
-  sParent_id          = JSVAL_VOID;
-  sScrollbars_id      = JSVAL_VOID;
-  sLocation_id        = JSVAL_VOID;
-  sConstructor_id     = JSVAL_VOID;
-  s_content_id        = JSVAL_VOID;
-  sContent_id         = JSVAL_VOID;
-  sMenubar_id         = JSVAL_VOID;
-  sToolbar_id         = JSVAL_VOID;
-  sLocationbar_id     = JSVAL_VOID;
-  sPersonalbar_id     = JSVAL_VOID;
-  sStatusbar_id       = JSVAL_VOID;
-  sDialogArguments_id = JSVAL_VOID;
-  sControllers_id     = JSVAL_VOID;
-  sLength_id          = JSVAL_VOID;
-  sInnerHeight_id     = JSVAL_VOID;
-  sInnerWidth_id      = JSVAL_VOID;
-  sOuterHeight_id     = JSVAL_VOID;
-  sOuterWidth_id      = JSVAL_VOID;
-  sScreenX_id         = JSVAL_VOID;
-  sScreenY_id         = JSVAL_VOID;
-  sStatus_id          = JSVAL_VOID;
-  sName_id            = JSVAL_VOID;
-  sOnmousedown_id     = JSVAL_VOID;
-  sOnmouseup_id       = JSVAL_VOID;
-  sOnclick_id         = JSVAL_VOID;
-  sOndblclick_id      = JSVAL_VOID;
-  sOncontextmenu_id   = JSVAL_VOID;
-  sOnmouseover_id     = JSVAL_VOID;
-  sOnmouseout_id      = JSVAL_VOID;
-  sOnkeydown_id       = JSVAL_VOID;
-  sOnkeyup_id         = JSVAL_VOID;
-  sOnkeypress_id      = JSVAL_VOID;
-  sOnmousemove_id     = JSVAL_VOID;
-  sOnfocus_id         = JSVAL_VOID;
-  sOnblur_id          = JSVAL_VOID;
-  sOnsubmit_id        = JSVAL_VOID;
-  sOnreset_id         = JSVAL_VOID;
-  sOnchange_id        = JSVAL_VOID;
-  sOnselect_id        = JSVAL_VOID;
-  sOnload_id          = JSVAL_VOID;
-  sOnbeforeunload_id  = JSVAL_VOID;
-  sOnunload_id        = JSVAL_VOID;
-  sOnhashchange_id    = JSVAL_VOID;
-  sOnreadystatechange_id = JSVAL_VOID;
-  sOnpageshow_id      = JSVAL_VOID;
-  sOnpagehide_id      = JSVAL_VOID;
-  sOnabort_id         = JSVAL_VOID;
-  sOnerror_id         = JSVAL_VOID;
-  sOnpaint_id         = JSVAL_VOID;
-  sOnresize_id        = JSVAL_VOID;
-  sOnscroll_id        = JSVAL_VOID;
-  sOndrag_id          = JSVAL_VOID;
-  sOndragend_id       = JSVAL_VOID;
-  sOndragenter_id     = JSVAL_VOID;
-  sOndragleave_id     = JSVAL_VOID;
-  sOndragover_id      = JSVAL_VOID;
-  sOndragstart_id     = JSVAL_VOID;
-  sOndrop_id          = JSVAL_VOID;
-  sScrollX_id         = JSVAL_VOID;
-  sScrollY_id         = JSVAL_VOID;
-  sScrollMaxX_id      = JSVAL_VOID;
-  sScrollMaxY_id      = JSVAL_VOID;
-  sOpen_id            = JSVAL_VOID;
-  sItem_id            = JSVAL_VOID;
-  sEnumerate_id       = JSVAL_VOID;
-  sNavigator_id       = JSVAL_VOID;
-  sDocument_id        = JSVAL_VOID;
-  sWindow_id          = JSVAL_VOID;
-  sFrames_id          = JSVAL_VOID;
-  sSelf_id            = JSVAL_VOID;
-  sOpener_id          = JSVAL_VOID;
-  sAll_id             = JSVAL_VOID;
-  sTags_id            = JSVAL_VOID;
-  sAddEventListener_id= JSVAL_VOID;
-  sBaseURIObject_id   = JSVAL_VOID;
-  sNodePrincipal_id   = JSVAL_VOID;
-  sDocumentURIObject_id=JSVAL_VOID;
-  sOncopy_id          = JSVAL_VOID;
-  sOncut_id           = JSVAL_VOID;
-  sOnpaste_id         = JSVAL_VOID;
-  sJava_id            = JSVAL_VOID;
-  sPackages_id        = JSVAL_VOID;
+  sTop_id             = JSID_VOID;
+  sParent_id          = JSID_VOID;
+  sScrollbars_id      = JSID_VOID;
+  sLocation_id        = JSID_VOID;
+  sConstructor_id     = JSID_VOID;
+  s_content_id        = JSID_VOID;
+  sContent_id         = JSID_VOID;
+  sMenubar_id         = JSID_VOID;
+  sToolbar_id         = JSID_VOID;
+  sLocationbar_id     = JSID_VOID;
+  sPersonalbar_id     = JSID_VOID;
+  sStatusbar_id       = JSID_VOID;
+  sDialogArguments_id = JSID_VOID;
+  sControllers_id     = JSID_VOID;
+  sLength_id          = JSID_VOID;
+  sInnerHeight_id     = JSID_VOID;
+  sInnerWidth_id      = JSID_VOID;
+  sOuterHeight_id     = JSID_VOID;
+  sOuterWidth_id      = JSID_VOID;
+  sScreenX_id         = JSID_VOID;
+  sScreenY_id         = JSID_VOID;
+  sStatus_id          = JSID_VOID;
+  sName_id            = JSID_VOID;
+  sOnmousedown_id     = JSID_VOID;
+  sOnmouseup_id       = JSID_VOID;
+  sOnclick_id         = JSID_VOID;
+  sOndblclick_id      = JSID_VOID;
+  sOncontextmenu_id   = JSID_VOID;
+  sOnmouseover_id     = JSID_VOID;
+  sOnmouseout_id      = JSID_VOID;
+  sOnkeydown_id       = JSID_VOID;
+  sOnkeyup_id         = JSID_VOID;
+  sOnkeypress_id      = JSID_VOID;
+  sOnmousemove_id     = JSID_VOID;
+  sOnfocus_id         = JSID_VOID;
+  sOnblur_id          = JSID_VOID;
+  sOnsubmit_id        = JSID_VOID;
+  sOnreset_id         = JSID_VOID;
+  sOnchange_id        = JSID_VOID;
+  sOnselect_id        = JSID_VOID;
+  sOnload_id          = JSID_VOID;
+  sOnbeforeunload_id  = JSID_VOID;
+  sOnunload_id        = JSID_VOID;
+  sOnhashchange_id    = JSID_VOID;
+  sOnreadystatechange_id = JSID_VOID;
+  sOnpageshow_id      = JSID_VOID;
+  sOnpagehide_id      = JSID_VOID;
+  sOnabort_id         = JSID_VOID;
+  sOnerror_id         = JSID_VOID;
+  sOnpaint_id         = JSID_VOID;
+  sOnresize_id        = JSID_VOID;
+  sOnscroll_id        = JSID_VOID;
+  sOndrag_id          = JSID_VOID;
+  sOndragend_id       = JSID_VOID;
+  sOndragenter_id     = JSID_VOID;
+  sOndragleave_id     = JSID_VOID;
+  sOndragover_id      = JSID_VOID;
+  sOndragstart_id     = JSID_VOID;
+  sOndrop_id          = JSID_VOID;
+  sScrollX_id         = JSID_VOID;
+  sScrollY_id         = JSID_VOID;
+  sScrollMaxX_id      = JSID_VOID;
+  sScrollMaxY_id      = JSID_VOID;
+  sOpen_id            = JSID_VOID;
+  sItem_id            = JSID_VOID;
+  sEnumerate_id       = JSID_VOID;
+  sNavigator_id       = JSID_VOID;
+  sDocument_id        = JSID_VOID;
+  sWindow_id          = JSID_VOID;
+  sFrames_id          = JSID_VOID;
+  sSelf_id            = JSID_VOID;
+  sOpener_id          = JSID_VOID;
+  sAll_id             = JSID_VOID;
+  sTags_id            = JSID_VOID;
+  sAddEventListener_id= JSID_VOID;
+  sBaseURIObject_id   = JSID_VOID;
+  sNodePrincipal_id   = JSID_VOID;
+  sDocumentURIObject_id=JSID_VOID;
+  sOncopy_id          = JSID_VOID;
+  sOncut_id           = JSID_VOID;
+  sOnpaste_id         = JSID_VOID;
+  sJava_id            = JSID_VOID;
+  sPackages_id        = JSID_VOID;
 
   NS_IF_RELEASE(sXPConnect);
   NS_IF_RELEASE(sSecMan);
   sIsInitialized = PR_FALSE;
 }
 
 // Window helper
 
@@ -4874,17 +4872,17 @@ static JSClass sGlobalScopePolluterClass
   (JSResolveOp)nsWindowSH::GlobalScopePolluterNewResolve, JS_ConvertStub,
   nsHTMLDocumentSH::ReleaseDocument
 };
 
 
 // static
 JSBool
 nsWindowSH::GlobalScopePolluterGetProperty(JSContext *cx, JSObject *obj,
-                                           jsval id, jsval *vp)
+                                           jsid id, jsval *vp)
 {
   // Someone is accessing a element by referencing its name/id in the
   // global scope, do a security check to make sure that's ok.
 
   nsresult rv =
     sSecMan->CheckPropertyAccess(cx, ::JS_GetGlobalForObject(cx, obj),
                                  "Window", id,
                                  nsIXPCSecurityManager::ACCESS_GET_PROPERTY);
@@ -4900,17 +4898,17 @@ nsWindowSH::GlobalScopePolluterGetProper
   // catch and fix these mistakes.
   PrintWarningOnConsole(cx, "GlobalScopeElementReference");
 
   return JS_TRUE;
 }
 
 // static
 JSBool
-nsWindowSH::SecurityCheckOnSetProp(JSContext *cx, JSObject *obj, jsval id,
+nsWindowSH::SecurityCheckOnSetProp(JSContext *cx, JSObject *obj, jsid id,
                                    jsval *vp)
 {
   // Someone is accessing a element by referencing its name/id in the
   // global scope, do a security check to make sure that's ok.
 
   nsresult rv =
     sSecMan->CheckPropertyAccess(cx, ::JS_GetGlobalForObject(cx, obj),
                                  "Window", id,
@@ -4919,22 +4917,22 @@ nsWindowSH::SecurityCheckOnSetProp(JSCon
   // If !NS_SUCCEEDED(rv) the security check failed. The security
   // manager set a JS exception for us.
   return NS_SUCCEEDED(rv);
 }
 
 // static
 JSBool
 nsWindowSH::GlobalScopePolluterNewResolve(JSContext *cx, JSObject *obj,
-                                          jsval id, uintN flags,
+                                          jsid id, uintN flags,
                                           JSObject **objp)
 {
   if (flags & (JSRESOLVE_ASSIGNING | JSRESOLVE_DECLARING |
                JSRESOLVE_CLASSNAME | JSRESOLVE_QUALIFIED) ||
-      !JSVAL_IS_STRING(id)) {
+      !JSID_IS_STRING(id)) {
     // Nothing to do here if we're either assigning or declaring,
     // resolving a class name, doing a qualified resolve, or
     // resolving a number.
 
     return JS_TRUE;
   }
 
   nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(cx, obj);
@@ -4944,21 +4942,20 @@ nsWindowSH::GlobalScopePolluterNewResolv
       document->GetCompatibilityMode() != eCompatibility_NavQuirks) {
     // If we don't have a document, or if the document is not in
     // quirks mode, return early.
 
     return JS_TRUE;
   }
 
   JSObject *proto = ::JS_GetPrototype(cx, obj);
-  JSString *jsstr = JSVAL_TO_STRING(id);
+  JSString *jsstr = JSID_TO_STRING(id);
   JSBool hasProp;
 
-  if (!proto || !::JS_HasUCProperty(cx, proto, ::JS_GetStringChars(jsstr),
-                                    ::JS_GetStringLength(jsstr), &hasProp) ||
+  if (!proto || !::JS_HasPropertyById(cx, proto, id, &hasProp) ||
       hasProp) {
     // No prototype, or the property exists on the prototype. Do
     // nothing.
 
     return JS_TRUE;
   }
 
   nsDependentJSString str(jsstr);
@@ -4970,19 +4967,17 @@ nsWindowSH::GlobalScopePolluterNewResolv
 
   if (result) {
     jsval v;
     nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
     nsresult rv = WrapNative(cx, obj, result, PR_TRUE, &v,
                              getter_AddRefs(holder));
     NS_ENSURE_SUCCESS(rv, JS_FALSE);
 
-    if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(jsstr),
-                               ::JS_GetStringLength(jsstr), v, nsnull, nsnull,
-                               0)) {
+    if (!::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull, 0)) {
       nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
 
       return JS_FALSE;
     }
 
     *objp = obj;
   }
 
@@ -5066,33 +5061,33 @@ nsWindowSH::InstallGlobalScopePolluter(J
   // invalidation).
   NS_ADDREF(doc);
 
   return NS_OK;
 }
 
 static
 already_AddRefed<nsIDOMWindow>
-GetChildFrame(nsGlobalWindow *win, jsval id)
+GetChildFrame(nsGlobalWindow *win, jsid id)
 {
   nsCOMPtr<nsIDOMWindowCollection> frames;
   win->GetFrames(getter_AddRefs(frames));
 
   nsIDOMWindow *frame = nsnull;
 
   if (frames) {
-    frames->Item(JSVAL_TO_INT(id), &frame);
+    frames->Item(JSID_TO_INT(id), &frame);
   }
 
   return frame;
 }
 
 NS_IMETHODIMP
 nsWindowSH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                        JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
 
   JSAutoRequest ar(cx);
 
 #ifdef DEBUG_SH_FORWARDING
   {
     JSString *jsstr = ::JS_ValueToString(cx, id);
@@ -5122,38 +5117,35 @@ nsWindowSH::GetProperty(nsIXPConnectWrap
 
     JSObject *innerObj;
     if (innerWin && (innerObj = innerWin->GetGlobalJSObject())) {
 #ifdef DEBUG_SH_FORWARDING
       printf(" --- Forwarding get to inner window %p\n", (void *)innerWin);
 #endif
 
       // Forward the get to the inner object
-      if (JSVAL_IS_STRING(id)) {
-        JSString *str = JSVAL_TO_STRING(id);
-
-        *_retval = ::JS_GetUCProperty(cx, innerObj, ::JS_GetStringChars(str),
-                                      ::JS_GetStringLength(str), vp);
-      } else if (JSVAL_IS_INT(id)) {
-        *_retval = ::JS_GetElement(cx, innerObj, JSVAL_TO_INT(id), vp);
+      if (JSID_IS_STRING(id)) {
+        *_retval = ::JS_GetPropertyById(cx, innerObj, id, vp);
+      } else if (JSID_IS_INT(id)) {
+        *_retval = ::JS_GetElement(cx, innerObj, JSID_TO_INT(id), vp);
       } else {
         NS_ERROR("Write me!");
 
         return NS_ERROR_NOT_IMPLEMENTED;
       }
 
       return NS_OK;
     }
   }
 
   // The order in which things are done in this method are a bit
   // whacky, that's because this method is *extremely* performace
   // critical. Don't touch this unless you know what you're doing.
 
-  if (JSVAL_IS_INT(id)) {
+  if (JSID_IS_INT(id)) {
     // If we're accessing a numeric property we'll treat that as if
     // window.frames[n] is accessed (since window.frames === window),
     // if window.frames[n] is a child frame, wrap the frame and return
     // it without doing a security check.
 
     nsCOMPtr<nsIDOMWindow> frame = GetChildFrame(win, id);
     nsresult rv = NS_OK;
 
@@ -5179,17 +5171,17 @@ nsWindowSH::GetProperty(nsIXPConnectWrap
         rv = sXPConnect->GetXOWForObject(cx, scopeobj, JSVAL_TO_OBJECT(*vp),
                                          vp);
       }
     }
 
     return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
   }
 
-  if (JSVAL_IS_STRING(id) && !JSVAL_IS_PRIMITIVE(*vp) &&
+  if (JSID_IS_STRING(id) && !JSVAL_IS_PRIMITIVE(*vp) &&
       ::JS_TypeOfValue(cx, *vp) != JSTYPE_FUNCTION) {
     // A named property accessed which could have been resolved to a
     // child frame in nsWindowSH::NewResolve() (*vp will tell us if
     // that's the case). If *vp is a window object (i.e. a child
     // frame), return without doing a security check.
     //
     // Calling GetWrappedNativeOfJSObject() is not all that cheap, so
     // only do that if the JSClass name is one that is likely to be a
@@ -5221,17 +5213,17 @@ nsWindowSH::GetProperty(nsIXPConnectWrap
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsWindowSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                        JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
 
 #ifdef DEBUG_SH_FORWARDING
   {
     nsDependentJSString str(::JS_ValueToString(cx, id));
 
     if (win->IsInnerWindow()) {
@@ -5256,23 +5248,20 @@ nsWindowSH::SetProperty(nsIXPConnectWrap
 
     JSObject *innerObj;
     if (innerWin && (innerObj = innerWin->GetGlobalJSObject())) {
 #ifdef DEBUG_SH_FORWARDING
       printf(" --- Forwarding set to inner window %p\n", (void *)innerWin);
 #endif
 
       // Forward the set to the inner object
-      if (JSVAL_IS_STRING(id)) {
-        JSString *str = JSVAL_TO_STRING(id);
-
-        *_retval = ::JS_SetUCProperty(cx, innerObj, ::JS_GetStringChars(str),
-                                      ::JS_GetStringLength(str), vp);
-      } else if (JSVAL_IS_INT(id)) {
-        *_retval = ::JS_SetElement(cx, innerObj, JSVAL_TO_INT(id), vp);
+      if (JSID_IS_STRING(id)) {
+        *_retval = ::JS_SetPropertyById(cx, innerObj, id, vp);
+      } else if (JSID_IS_INT(id)) {
+        *_retval = ::JS_SetElement(cx, innerObj, JSID_TO_INT(id), vp);
       } else {
         NS_ERROR("Write me!");
 
         return NS_ERROR_NOT_IMPLEMENTED;
       }
 
       return NS_OK;
     }
@@ -5301,17 +5290,17 @@ nsWindowSH::SetProperty(nsIXPConnectWrap
     return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
   }
 
   return nsEventReceiverSH::SetProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsWindowSH::AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, jsval *vp,
+                        JSObject *obj, jsid id, jsval *vp,
                         PRBool *_retval)
 {
   nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
 
 #ifdef DEBUG_SH_FORWARDING
   {
     nsDependentJSString str(::JS_ValueToString(cx, id));
 
@@ -5340,43 +5329,37 @@ nsWindowSH::AddProperty(nsIXPConnectWrap
       if (sResolving) {
         return NS_OK;
       }
 
 #ifdef DEBUG_SH_FORWARDING
       printf(" --- Forwarding add to inner window %p\n", (void *)innerWin);
 #endif
 
-      jsid interned_id;
-      if (!JS_ValueToId(cx, id, &interned_id)) {
-        *_retval = JS_FALSE;
-        return NS_OK;
-      }
-
       JSPropertyDescriptor desc;
-      if (!JS_GetPropertyDescriptorById(cx, obj, interned_id,
+      if (!JS_GetPropertyDescriptorById(cx, obj, id,
                                         JSRESOLVE_QUALIFIED, &desc)) {
         *_retval = JS_FALSE;
         return NS_OK;
       }
 
       // Forward the add to the inner object
-      *_retval = JS_DefinePropertyById(cx, innerObj, interned_id, *vp,
+      *_retval = JS_DefinePropertyById(cx, innerObj, id, *vp,
                                        desc.getter, desc.setter,
                                        desc.attrs | JSPROP_ENUMERATE);
       return NS_OK;
     }
   }
 
   return nsEventReceiverSH::AddProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsWindowSH::DelProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, jsval *vp,
+                        JSObject *obj, jsid id, jsval *vp,
                         PRBool *_retval)
 {
   nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
 
 #ifdef DEBUG_SH_FORWARDING
   {
     nsDependentJSString str(::JS_ValueToString(cx, id));
 
@@ -5400,19 +5383,17 @@ nsWindowSH::DelProperty(nsIXPConnectWrap
 
     JSObject *innerObj;
     if (innerWin && (innerObj = innerWin->GetGlobalJSObject())) {
 #ifdef DEBUG_SH_FORWARDING
       printf(" --- Forwarding del to inner window %p\n", (void *)innerWin);
 #endif
 
       // Forward the del to the inner object
-      jsid interned_id;
-      *_retval = (JS_ValueToId(cx, id, &interned_id) &&
-                  JS_DeletePropertyById(cx, innerObj, interned_id));
+      *_retval = JS_DeletePropertyById(cx, innerObj, id);
 
       return NS_OK;
     }
   }
 
   // Notify any XOWs on our outer window.
 
   nsGlobalWindow *outerWin = win->GetOuterWindowInternal();
@@ -5612,71 +5593,60 @@ DefineInterfaceConstants(JSContext *cx, 
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLBodyElementSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext
-                                *cx, JSObject *obj, jsval id, PRUint32 flags,
+                                *cx, JSObject *obj, jsid id, PRUint32 flags,
                                 JSObject **objp, PRBool *_retval)
 {
   if (id == sOnhashchange_id) {
     // Special handling so |"onhashchange" in document.body| returns true.
-    jsid interned_id;
-
-    if (!JS_ValueToId(cx, id, &interned_id) ||
-        !JS_DefinePropertyById(cx, obj, interned_id, JSVAL_VOID,
+    if (!JS_DefinePropertyById(cx, obj, id, JSVAL_VOID,
                                nsnull, nsnull, JSPROP_ENUMERATE)) {
       *_retval = PR_FALSE;
       return NS_ERROR_FAILURE;
     }
 
     *objp = obj;
     return NS_OK;
   }
 
   return nsElementSH::NewResolve(wrapper, cx, obj, id, flags, objp, _retval);
 }
 
 NS_IMETHODIMP
 nsHTMLBodyElementSH::GetProperty(nsIXPConnectWrappedNative *wrapper,
-                                 JSContext *cx, JSObject *obj, jsval id,
+                                 JSContext *cx, JSObject *obj, jsid id,
                                  jsval *vp, PRBool *_retval)
 {
   if (id == sOnhashchange_id) {
     // Forward the request to the Window.
-    jsid interned_id;
-
-    if (!JS_ValueToId(cx, id, &interned_id) ||
-        !JS_GetPropertyById(cx, JS_GetGlobalForObject(cx, obj),
-                            interned_id, vp)) {
+    if (!JS_GetPropertyById(cx, JS_GetGlobalForObject(cx, obj), id, vp)) {
       *_retval = PR_FALSE;
       return NS_ERROR_FAILURE;
     }
 
     return NS_OK;
   }
 
   return nsElementSH::GetProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsHTMLBodyElementSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
                                  JSContext *cx, JSObject *obj,
-                                 jsval id, jsval *vp, PRBool *_retval)
+                                 jsid id, jsval *vp, PRBool *_retval)
 {
   if (id == sOnhashchange_id) {
     // Forward the request to the Window.
-    jsid interned_id;
-
-    if (!JS_ValueToId(cx, id, &interned_id) ||
-        !JS_SetPropertyById(cx, JS_GetGlobalForObject(cx, obj),
-                            interned_id, vp)) {
+    if (!JS_SetPropertyById(cx, JS_GetGlobalForObject(cx, obj), id, vp)) {
       *_retval = PR_FALSE;
       return NS_ERROR_FAILURE;
     }
 
     return NS_OK;
   }
 
   return nsElementSH::SetProperty(wrapper, cx, obj, id, vp, _retval);
@@ -5705,17 +5675,17 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMDOMCONSTRUCTOR
 
   nsresult Construct(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                      JSObject *obj, PRUint32 argc, jsval *argv,
                      jsval *vp, PRBool *_retval);
 
   nsresult HasInstance(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                       JSObject *obj, jsval val, PRBool *bp,
+                       JSObject *obj, const jsval &val, PRBool *bp,
                        PRBool *_retval);
 
   nsresult Install(JSContext *cx, JSObject *target, jsval thisAsVal)
   {
     JSBool ok =
       ::JS_DefineUCProperty(cx, target,
                             reinterpret_cast<const jschar *>(mClassName),
                             nsCRT::strlen(mClassName), thisAsVal, nsnull,
@@ -5865,17 +5835,17 @@ nsDOMConstructor::Construct(nsIXPConnect
   }
 
   return BaseStubConstructor(mWeakOwner, name_struct, cx, obj, argc, argv, vp);
 }
 
 nsresult
 nsDOMConstructor::HasInstance(nsIXPConnectWrappedNative *wrapper,
                               JSContext * cx, JSObject * obj,
-                              jsval v, PRBool *bp, PRBool *_retval)
+                              const jsval &v, PRBool *bp, PRBool *_retval)
 
 {
   // No need to look these up in the hash.
   if (JSVAL_IS_PRIMITIVE(v)) {
     return NS_OK;
   }
 
   JSObject *dom_obj = JSVAL_TO_OBJECT(v);
@@ -6467,17 +6437,17 @@ ContentWindowGetter(JSContext *cx, JSObj
   return ::JS_GetProperty(cx, obj, "content", rval);
 }
 
 PRBool
 nsWindowSH::sResolving = PR_FALSE;
 
 NS_IMETHODIMP
 nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                       JSObject *obj, jsval id, PRUint32 flags,
+                       JSObject *obj, jsid id, PRUint32 flags,
                        JSObject **objp, PRBool *_retval)
 {
   nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
 
 #ifdef DEBUG_SH_FORWARDING
   {
     nsDependentJSString str(::JS_ValueToString(cx, id));
 
@@ -6533,22 +6503,19 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
     JSObject *realObj;
     wrapper->GetJSObject(&realObj);
     if (realObj == obj &&
         innerWin && (innerObj = innerWin->GetGlobalJSObject())) {
 #ifdef DEBUG_SH_FORWARDING
       printf(" --- Forwarding resolve to inner window %p\n", (void *)innerWin);
 #endif
 
-      jsid interned_id;
       JSPropertyDescriptor desc;
 
-      *_retval = (JS_ValueToId(cx, id, &interned_id) &&
-                  JS_GetPropertyDescriptorById(cx, innerObj, interned_id,
-                                               flags, &desc));
+      *_retval = JS_GetPropertyDescriptorById(cx, innerObj, id, flags, &desc);
 
       if (*_retval && desc.obj) {
 #ifdef DEBUG_SH_FORWARDING
         printf(" --- Resolve on inner window found property.\n");
 #endif
 
         // The JS engine assumes that the object that we return in objp is on
         // our prototype chain. As a result, for an assignment, it wants to
@@ -6561,47 +6528,47 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
         // we only care about fast expandos on the innerObj itself, things
         // found further up the prototype chain need to fend for themselves.
         if ((flags & JSRESOLVE_ASSIGNING) &&
             !(desc.attrs & (JSPROP_GETTER | JSPROP_SETTER)) &&
             desc.obj == innerObj) {
           PRBool oldResolving = sResolving;
           sResolving = PR_TRUE;
 
-          *_retval = JS_DefinePropertyById(cx, obj, interned_id, JSVAL_VOID,
+          *_retval = JS_DefinePropertyById(cx, obj, id, JSVAL_VOID,
                                            nsnull, nsnull,
                                            desc.attrs & JSPROP_ENUMERATE);
 
           sResolving = oldResolving;
           if (!*_retval) {
             return NS_OK;
           }
         }
 
         *objp = desc.obj;
       }
 
       return NS_OK;
     }
   }
 
-  if (!JSVAL_IS_STRING(id)) {
-    if (JSVAL_IS_INT(id) && !(flags & JSRESOLVE_ASSIGNING)) {
+  if (!JSID_IS_STRING(id)) {
+    if (JSID_IS_INT(id) && !(flags & JSRESOLVE_ASSIGNING)) {
       // If we're resolving a numeric property, treat that as if
       // window.frames[n] is resolved (since window.frames ===
       // window), if window.frames[n] is a child frame, define a
       // property for this index.
 
       nsCOMPtr<nsIDOMWindow> frame = GetChildFrame(win, id);
 
       if (frame) {
         // A numeric property accessed and the numeric property is a
         // child frame. Define a property for this index.
 
-        *_retval = ::JS_DefineElement(cx, obj, JSVAL_TO_INT(id), JSVAL_VOID,
+        *_retval = ::JS_DefineElement(cx, obj, JSID_TO_INT(id), JSVAL_VOID,
                                       nsnull, nsnull, JSPROP_SHARED);
 
         if (*_retval) {
           *objp = obj;
         }
       }
     }
 
@@ -6687,17 +6654,17 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
     return NS_OK;
   }
 
 
   // Hmm, we do an awful lot of QIs here; maybe we should add a
   // method on an interface that would let us just call into the
   // window code directly...
 
-  JSString *str = JSVAL_TO_STRING(id);
+  JSString *str = JSID_TO_STRING(id);
 
   // Don't resolve named frames on native wrappers
   if (!ObjectIsNativeWrapper(cx, obj)) {
     nsCOMPtr<nsIDocShellTreeNode> dsn(do_QueryInterface(win->GetDocShell()));
 
     PRInt32 count = 0;
 
     if (dsn) {
@@ -6736,20 +6703,17 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
                        !strcmp(JSVAL_TO_OBJECT(v)->getClass()->name,
                                "XPCCrossOriginWrapper"),
                        "Didn't wrap a window!");
         }
 #endif
 
         JSAutoRequest ar(cx);
 
-        PRBool ok = ::JS_DefineUCProperty(cx, obj, chars,
-                                          ::JS_GetStringLength(str),
-                                          v, nsnull, nsnull, 0);
-
+        PRBool ok = ::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull, 0);
         if (!ok) {
           return NS_ERROR_FAILURE;
         }
 
         *objp = obj;
 
         return NS_OK;
       }
@@ -6793,22 +6757,21 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
     JSObject *funObj = ::JS_GetFunctionObject(fun);
 
     nsAutoGCRoot root(&funObj, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    if (!::JS_DefineUCProperty(cx, windowObj, ::JS_GetStringChars(str),
-                               ::JS_GetStringLength(str), JSVAL_VOID,
-                               JS_DATA_TO_FUNC_PTR(JSPropertyOp, funObj),
-                               nsnull,
-                               JSPROP_ENUMERATE | JSPROP_GETTER |
-                               JSPROP_SHARED)) {
+    if (!::JS_DefinePropertyById(cx, windowObj, id, JSVAL_VOID,
+                                 JS_DATA_TO_FUNC_PTR(JSPropertyOp, funObj),
+                                 nsnull,
+                                 JSPROP_ENUMERATE | JSPROP_GETTER |
+                                 JSPROP_SHARED)) {
       return NS_ERROR_FAILURE;
     }
 
     *objp = obj;
 
     return NS_OK;
   }
 
@@ -6857,37 +6820,31 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
                        !strcmp(JSVAL_TO_OBJECT(v)->getClass()->name,
                                "XPCCrossOriginWrapper"),
                        "Didn't wrap a location object!");
     }
 #endif
 
     JSAutoRequest ar(cx);
 
-    JSBool ok = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                      ::JS_GetStringLength(str), v, nsnull,
-                                      nsnull,
-                                      JSPROP_PERMANENT |
-                                      JSPROP_ENUMERATE);
+    JSBool ok = ::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull,
+                                        JSPROP_PERMANENT | JSPROP_ENUMERATE);
 
     if (!ok) {
       return NS_ERROR_FAILURE;
     }
 
     *objp = obj;
 
     return NS_OK;
   }
 
   if (id == sOnhashchange_id) {
     // Special handling so |"onhashchange" in window| returns true
-    jsid interned_id;
-
-    if (!JS_ValueToId(cx, id, &interned_id) ||
-        !JS_DefinePropertyById(cx, obj, interned_id, JSVAL_VOID,
+    if (!JS_DefinePropertyById(cx, obj, id, JSVAL_VOID,
                                 nsnull, nsnull, JSPROP_ENUMERATE)) {
       *_retval = PR_FALSE;
       return NS_ERROR_FAILURE;
     }
 
     *objp = obj;
     return NS_OK;
   }
@@ -6897,20 +6854,18 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
         (!(flags & JSRESOLVE_QUALIFIED) && IsWritableReplaceable(id))) {
       // A readonly "replaceable" property is being set, or a
       // readwrite "replaceable" property is being set w/o being
       // fully qualified. Define the property on obj with the value
       // undefined to override the predefined property. This is done
       // for compatibility with other browsers.
       JSAutoRequest ar(cx);
 
-      if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                 ::JS_GetStringLength(str),
-                                 JSVAL_VOID, JS_PropertyStub, JS_PropertyStub,
-                                 JSPROP_ENUMERATE)) {
+      if (!::JS_DefinePropertyById(cx, obj, id, JSVAL_VOID, JS_PropertyStub,
+                                   JS_PropertyStub, JSPROP_ENUMERATE)) {
         return NS_ERROR_FAILURE;
       }
       *objp = obj;
 
       return NS_OK;
     }
   } else {
     if (id == sNavigator_id) {
@@ -6921,20 +6876,19 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
       jsval v;
       nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
       rv = WrapNative(cx, obj, navigator, &NS_GET_IID(nsIDOMNavigator), PR_TRUE,
                       &v, getter_AddRefs(holder));
       NS_ENSURE_SUCCESS(rv, rv);
 
       JSAutoRequest ar(cx);
 
-      if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                 ::JS_GetStringLength(str), v, nsnull, nsnull,
-                                 JSPROP_READONLY | JSPROP_PERMANENT |
-                                 JSPROP_ENUMERATE)) {
+      if (!::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull,
+                                   JSPROP_READONLY | JSPROP_PERMANENT |
+                                   JSPROP_ENUMERATE)) {
         return NS_ERROR_FAILURE;
       }
       *objp = obj;
 
       return NS_OK;
     }
 
     if (id == sDocument_id) {
@@ -6987,20 +6941,18 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
           scope = oldWin->GetGlobalJSObject();
         }
 
         rv = sXPConnect->GetXOWForObject(cx, scope, JSVAL_TO_OBJECT(winVal),
                                          &winVal);
         NS_ENSURE_SUCCESS(rv, rv);
       }
       PRBool ok =
-        ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                              ::JS_GetStringLength(str),
-                              winVal, JS_PropertyStub, JS_PropertyStub,
-                              JSPROP_READONLY | JSPROP_ENUMERATE);
+        ::JS_DefinePropertyById(cx, obj, id, winVal, JS_PropertyStub, JS_PropertyStub,
+                                JSPROP_READONLY | JSPROP_ENUMERATE);
 
       if (!ok) {
         return NS_ERROR_FAILURE;
       }
       *objp = obj;
 
       return NS_OK;
     }
@@ -7071,22 +7023,20 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
   if ((flags & JSRESOLVE_ASSIGNING) && !(flags & JSRESOLVE_WITH) &&
       win->IsInnerWindow()) {
     JSObject *realObj;
     wrapper->GetJSObject(&realObj);
 
     if (obj == realObj) {
       JSObject *proto = obj->getProto();
       if (proto) {
-        jsid interned_id;
         JSObject *pobj = NULL;
         jsval val;
 
-        if (!::JS_ValueToId(cx, id, &interned_id) ||
-            !::JS_LookupPropertyWithFlagsById(cx, proto, interned_id, flags,
+        if (!::JS_LookupPropertyWithFlagsById(cx, proto, id, flags,
                                               &pobj, &val)) {
           *_retval = JS_FALSE;
 
           return NS_OK;
         }
 
         if (pobj) {
           // A property was found on the prototype chain.
@@ -7101,23 +7051,21 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
       //
       // We don't need to worry about property attributes here as we
       // know here we're dealing with an undefined property set, so
       // we're not declaring readonly or permanent properties.
       //
       // Since we always create the undeclared property here without given a
       // chance for the interpreter to report applicable strict mode warnings,
       // we must take care to check those warnings here.
-      JSString *str = JSVAL_TO_STRING(id);
+      JSString *str = JSID_TO_STRING(id);
       if ((!(flags & JSRESOLVE_QUALIFIED) &&
-           !js_CheckUndeclaredVarAssignment(cx, id)) ||
-          !::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                 ::JS_GetStringLength(str), JSVAL_VOID,
-                                 JS_PropertyStub, JS_PropertyStub,
-                                 JSPROP_ENUMERATE)) {
+           !js_CheckUndeclaredVarAssignment(cx, str)) ||
+          !::JS_DefinePropertyById(cx, obj, id, JSVAL_VOID, JS_PropertyStub,
+                                   JS_PropertyStub, JSPROP_ENUMERATE)) {
         *_retval = JS_FALSE;
 
         return NS_OK;
       }
 
       *objp = obj;
     }
   }
@@ -7158,28 +7106,28 @@ nsWindowSH::NewEnumerate(nsIXPConnectWra
       if (!iterator) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
 
       *statep = OBJECT_TO_JSVAL(iterator);
       if (idp) {
         // Note: With these property iterators, we can't tell ahead of time how
         // many properties we're going to be iterating over.
-        *idp = JSVAL_ZERO;
+        *idp = INT_TO_JSID(0);
       }
       break;
     }
     case JSENUMERATE_NEXT:
     {
       JSObject *iterator = (JSObject*)JSVAL_TO_OBJECT(*statep);
       if (!JS_NextProperty(cx, iterator, idp)) {
         return NS_ERROR_UNEXPECTED;
       }
 
-      if (*idp != JSVAL_VOID) {
+      if (*idp != JSID_VOID) {
         break;
       }
 
       // Fall through.
     }
     case JSENUMERATE_DESTROY:
       // Let GC at our iterator object.
       *statep = JSVAL_NULL;
@@ -7198,17 +7146,17 @@ nsWindowSH::Finalize(nsIXPConnectWrapped
 
   sgo->OnFinalize(nsIProgrammingLanguage::JAVASCRIPT, obj);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsWindowSH::Equality(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                     JSObject * obj, jsval val, PRBool *bp)
+                     JSObject * obj, const jsval &val, PRBool *bp)
 {
   *bp = PR_FALSE;
 
   if (JSVAL_IS_PRIMITIVE(val)) {
     return NS_OK;
   }
 
   nsCOMPtr<nsIXPConnectWrappedNative> other_wrapper;
@@ -7295,17 +7243,17 @@ nsWindowSH::InnerObject(nsIXPConnectWrap
 
   return NS_OK;
 }
 
 // DOM Location helper
 
 NS_IMETHODIMP
 nsLocationSH::CheckAccess(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                          JSObject *obj, jsval id, PRUint32 mode,
+                          JSObject *obj, jsid id, PRUint32 mode,
                           jsval *vp, PRBool *_retval)
 {
   if ((mode & JSACC_TYPEMASK) == JSACC_PROTO && (mode & JSACC_WRITE)) {
     // No setting location.__proto__, ever!
 
     // Let XPConnect know that the access was not granted.
     *_retval = PR_FALSE;
 
@@ -7400,29 +7348,26 @@ nsNodeSH::IsCapabilityEnabled(const char
 {
   PRBool enabled;
   return sSecMan &&
     NS_SUCCEEDED(sSecMan->IsCapabilityEnabled(aCapability, &enabled)) &&
     enabled;
 }
 
 nsresult
-nsNodeSH::DefineVoidProp(JSContext* cx, JSObject* obj, jsval id,
+nsNodeSH::DefineVoidProp(JSContext* cx, JSObject* obj, jsid id,
                          JSObject** objp)
 {
-  NS_ASSERTION(JSVAL_IS_STRING(id), "id must be a string");
-
-  JSString* str = JSVAL_TO_STRING(id);
+  NS_ASSERTION(JSID_IS_STRING(id), "id must be a string");
 
   // We want this to be as invisible to content script as possible.  So
   // don't enumerate this, and set is as JSPROP_SHARED so it won't get
   // cached on the object.
-  JSBool ok = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                    ::JS_GetStringLength(str), JSVAL_VOID,
-                                    nsnull, nsnull, JSPROP_SHARED);
+  JSBool ok = ::JS_DefinePropertyById(cx, obj, id, JSVAL_VOID,
+                                      nsnull, nsnull, JSPROP_SHARED);
 
   if (!ok) {
     return NS_ERROR_FAILURE;
   }
 
   *objp = obj;
   return NS_OK;
 }
@@ -7563,25 +7508,25 @@ nsNodeSH::PreCreate(nsISupports *nativeO
 
   return node->IsInNativeAnonymousSubtree() ?
     NS_SUCCESS_CHROME_ACCESS_ONLY :
     (slimWrappers ? NS_SUCCESS_ALLOW_SLIM_WRAPPERS : NS_OK);
 }
 
 NS_IMETHODIMP
 nsNodeSH::AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                      JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                      JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   nsNodeSH::PreserveWrapper(GetNative(wrapper, obj));
   return nsEventReceiverSH::AddProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsNodeSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                     JSObject *obj, jsval id, PRUint32 flags,
+                     JSObject *obj, jsid id, PRUint32 flags,
                      JSObject **objp, PRBool *_retval)
 {
   if ((id == sBaseURIObject_id || id == sNodePrincipal_id) &&
       IsPrivilegedScript()) {
     return DefineVoidProp(cx, obj, id, objp);
   }
 
   if (id == sOnload_id || id == sOnerror_id) {
@@ -7591,17 +7536,17 @@ nsNodeSH::NewResolve(nsIXPConnectWrapped
   }
 
   return nsEventReceiverSH::NewResolve(wrapper, cx, obj, id, flags, objp,
                                        _retval);
 }
 
 NS_IMETHODIMP
 nsNodeSH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                      JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                      JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   if (id == sBaseURIObject_id && IsPrivilegedScript()) {
     // I wish GetBaseURI lived on nsINode
     nsCOMPtr<nsIURI> uri;
     nsCOMPtr<nsIContent> content = do_QueryWrappedNative(wrapper, obj);
     if (content) {
       uri = content->GetBaseURI();
       NS_ENSURE_TRUE(uri, NS_ERROR_OUT_OF_MEMORY);
@@ -7631,17 +7576,17 @@ nsNodeSH::GetProperty(nsIXPConnectWrappe
   }    
 
   // Note: none of our ancestors want GetProperty
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsNodeSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                      JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                      JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   if ((id == sBaseURIObject_id || id == sNodePrincipal_id) &&
       IsPrivilegedScript()) {
     // We don't want privileged script that can read this property to set it,
     // but _do_ want to allow everyone else to set a value they can then read.
     //
     // XXXbz Is there a better error we could use here?
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@@ -7664,17 +7609,17 @@ nsNodeSH::PreserveWrapper(nsISupports *a
   nsINode *node = static_cast<nsINode*>(aNative);
   nsContentUtils::PreserveWrapper(aNative, node);
 }
 
 // EventReceiver helper
 
 // static
 PRBool
-nsEventReceiverSH::ReallyIsEventName(jsval id, jschar aFirstChar)
+nsEventReceiverSH::ReallyIsEventName(jsid id, jschar aFirstChar)
 {
   // I wonder if this is faster than using a hash...
 
   switch (aFirstChar) {
   case 'a' :
     return id == sOnabort_id;
   case 'b' :
     return (id == sOnbeforeunload_id ||
@@ -7731,17 +7676,17 @@ nsEventReceiverSH::ReallyIsEventName(jsv
   }
 
   return PR_FALSE;
 }
 
 nsresult
 nsEventReceiverSH::RegisterCompileHandler(nsIXPConnectWrappedNative *wrapper,
                                           JSContext *cx, JSObject *obj,
-                                          jsval id, PRBool compile,
+                                          jsid id, PRBool compile,
                                           PRBool remove,
                                           PRBool *did_define)
 {
   NS_PRECONDITION(!compile || !remove,
                   "Can't both compile and remove at the same time");
   *did_define = PR_FALSE;
 
   if (!IsEventName(id)) {
@@ -7783,48 +7728,43 @@ nsEventReceiverSH::RegisterCompileHandle
                                               atom);
   }
 
   return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
 }
 
 NS_IMETHODIMP
 nsEventReceiverSH::NewResolve(nsIXPConnectWrappedNative *wrapper,
-                              JSContext *cx, JSObject *obj, jsval id,
+                              JSContext *cx, JSObject *obj, jsid id,
                               PRUint32 flags, JSObject **objp, PRBool *_retval)
 {
-  if (!JSVAL_IS_STRING(id)) {
+  if (!JSID_IS_STRING(id)) {
     return NS_OK;
   }
 
   if (flags & JSRESOLVE_ASSIGNING) {
     if (!IsEventName(id)) {
       // Bail out.  We don't care about this assignment.
       return NS_OK;
     }
 
     // If we're assigning to an on* property, just resolve to null for
     // now; the assignment will then set the right value. Only do this
     // in the case where the property isn't already defined on the
     // object's prototype chain though.
-    JSString* str = JSVAL_TO_STRING(id);
     JSAutoRequest ar(cx);
 
     JSObject *proto = ::JS_GetPrototype(cx, obj);
     PRBool ok = PR_TRUE, hasProp = PR_FALSE;
-    if (!proto || ((ok = ::JS_HasUCProperty(cx, proto, ::JS_GetStringChars(str),
-                                            ::JS_GetStringLength(str),
-                                            &hasProp)) &&
+    if (!proto || ((ok = ::JS_HasPropertyById(cx, proto, id, &hasProp)) &&
                    !hasProp)) {
       // Make sure the flags here match those in
       // nsJSContext::BindCompiledEventHandler
-      if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                 ::JS_GetStringLength(str), JSVAL_NULL,
-                                 nsnull, nsnull,
-                                 JSPROP_ENUMERATE | JSPROP_PERMANENT)) {
+      if (!::JS_DefinePropertyById(cx, obj, id, JSVAL_NULL, nsnull, nsnull,
+                                   JSPROP_ENUMERATE | JSPROP_PERMANENT)) {
         return NS_ERROR_FAILURE;
       }
 
       *objp = obj;
       return NS_OK;
     }
 
     return ok ? NS_OK : NS_ERROR_FAILURE;
@@ -7844,35 +7784,35 @@ nsEventReceiverSH::NewResolve(nsIXPConne
   }
 
   return nsDOMGenericSH::NewResolve(wrapper, cx, obj, id, flags, objp,
                                     _retval);
 }
 
 NS_IMETHODIMP
 nsEventReceiverSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
-                               JSContext *cx, JSObject *obj, jsval id,
+                               JSContext *cx, JSObject *obj, jsid id,
                                jsval *vp, PRBool *_retval)
 {
   JSAutoRequest ar(cx);
 
   if ((::JS_TypeOfValue(cx, *vp) != JSTYPE_FUNCTION && !JSVAL_IS_NULL(*vp)) ||
-      !JSVAL_IS_STRING(id) || id == sAddEventListener_id) {
+      !JSID_IS_STRING(id) || id == sAddEventListener_id) {
     return NS_OK;
   }
 
   PRBool did_compile; // Ignored here.
 
   return RegisterCompileHandler(wrapper, cx, obj, id, PR_FALSE,
                                 JSVAL_IS_NULL(*vp), &did_compile);
 }
 
 NS_IMETHODIMP
 nsEventReceiverSH::AddProperty(nsIXPConnectWrappedNative *wrapper,
-                               JSContext *cx, JSObject *obj, jsval id,
+                               JSContext *cx, JSObject *obj, jsid id,
                                jsval *vp, PRBool *_retval)
 {
   return nsEventReceiverSH::SetProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 // EventTarget helper
 
 NS_IMETHODIMP
@@ -7887,17 +7827,17 @@ nsEventTargetSH::PreCreate(nsISupports *
 
   *parentObj = native_parent ? native_parent->GetGlobalJSObject() : globalObj;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsEventTargetSH::AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                             JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                             JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   if (id == sAddEventListener_id) {
     return NS_OK;
   }
 
   nsEventTargetSH::PreserveWrapper(GetNative(wrapper, obj));
 
   return NS_OK;
@@ -8100,17 +8040,17 @@ nsElementSH::Enumerate(nsIXPConnectWrapp
   return NS_OK;
 }
   
 
 // Generic array scriptable helper.
 
 NS_IMETHODIMP
 nsGenericArraySH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                             JSObject *obj, jsval id, PRUint32 flags,
+                             JSObject *obj, jsid id, PRUint32 flags,
                              JSObject **objp, PRBool *_retval)
 {
   if (id == sLength_id) {
     // Bail early; this isn't something we're interested in
     return NS_OK;
   }
   
   PRBool is_number = PR_FALSE;
@@ -8197,17 +8137,17 @@ nsGenericArraySH::Enumerate(nsIXPConnect
 
   return ok ? NS_OK : NS_ERROR_UNEXPECTED;
 }
 
 // Array scriptable helper
 
 NS_IMETHODIMP
 nsArraySH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                       JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                       JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   PRBool is_number = PR_FALSE;
   PRInt32 n = GetArrayIndexFromId(cx, id, &is_number);
 
   nsresult rv = NS_OK;
 
   if (is_number) {
     if (n < 0) {
@@ -8323,20 +8263,20 @@ nsDOMTokenListSH::GetStringAt(nsISupport
   return list->Item(aIndex, aResult);
 }
 
 
 // Named Array helper
 
 NS_IMETHODIMP
 nsNamedArraySH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                            JSObject *obj, jsval id, jsval *vp,
+                            JSObject *obj, jsid id, jsval *vp,
                             PRBool *_retval)
 {
-  if (JSVAL_IS_STRING(id) && !ObjectIsNativeWrapper(cx, obj)) {
+  if (JSID_IS_STRING(id) && !ObjectIsNativeWrapper(cx, obj)) {
     nsresult rv = NS_OK;
     nsISupports* item = GetNamedItem(GetNative(wrapper, obj),
                                      nsDependentJSString(id),
                                      &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
     if (item) {
       rv = WrapNative(cx, obj, item, PR_TRUE, vp);
@@ -8481,17 +8421,17 @@ nsContentListSH::GetNamedItem(nsISupport
 {
   nsContentList *list = nsContentList::FromSupports(aNative);
 
   return list->GetNamedItem(aName, aResult);
 }
 
 NS_IMETHODIMP
 nsDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, PRUint32 flags,
+                         JSObject *obj, jsid id, PRUint32 flags,
                          JSObject **objp, PRBool *_retval)
 {
   nsresult rv;
 
   if (id == sLocation_id) {
     // Define the location property on the document object itself so
     // that we can intercept getting and setting of document.location.
 
@@ -8506,22 +8446,18 @@ nsDocumentSH::NewResolve(nsIXPConnectWra
 
     nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
     rv = WrapNative(cx, obj, location, &NS_GET_IID(nsIDOMLocation), PR_TRUE,
                     &v, getter_AddRefs(holder));
     NS_ENSURE_SUCCESS(rv, rv);
 
     JSAutoRequest ar(cx);
 
-    JSString *str = JSVAL_TO_STRING(id);
-    JSBool ok = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                      ::JS_GetStringLength(str), v, nsnull,
-                                      nsnull,
-                                      JSPROP_PERMANENT |
-                                      JSPROP_ENUMERATE);
+    JSBool ok = ::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull,
+                                        JSPROP_PERMANENT | JSPROP_ENUMERATE);
 
     if (!ok) {
       return NS_ERROR_FAILURE;
     }
 
     *objp = obj;
 
     return NS_OK;
@@ -8531,17 +8467,17 @@ nsDocumentSH::NewResolve(nsIXPConnectWra
     return DefineVoidProp(cx, obj, id, objp);
   } 
 
   return nsNodeSH::NewResolve(wrapper, cx, obj, id, flags, objp, _retval);
 }
 
 NS_IMETHODIMP
 nsDocumentSH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                          JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                          JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   if (id == sDocumentURIObject_id && IsPrivilegedScript()) {
     nsCOMPtr<nsIDocument> doc = do_QueryWrappedNative(wrapper);
     NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
     nsIURI* uri = doc->GetDocumentURI();
     NS_ENSURE_TRUE(uri, NS_ERROR_NOT_AVAILABLE);
 
@@ -8552,17 +8488,17 @@ nsDocumentSH::GetProperty(nsIXPConnectWr
     return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
   }
 
   return nsNodeSH::GetProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsDocumentSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                          JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                          JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   if (id == sLocation_id) {
     nsCOMPtr<nsIDOMNSDocument> doc(do_QueryWrappedNative(wrapper));
     NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
 
     nsCOMPtr<nsIDOMLocation> location;
 
     nsresult rv = doc->GetLocation(getter_AddRefs(location));
@@ -8647,27 +8583,27 @@ nsDocumentSH::PostCreate(nsIXPConnectWra
   return NS_OK;
 }
 
 // HTMLDocument helper
 
 // static
 nsresult
 nsHTMLDocumentSH::ResolveImpl(JSContext *cx,
-                              nsIXPConnectWrappedNative *wrapper, jsval id,
+                              nsIXPConnectWrappedNative *wrapper, jsid id,
                               nsISupports **result)
 {
   nsHTMLDocument *doc =
     static_cast<nsHTMLDocument*>(static_cast<nsINode*>
                                  (wrapper->Native()));
 
   // 'id' is not always a string, it can be a number since document.1
   // should map to <input name="1">. Thus we can't use
   // JSVAL_TO_STRING() here.
-  JSString *str = JS_ValueToString(cx, id);
+  JSString *str = IdToString(cx, id);
   NS_ENSURE_TRUE(str, NS_ERROR_UNEXPECTED);
 
   return doc->ResolveName(nsDependentJSString(str), nsnull, result);
 }
 
 // static
 JSBool
 nsHTMLDocumentSH::DocumentOpen(JSContext *cx, JSObject *obj, uintN argc,
@@ -8822,42 +8758,42 @@ nsHTMLDocumentSH::GetDocumentAllNodeList
     return JS_FALSE;
   }
 
   return *nodeList != nsnull;
 }
 
 JSBool
 nsHTMLDocumentSH::DocumentAllGetProperty(JSContext *cx, JSObject *obj,
-                                         jsval id, jsval *vp)
+                                         jsid id, jsval *vp)
 {
   // document.all.item and .namedItem get their value in the
   // newResolve hook, so nothing to do for those properties here. And
   // we need to return early to prevent <div id="item"> from shadowing
   // document.all.item(), etc.
   if (id == sItem_id || id == sNamedItem_id) {
     return JS_TRUE;
   }
 
-  while (obj->getClass() != &sHTMLDocumentAllClass) {
+  while (obj->getJSClass() != &sHTMLDocumentAllClass) {
     obj = obj->getProto();
 
     if (!obj) {
       NS_ERROR("The JS engine lies!");
 
       return JS_TRUE;
     }
   }
 
   nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(cx, obj);
   nsCOMPtr<nsIDOMHTMLDocument> domdoc(do_QueryInterface(doc));
   nsCOMPtr<nsISupports> result;
   nsresult rv = NS_OK;
 
-  if (JSVAL_IS_STRING(id)) {
+  if (JSID_IS_STRING(id)) {
     if (id == sLength_id) {
       // Map document.all.length to the length of the collection
       // document.getElementsByTagName("*"), and make sure <div
       // id="length"> doesn't shadow document.all.length.
 
       nsCOMPtr<nsIDOMNodeList> nodeList;
       if (!GetDocumentAllNodeList(cx, obj, domdoc, getter_AddRefs(nodeList))) {
         return JS_FALSE;
@@ -8883,27 +8819,27 @@ nsHTMLDocumentSH::DocumentAllGetProperty
       rv = doc->GetDocumentAllResult(str, getter_AddRefs(result));
 
       if (NS_FAILED(rv)) {
         nsDOMClassInfo::ThrowJSException(cx, rv);
 
         return JS_FALSE;
       }
     }
-  } else if (JSVAL_IS_INT(id) && JSVAL_TO_INT(id) >= 0) {
+  } else if (JSID_IS_INT(id) && JSID_TO_INT(id) >= 0) {
     // Map document.all[n] (where n is a number) to the n:th item in
     // the document.all node list.
 
     nsCOMPtr<nsIDOMNodeList> nodeList;
     if (!GetDocumentAllNodeList(cx, obj, domdoc, getter_AddRefs(nodeList))) {
       return JS_FALSE;
     }
 
     nsCOMPtr<nsIDOMNode> node;
-    nodeList->Item(JSVAL_TO_INT(id), getter_AddRefs(node));
+    nodeList->Item(JSID_TO_INT(id), getter_AddRefs(node));
 
     result = node;
   }
 
   if (result) {
     rv = WrapNative(cx, obj, result, PR_TRUE, vp);
     if (NS_FAILED(rv)) {
       nsDOMClassInfo::ThrowJSException(cx, rv);
@@ -8913,32 +8849,32 @@ nsHTMLDocumentSH::DocumentAllGetProperty
   } else {
     *vp = JSVAL_VOID;
   }
 
   return JS_TRUE;
 }
 
 JSBool
-nsHTMLDocumentSH::DocumentAllNewResolve(JSContext *cx, JSObject *obj, jsval id,
+nsHTMLDocumentSH::DocumentAllNewResolve(JSContext *cx, JSObject *obj, jsid id,
                                         uintN flags, JSObject **objp)
 {
   if (flags & JSRESOLVE_ASSIGNING) {
     // Nothing to do here if we're assigning
 
     return JS_TRUE;
   }
 
   jsval v = JSVAL_VOID;
 
   if (id == sItem_id || id == sNamedItem_id) {
     // Define the item() or namedItem() method.
 
     JSFunction *fnc =
-      ::JS_DefineFunction(cx, obj, ::JS_GetStringBytes(JSVAL_TO_STRING(id)),
+      ::JS_DefineFunction(cx, obj, ::JS_GetStringBytes(JSID_TO_STRING(id)),
                           CallToGetPropMapper, 0, JSPROP_ENUMERATE);
 
     *objp = obj;
 
     return fnc != nsnull;
   }
 
   if (id == sLength_id) {
@@ -8969,24 +8905,20 @@ nsHTMLDocumentSH::DocumentAllNewResolve(
     if (!DocumentAllGetProperty(cx, obj, id, &v)) {
       return JS_FALSE;
     }
   }
 
   JSBool ok = JS_TRUE;
 
   if (v != JSVAL_VOID) {
-    if (JSVAL_IS_STRING(id)) {
-      JSString *str = JSVAL_TO_STRING(id);
-
-      ok = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                 ::JS_GetStringLength(str), v, nsnull, nsnull,
-                                 0);
+    if (JSID_IS_STRING(id)) {
+      ok = ::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull, 0);
     } else {
-      ok = ::JS_DefineElement(cx, obj, JSVAL_TO_INT(id), v, nsnull, nsnull, 0);
+      ok = ::JS_DefineElement(cx, obj, JSID_TO_INT(id), v, nsnull, nsnull, 0);
     }
 
     *objp = obj;
   }
 
   return ok;
 }
 
@@ -9047,35 +8979,49 @@ GetDocumentAllHelper(JSContext *cx, JSOb
 {
   while (obj && JS_GET_CLASS(cx, obj) != &sHTMLDocumentAllHelperClass) {
     obj = ::JS_GetPrototype(cx, obj);
   }
 
   return obj;
 }
 
+static inline void *
+FlagsToPrivate(PRUint32 flags)
+{
+  JS_ASSERT((flags & (1 << 31)) == 0);
+  return (void *)(flags << 1);
+}
+
+static inline PRUint32
+PrivateToFlags(void *priv)
+{
+  JS_ASSERT(size_t(priv) <= PR_UINT32_MAX && (size_t(priv) & 1) == 0);
+  return (PRUint32)(size_t(priv) >> 1);
+}
+
 JSBool
 nsHTMLDocumentSH::DocumentAllHelperGetProperty(JSContext *cx, JSObject *obj,
-                                               jsval id, jsval *vp)
+                                               jsid id, jsval *vp)
 {
   if (id != nsDOMClassInfo::sAll_id) {
     return JS_TRUE;
   }
 
   JSObject *helper = GetDocumentAllHelper(cx, obj);
 
   if (!helper) {
     NS_ERROR("Uh, how'd we get here?");
 
     // Let scripts continue, if we somehow did get here...
 
     return JS_TRUE;
   }
 
-  PRUint32 flags = JSVAL_TO_INT(PRIVATE_TO_JSVAL(::JS_GetPrivate(cx, helper)));
+  PRUint32 flags = PrivateToFlags(::JS_GetPrivate(cx, helper));
 
   if (flags & JSRESOLVE_DETECTING || !(flags & JSRESOLVE_QUALIFIED)) {
     // document.all is either being detected, e.g. if (document.all),
     // or it was not being resolved with a qualified name. Claim that
     // document.all is undefined.
 
     *vp = JSVAL_VOID;
   } else {
@@ -9110,17 +9056,17 @@ nsHTMLDocumentSH::DocumentAllHelperGetPr
     }
   }
 
   return JS_TRUE;
 }
 
 JSBool
 nsHTMLDocumentSH::DocumentAllHelperNewResolve(JSContext *cx, JSObject *obj,
-                                              jsval id, uintN flags,
+                                              jsid id, uintN flags,
                                               JSObject **objp)
 {
   if (id == nsDOMClassInfo::sAll_id) {
     // document.all is resolved for the first time. Define it.
     JSObject *helper = GetDocumentAllHelper(cx, obj);
 
     if (helper) {
       if (!::JS_DefineProperty(cx, helper, "all", JSVAL_VOID, nsnull, nsnull,
@@ -9133,33 +9079,31 @@ nsHTMLDocumentSH::DocumentAllHelperNewRe
   }
 
   return JS_TRUE;
 }
 
 
 JSBool
 nsHTMLDocumentSH::DocumentAllTagsNewResolve(JSContext *cx, JSObject *obj,
-                                            jsval id, uintN flags,
+                                            jsid id, uintN flags,
                                             JSObject **objp)
 {
-  if (JSVAL_IS_STRING(id)) {
+  if (JSID_IS_STRING(id)) {
     nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(cx, obj);
 
-    JSString *str = JSVAL_TO_STRING(id);
+    JSString *str = JSID_TO_STRING(id);
 
     JSObject *proto = ::JS_GetPrototype(cx, obj);
     if (NS_UNLIKELY(!proto)) {
       return JS_TRUE;
     }
 
     JSBool found;
-    if (!::JS_HasUCProperty(cx, proto,
-                            ::JS_GetStringChars(str),
-                            ::JS_GetStringLength(str), &found)) {
+    if (!::JS_HasPropertyById(cx, proto, id, &found)) {
       return JS_FALSE;
     }
 
     if (found) {
       return JS_TRUE;
     }
 
     nsCOMPtr<nsIDOMDocument> domdoc(do_QueryInterface(doc));
@@ -9174,33 +9118,31 @@ nsHTMLDocumentSH::DocumentAllTagsNewReso
       nsresult rv = nsDOMClassInfo::WrapNative(cx, obj, tags, PR_TRUE, &v,
                                                getter_AddRefs(holder));
       if (NS_FAILED(rv)) {
         nsDOMClassInfo::ThrowJSException(cx, rv);
 
         return JS_FALSE;
       }
 
-      if (!::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                 ::JS_GetStringLength(str), v, nsnull, nsnull,
-                                 0)) {
+      if (!::JS_DefinePropertyById(cx, obj, id, v, nsnull, nsnull, 0)) {
         return JS_FALSE;
       }
 
       *objp = obj;
     }
   }
 
   return JS_TRUE;
 }
 
 
 NS_IMETHODIMP
 nsHTMLDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                             JSObject *obj, jsval id, PRUint32 flags,
+                             JSObject *obj, jsid id, PRUint32 flags,
                              JSObject **objp, PRBool *_retval)
 {
   // nsDocumentSH::NewResolve() does a security check that we'd kinda
   // want to do here too before doing anything else. But given that we
   // only define dynamic properties here before the call to
   // nsDocumentSH::NewResolve() we're ok, since once those properties
   // are accessed, we'll do the necessary security check.
 
@@ -9211,30 +9153,26 @@ nsHTMLDocumentSH::NewResolve(nsIXPConnec
 
     if (!ObjectIsNativeWrapper(cx, obj)) {
       nsCOMPtr<nsISupports> result;
 
       nsresult rv = ResolveImpl(cx, wrapper, id, getter_AddRefs(result));
       NS_ENSURE_SUCCESS(rv, rv);
 
       if (result) {
-        JSString *str = JS_ValueToString(cx, id);
-
         JSBool ok = *_retval =
-          ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                ::JS_GetStringLength(str), JSVAL_VOID, nsnull,
-                                nsnull, 0);
+          ::JS_DefinePropertyById(cx, obj, id, JSVAL_VOID, nsnull, nsnull, 0);
         *objp = obj;
 
         return ok ? NS_OK : NS_ERROR_FAILURE;
       }
     }
 
     if (id == sOpen_id) {
-      JSString *str = JSVAL_TO_STRING(id);
+      JSString *str = JSID_TO_STRING(id);
       JSFunction *fnc =
         ::JS_DefineFunction(cx, obj, ::JS_GetStringBytes(str),
                             DocumentOpen, 0, JSPROP_ENUMERATE);
 
       *objp = obj;
 
       return fnc ? NS_OK : NS_ERROR_UNEXPECTED;
     }
@@ -9294,35 +9232,33 @@ nsHTMLDocumentSH::NewResolve(nsIXPConnec
             nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
 
             return NS_ERROR_UNEXPECTED;
           }
         }
 
         // If we have (or just created) a helper, pass the resolve flags
         // to the helper as its private data.
-        if (helper &&
-            !::JS_SetPrivate(cx, helper,
-                             JSVAL_TO_PRIVATE(INT_TO_JSVAL(flags)))) {
+        if (helper && !::JS_SetPrivate(cx, helper, FlagsToPrivate(flags))) {
           nsDOMClassInfo::ThrowJSException(cx, NS_ERROR_UNEXPECTED);
 
           return NS_ERROR_UNEXPECTED;
         }
       }
 
       return NS_OK;
     }
   }
 
   return nsDocumentSH::NewResolve(wrapper, cx, obj, id, flags, objp, _retval);
 }
 
 NS_IMETHODIMP
 nsHTMLDocumentSH::GetProperty(nsIXPConnectWrappedNative *wrapper,
-                              JSContext *cx, JSObject *obj, jsval id,
+                              JSContext *cx, JSObject *obj, jsid id,
                               jsval *vp, PRBool *_retval)
 {
   // For native wrappers, do not get random names on document
   if (!ObjectIsNativeWrapper(cx, obj)) {
     nsCOMPtr<nsISupports> result;
 
     JSAutoRequest ar(cx);
 
@@ -9364,59 +9300,57 @@ nsHTMLFormElementSH::FindNamedItem(nsIFo
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLFormElementSH::NewResolve(nsIXPConnectWrappedNative *wrapper,
-                                JSContext *cx, JSObject *obj, jsval id,
+                                JSContext *cx, JSObject *obj, jsid id,
                                 PRUint32 flags, JSObject **objp,
                                 PRBool *_retval)
 {
   // For native wrappers, do not resolve random names on form
-  if ((!(JSRESOLVE_ASSIGNING & flags)) && JSVAL_IS_STRING(id) &&
+  if ((!(JSRESOLVE_ASSIGNING & flags)) && JSID_IS_STRING(id) &&
       !ObjectIsNativeWrapper(cx, obj)) {
     nsCOMPtr<nsIForm> form(do_QueryWrappedNative(wrapper, obj));
     nsCOMPtr<nsISupports> result;
 
-    JSString *str = JSVAL_TO_STRING(id);
+    JSString *str = JSID_TO_STRING(id);
     FindNamedItem(form, str, getter_AddRefs(result));
 
     if (result) {
       JSAutoRequest ar(cx);
-      *_retval = ::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
-                                       ::JS_GetStringLength(str),
-                                       JSVAL_VOID, nsnull, nsnull,
-                                       JSPROP_ENUMERATE);
+      *_retval = ::JS_DefinePropertyById(cx, obj, id, JSVAL_VOID, nsnull,
+                                         nsnull, JSPROP_ENUMERATE);
 
       *objp = obj;
 
       return *_retval ? NS_OK : NS_ERROR_FAILURE;
     }
   }
 
   return nsElementSH::NewResolve(wrapper, cx, obj, id, flags, objp, _retval);
 }
 
 
 NS_IMETHODIMP
 nsHTMLFormElementSH::GetProperty(nsIXPConnectWrappedNative *wrapper,
-                                 JSContext *cx, JSObject *obj, jsval id,
+                                 JSContext *cx, JSObject *obj, jsid id,
                                  jsval *vp, PRBool *_retval)
 {
   nsCOMPtr<nsIForm> form(do_QueryWrappedNative(wrapper, obj));
 
-  if (JSVAL_IS_STRING(id)) {
+  if (JSID_IS_STRING(id)) {
     // For native wrappers, do not get random names on form
     if (!ObjectIsNativeWrapper(cx, obj)) {
       nsCOMPtr<nsISupports> result;
 
-      JSString *str = JSVAL_TO_STRING(id);
+      JSString *str = JSID_TO_STRING(id);
       FindNamedItem(form, str, getter_AddRefs(result));
 
       if (result) {
         // Wrap result, result can be either an element or a list of
         // elements
         nsresult rv = WrapNative(cx, obj, result, PR_TRUE, vp);
         return NS_FAILED(rv) ? rv : NS_SUCCESS_I_DID_SOMETHING;
       }
@@ -9454,17 +9388,17 @@ nsHTMLFormElementSH::NewEnumerate(nsIXPC
         return NS_ERROR_UNEXPECTED;
       }
 
       *statep = INT_TO_JSVAL(0);
 
       if (idp) {
         PRUint32 count = form->GetElementCount();
 
-        *idp = INT_TO_JSVAL(count);
+        *idp = INT_TO_JSID(count);
       }
 
       break;
     }
   case JSENUMERATE_NEXT:
     {
       nsCOMPtr<nsIForm> form(do_QueryWrappedNative(wrapper, obj));
       NS_ENSURE_TRUE(form, NS_ERROR_FAILURE);
@@ -9513,17 +9447,17 @@ nsHTMLFormElementSH::NewEnumerate(nsIXPC
   return NS_OK;
 }
 
 
 // HTMLSelectElement helper
 
 NS_IMETHODIMP
 nsHTMLSelectElementSH::GetProperty(nsIXPConnectWrappedNative *wrapper,
-                                   JSContext *cx, JSObject *obj, jsval id,
+                                   JSContext *cx, JSObject *obj, jsid id,
                                    jsval *vp, PRBool *_retval)
 {
   PRInt32 n = GetArrayIndexFromId(cx, id);
 
   nsresult rv = NS_OK;
   if (n >= 0) {
     nsCOMPtr<nsIDOMHTMLSelectElement> s = do_QueryWrappedNative(wrapper, obj);
 
@@ -9569,17 +9503,17 @@ nsHTMLSelectElementSH::SetOption(JSConte
     }
   }
 
   return aOptCollection->SetOption(aIndex, new_option);
 }
 
 NS_IMETHODIMP
 nsHTMLSelectElementSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
-                                   JSContext *cx, JSObject *obj, jsval id,
+                                   JSContext *cx, JSObject *obj, jsid id,
                                    jsval *vp, PRBool *_retval)
 {
   PRInt32 n = GetArrayIndexFromId(cx, id);
 
   if (n >= 0) {
     nsCOMPtr<nsIDOMHTMLSelectElement> select =
       do_QueryWrappedNative(wrapper, obj);
     NS_ENSURE_TRUE(select, NS_ERROR_UNEXPECTED);
@@ -9833,100 +9767,84 @@ nsHTMLPluginObjElementSH::PostCreate(nsI
     new nsPluginProtoChainInstallRunner(wrapper, scriptContext);
   nsContentUtils::AddScriptRunner(runner);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLPluginObjElementSH::GetProperty(nsIXPConnectWrappedNative *wrapper,
-                                      JSContext *cx, JSObject *obj, jsval id,
+                                      JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp, PRBool *_retval)
 {
   JSAutoRequest ar(cx);
 
   JSObject *pi_obj = ::JS_GetPrototype(cx, obj);
   if (NS_UNLIKELY(!pi_obj)) {
     return NS_OK;
   }
 
-  const jschar *id_chars = nsnull;
-  size_t id_length = 0;
-
   JSBool found = PR_FALSE;
 
   if (!ObjectIsNativeWrapper(cx, obj)) {
-    if (JSVAL_IS_STRING(id)) {
-      JSString *id_str = JSVAL_TO_STRING(id);
-
-      id_chars = ::JS_GetStringChars(id_str);
-      id_length = ::JS_GetStringLength(id_str);
-
-      *_retval = ::JS_HasUCProperty(cx, pi_obj, id_chars, id_length, &found);
+    if (JSID_IS_STRING(id)) {
+      *_retval = ::JS_HasPropertyById(cx, pi_obj, id, &found);
     } else {
-      *_retval = JS_HasElement(cx, pi_obj, JSVAL_TO_INT(id), &found);
+      *_retval = ::JS_HasElement(cx, pi_obj, JSID_TO_INT(id), &found);
     }
 
     if (!*_retval) {
       return NS_ERROR_UNEXPECTED;
     }
   }
 
   if (found) {
-    if (JSVAL_IS_STRING(id)) {
-      *_retval = ::JS_GetUCProperty(cx, pi_obj, id_chars, id_length, vp);
+    if (JSID_IS_STRING(id)) {
+      *_retval = ::JS_GetPropertyById(cx, pi_obj, id, vp);
     } else {
-      *_retval = ::JS_GetElement(cx, pi_obj, JSVAL_TO_INT(id), vp);
+      *_retval = ::JS_GetElement(cx, pi_obj, JSID_TO_INT(id), vp);
     }
 
     return *_retval ? NS_SUCCESS_I_DID_SOMETHING : NS_ERROR_FAILURE;
   }
 
   return nsElementSH::GetProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsHTMLPluginObjElementSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
-                                      JSContext *cx, JSObject *obj, jsval id,
+                                      JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp, PRBool *_retval)
 {
   JSAutoRequest ar(cx);
 
   JSObject *pi_obj = ::JS_GetPrototype(cx, obj);
   if (NS_UNLIKELY(!pi_obj)) {
     return NS_OK;
   }
 
-  const jschar *id_chars = nsnull;
-  size_t id_length = 0;
-
   JSBool found = PR_FALSE;
 
   if (!ObjectIsNativeWrapper(cx, obj)) {
-    if (JSVAL_IS_STRING(id)) {
-      JSString *id_str = JSVAL_TO_STRING(id);
-
-      id_chars = ::JS_GetStringChars(id_str);
-      id_length = ::JS_GetStringLength(id_str);
-
-      *_retval = ::JS_HasUCProperty(cx, pi_obj, id_chars, id_length, &found);
+    if (JSID_IS_STRING(id)) {
+      *_retval = ::JS_HasPropertyById(cx, pi_obj, id, &found);
     } else {
-      *_retval = JS_HasElement(cx, pi_obj, JSVAL_TO_INT(id), &found);
+      *_retval = ::JS_HasElement(cx, pi_obj, JSID_TO_INT(id), &found);
     }
 
     if (!*_retval) {
       return NS_ERROR_UNEXPECTED;
     }
   }
 
   if (found) {
-    if (JSVAL_IS_STRING(id)) {
-      *_retval = ::JS_SetUCProperty(cx, pi_obj, id_chars, id_length, vp);
+    if (JSID_IS_STRING(id)) {
+      *_retval = ::JS_SetPropertyById(cx, pi_obj, id, vp);
     } else {
-      *_retval = ::JS_SetElement(cx, pi_obj, JSVAL_TO_INT(id), vp);
+      *_retval = ::JS_SetElement(cx, pi_obj, JSID_TO_INT(id), vp);
     }
 
     return *_retval ? NS_SUCCESS_I_DID_SOMETHING : NS_ERROR_FAILURE;
   }
 
   return nsElementSH::SetProperty(wrapper, cx, obj, id, vp, _retval);
 }
 
@@ -9984,17 +9902,17 @@ nsHTMLPluginObjElementSH::GetPluginJSObj
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLPluginObjElementSH::NewResolve(nsIXPConnectWrappedNative *wrapper,
-                                     JSContext *cx, JSObject *obj, jsval id,
+                                     JSContext *cx, JSObject *obj, jsid id,
                                      PRUint32 flags, JSObject **objp,
                                      PRBool *_retval)
 {
   // Make sure the plugin instance is loaded and instantiated, if
   // possible.
 
   nsCOMPtr<nsIPluginInstance> pi;
   nsresult rv = GetPluginInstanceIfSafe(wrapper, obj, getter_AddRefs(pi));
@@ -10003,17 +9921,17 @@ nsHTMLPluginObjElementSH::NewResolve(nsI
   return nsElementSH::NewResolve(wrapper, cx, obj, id, flags, objp,
                                  _retval);
 }
  
 // HTMLOptionsCollection helper
 
 NS_IMETHODIMP
 nsHTMLOptionsCollectionSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
-                                       JSContext *cx, JSObject *obj, jsval id,
+                                       JSContext *cx, JSObject *obj, jsid id,
                                        jsval *vp, PRBool *_retval)
 {
   PRInt32 n = GetArrayIndexFromId(cx, id);
 
   if (n < 0) {
     return NS_OK;
   }
 
@@ -10091,17 +10009,17 @@ nsMimeTypeArraySH::GetNamedItem(nsISuppo
   return array->GetNamedItem(aName, aResult);
 }
 
 
 // StringArray helper
 
 NS_IMETHODIMP
 nsStringArraySH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                             JSObject *obj, jsval id, jsval *vp,
+                             JSObject *obj, jsid id, jsval *vp,
                              PRBool *_retval)
 {
   PRBool is_number = PR_FALSE;
   PRInt32 n = GetArrayIndexFromId(cx, id, &is_number);
 
   if (!is_number) {
     return NS_OK;
   }
@@ -10125,17 +10043,17 @@ nsStringArraySH::GetProperty(nsIXPConnec
   return NS_SUCCESS_I_DID_SOMETHING;
 }
 
 
 // History helper
 
 NS_IMETHODIMP
 nsHistorySH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   PRBool is_number = PR_FALSE;
   GetArrayIndexFromId(cx, id, &is_number);
 
   if (!is_number) {
     return NS_OK;
   }
 
@@ -10319,59 +10237,55 @@ nsTreeColumnsSH::GetNamedItem(nsISupport
 
 // One reason we need a newResolve hook is that in order for
 // enumeration of storage object keys to work the keys we're
 // enumerating need to exist on the storage object for the JS engine
 // to find them.
 
 NS_IMETHODIMP
 nsStorageSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval)
 {
   JSObject *realObj;
   wrapper->GetJSObject(&realObj);
 
-  // First check to see if the property is defined on our prototype,
-  // after converting id to a string if it's an integer.
-
-  JSString *jsstr = JS_ValueToString(cx, id);
-  if (!jsstr) {
-    return JS_FALSE;
-  }
+  // First check to see if the property is defined on our prototype.
 
   JSObject *proto = ::JS_GetPrototype(cx, realObj);
   JSBool hasProp;
 
   if (proto &&
-      (::JS_HasUCProperty(cx, proto, ::JS_GetStringChars(jsstr),
-                          ::JS_GetStringLength(jsstr), &hasProp) &&
+      (::JS_HasPropertyById(cx, proto, id, &hasProp) &&
        hasProp)) {
     // We found the property we're resolving on the prototype,
     // nothing left to do here then.
 
     return NS_OK;
   }
 
   // We're resolving property that doesn't exist on the prototype,
   // check if the key exists in the storage object.
 
   nsCOMPtr<nsIDOMStorageObsolete> storage(do_QueryWrappedNative(wrapper));
 
+  JSString *jsstr = IdToString(cx, id);
+  if (!jsstr)
+    return JS_FALSE;
+
   // GetItem() will return null if the caller can't access the session
   // storage item.
   nsCOMPtr<nsIDOMStorageItem> item;
   nsresult rv = storage->GetItem(nsDependentJSString(jsstr),
                                  getter_AddRefs(item));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (item) {
-    if (!::JS_DefineUCProperty(cx, realObj, ::JS_GetStringChars(jsstr),
-                               ::JS_GetStringLength(jsstr), JSVAL_VOID, nsnull,
-                               nsnull, JSPROP_ENUMERATE)) {
+    if (!::JS_DefinePropertyById(cx, realObj, id, JSVAL_VOID, nsnull, nsnull,
+                                 JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 
     *objp = realObj;
   }
 
   return NS_OK;
 }
@@ -10382,46 +10296,46 @@ nsStorageSH::GetNamedItem(nsISupports *a
 {
   nsDOMStorage* storage = nsDOMStorage::FromSupports(aNative);
 
   return storage->GetNamedItem(aName, aResult);
 }
 
 NS_IMETHODIMP
 nsStorageSH::SetProperty(nsIXPConnectWrappedNative *wrapper,
-                         JSContext *cx, JSObject *obj, jsval id,
+                         JSContext *cx, JSObject *obj, jsid id,
                          jsval *vp, PRBool *_retval)
 {
   nsCOMPtr<nsIDOMStorageObsolete> storage(do_QueryWrappedNative(wrapper));
   NS_ENSURE_TRUE(storage, NS_ERROR_UNEXPECTED);
 
-  JSString *key = ::JS_ValueToString(cx, id);
+  JSString *key = IdToString(cx, id);
   NS_ENSURE_TRUE(key, NS_ERROR_UNEXPECTED);
 
   JSString *value = ::JS_ValueToString(cx, *vp);
   NS_ENSURE_TRUE(value, NS_ERROR_UNEXPECTED);
 
   nsresult rv = storage->SetItem(nsDependentJSString(key),
                                  nsDependentJSString(value));
   if (NS_SUCCEEDED(rv)) {
     rv = NS_SUCCESS_I_DID_SOMETHING;
   }
 
   return rv;
 }
 
 NS_IMETHODIMP
 nsStorageSH::DelProperty(nsIXPConnectWrappedNative *wrapper,
-                         JSContext *cx, JSObject *obj, jsval id,
+                         JSContext *cx, JSObject *obj, jsid id,
                          jsval *vp, PRBool *_retval)
 {
   nsCOMPtr<nsIDOMStorageObsolete> storage(do_QueryWrappedNative(wrapper));
   NS_ENSURE_TRUE(storage, NS_ERROR_UNEXPECTED);
 
-  JSString *key = ::JS_ValueToString(cx, id);
+  JSString *key = IdToString(cx, id);
   NS_ENSURE_TRUE(key, NS_ERROR_UNEXPECTED);
 
   nsresult rv = storage->RemoveItem(nsDependentJSString(key));
   if (NS_SUCCEEDED(rv)) {
     rv = NS_SUCCESS_I_DID_SOMETHING;
   }
 
   return rv;
@@ -10444,17 +10358,17 @@ nsStorageSH::NewEnumerate(nsIXPConnectWr
 
       // XXXndeakin need to free the keys afterwards
       keys = storage->GetKeys();
       NS_ENSURE_TRUE(keys, NS_ERROR_OUT_OF_MEMORY);
 
       *statep = PRIVATE_TO_JSVAL(keys);
 
       if (idp) {
-        *idp = INT_TO_JSVAL(keys->Length());
+        *idp = INT_TO_JSID(keys->Length());
       }
       break;
     }
     case JSENUMERATE_NEXT:
       if (keys->Length() != 0) {
         nsString& key = keys->ElementAt(0);
         JSString *str =
           JS_NewUCStringCopyN(cx, reinterpret_cast<const jschar *>
@@ -10490,36 +10404,35 @@ nsStorageSH::NewEnumerate(nsIXPConnectWr
 
 // One reason we need a newResolve hook is that in order for
 // enumeration of storage object keys to work the keys we're
 // enumerating need to exist on the storage object for the JS engine
 // to find them.
 
 NS_IMETHODIMP
 nsStorage2SH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, PRUint32 flags,
+                         JSObject *obj, jsid id, PRUint32 flags,
                          JSObject **objp, PRBool *_retval)
 {
   JSObject *realObj;
   wrapper->GetJSObject(&realObj);
 
   // First check to see if the property is defined on our prototype,
   // after converting id to a string if it's an integer.
 
-  JSString *jsstr = JS_ValueToString(cx, id);
+  JSString *jsstr = IdToString(cx, id);
   if (!jsstr) {
     return JS_FALSE;
   }
 
   JSObject *proto = ::JS_GetPrototype(cx, realObj);
   JSBool hasProp;
 
   if (proto &&
-      (::JS_HasUCProperty(cx, proto, ::JS_GetStringChars(jsstr),
-                          ::JS_GetStringLength(jsstr), &hasProp) &&
+      (::JS_HasPropertyById(cx, proto, id, &hasProp) &&
        hasProp)) {
     // We found the property we're resolving on the prototype,
     // nothing left to do here then.
 
     return NS_OK;
   }
 
   // We're resolving property that doesn't exist on the prototype,
@@ -10529,39 +10442,38 @@ nsStorage2SH::NewResolve(nsIXPConnectWra
 
   // GetItem() will return null if the caller can't access the session
   // storage item.
   nsAutoString data;
   nsresult rv = storage->GetItem(nsDependentJSString(jsstr), data);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!DOMStringIsNull(data)) {
-    if (!::JS_DefineUCProperty(cx, realObj, ::JS_GetStringChars(jsstr),
-                               ::JS_GetStringLength(jsstr), JSVAL_VOID, nsnull,
-                               nsnull, JSPROP_ENUMERATE)) {
+    if (!::JS_DefinePropertyById(cx, realObj, id, JSVAL_VOID, nsnull,
+                                 nsnull, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 
     *objp = realObj;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsStorage2SH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                          JSObject *obj, jsval id, jsval *vp, PRBool *_retval)
+                          JSObject *obj, jsid id, jsval *vp, PRBool *_retval)
 {
   nsCOMPtr<nsIDOMStorage> storage(do_QueryWrappedNative(wrapper));
   NS_ENSURE_TRUE(storage, NS_ERROR_UNEXPECTED);
 
   nsAutoString val;
   nsresult rv = NS_OK;
 
-  if (JSVAL_IS_STRING(id)) {
+  if (JSID_IS_STRING(id)) {
     // For native wrappers, do not get random names on storage objects.
     if (ObjectIsNativeWrapper(cx, obj)) {
       return NS_ERROR_NOT_AVAILABLE;
     }
 
     rv = storage->GetItem(nsDependentJSString(id), val);
     NS_ENSURE_SUCCESS(rv, rv);
   } else {
@@ -10586,46 +10498,46 @@ nsStorage2SH::GetProperty(nsIXPConnectWr
       *vp = STRING_TO_JSVAL(str);
   }
 
   return NS_SUCCESS_I_DID_SOMETHING;
 }
 
 NS_IMETHODIMP
 nsStorage2SH::SetProperty(nsIXPConnectWrappedNative *wrapper,
-                          JSContext *cx, JSObject *obj, jsval id,
+                          JSContext *cx, JSObject *obj, jsid id,
                           jsval *vp, PRBool *_retval)
 {
   nsCOMPtr<nsIDOMStorage> storage(do_QueryWrappedNative(wrapper));
   NS_ENSURE_TRUE(storage, NS_ERROR_UNEXPECTED);
 
-  JSString *key = ::JS_ValueToString(cx, id);
+  JSString *key = IdToString(cx, id);
   NS_ENSURE_TRUE(key, NS_ERROR_UNEXPECTED);
 
   JSString *value = ::JS_ValueToString(cx, *vp);
   NS_ENSURE_TRUE(value, NS_ERROR_UNEXPECTED);
 
   nsresult rv = storage->SetItem(nsDependentJSString(key),
                                  nsDependentJSString(value));
   if (NS_SUCCEEDED(rv)) {
     rv = NS_SUCCESS_I_DID_SOMETHING;
   }
 
   return rv;
 }
 
 NS_IMETHODIMP
 nsStorage2SH::DelProperty(nsIXPConnectWrappedNative *wrapper,
-                          JSContext *cx, JSObject *obj, jsval id,
+                          JSContext *cx, JSObject *obj, jsid id,
                           jsval *vp, PRBool *_retval)
 {
   nsCOMPtr<nsIDOMStorage> storage(do_QueryWrappedNative(wrapper));
   NS_ENSURE_TRUE(storage, NS_ERROR_UNEXPECTED);
 
-  JSString *key = ::JS_ValueToString(cx, id);
+  JSString *key = IdToString(cx, id);
   NS_ENSURE_TRUE(key, NS_ERROR_UNEXPECTED);
 
   nsresult rv = storage->RemoveItem(nsDependentJSString(key));
   if (NS_SUCCEEDED(rv)) {
     rv = NS_SUCCESS_I_DID_SOMETHING;
   }
 
   return rv;
@@ -10648,17 +10560,17 @@ nsStorage2SH::NewEnumerate(nsIXPConnectW
 
       // XXXndeakin need to free the keys afterwards
       keys = storage->GetKeys();
       NS_ENSURE_TRUE(keys, NS_ERROR_OUT_OF_MEMORY);
 
       *statep = PRIVATE_TO_JSVAL(keys);
 
       if (idp) {
-        *idp = INT_TO_JSVAL(keys->Length());
+        *idp = INT_TO_JSID(keys->Length());
       }
       break;
     }
     case JSENUMERATE_NEXT:
       if (keys->Length() != 0) {
         nsString& key = keys->ElementAt(0);
         JSString *str =
           JS_NewUCStringCopyN(cx, reinterpret_cast<const jschar *>
@@ -10770,17 +10682,17 @@ nsDOMConstructorSH::Construct(nsIXPConne
   }
 #endif
 
   return wrapped->Construct(wrapper, cx, obj, argc, argv, vp, _retval);
 }
 
 NS_IMETHODIMP
 nsDOMConstructorSH::HasInstance(nsIXPConnectWrappedNative *wrapper,
-                                JSContext *cx, JSObject *obj, jsval val,
+                                JSContext *cx, JSObject *obj, const jsval &val,
                                 PRBool *bp, PRBool *_retval)
 {
   nsDOMConstructor *wrapped =
     static_cast<nsDOMConstructor *>(wrapper->Native());
 
 #ifdef DEBUG
   {
     nsCOMPtr<nsIDOMDOMConstructor> is_constructor =
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -212,20 +212,20 @@ protected:
   static nsresult RegisterClassProtos(PRInt32 aDOMClassInfoID);
   static nsresult RegisterExternalClasses();
   nsresult ResolveConstructor(JSContext *cx, JSObject *obj,
                               JSObject **objp);
 
   // Checks if id is a number and returns the number, if aIsNumber is
   // non-null it's set to true if the id is a number and false if it's
   // not a number. If id is not a number this method returns -1
-  static PRInt32 GetArrayIndexFromId(JSContext *cx, jsval id,
+  static PRInt32 GetArrayIndexFromId(JSContext *cx, jsid id,
                                      PRBool *aIsNumber = nsnull);
 
-  static inline PRBool IsReadonlyReplaceable(jsval id)
+  static inline PRBool IsReadonlyReplaceable(jsid id)
   {
     return (id == sTop_id          ||
             id == sParent_id       ||
             id == sScrollbars_id   ||
             id == sContent_id      ||
             id == sMenubar_id      ||
             id == sToolbar_id      ||
             id == sLocationbar_id  ||
@@ -236,17 +236,17 @@ protected:
             id == sScrollY_id      ||
             id == sScrollMaxX_id   ||
             id == sScrollMaxY_id   ||
             id == sLength_id       ||
             id == sFrames_id       ||
             id == sSelf_id);
   }
 
-  static inline PRBool IsWritableReplaceable(jsval id)
+  static inline PRBool IsWritableReplaceable(jsid id)
   {
     return (id == sInnerHeight_id  ||
             id == sInnerWidth_id   ||
             id == sOpener_id       ||
             id == sOuterHeight_id  ||
             id == sOuterWidth_id   ||
             id == sScreenX_id      ||
             id == sScreenY_id      ||
@@ -259,101 +259,101 @@ protected:
 
   // nsIXPCScriptable code
   static nsresult DefineStaticJSVals(JSContext *cx);
 
   static PRBool sIsInitialized;
   static PRBool sDisableDocumentAllSupport;
   static PRBool sDisableGlobalScopePollutionSupport;
 
-  static jsval sTop_id;
-  static jsval sParent_id;
-  static jsval sScrollbars_id;
-  static jsval sLocation_id;
-  static jsval sConstructor_id;
-  static jsval s_content_id;
-  static jsval sContent_id;
-  static jsval sMenubar_id;
-  static jsval sToolbar_id;
-  static jsval sLocationbar_id;
-  static jsval sPersonalbar_id;
-  static jsval sStatusbar_id;
-  static jsval sDialogArguments_id;
-  static jsval sControllers_id;
-  static jsval sLength_id;
-  static jsval sInnerHeight_id;
-  static jsval sInnerWidth_id;
-  static jsval sOuterHeight_id;
-  static jsval sOuterWidth_id;
-  static jsval sScreenX_id;
-  static jsval sScreenY_id;
-  static jsval sStatus_id;
-  static jsval sName_id;
-  static jsval sOnmousedown_id;
-  static jsval sOnmouseup_id;
-  static jsval sOnclick_id;
-  static jsval sOndblclick_id;
-  static jsval sOncontextmenu_id;
-  static jsval sOnmouseover_id;
-  static jsval sOnmouseout_id;
-  static jsval sOnkeydown_id;
-  static jsval sOnkeyup_id;
-  static jsval sOnkeypress_id;
-  static jsval sOnmousemove_id;
-  static jsval sOnfocus_id;
-  static jsval sOnblur_id;
-  static jsval sOnsubmit_id;
-  static jsval sOnreset_id;
-  static jsval sOnchange_id;
-  static jsval sOnselect_id;
-  static jsval sOnload_id;
-  static jsval sOnpopstate_id;
-  static jsval sOnbeforeunload_id;
-  static jsval sOnunload_id;
-  static jsval sOnhashchange_id;
-  static jsval sOnreadystatechange_id;
-  static jsval sOnpageshow_id;
-  static jsval sOnpagehide_id;
-  static jsval sOnabort_id;
-  static jsval sOnerror_id;
-  static jsval sOnpaint_id;
-  static jsval sOnresize_id;
-  static jsval sOnscroll_id;
-  static jsval sOndrag_id;
-  static jsval sOndragend_id;
-  static jsval sOndragenter_id;
-  static jsval sOndragleave_id;
-  static jsval sOndragover_id;
-  static jsval sOndragstart_id;
-  static jsval sOndrop_id;
-  static jsval sScrollX_id;
-  static jsval sScrollY_id;
-  static jsval sScrollMaxX_id;
-  static jsval sScrollMaxY_id;
-  static jsval sOpen_id;
-  static jsval sItem_id;
-  static jsval sNamedItem_id;
-  static jsval sEnumerate_id;
-  static jsval sNavigator_id;
-  static jsval sDocument_id;
-  static jsval sWindow_id;
-  static jsval sFrames_id;
-  static jsval sSelf_id;
-  static jsval sOpener_id;
-  static jsval sAll_id;
-  static jsval sTags_id;
-  static jsval sAddEventListener_id;
-  static jsval sBaseURIObject_id;
-  static jsval sNodePrincipal_id;
-  static jsval sDocumentURIObject_id;
-  static jsval sOncopy_id;
-  static jsval sOncut_id;
-  static jsval sOnpaste_id;
-  static jsval sJava_id;
-  static jsval sPackages_id;
+  static jsid sTop_id;
+  static jsid sParent_id;
+  static jsid sScrollbars_id;
+  static jsid sLocation_id;
+  static jsid sConstructor_id;
+  static jsid s_content_id;
+  static jsid sContent_id;
+  static jsid sMenubar_id;
+  static jsid sToolbar_id;
+  static jsid sLocationbar_id;
+  static jsid sPersonalbar_id;
+  static jsid sStatusbar_id;
+  static jsid sDialogArguments_id;
+  static jsid sControllers_id;
+  static jsid sLength_id;
+  static jsid sInnerHeight_id;
+  static jsid sInnerWidth_id;
+  static jsid sOuterHeight_id;
+  static jsid sOuterWidth_id;
+  static jsid sScreenX_id;
+  static jsid sScreenY_id;
+  static jsid sStatus_id;
+  static jsid sName_id;
+  static jsid sOnmousedown_id;
+  static jsid sOnmouseup_id;
+  static jsid sOnclick_id;
+  static jsid sOndblclick_id;
+  static jsid sOncontextmenu_id;
+  static jsid sOnmouseover_id;
+  static jsid sOnmouseout_id;
+  static jsid sOnkeydown_id;
+  static jsid sOnkeyup_id;
+  static jsid sOnkeypress_id;
+  static jsid sOnmousemove_id;
+  static jsid sOnfocus_id;
+  static jsid sOnblur_id;
+  static jsid sOnsubmit_id;
+  static jsid sOnreset_id;
+  static jsid sOnchange_id;
+  static jsid sOnselect_id;
+  static jsid sOnload_id;
+  static jsid sOnpopstate_id;
+  static jsid sOnbeforeunload_id;
+  static jsid sOnunload_id;
+  static jsid sOnhashchange_id;
+  static jsid sOnreadystatechange_id;
+  static jsid sOnpageshow_id;
+  static jsid sOnpagehide_id;
+  static jsid sOnabort_id;
+  static jsid sOnerror_id;
+  static jsid sOnpaint_id;
+  static jsid sOnresize_id;
+  static jsid sOnscroll_id;
+  static jsid sOndrag_id;
+  static jsid sOndragend_id;
+  static jsid sOndragenter_id;
+  static jsid sOndragleave_id;
+  static jsid sOndragover_id;
+  static jsid sOndragstart_id;
+  static jsid sOndrop_id;
+  static jsid sScrollX_id;
+  static jsid sScrollY_id;
+  static jsid sScrollMaxX_id;
+  static jsid sScrollMaxY_id;
+  static jsid sOpen_id;
+  static jsid sItem_id;
+  static jsid sNamedItem_id;
+  static jsid sEnumerate_id;
+  static jsid sNavigator_id;
+  static jsid sDocument_id;
+  static jsid sWindow_id;
+  static jsid sFrames_id;
+  static jsid sSelf_id;
+  static jsid sOpener_id;
+  static jsid sAll_id;
+  static jsid sTags_id;
+  static jsid sAddEventListener_id;
+  static jsid sBaseURIObject_id;
+  static jsid sNodePrincipal_id;
+  static jsid sDocumentURIObject_id;
+  static jsid sOncopy_id;
+  static jsid sOncut_id;
+  static jsid sOnpaste_id;
+  static jsid sJava_id;
+  static jsid sPackages_id;
 
   static JSPropertyOp sXPCNativeWrapperGetPropertyOp;
   static JSPropertyOp sXrayWrapperPropertyHolderGetPropertyOp;
 };
 
 
 inline
 const nsQueryInterface
@@ -403,45 +403,45 @@ protected:
   nsEventReceiverSH(nsDOMClassInfoData* aData) : nsDOMGenericSH(aData)
   {
   }
 
   virtual ~nsEventReceiverSH()
   {
   }
 
-  static PRBool ReallyIsEventName(jsval id, jschar aFirstChar);
+  static PRBool ReallyIsEventName(jsid id, jschar aFirstChar);
 
-  static inline PRBool IsEventName(jsval id)
+  static inline PRBool IsEventName(jsid id)
   {
-    NS_ASSERTION(JSVAL_IS_STRING(id), "Don't pass non-string jsval's here!");
+    NS_ASSERTION(JSID_IS_STRING(id), "Don't pass non-string jsid's here!");
 
-    jschar *str = ::JS_GetStringChars(JSVAL_TO_STRING(id));
+    jschar *str = ::JS_GetStringChars(JSID_TO_STRING(id));
 
     if (str[0] == 'o' && str[1] == 'n') {
       return ReallyIsEventName(id, str[2]);
     }
 
     return PR_FALSE;
   }
 
   nsresult RegisterCompileHandler(nsIXPConnectWrappedNative *wrapper,
-                                  JSContext *cx, JSObject *obj, jsval id,
+                                  JSContext *cx, JSObject *obj, jsid id,
                                   PRBool compile, PRBool remove,
                                   PRBool *did_define);
 
 public:
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp,
+                         JSObject *obj, jsid id, jsval *vp,
                          PRBool *_retval);
   NS_IMETHOD AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 };
 
 // Simpler than nsEventReceiverSH
 // Makes sure that the wrapper is preserved if new properties are added.
 class nsEventTargetSH : public nsDOMGenericSH
 {
 protected:
   nsEventTargetSH(nsDOMClassInfoData* aData) : nsDOMGenericSH(aData)
@@ -450,17 +450,17 @@ protected:
 
   virtual ~nsEventTargetSH()
   {
   }
 public:
   NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
                        JSObject *globalObj, JSObject **parentObj);
   NS_IMETHOD AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
   virtual void PreserveWrapper(nsISupports *aNative);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsEventTargetSH(aData);
   }
 };
@@ -505,44 +505,44 @@ public:
     if (NS_SUCCEEDED(rv)) {
       *aFlags = flags | nsIXPCScriptable::WANT_POSTCREATE;
     }
 
     return rv;
   }
 #endif
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD DelProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD NewEnumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                           JSObject *obj, PRUint32 enum_op, jsval *statep,
                           jsid *idp, PRBool *_retval);
   NS_IMETHOD Finalize(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                       JSObject *obj);
   NS_IMETHOD Equality(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                      JSObject * obj, jsval val, PRBool *bp);
+                      JSObject * obj, const jsval &val, PRBool *bp);
   NS_IMETHOD OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
                          JSObject * obj, JSObject * *_retval);
   NS_IMETHOD InnerObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
                          JSObject * obj, JSObject * *_retval);
 
   static JSBool GlobalScopePolluterNewResolve(JSContext *cx, JSObject *obj,
-                                              jsval id, uintN flags,
+                                              jsid id, uintN flags,
                                               JSObject **objp);
   static JSBool GlobalScopePolluterGetProperty(JSContext *cx, JSObject *obj,
-                                               jsval id, jsval *vp);
-  static JSBool SecurityCheckOnSetProp(JSContext *cx, JSObject *obj, jsval id,
+                                               jsid id, jsval *vp);
+  static JSBool SecurityCheckOnSetProp(JSContext *cx, JSObject *obj, jsid id,
                                        jsval *vp);
   static void InvalidateGlobalScopePolluter(JSContext *cx, JSObject *obj);
   static nsresult InstallGlobalScopePolluter(JSContext *cx, JSObject *obj,
                                              nsIHTMLDocument *doc);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsWindowSH(aData);
@@ -560,17 +560,17 @@ protected:
   }
 
   virtual ~nsLocationSH()
   {
   }
 
 public:
   NS_IMETHOD CheckAccess(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, PRUint32 mode,
+                         JSObject *obj, jsid id, PRUint32 mode,
                          jsval *vp, PRBool *_retval);
 
   NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
                        JSObject *globalObj, JSObject **parentObj);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsLocationSH(aData);
@@ -622,31 +622,31 @@ protected:
   inline PRBool IsPrivilegedScript() {
     return IsCapabilityEnabled("UniversalXPConnect");
   }
 
   // Helper to define a void property with JSPROP_SHARED; this can do all the
   // work so it's safe to just return whatever it returns.  |obj| is the object
   // we're defining on, |id| is the name of the prop.  This must be a string
   // jsval.  |objp| is the out param if we define successfully.
-  nsresult DefineVoidProp(JSContext* cx, JSObject* obj, jsval id,
+  nsresult DefineVoidProp(JSContext* cx, JSObject* obj, jsid id,
                           JSObject** objp);
 
 public:
   NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
                        JSObject *globalObj, JSObject **parentObj);
   NS_IMETHOD AddProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD GetFlags(PRUint32 *aFlags);
 
   virtual void PreserveWrapper(nsISupports *aNative);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsNodeSH(aData);
   }
@@ -691,17 +691,17 @@ protected:
   }
 
   virtual ~nsGenericArraySH()
   {
   }
   
 public:
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                        JSObject *obj, PRBool *_retval);
   
   virtual nsresult GetLength(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *obj, PRUint32 *length);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
@@ -726,17 +726,17 @@ protected:
 
   // Subclasses need to override this, if the implementation can't fail it's
   // allowed to not set *aResult.
   virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
                                  nsresult *aResult) = 0;
 
 public:
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
 private:
   // Not implemented, nothing should create an instance of this class.
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData);
 };
 
 
 // NodeList scriptable helper
@@ -778,17 +778,17 @@ protected:
   }
 
   virtual nsISupports* GetNamedItem(nsISupports *aNative,
                                     const nsAString& aName,
                                     nsresult *aResult) = 0;
 
 public:
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
 private:
   // Not implemented, nothing should create an instance of this class.
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData);
 };
 
 
 // NamedNodeMap helper
@@ -890,22 +890,22 @@ public:
   }
 
   virtual ~nsDocumentSH()
   {
   }
 
 public:
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD GetFlags(PRUint32* aFlags);
   NS_IMETHOD PostCreate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsDocumentSH(aData);
   }
@@ -921,46 +921,46 @@ protected:
   {
   }
 
   virtual ~nsHTMLDocumentSH()
   {
   }
 
   static nsresult ResolveImpl(JSContext *cx,
-                              nsIXPConnectWrappedNative *wrapper, jsval id,
+                              nsIXPConnectWrappedNative *wrapper, jsid id,
                               nsISupports **result);
   static JSBool DocumentOpen(JSContext *cx, JSObject *obj, uintN argc,
                              jsval *argv, jsval *rval);
   static JSBool GetDocumentAllNodeList(JSContext *cx, JSObject *obj,
                                        nsIDOMDocument *doc,
                                        nsIDOMNodeList **nodeList);
 
 public:
-  static JSBool DocumentAllGetProperty(JSContext *cx, JSObject *obj, jsval id,
+  static JSBool DocumentAllGetProperty(JSContext *cx, JSObject *obj, jsid id,
                                        jsval *vp);
-  static JSBool DocumentAllNewResolve(JSContext *cx, JSObject *obj, jsval id,
+  static JSBool DocumentAllNewResolve(JSContext *cx, JSObject *obj, jsid id,
                                       uintN flags, JSObject **objp);
   static void ReleaseDocument(JSContext *cx, JSObject *obj);
   static JSBool CallToGetPropMapper(JSContext *cx, JSObject *obj, uintN argc,
                                     jsval *argv, jsval *rval);
   static JSBool DocumentAllHelperGetProperty(JSContext *cx, JSObject *obj,
-                                             jsval id, jsval *vp);
+                                             jsid id, jsval *vp);
   static JSBool DocumentAllHelperNewResolve(JSContext *cx, JSObject *obj,
-                                            jsval id, uintN flags,
+                                            jsid id, uintN flags,
                                             JSObject **objp);
   static JSBool DocumentAllTagsNewResolve(JSContext *cx, JSObject *obj,
-                                          jsval id, uintN flags,
+                                          jsid id, uintN flags,
                                           JSObject **objp);
 
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsHTMLDocumentSH(aData);
   }
 };
 
 
@@ -974,25 +974,25 @@ protected:
   }
 
   virtual ~nsHTMLBodyElementSH()
   {
   }
 
 public:
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
 
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp,
+                         JSObject *obj, jsid id, jsval *vp,
                          PRBool *_retval);
 
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsHTMLBodyElementSH(aData);
   }
 };
 
 
@@ -1009,20 +1009,20 @@ protected:
   {
   }
 
   static nsresult FindNamedItem(nsIForm *aForm, JSString *str,
                                 nsISupports **aResult);
 
 public:
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp,
+                         JSObject *obj, jsid id, jsval *vp,
                          PRBool *_retval);
 
   NS_IMETHOD NewEnumerate(nsIXPConnectWrappedNative *wrapper,
                           JSContext *cx, JSObject *obj,
                           PRUint32 enum_op, jsval *statep,
                           jsid *idp, PRBool *_retval);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
@@ -1042,20 +1042,20 @@ protected:
   }
 
   virtual ~nsHTMLSelectElementSH()
   {
   }
 
 public:
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp,
+                         JSObject *obj, jsid id, jsval *vp,
                          PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
   static nsresult SetOption(JSContext *cx, jsval *vp, PRUint32 aIndex,
                             nsIDOMNSHTMLOptionCollection *aOptCollection);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsHTMLSelectElementSH(aData);
   }
@@ -1082,26 +1082,26 @@ protected:
 
   static nsresult GetPluginJSObject(JSContext *cx, JSObject *obj,
                                     nsIPluginInstance *plugin_inst,
                                     JSObject **plugin_obj,
                                     JSObject **plugin_proto);
 
 public:
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
                        JSObject *globalObj, JSObject **parentObj);
   NS_IMETHOD PostCreate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD Call(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                   JSObject *obj, PRUint32 argc, jsval *argv, jsval *vp,
                   PRBool *_retval);
 
 
   static nsresult SetupProtoChain(nsIXPConnectWrappedNative *wrapper,
                                   JSContext *cx, JSObject *obj);
 
@@ -1123,17 +1123,17 @@ protected:
   }
 
   virtual ~nsHTMLOptionsCollectionSH()
   {
   }
 
 public:
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsHTMLOptionsCollectionSH(aData);
   }
 };
 
 
@@ -1237,17 +1237,17 @@ protected:
   {
   }
 
   virtual nsresult GetStringAt(nsISupports *aNative, PRInt32 aIndex,
                                nsAString& aResult) = 0;
 
 public:
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 };
 
 
 // History helper
 
 class nsHistorySH : public nsStringArraySH
 {
 protected:
@@ -1259,17 +1259,17 @@ protected:
   {
   }
 
   virtual nsresult GetStringAt(nsISupports *aNative, PRInt32 aIndex,
                                nsAString& aResult);
 
 public:
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsHistorySH(aData);
   }
 };
 
 // StringList scriptable helper
@@ -1532,22 +1532,22 @@ protected:
   {
   }
 
   virtual ~nsStorageSH()
   {
   }
 
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD DelProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD NewEnumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                           JSObject *obj, PRUint32 enum_op, jsval *statep,
                           jsid *idp, PRBool *_retval);
 
   virtual nsISupports* GetItemAt(nsISupports *aNative, PRUint32 aIndex,
                                  nsresult *aResult)
   {
     return nsnull;
@@ -1572,24 +1572,24 @@ protected:
   {
   }
 
   virtual ~nsStorage2SH()
   {
   }
 
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsval id, PRUint32 flags,
+                        JSObject *obj, jsid id, PRUint32 flags,
                         JSObject **objp, PRBool *_retval);
   NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD DelProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval id, jsval *vp, PRBool *_retval);
+                         JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
   NS_IMETHOD NewEnumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                           JSObject *obj, PRUint32 enum_op, jsval *statep,
                           jsid *idp, PRBool *_retval);
 
 public:
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsStorage2SH(aData);
@@ -1666,17 +1666,17 @@ public:
                   JSObject *obj, PRUint32 argc, jsval *argv, jsval *vp,
                   PRBool *_retval);
 
   NS_IMETHOD Construct(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                        JSObject *obj, PRUint32 argc, jsval *argv,
                        jsval *vp, PRBool *_retval);
 
   NS_IMETHOD HasInstance(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                         JSObject *obj, jsval val, PRBool *bp,
+                         JSObject *obj, const jsval &val, PRBool *bp,
                          PRBool *_retval);
 
   static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
   {
     return new nsDOMConstructorSH(aData);
   }
 };
 
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -1217,17 +1217,17 @@ nsJSContext::DOMOperationCallback(JSCont
   else if ((buttonPressed == 2) && debugPossible) {
     // Debug the script
     jsval rval;
     switch(cx->debugHooks->debuggerHandler(cx, script, ::JS_GetFramePC(cx, fp),
                                            &rval,
                                            cx->debugHooks->
                                            debuggerHandlerData)) {
       case JSTRAP_RETURN:
-        fp->rval = rval;
+        fp->rval = js::Valueify(rval);
         return JS_TRUE;
       case JSTRAP_ERROR:
         cx->throwing = JS_FALSE;
         return JS_FALSE;
       case JSTRAP_THROW:
         JS_SetPendingException(cx, rval);
         return JS_FALSE;
       case JSTRAP_CONTINUE:
@@ -3048,32 +3048,32 @@ nsJSContext::AddSupportsPrimitiveTojsval
 static JSPropertySpec OptionsProperties[] = {
   {"strict",    (int8)JSOPTION_STRICT,   JSPROP_ENUMERATE | JSPROP_PERMANENT},
   {"werror",    (int8)JSOPTION_WERROR,   JSPROP_ENUMERATE | JSPROP_PERMANENT},
   {"relimit",   (int8)JSOPTION_RELIMIT,  JSPROP_ENUMERATE | JSPROP_PERMANENT},
   {0}
 };
 
 static JSBool
-GetOptionsProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+GetOptionsProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
-  if (JSVAL_IS_INT(id)) {
-    uint32 optbit = (uint32) JSVAL_TO_INT(id);
+  if (JSID_IS_INT(id)) {
+    uint32 optbit = (uint32) JSID_TO_INT(id);
     if (((optbit & (optbit - 1)) == 0 && optbit <= JSOPTION_WERROR) ||
           optbit == JSOPTION_RELIMIT)
       *vp = (JS_GetOptions(cx) & optbit) ? JSVAL_TRUE : JSVAL_FALSE;
   }
   return JS_TRUE;
 }
 
 static JSBool
-SetOptionsProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+SetOptionsProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
-  if (JSVAL_IS_INT(id)) {
-    uint32 optbit = (uint32) JSVAL_TO_INT(id);
+  if (JSID_IS_INT(id)) {
+    uint32 optbit = (uint32) JSID_TO_INT(id);
 
     // Don't let options other than strict, werror, or relimit be set -- it
     // would be bad if web page script could clear
     // JSOPTION_PRIVATE_IS_NSISUPPORTS!
     if (((optbit & (optbit - 1)) == 0 && optbit <= JSOPTION_WERROR) ||
         optbit == JSOPTION_RELIMIT) {
       JSBool optval;
       JS_ValueToBoolean(cx, *vp, &optval);
@@ -3941,17 +3941,17 @@ SetMemoryHighWaterMarkPrefChangedCallbac
 
   if (highwatermark >= 32) {
     // There are two options of memory usage in tracemonkey. One is
     // to use malloc() and the other is to use memory for GC. (E.g.
     // js_NewGCThing()/RefillDoubleFreeList()).
     // Let's limit the high water mark for the first one to 32MB,
     // and second one to 0xffffffff.
     JS_SetGCParameter(nsJSRuntime::sRuntime, JSGC_MAX_MALLOC_BYTES,
-                      32L * 1024L * 1024L);
+                      64L * 1024L * 1024L);
     JS_SetGCParameter(nsJSRuntime::sRuntime, JSGC_MAX_BYTES,
                       0xffffffff);
   } else {
     JS_SetGCParameter(nsJSRuntime::sRuntime, JSGC_MAX_MALLOC_BYTES,
                       highwatermark * 1024L * 1024L);
     JS_SetGCParameter(nsJSRuntime::sRuntime, JSGC_MAX_BYTES,
                       highwatermark * 1024L * 1024L);
   }
--- a/dom/base/nsJSUtils.h
+++ b/dom/base/nsJSUtils.h
@@ -76,16 +76,22 @@ class nsDependentJSString : public nsDep
 {
 public:
   explicit nsDependentJSString(jsval v)
     : nsDependentString((PRUnichar *)::JS_GetStringChars(JSVAL_TO_STRING(v)),
                         ::JS_GetStringLength(JSVAL_TO_STRING(v)))
   {
   }
 
+  explicit nsDependentJSString(jsid id)
+    : nsDependentString((PRUnichar *)::JS_GetStringChars(JSID_TO_STRING(id)),
+                        ::JS_GetStringLength(JSID_TO_STRING(id)))
+  {
+  }
+
   explicit nsDependentJSString(JSString *str)
     : nsDependentString((PRUnichar *)::JS_GetStringChars(str), ::JS_GetStringLength(str))
   {
   }
 
   ~nsDependentJSString()
   {
   }
--- a/dom/indexedDB/IDBCursor.cpp
+++ b/dom/indexedDB/IDBCursor.cpp
@@ -360,17 +360,17 @@ IDBCursor::GetValue(JSContext* aCx,
     mHaveCachedValue = true;
   }
 
   *aValue = mCachedValue;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-IDBCursor::Continue(jsval aKey,
+IDBCursor::Continue(const jsval &aKey,
                     JSContext* aCx,
                     PRUint8 aOptionalArgCount,
                     PRBool* _retval)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 
   if (!mObjectStore->TransactionIsOpen()) {
     return NS_ERROR_UNEXPECTED;
@@ -405,17 +405,17 @@ IDBCursor::Continue(jsval aKey,
 
   mContinueCalled = true;
 
   *_retval = PR_TRUE;
   return NS_OK;
 }
 
 NS_IMETHODIMP
-IDBCursor::Update(jsval aValue,
+IDBCursor::Update(const jsval &aValue,
                   JSContext* aCx,
                   nsIIDBRequest** _retval)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 
   if (mType != OBJECTSTORE) {
     NS_NOTYETIMPLEMENTED("Implement me!");
     return NS_ERROR_NOT_IMPLEMENTED;
@@ -431,62 +431,62 @@ IDBCursor::Update(jsval aValue,
 
   const Key& key = mData[mDataIndex].key;
   NS_ASSERTION(!key.IsUnset() && !key.IsNull(), "Bad key!");
 
   JSAutoRequest ar(aCx);
 
   js::AutoValueRooter clone(aCx);
   nsresult rv = nsContentUtils::CreateStructuredClone(aCx, aValue,
-                                                      clone.addr());
+                                                      clone.jsval_addr());
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (!mObjectStore->KeyPath().IsEmpty()) {
     // Make sure the object given has the correct keyPath value set on it or
     // we will add it.
     const nsString& keyPath = mObjectStore->KeyPath();
     const jschar* keyPathChars = reinterpret_cast<const jschar*>(keyPath.get());
     const size_t keyPathLen = keyPath.Length();
 
     js::AutoValueRooter prop(aCx);
-    JSBool ok = JS_GetUCProperty(aCx, JSVAL_TO_OBJECT(clone.value()),
-                                 keyPathChars, keyPathLen, prop.addr());
+    JSBool ok = JS_GetUCProperty(aCx, JSVAL_TO_OBJECT(clone.jsval_value()),
+                                 keyPathChars, keyPathLen, prop.jsval_addr());
     NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 
-    if (JSVAL_IS_VOID(prop.value())) {
-      rv = IDBObjectStore::GetJSValFromKey(key, aCx, prop.addr());
+    if (JSVAL_IS_VOID(prop.jsval_value())) {
+      rv = IDBObjectStore::GetJSValFromKey(key, aCx, prop.jsval_addr());
       NS_ENSURE_SUCCESS(rv, rv);
 
-      ok = JS_DefineUCProperty(aCx, JSVAL_TO_OBJECT(clone.value()),
-                               keyPathChars, keyPathLen, prop.value(), nsnull,
+      ok = JS_DefineUCProperty(aCx, JSVAL_TO_OBJECT(clone.jsval_value()),
+                               keyPathChars, keyPathLen, prop.jsval_value(), nsnull,
                                nsnull, JSPROP_ENUMERATE);
       NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
     }
     else {
       Key newKey;
-      rv = IDBObjectStore::GetKeyFromJSVal(prop.value(), newKey);
+      rv = IDBObjectStore::GetKeyFromJSVal(prop.jsval_value(), newKey);
       NS_ENSURE_SUCCESS(rv, rv);
 
       if (newKey.IsUnset() || newKey.IsNull() || newKey != key) {
         return NS_ERROR_INVALID_ARG;
       }
     }
   }
 
   nsTArray<IndexUpdateInfo> indexUpdateInfo;
   rv = IDBObjectStore::GetIndexUpdateInfo(mObjectStore->GetObjectStoreInfo(),
-                                          aCx, clone.value(), indexUpdateInfo);
+                                          aCx, clone.jsval_value(), indexUpdateInfo);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIJSON> json(new nsJSON());
 
   nsString jsonValue;
-  rv = json->EncodeFromJSVal(clone.addr(), aCx, jsonValue);
+  rv = json->EncodeFromJSVal(clone.jsval_addr(), aCx, jsonValue);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsRefPtr<IDBRequest> request = GenerateWriteRequest();
   NS_ENSURE_TRUE(request, NS_ERROR_FAILURE);
 
   nsRefPtr<UpdateHelper> helper =
     new UpdateHelper(mTransaction, request, mObjectStore->Id(), jsonValue, key,
                      mObjectStore->IsAutoIncrement(), indexUpdateInfo);
--- a/dom/indexedDB/IDBEvents.cpp
+++ b/dom/indexedDB/IDBEvents.cpp
@@ -468,24 +468,24 @@ GetAllSuccessEvent::GetResult(JSContext*
       js::AutoValueRooter value(aCx);
 
       jsint count = jsint(values.Length());
 
       for (jsint index = 0; index < count; index++) {
         nsString jsonValue = values[index];
         values[index].Truncate();
 
-        nsresult rv = json->DecodeToJSVal(jsonValue, aCx, value.addr());
+        nsresult rv = json->DecodeToJSVal(jsonValue, aCx, value.jsval_addr());
         if (NS_FAILED(rv)) {
           mCachedValue = JSVAL_VOID;
           NS_ERROR("Failed to decode!");
           return rv;
         }
 
-        if (!JS_SetElement(aCx, array, index, value.addr())) {
+        if (!JS_SetElement(aCx, array, index, value.jsval_addr())) {
           mCachedValue = JSVAL_VOID;
           NS_ERROR("Failed to set array element!");
           return NS_ERROR_FAILURE;
         }
       }
     }
   }
 
@@ -534,24 +534,24 @@ GetAllKeySuccessEvent::GetResult(JSConte
       js::AutoValueRooter value(aCx);
 
       jsint count = jsint(keys.Length());
 
       for (jsint index = 0; index < count; index++) {
         const Key& key = keys[index];
         NS_ASSERTION(!key.IsUnset() && !key.IsNull(), "Bad key!");
 
-        nsresult rv = IDBObjectStore::GetJSValFromKey(key, aCx, value.addr());
+        nsresult rv = IDBObjectStore::GetJSValFromKey(key, aCx, value.jsval_addr());
         if (NS_FAILED(rv)) {
           mCachedValue = JSVAL_VOID;
           NS_WARNING("Failed to get jsval for key!");
           return rv;
         }
 
-        if (!JS_SetElement(aCx, array, index, value.addr())) {
+        if (!JS_SetElement(aCx, array, index, value.jsval_addr())) {
           mCachedValue = JSVAL_VOID;
           NS_WARNING("Failed to set array element!");
           return NS_ERROR_FAILURE;
         }
       }
     }
   }
 
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -368,17 +368,17 @@ IDBObjectStore::GetKeyFromJSVal(jsval aK
   }
   else if (JSVAL_IS_STRING(aKeyVal)) {
     aKey = nsDependentJSString(aKeyVal);
   }
   else if (JSVAL_IS_INT(aKeyVal)) {
     aKey = JSVAL_TO_INT(aKeyVal);
   }
   else if (JSVAL_IS_DOUBLE(aKeyVal)) {
-    aKey = *JSVAL_TO_DOUBLE(aKeyVal);
+    aKey = JSVAL_TO_DOUBLE(aKeyVal);
   }
   else {
     return NS_ERROR_INVALID_ARG;
   }
 
   return NS_OK;
 }
 
@@ -447,24 +447,24 @@ IDBObjectStore::GetJSONFromArg0(/* jsval
 
   JSContext* cx;
   rv = cc->GetJSContext(&cx);
   NS_ENSURE_SUCCESS(rv, rv);
 
   JSAutoRequest ar(cx);
 
   js::AutoValueRooter clone(cx);
-  rv = nsContentUtils::CreateStructuredClone(cx, argv[0], clone.addr());
+  rv = nsContentUtils::CreateStructuredClone(cx, argv[0], clone.jsval_addr());
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   nsCOMPtr<nsIJSON> json(new nsJSON());
 
-  rv = json->EncodeFromJSVal(clone.addr(), cx, aJSON);
+  rv = json->EncodeFromJSVal(clone.jsval_addr(), cx, aJSON);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
 
 // static
 nsresult
 IDBObjectStore::GetKeyPathValueFromJSON(const nsAString& aJSON,
@@ -483,37 +483,37 @@ IDBObjectStore::GetKeyPathValueFromJSON(
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   JSAutoRequest ar(*aCx);
 
   js::AutoValueRooter clone(*aCx);
 
   nsCOMPtr<nsIJSON> json(new nsJSON());
-  rv = json->DecodeToJSVal(aJSON, *aCx, clone.addr());
+  rv = json->DecodeToJSVal(aJSON, *aCx, clone.jsval_addr());
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (JSVAL_IS_PRIMITIVE(clone.value())) {
+  if (JSVAL_IS_PRIMITIVE(clone.jsval_value())) {
     // This isn't an object, so just leave the key unset.
     aValue = Key::UNSETKEY;
     return NS_OK;
   }
 
-  JSObject* obj = JSVAL_TO_OBJECT(clone.value());
+  JSObject* obj = JSVAL_TO_OBJECT(clone.jsval_value());
 
   const jschar* keyPathChars =
     reinterpret_cast<const jschar*>(aKeyPath.BeginReading());
   const size_t keyPathLen = aKeyPath.Length();
 
   js::AutoValueRooter value(*aCx);
   JSBool ok = JS_GetUCProperty(*aCx, obj, keyPathChars, keyPathLen,
-                               value.addr());
+                               value.jsval_addr());
   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 
-  rv = GetKeyFromJSVal(value.value(), aValue);
+  rv = GetKeyFromJSVal(value.jsval_value(), aValue);
   if (NS_FAILED(rv) || aValue.IsNull()) {
     // If the object doesn't have a value that we can use for our index then we
     // leave it unset.
     aValue = Key::UNSETKEY;
   }
 
   return NS_OK;
 }
@@ -724,32 +724,32 @@ IDBObjectStore::GetAddInfo(JSContext* aC
                            nsString& aJSON,
                            Key& aKey,
                            nsTArray<IndexUpdateInfo>& aUpdateInfoArray)
 {
   JSAutoRequest ar(aCx);
 
   js::AutoValueRooter clone(aCx);
   nsresult rv = nsContentUtils::CreateStructuredClone(aCx, aValue,
-                                                      clone.addr());
+                                                      clone.jsval_addr());
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (mKeyPath.IsEmpty()) {
     rv = GetKeyFromJSVal(aKeyVal, aKey);
     NS_ENSURE_SUCCESS(rv, rv);
   }
   else {
     // Inline keys live on the object. Make sure it is an object.
-    if (JSVAL_IS_PRIMITIVE(clone.value())) {
+    if (JSVAL_IS_PRIMITIVE(clone.jsval_value())) {
       return NS_ERROR_INVALID_ARG;
     }
 
-    rv = GetKeyFromObject(aCx, JSVAL_TO_OBJECT(clone.value()), mKeyPath, aKey);
+    rv = GetKeyFromObject(aCx, JSVAL_TO_OBJECT(clone.jsval_value()), mKeyPath, aKey);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Except if null was passed, in which case we're supposed to generate the
     // key.
     if (aKey.IsUnset() && JSVAL_IS_NULL(aKeyVal)) {
       aKey = Key::NULLKEY;
     }
   }
@@ -757,21 +757,21 @@ IDBObjectStore::GetAddInfo(JSContext* aC
   if (aKey.IsUnset() && !mAutoIncrement) {
     return NS_ERROR_INVALID_ARG;
   }
 
   // Figure out indexes and the index values to update here.
   ObjectStoreInfo* objectStoreInfo = GetObjectStoreInfo();
   NS_ENSURE_TRUE(objectStoreInfo, NS_ERROR_FAILURE);
 
-  rv = GetIndexUpdateInfo(objectStoreInfo, aCx, clone.value(), aUpdateInfoArray);
+  rv = GetIndexUpdateInfo(objectStoreInfo, aCx, clone.jsval_value(), aUpdateInfoArray);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIJSON> json(new nsJSON());
-  rv = json->EncodeFromJSVal(clone.addr(), aCx, aJSON);
+  rv = json->EncodeFromJSVal(clone.jsval_addr(), aCx, aJSON);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
 
 NS_IMPL_ADDREF(IDBObjectStore)
 NS_IMPL_RELEASE(IDBObjectStore)
 
@@ -899,41 +899,39 @@ IDBObjectStore::GetAll(nsIIDBKeyRange* a
   rv = helper->DispatchToTransactionPool();
   NS_ENSURE_SUCCESS(rv, rv);
 
   request.forget(_retval);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-IDBObjectStore::Add(jsval aValue,
-                    jsval aKey,
+IDBObjectStore::Add(const jsval &aValue,
+                    const jsval &aKey,
                     JSContext* aCx,
                     PRUint8 aOptionalArgCount,
                     nsIIDBRequest** _retval)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 
   if (!mTransaction->TransactionIsOpen()) {
     return NS_ERROR_UNEXPECTED;
   }
 
   if (mMode != nsIIDBTransaction::READ_WRITE) {
     return NS_ERROR_OBJECT_IS_IMMUTABLE;
   }
 
-  if (aOptionalArgCount < 1) {
-    aKey = JSVAL_VOID;
-  }
+  jsval keyval = (aOptionalArgCount >= 1) ? aKey : JSVAL_VOID;
 
   nsString jsonValue;
   Key key;
   nsTArray<IndexUpdateInfo> updateInfo;
 
-  nsresult rv = GetAddInfo(aCx, aValue, aKey, jsonValue, key, updateInfo);
+  nsresult rv = GetAddInfo(aCx, aValue, keyval, jsonValue, key, updateInfo);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (key.IsUnset() && !mAutoIncrement) {
     return NS_ERROR_ILLEGAL_VALUE;
   }
 
@@ -946,41 +944,39 @@ IDBObjectStore::Add(jsval aValue,
   rv = helper->DispatchToTransactionPool();
   NS_ENSURE_SUCCESS(rv, rv);
 
   request.forget(_retval);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-IDBObjectStore::Modify(jsval aValue,
-                       jsval aKey,
+IDBObjectStore::Modify(const jsval &aValue,
+                       const jsval &aKey,
                        JSContext* aCx,
                        PRUint8 aOptionalArgCount,
                        nsIIDBRequest** _retval)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 
   if (!mTransaction->TransactionIsOpen()) {
     return NS_ERROR_UNEXPECTED;
   }
 
   if (mMode != nsIIDBTransaction::READ_WRITE) {
     return NS_ERROR_OBJECT_IS_IMMUTABLE;
   }
 
-  if (aOptionalArgCount < 1) {
-    aKey = JSVAL_VOID;
-  }
+  jsval keyval = (aOptionalArgCount >= 1) ? aKey : JSVAL_VOID;
 
   nsString jsonValue;
   Key key;
   nsTArray<IndexUpdateInfo> updateInfo;
 
-  nsresult rv = GetAddInfo(aCx, aValue, aKey, jsonValue, key, updateInfo);
+  nsresult rv = GetAddInfo(aCx, aValue, keyval, jsonValue, key, updateInfo);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (key.IsUnset() || key.IsNull()) {
     return NS_ERROR_ILLEGAL_VALUE;
   }
 
@@ -993,41 +989,39 @@ IDBObjectStore::Modify(jsval aValue,
   rv = helper->DispatchToTransactionPool();
   NS_ENSURE_SUCCESS(rv, rv);
 
   request.forget(_retval);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-IDBObjectStore::AddOrModify(jsval aValue,
-                            jsval aKey,
+IDBObjectStore::AddOrModify(const jsval &aValue,
+                            const jsval &aKey,
                             JSContext* aCx,
                             PRUint8 aOptionalArgCount,
                             nsIIDBRequest** _retval)
 {
   NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
 
   if (!mTransaction->TransactionIsOpen()) {
     return NS_ERROR_UNEXPECTED;
   }
 
   if (mMode != nsIIDBTransaction::READ_WRITE) {
     return NS_ERROR_OBJECT_IS_IMMUTABLE;
   }
 
-  if (aOptionalArgCount < 1) {
-    aKey = JSVAL_VOID;
-  }
+  jsval keyval = (aOptionalArgCount >= 1) ? aKey : JSVAL_VOID;
 
   nsString jsonValue;
   Key key;
   nsTArray<IndexUpdateInfo> updateInfo;
 
-  nsresult rv = GetAddInfo(aCx, aValue, aKey, jsonValue, key, updateInfo);
+  nsresult rv = GetAddInfo(aCx, aValue, keyval, jsonValue, key, updateInfo);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (key.IsUnset() || key.IsNull()) {
     return NS_ERROR_ILLEGAL_VALUE;
   }
 
@@ -1468,39 +1462,39 @@ AddHelper::ModifyValueForNewKey()
   nsresult rv = nsContentUtils::ThreadJSContextStack()->GetSafeJSContext(&cx);
   NS_ENSURE_SUCCESS(rv, rv);
 
   JSAutoRequest ar(cx);
 
   js::AutoValueRooter clone(cx);
 
   nsCOMPtr<nsIJSON> json(new nsJSON());
-  rv = json->DecodeToJSVal(mValue, cx, clone.addr());
+  rv = json->DecodeToJSVal(mValue, cx, clone.jsval_addr());
   NS_ENSURE_SUCCESS(rv, rv);
 
-  JSObject* obj = JSVAL_TO_OBJECT(clone.value());
+  JSObject* obj = JSVAL_TO_OBJECT(clone.jsval_value());
   JSBool ok;
   js::AutoValueRooter key(cx);
 
   const jschar* keyPathChars = reinterpret_cast<const jschar*>(mKeyPath.get());
   const size_t keyPathLen = mKeyPath.Length();
 
 #ifdef DEBUG
-  ok = JS_GetUCProperty(cx, obj, keyPathChars, keyPathLen, key.addr());
-  NS_ASSERTION(ok && JSVAL_IS_VOID(key.value()), "Already has a key prop!");
+  ok = JS_GetUCProperty(cx, obj, keyPathChars, keyPathLen, key.jsval_addr());
+  NS_ASSERTION(ok && JSVAL_IS_VOID(key.jsval_value()), "Already has a key prop!");
 #endif
 
-  ok = JS_NewNumberValue(cx, mKey.IntValue(), key.addr());
+  ok = JS_NewNumberValue(cx, mKey.IntValue(), key.jsval_addr());
   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 
-  ok = JS_DefineUCProperty(cx, obj, keyPathChars, keyPathLen, key.value(),
+  ok = JS_DefineUCProperty(cx, obj, keyPathChars, keyPathLen, key.jsval_value(),
                            nsnull, nsnull, JSPROP_ENUMERATE);
   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 
-  rv = json->EncodeFromJSVal(clone.addr(), cx, mValue);
+  rv = json->EncodeFromJSVal(clone.jsval_addr(), cx, mValue);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_OK;
 }
 
 PRUint16
 GetHelper::DoDatabaseWork(mozIStorageConnection* aConnection)
 {
--- a/dom/src/threads/nsDOMWorker.cpp
+++ b/dom/src/threads/nsDOMWorker.cpp
@@ -111,17 +111,17 @@ public:
 
   // Chrome-only functions
   static JSBool
   NewChromeWorker(JSContext* aCx, JSObject* aObj, uintN aArgc, jsval* aArgv,
                   jsval* aRval);
 
 #ifdef BUILD_CTYPES
   static JSBool
-  CTypesLazyGetter(JSContext* aCx, JSObject* aObj, jsval aId, jsval* aVp);
+  CTypesLazyGetter(JSContext* aCx, JSObject* aObj, jsid aId, jsval* aVp);
 #endif
 
 private:
   // Internal helper for SetTimeout and SetInterval.
   static JSBool
   MakeTimeout(JSContext* aCx, JSObject* aObj, uintN aArgc, jsval* aArgv,
               jsval* aRval, PRBool aIsInterval);
 
@@ -429,40 +429,38 @@ nsDOMWorkerFunctions::MakeNewWorker(JSCo
   *aRval = v;
   return JS_TRUE;
 }
 
 #ifdef BUILD_CTYPES
 JSBool
 nsDOMWorkerFunctions::CTypesLazyGetter(JSContext* aCx,
                                        JSObject* aObj,
-                                       jsval aId,
+                                       jsid aId,
                                        jsval* aVp)
 {
 #ifdef DEBUG
   {
     NS_ASSERTION(JS_GetGlobalForObject(aCx, aObj) == aObj, "Bad object!");
-    NS_ASSERTION(JSVAL_IS_STRING(aId), "Not a string!");
-    JSString* str = JSVAL_TO_STRING(aId);
+    NS_ASSERTION(JSID_IS_STRING(aId), "Not a string!");
+    JSString* str = JSID_TO_STRING(aId);
     NS_ASSERTION(nsDependentJSString(str).EqualsLiteral("ctypes"), "Bad id!");
   }
 #endif
   nsDOMWorker* worker = static_cast<nsDOMWorker*>(JS_GetContextPrivate(aCx));
   NS_ASSERTION(worker, "This should be set by the DOM thread service!");
   NS_ASSERTION(worker->IsPrivileged(), "This shouldn't be possible!");
 
   if (worker->IsCanceled()) {
     return JS_FALSE;
   }
 
-  js::AutoIdRooter rooter(aCx);
-  return JS_ValueToId(aCx, aId, rooter.addr()) &&
-         JS_DeletePropertyById(aCx, aObj, rooter.id()) &&
+  return JS_DeletePropertyById(aCx, aObj, aId) &&
          JS_InitCTypesClass(aCx, aObj) &&
-         JS_GetPropertyById(aCx, aObj, rooter.id(), aVp);
+         JS_GetPropertyById(aCx, aObj, aId, aVp);
 }
 #endif
 
 JSFunctionSpec gDOMWorkerFunctions[] = {
   { "dump",                nsDOMWorkerFunctions::Dump,                1, 0, 0 },
   { "setTimeout",          nsDOMWorkerFunctions::SetTimeout,          1, 0, 0 },
   { "clearTimeout",        nsDOMWorkerFunctions::KillTimeout,         1, 0, 0 },
   { "setInterval",         nsDOMWorkerFunctions::SetInterval,         1, 0, 0 },
@@ -581,36 +579,36 @@ nsDOMWorkerScope::GetWrappedNative()
   NS_ASSERTION(wrappedNative, "Null wrapped native!");
   return wrappedNative.forget();
 }
 
 NS_IMETHODIMP
 nsDOMWorkerScope::AddProperty(nsIXPConnectWrappedNative* aWrapper,
                               JSContext* aCx,
                               JSObject* aObj,
-                              jsval aId,
+                              jsid aId,
                               jsval* aVp,
                               PRBool* _retval)
 {
   // We're not going to be setting any exceptions manually so set _retval to
   // true in the beginning.
   *_retval = PR_TRUE;
 
   // Bail out now if any of our prerequisites are not met. We only care about
   // someone making an 'onmessage' or 'onerror' function so aId must be a
   // string and aVp must be a function.
   JSObject* funObj;
-  if (!(JSVAL_IS_STRING(aId) &&
+  if (!(JSID_IS_STRING(aId) &&
         JSVAL_IS_OBJECT(*aVp) &&
         (funObj = JSVAL_TO_OBJECT(*aVp)) &&
         JS_ObjectIsFunction(aCx, funObj))) {
     return NS_OK;
   }
 
-  const char* name = JS_GetStringBytes(JSVAL_TO_STRING(aId));
+  const char* name = JS_GetStringBytes(JSID_TO_STRING(aId));
 
   // Figure out which listener we're setting.
   SetListenerFunc func;
   if (!strcmp(name, "onmessage")) {
     func = &nsDOMWorkerScope::SetOnmessage;
   }
   else if (!strcmp(name, "onerror")) {
     func = &nsDOMWorkerScope::SetOnerror;
--- a/dom/src/threads/nsDOMWorkerSecurityManager.cpp
+++ b/dom/src/threads/nsDOMWorkerSecurityManager.cpp
@@ -103,32 +103,32 @@ nsDOMWorkerSecurityManager::CanGetServic
 
 NS_IMETHODIMP
 nsDOMWorkerSecurityManager::CanAccess(PRUint32 aAction,
                                       nsAXPCNativeCallContext* aCallContext,
                                       JSContext* aJSContext,
                                       JSObject* aJSObject,
                                       nsISupports* aObj,
                                       nsIClassInfo* aClassInfo,
-                                      jsval aName,
+                                      jsid aName,
                                       void** aPolicy)
 {
   return NS_OK;
 }
 
 JSPrincipals*
 nsDOMWorkerSecurityManager::WorkerPrincipal()
 {
   return &gWorkerPrincipal;
 }
 
 JSBool
 nsDOMWorkerSecurityManager::JSCheckAccess(JSContext* aCx,
                                           JSObject* aObj,
-                                          jsval aId,
+                                          jsid aId,
                                           JSAccessMode aMode,
                                           jsval* aVp)
 {
   return JS_TRUE;
 }
 
 JSPrincipals*
 nsDOMWorkerSecurityManager::JSFindPrincipal(JSContext* aCx, JSObject* aObj)
--- a/dom/src/threads/nsDOMWorkerSecurityManager.h
+++ b/dom/src/threads/nsDOMWorkerSecurityManager.h
@@ -45,17 +45,17 @@
 class nsDOMWorkerSecurityManager : public nsIXPCSecurityManager
 {
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIXPCSECURITYMANAGER
 
   static JSPrincipals* WorkerPrincipal();
 
-  static JSBool JSCheckAccess(JSContext* aCx, JSObject* aObj, jsval aId,
+  static JSBool JSCheckAccess(JSContext* aCx, JSObject* aObj, jsid aId,
                               JSAccessMode aMode, jsval* aVp);
 
   static JSPrincipals* JSFindPrincipal(JSContext* aCx, JSObject* aObj);
 
   static JSBool JSTranscodePrincipals(JSXDRState* aXdr,
                                       JSPrincipals** aJsprinp);
 };
 
--- a/extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp
+++ b/extensions/pref/autoconfig/src/nsJSConfigTriggers.cpp
@@ -91,17 +91,17 @@ AutoConfigSecMan::CanGetService(JSContex
     return NS_OK;
 }
 
 NS_IMETHODIMP 
 AutoConfigSecMan::CanAccess(PRUint32 aAction, 
                             nsAXPCNativeCallContext *aCallContext, 
                             JSContext *aJSContext, JSObject *aJSObject, 
                             nsISupports *aObj, nsIClassInfo *aClassInfo, 
-                            jsval aName, void **aPolicy)
+                            jsid aName, void **aPolicy)
 {
     return NS_OK;
 }
 
 //*****************************************************************************
 
 static  JSContext *autoconfig_cx = nsnull;
 static  JSObject *autoconfig_glob;
--- a/ipc/testshell/TestShellParent.cpp
+++ b/ipc/testshell/TestShellParent.cpp
@@ -111,17 +111,17 @@ TestShellCommandParent::SetCallback(JSCo
   mCx = aCx;
 
   return JS_TRUE;
 }
 
 JSBool
 TestShellCommandParent::RunCallback(const nsString& aResponse)
 {
-  NS_ENSURE_TRUE(mCallback && mCx, JS_FALSE);
+  NS_ENSURE_TRUE(mCallback != JSVAL_NULL && mCx, JS_FALSE);
 
   JSAutoRequest ar(mCx);
 
   JSObject* global = JS_GetGlobalObject(mCx);
   NS_ENSURE_TRUE(global, JS_FALSE);
 
   JSString* str = JS_NewUCStringCopyN(mCx, aResponse.get(), aResponse.Length());
   NS_ENSURE_TRUE(str, JS_FALSE);
--- a/ipc/testshell/XPCShellEnvironment.cpp
+++ b/ipc/testshell/XPCShellEnvironment.cpp
@@ -732,27 +732,27 @@ FullTrustSecMan::CanGetService(JSContext
 
 NS_IMETHODIMP
 FullTrustSecMan::CanAccess(PRUint32 aAction,
                            nsAXPCNativeCallContext *aCallContext,
                            JSContext * aJSContext,
                            JSObject * aJSObject,
                            nsISupports *aObj,
                            nsIClassInfo *aClassInfo,
-                           jsval aName,
+                           jsid aName,
                            void * *aPolicy)
 {
     return NS_OK;
 }
 
 NS_IMETHODIMP
 FullTrustSecMan::CheckPropertyAccess(JSContext * aJSContext,
                                      JSObject * aJSObject,
                                      const char *aClassName,
-                                     jsval aProperty,
+                                     jsid aProperty,
                                      PRUint32 aAction)
 {
     return NS_OK;
 }
 
 NS_IMETHODIMP
 FullTrustSecMan::CheckLoadURIFromScript(JSContext * cx,
                                         nsIURI *uri)
--- a/js/ipc/ObjectWrapperChild.cpp
+++ b/js/ipc/ObjectWrapperChild.cpp
@@ -190,17 +190,17 @@ ObjectWrapperChild::jsval_to_JSVariant(J
     case JSTYPE_STRING:
         *to = nsDependentString((PRUnichar*)JS_GetStringChars(JSVAL_TO_STRING(from)),
                                 JS_GetStringLength(JSVAL_TO_STRING(from)));
         return true;
     case JSTYPE_NUMBER:
         if (JSVAL_IS_INT(from))
             *to = JSVAL_TO_INT(from);
         else if (JSVAL_IS_DOUBLE(from))
-            *to = *JSVAL_TO_DOUBLE(from);
+            *to = JSVAL_TO_DOUBLE(from);
         else return false;
         return true;
     case JSTYPE_BOOLEAN:
         *to = !!JSVAL_TO_BOOLEAN(from);
         return true;
     case JSTYPE_XML:
         // fall through
     default:
@@ -211,17 +211,17 @@ ObjectWrapperChild::jsval_to_JSVariant(J
 /*static*/ bool
 ObjectWrapperChild::
 JSObject_from_PObjectWrapperChild(JSContext*,
                                   const PObjectWrapperChild* from,
                                   JSObject** to)
 {
     const ObjectWrapperChild* owc =
         static_cast<const ObjectWrapperChild*>(from);
-    *to = owc ? owc->mObj : JSVAL_NULL;
+    *to = owc ? owc->mObj : NULL;
     return true;
 }
     
 /*static*/ bool
 ObjectWrapperChild::JSObject_from_JSVariant(JSContext* cx,
                                             const JSVariant& from,
                                             JSObject** to)
 {
@@ -258,17 +258,17 @@ ObjectWrapperChild::jsval_from_JSVariant
                 return false;
             *to = STRING_TO_JSVAL(s);
         }
         return true;
     case JSVariant::Tint:
         *to = INT_TO_JSVAL(from.get_int());
         return true;
     case JSVariant::Tdouble:
-        return !!JS_NewDoubleValue(cx, from.get_double(), to);
+        return !!JS_NewNumberValue(cx, from.get_double(), to);
     case JSVariant::Tbool:
         *to = BOOLEAN_TO_JSVAL(from.get_bool());
         return true;
     default:
         return false;
     }
 }
     
@@ -439,17 +439,17 @@ ObjectWrapperChild::AnswerNewEnumerateIn
     JSContext* cx = Manager()->GetContext();
     AutoContextPusher acp(cx);
     AutoCheckOperation aco(this, status);
 
     JSClass* clasp = const_cast<JSClass*>(&sCPOW_NewEnumerateState_JSClass);
     JSObject* state = JS_NewObjectWithGivenProto(cx, clasp, NULL, NULL);
     if (!state)
         return false;
-    AutoValueRooter tvr(cx, state);
+    AutoObjectRooter tvr(cx, state);
 
     for (JSObject* proto = mObj;
          proto;
          proto = JS_GetPrototype(cx, proto))
     {
         AutoIdArray ids(cx, JS_Enumerate(cx, proto));
         for (uint i = 0; i < ids.length(); ++i)
             JS_DefinePropertyById(cx, state, ids[i], JSVAL_VOID,
--- a/js/ipc/ObjectWrapperParent.cpp
+++ b/js/ipc/ObjectWrapperParent.cpp
@@ -225,17 +225,17 @@ ObjectWrapperParent::GetJSObject(JSConte
         JS_SetReservedSlot(cx, mObj, sFlagsSlot, JSVAL_ZERO);
     }
     return mObj;
 }
 
 static ObjectWrapperParent*
 Unwrap(JSContext* cx, JSObject* obj)
 {
-    while (obj->getClass() != &ObjectWrapperParent::sCPOW_JSClass.base)
+    while (obj->getJSClass() != &ObjectWrapperParent::sCPOW_JSClass.base)
         if (!(obj = obj->getProto()))
             return NULL;
     
     ObjectWrapperParent* self =
         static_cast<ObjectWrapperParent*>(JS_GetPrivate(cx, obj));
 
     NS_ASSERTION(!self || self->GetJSObject(cx) == obj,
                  "Wrapper and wrapped object disagree?");
@@ -270,17 +270,17 @@ ObjectWrapperParent::jsval_to_JSVariant(
     case JSTYPE_STRING:
         *to = nsDependentString((PRUnichar*)JS_GetStringChars(JSVAL_TO_STRING(from)),
                                 JS_GetStringLength(JSVAL_TO_STRING(from)));
         return true;
     case JSTYPE_NUMBER:
         if (JSVAL_IS_INT(from))
             *to = JSVAL_TO_INT(from);
         else if (JSVAL_IS_DOUBLE(from))
-            *to = *JSVAL_TO_DOUBLE(from);
+            *to = JSVAL_TO_DOUBLE(from);
         else return false;
         return true;
     case JSTYPE_BOOLEAN:
         *to = !!JSVAL_TO_BOOLEAN(from);
         return true;
     case JSTYPE_XML:
         return with_error(cx, false, "CPOWs currently cannot handle JSTYPE_XML");
     default:
@@ -305,17 +305,17 @@ ObjectWrapperParent::jsval_from_JSVarian
                 return false;
             *to = STRING_TO_JSVAL(str);
             return true;
         }
     case JSVariant::Tint:
         *to = INT_TO_JSVAL(from.get_int());
         return true;
     case JSVariant::Tdouble:
-        return !!JS_NewDoubleValue(cx, from.get_double(), to);
+        return !!JS_NewNumberValue(cx, from.get_double(), to);
     case JSVariant::Tbool:
         *to = BOOLEAN_TO_JSVAL(from.get_bool());
         return true;
     default:
         return false;
     }
 }
 
@@ -374,28 +374,30 @@ jsid_from_nsString(JSContext* cx, const 
 {
     JSString* str = JS_NewUCStringCopyZ(cx, from.BeginReading());
     if (!str)
         return false;
     return JS_ValueToId(cx, STRING_TO_JSVAL(str), to);
 }
 
 static bool
-jsval_to_nsString(JSContext* cx, jsval from, nsString* to)
+jsval_to_nsString(JSContext* cx, jsid from, nsString* to)
 {
     JSString* str;
-    if ((str = JS_ValueToString(cx, from))) {
+    jsval idval;
+    if (JS_IdToValue(cx, from, &idval) &&
+        (str = JS_ValueToString(cx, idval))) {
         *to = JS_GetStringChars(str);
         return true;
     }
     return false;
 }
 
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_AddProperty(JSContext *cx, JSObject *obj, jsval id,
+ObjectWrapperParent::CPOW_AddProperty(JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp)
 {
     CPOW_LOG(("Calling CPOW_AddProperty (%s)...",
               JSVAL_TO_CSTR(cx, id)));
 
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_AddProperty");
@@ -412,17 +414,17 @@ ObjectWrapperParent::CPOW_AddProperty(JS
 
     return (self->Manager()->RequestRunToCompletion() &&
             self->CallAddProperty(in_id,
                                   aco.StatusPtr()) &&
             aco.Ok());
 }
 
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_GetProperty(JSContext *cx, JSObject *obj, jsval id,
+ObjectWrapperParent::CPOW_GetProperty(JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp)
 {
     CPOW_LOG(("Calling CPOW_GetProperty (%s)...",
               JSVAL_TO_CSTR(cx, id)));
 
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_GetProperty");
@@ -439,17 +441,17 @@ ObjectWrapperParent::CPOW_GetProperty(JS
     return (self->Manager()->RequestRunToCompletion() &&
             self->CallGetProperty(in_id,
                                   aco.StatusPtr(), &out_v) &&
             aco.Ok() &&
             self->jsval_from_JSVariant(cx, out_v, vp));
 }
 
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_SetProperty(JSContext *cx, JSObject *obj, jsval id,
+ObjectWrapperParent::CPOW_SetProperty(JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp)
 {
     CPOW_LOG(("Calling CPOW_SetProperty (%s)...",
               JSVAL_TO_CSTR(cx, id)));
 
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_SetProperty");
@@ -468,17 +470,17 @@ ObjectWrapperParent::CPOW_SetProperty(JS
     return (self->Manager()->RequestRunToCompletion() &&
             self->CallSetProperty(in_id, in_v,
                                   aco.StatusPtr(), &out_v) &&
             aco.Ok() &&
             self->jsval_from_JSVariant(cx, out_v, vp));
 }    
     
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_DelProperty(JSContext *cx, JSObject *obj, jsval id,
+ObjectWrapperParent::CPOW_DelProperty(JSContext *cx, JSObject *obj, jsid id,
                                       jsval *vp)
 {
     CPOW_LOG(("Calling CPOW_DelProperty (%s)...",
               JSVAL_TO_CSTR(cx, id)));
 
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_DelProperty");
@@ -575,17 +577,17 @@ ObjectWrapperParent::CPOW_NewEnumerate(J
         return self->NewEnumerateDestroy(cx, *statep);
     }
 
     NS_NOTREACHED("Unknown enum_op value in CPOW_NewEnumerate");
     return JS_FALSE;
 }
 
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_NewResolve(JSContext *cx, JSObject *obj, jsval id,
+ObjectWrapperParent::CPOW_NewResolve(JSContext *cx, JSObject *obj, jsid id,
                                      uintN flags, JSObject **objp)
 {
     CPOW_LOG(("Calling CPOW_NewResolve (%s)...",
               JSVAL_TO_CSTR(cx, id)));
 
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_NewResolve");
@@ -601,21 +603,19 @@ ObjectWrapperParent::CPOW_NewResolve(JSC
 
     if (!self->Manager()->RequestRunToCompletion() ||
         !self->CallNewResolve(in_id, flags,
                               aco.StatusPtr(), &out_pobj) ||
         !aco.Ok() ||
         !JSObject_from_PObjectWrapperParent(cx, out_pobj, objp))
         return JS_FALSE;
 
-    jsid interned_id;
-    if (*objp &&
-        JS_ValueToId(cx, id, &interned_id)) {
+    if (*objp) {
         AutoResolveFlag arf(cx, *objp);
-        JS_DefinePropertyById(cx, *objp, interned_id, JSVAL_VOID, NULL, NULL,
+        JS_DefinePropertyById(cx, *objp, id, JSVAL_VOID, NULL, NULL,
                               JSPROP_ENUMERATE);
     }
     return JS_TRUE;
 }
 
 /*static*/ JSBool
 ObjectWrapperParent::CPOW_Convert(JSContext *cx, JSObject *obj, JSType type,
                                   jsval *vp)
@@ -703,55 +703,55 @@ ObjectWrapperParent::CPOW_Construct(JSCo
     return (constructor->Manager()->RequestRunToCompletion() &&
             constructor->CallConstruct(in_argv,
                                        aco.StatusPtr(), &out_powp) &&
             aco.Ok() &&
             jsval_from_PObjectWrapperParent(cx, out_powp, rval));
 }
 
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_HasInstance(JSContext *cx, JSObject *obj, jsval v,
+ObjectWrapperParent::CPOW_HasInstance(JSContext *cx, JSObject *obj, const jsval *v,
                                       JSBool *bp)
 {
     CPOW_LOG(("Calling CPOW_HasInstance..."));
 
     *bp = JS_FALSE;
 
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_HasInstance");
 
     AutoCheckOperation aco(cx, self);
 
     JSVariant in_v;
 
-    if (!jsval_to_JSVariant(cx, v, &in_v))
+    if (!jsval_to_JSVariant(cx, *v, &in_v))
         return JS_FALSE;
 
     return (self->Manager()->RequestRunToCompletion() &&
             self->CallHasInstance(in_v,
                                   aco.StatusPtr(), bp) &&
             aco.Ok());
 }
 
 /*static*/ JSBool
-ObjectWrapperParent::CPOW_Equality(JSContext *cx, JSObject *obj, jsval v,
+ObjectWrapperParent::CPOW_Equality(JSContext *cx, JSObject *obj, const jsval *v,
                                    JSBool *bp)
 {
     CPOW_LOG(("Calling CPOW_Equality..."));
 
     *bp = JS_FALSE;
     
     ObjectWrapperParent* self = Unwrap(cx, obj);
     if (!self)
         return with_error(cx, JS_FALSE, "Unwrapping failed in CPOW_Equality");
 
-    if (JSVAL_IS_PRIMITIVE(v))
+    if (JSVAL_IS_PRIMITIVE(*v))
         return JS_TRUE;
 
-    ObjectWrapperParent* other = Unwrap(cx, JSVAL_TO_OBJECT(v));
+    ObjectWrapperParent* other = Unwrap(cx, JSVAL_TO_OBJECT(*v));
     if (!other)
         return JS_TRUE;
 
     *bp = (self == other);
     
     return JS_TRUE;
 }
--- a/js/ipc/ObjectWrapperParent.h
+++ b/js/ipc/ObjectWrapperParent.h
@@ -83,36 +83,36 @@ protected:
 
     ContextWrapperParent* Manager();
 
 private:
 
     mutable JSObject* mObj;
 
     static JSBool
-    CPOW_AddProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
+    CPOW_AddProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
     static JSBool
-    CPOW_DelProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
+    CPOW_DelProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
     static JSBool
-    CPOW_GetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
+    CPOW_GetProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
     
     static JSBool
-    CPOW_SetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
+    CPOW_SetProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
     JSBool NewEnumerateInit(JSContext* cx, jsval* statep, jsid* idp);
     JSBool NewEnumerateNext(JSContext* cx, jsval* statep, jsid* idp);
     JSBool NewEnumerateDestroy(JSContext* cx, jsval state);
     static JSBool
     CPOW_NewEnumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
                       jsval *statep, jsid *idp);
 
     static JSBool
-    CPOW_NewResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
+    CPOW_NewResolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
                     JSObject **objp);
 
     static JSBool
     CPOW_Convert(JSContext *cx, JSObject *obj, JSType type, jsval *vp);
 
     static void
     CPOW_Finalize(JSContext* cx, JSObject* obj);
 
@@ -120,20 +120,20 @@ private:
     CPOW_Call(JSContext* cx, JSObject* obj, uintN argc, jsval* argv,
               jsval* rval);
 
     static JSBool
     CPOW_Construct(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
                    jsval *rval);
     
     static JSBool
-    CPOW_HasInstance(JSContext *cx, JSObject *obj, jsval v, JSBool *bp);
+    CPOW_HasInstance(JSContext *cx, JSObject *obj, const jsval *v, JSBool *bp);
 
     static JSBool
-    CPOW_Equality(JSContext *cx, JSObject *obj, jsval v, JSBool *bp);
+    CPOW_Equality(JSContext *cx, JSObject *obj, const jsval *v, JSBool *bp);
 
     static bool jsval_to_JSVariant(JSContext* cx, jsval from, JSVariant* to);
     static bool jsval_from_JSVariant(JSContext* cx, const JSVariant& from,
                                      jsval* to);
     static bool
     JSObject_to_PObjectWrapperParent(JSContext* cx, JSObject* from,
                                      PObjectWrapperParent** to);
     static bool
--- a/js/jetpack/Handle.h
+++ b/js/jetpack/Handle.h
@@ -155,32 +155,32 @@ private:
 
   // Used to cache the JSObject returned by ToJSObject, which is
   // otherwise a const method.
   mutable JSObject*  mObj;
   mutable JSRuntime* mRuntime;
 
   static Handle*
   Unwrap(JSContext* cx, JSObject* obj) {
-    while (obj && obj->getClass() != &sHandle_JSClass)
+    while (obj && obj->getJSClass() != &sHandle_JSClass)
       obj = obj->getProto();
 
     if (!obj)
       return NULL;
 
     Handle* self = static_cast<Handle*>(JS_GetPrivate(cx, obj));
 
     NS_ASSERTION(!self || self->ToJSObject(cx) == obj,
                  "Wrapper and wrapped object disagree?");
 
     return self;
   }
 
   static JSBool
-  GetParent(JSContext* cx, JSObject* obj, jsval, jsval* vp) {
+  GetParent(JSContext* cx, JSObject* obj, jsid, jsval* vp) {
     JS_SET_RVAL(cx, vp, JSVAL_NULL);
 
     Handle* self = Unwrap(cx, obj);
     if (!self)
       return JS_TRUE;
 
     Handle* parent = self->mParent;
     if (!parent)
@@ -188,17 +188,17 @@ private:
 
     JSObject* pobj = parent->ToJSObject(cx);
     JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(pobj));
 
     return JS_TRUE;
   }
 
   static JSBool
-  GetIsValid(JSContext* cx, JSObject* obj, jsval, jsval* vp) {
+  GetIsValid(JSContext* cx, JSObject* obj, jsid, jsval* vp) {
     Handle* self = Unwrap(cx, obj);
     JS_SET_RVAL(cx, vp, BOOLEAN_TO_JSVAL(!!self));
     return JS_TRUE;
   }
 
   static JSBool
   Invalidate(JSContext* cx, uintN argc, jsval* vp) {
     if (argc > 0) {
--- a/js/jetpack/JetpackActorCommon.cpp
+++ b/js/jetpack/JetpackActorCommon.cpp
@@ -141,17 +141,17 @@ JetpackActorCommon::jsval_to_PrimVariant
     *to = nsDependentString((PRUnichar*)JS_GetStringChars(JSVAL_TO_STRING(from)),
                             JS_GetStringLength(JSVAL_TO_STRING(from)));
     return true;
 
   case JSTYPE_NUMBER:
     if (JSVAL_IS_INT(from))
       *to = JSVAL_TO_INT(from);
     else if (JSVAL_IS_DOUBLE(from))
-      *to = *JSVAL_TO_DOUBLE(from);
+      *to = JSVAL_TO_DOUBLE(from);
     else
       return false;
     return true;
 
   case JSTYPE_BOOLEAN:
     *to = !!JSVAL_TO_BOOLEAN(from);
     return true;
 
@@ -273,17 +273,17 @@ JetpackActorCommon::jsval_from_PrimVaria
     *to = from.get_bool() ? JSVAL_TRUE : JSVAL_FALSE;
     return true;
 
   case PrimVariant::Tint:
     *to = INT_TO_JSVAL(from.get_int());
     return true;
 
   case PrimVariant::Tdouble:
-    return !!JS_NewDoubleValue(cx, from.get_double(), to);
+    return !!JS_NewNumberValue(cx, from.get_double(), to);
 
   case PrimVariant::TnsString: {
     const nsString& str = from.get_nsString();
     // TODO Use some sort of sharedstring/stringbuffer abstraction to
     // exploit sharing opportunities more generally.
     if (!str.Length()) {
       *to = JS_GetEmptyStringValue(cx);
       return true;
@@ -344,21 +344,21 @@ JetpackActorCommon::jsval_from_CompVaria
     OpaqueSeenType::IdType ignored;
     if (!seen->add(obj, &ignored))
       return false;
 
     const nsTArray<KeyValue>& kvs = from.get_ArrayOfKeyValue();
     for (PRUint32 i = 0; i < kvs.Length(); ++i) {
       const KeyValue& kv = kvs.ElementAt(i);
       js::AutoValueRooter toSet(cx);
-      if (!jsval_from_Variant(cx, kv.value(), toSet.addr(), seen) ||
+      if (!jsval_from_Variant(cx, kv.value(), toSet.jsval_addr(), seen) ||
           !JS_SetUCProperty(cx, obj,
                             kv.key().get(),
                             kv.key().Length(),
-                            toSet.addr()))
+                            toSet.jsval_addr()))
         return false;
     }
 
     break;
   }
 
   case CompVariant::TArrayOfVariant: {
     const nsTArray<Variant>& vs = from.get_ArrayOfVariant();
@@ -451,21 +451,21 @@ JetpackActorCommon::RecvMessage(JSContex
 
   JSObject* implGlobal = JS_GetGlobalObject(cx);
   js::AutoValueRooter rval(cx);
 
   for (PRUint32 i = 0; i < snapshot.Length(); ++i) {
     Variant* vp = results ? results->AppendElement() : NULL;
     rval.set(JSVAL_VOID);
     if (!JS_CallFunctionValue(cx, implGlobal, snapshot[i], argc, argv,
-                              rval.addr())) {
+                              rval.jsval_addr())) {
       (void) JS_ReportPendingException(cx);
       if (vp)
         *vp = void_t();
-    } else if (vp && !jsval_to_Variant(cx, rval.value(), vp))
+    } else if (vp && !jsval_to_Variant(cx, rval.jsval_value(), vp))
       *vp = void_t();
   }
 
   return true;
 }
 
 JetpackActorCommon::RecList::~RecList()
 {
--- a/js/jetpack/JetpackChild.cpp
+++ b/js/jetpack/JetpackChild.cpp
@@ -153,17 +153,17 @@ JetpackChild::RecvSendMessage(const nsSt
 
 bool
 JetpackChild::RecvEvalScript(const nsString& code)
 {
   JSAutoRequest request(mCx);
 
   js::AutoValueRooter ignored(mCx);
   (void) JS_EvaluateUCScript(mCx, JS_GetGlobalObject(mCx), code.get(),
-                             code.Length(), "", 1, ignored.addr());
+                             code.Length(), "", 1, ignored.jsval_addr());
   return true;
 }
 
 PHandleChild*
 JetpackChild::AllocPHandle()
 {
   return new HandleChild();
 }
@@ -437,13 +437,13 @@ JetpackChild::EvalInSandbox(JSContext* c
   }
 
   JSString* str = JS_ValueToString(cx, argv[1]);
   if (!str)
     return JS_FALSE;
 
   js::AutoValueRooter ignored(cx);
   return JS_EvaluateUCScript(cx, obj, JS_GetStringChars(str), JS_GetStringLength(str), "", 1,
-                             ignored.addr());
+                             ignored.jsval_addr());
 }
 
 } // namespace jetpack
 } // namespace mozilla
--- a/js/jetpack/JetpackParent.cpp
+++ b/js/jetpack/JetpackParent.cpp
@@ -98,26 +98,26 @@ JetpackParent::SendMessage(const nsAStri
   if (!SendSendMessage(nsString(aMessageName), data))
     return NS_ERROR_FAILURE;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 JetpackParent::RegisterReceiver(const nsAString& aMessageName,
-                                jsval aReceiver)
+                                const jsval &aReceiver)
 {
   return JetpackActorCommon::RegisterReceiver(mContext,
                                               nsString(aMessageName),
                                               aReceiver);
 }
 
 NS_IMETHODIMP
 JetpackParent::UnregisterReceiver(const nsAString& aMessageName,
-                                  jsval aReceiver)
+                                  const jsval &aReceiver)
 {
   JetpackActorCommon::UnregisterReceiver(nsString(aMessageName),
                                          aReceiver);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 JetpackParent::UnregisterReceivers(const nsAString& aMessageName)
--- a/js/jsd/jsd.h
+++ b/js/jsd/jsd.h
@@ -961,17 +961,17 @@ jsd_IsValueNative(JSDContext* jsdc, JSDV
 /**************************************************/
 
 extern JSBool
 jsd_GetValueBoolean(JSDContext* jsdc, JSDValue* jsdval);
 
 extern int32
 jsd_GetValueInt(JSDContext* jsdc, JSDValue* jsdval);
 
-extern jsdouble*
+extern jsdouble
 jsd_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval);
 
 extern JSString*
 jsd_GetValueString(JSDContext* jsdc, JSDValue* jsdval);
 
 extern const char*
 jsd_GetValueFunctionName(JSDContext* jsdc, JSDValue* jsdval);
 
--- a/js/jsd/jsd_val.c
+++ b/js/jsd/jsd_val.c
@@ -198,23 +198,22 @@ int32
 jsd_GetValueInt(JSDContext* jsdc, JSDValue* jsdval)
 {
     jsval val = jsdval->val;
     if(!JSVAL_IS_INT(val))
         return 0;
     return JSVAL_TO_INT(val);
 }
 
-jsdouble*
+jsdouble
 jsd_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval)
 {
-    jsval val = jsdval->val;
-    if(!JSVAL_IS_DOUBLE(val))
+    if(!JSVAL_IS_DOUBLE(jsdval->val))
         return 0;
-    return JSVAL_TO_DOUBLE(val);
+    return JSVAL_TO_DOUBLE(jsdval->val);
 }
 
 JSString*
 jsd_GetValueString(JSDContext* jsdc, JSDValue* jsdval)
 {
     JSContext* cx = jsdc->dumbContext;
     JSExceptionState* exceptionState;
 
@@ -487,17 +486,18 @@ jsd_GetValueProperty(JSDContext* jsdc, J
     JSDProperty* jsdprop;
     JSDProperty* iter = NULL;
     JSObject* obj;
     uintN  attrs = 0;
     JSBool found;
     JSPropertyDesc pd;
     const jschar * nameChars;
     size_t nameLen;
-    jsval val;
+    jsval val, nameval;
+    jsid nameid;
 
     if(!jsd_IsValueObject(jsdc, jsdval))
         return NULL;
 
     /* If we already have the prop, then return it */
     while(NULL != (jsdprop = jsd_IterateProperties(jsdc, jsdval, &iter)))
     {
         JSString* propName = jsd_GetValueString(jsdc, jsdprop->name);
@@ -543,18 +543,24 @@ jsd_GetValueProperty(JSDContext* jsdc, J
     }
     else
     {
         pd.value = val;
     }
 
     JS_EndRequest(cx);
 
-    pd.id = STRING_TO_JSVAL(name);
-    pd.alias = pd.slot = pd.spare = 0;
+    nameval = STRING_TO_JSVAL(name);
+    if (!JS_ValueToId(cx, nameval, &nameid) ||
+        !JS_IdToValue(cx, nameid, &pd.id)) {
+        return NULL;
+    }
+
+    pd.slot = pd.spare = 0;
+    pd.alias = JSVAL_NULL;
     pd.flags |= (attrs & JSPROP_ENUMERATE) ? JSPD_ENUMERATE : 0
         | (attrs & JSPROP_READONLY)  ? JSPD_READONLY  : 0
         | (attrs & JSPROP_PERMANENT) ? JSPD_PERMANENT : 0;
 
     return _newProperty(jsdc, &pd, JSDPD_HINTED);
 }
 
 
--- a/js/jsd/jsd_xpc.cpp
+++ b/js/jsd/jsd_xpc.cpp
@@ -33,18 +33,16 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "jsdbgapi.h"
-#include "jscntxt.h"
-#include "jsfun.h"
 #include "jsd_xpc.h"
 
 #include "nsIXPConnect.h"
 #include "mozilla/ModuleUtils.h"
 #include "nsIServiceManager.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
@@ -1009,26 +1007,27 @@ jsdScript::CreatePPLineMap()
     JSAutoRequest ar(cx);
     JSObject   *obj = JS_NewObject(cx, NULL, NULL, NULL);
     JSFunction *fun = JSD_GetJSFunction (mCx, mScript);
     JSScript   *script;
     PRUint32    baseLine;
     PRBool      scriptOwner = PR_FALSE;
     
     if (fun) {
-        if (fun->nargs > 12)
+        uintN nargs = JS_GetFunctionArgumentCount(cx, fun);
+        if (nargs > 12)
             return nsnull;
         JSString *jsstr = JS_DecompileFunctionBody (cx, fun, 4);
         if (!jsstr)
             return nsnull;
     
         const char *argnames[] = {"arg1", "arg2", "arg3", "arg4", 
                                   "arg5", "arg6", "arg7", "arg8",
                                   "arg9", "arg10", "arg11", "arg12" };
-        fun = JS_CompileUCFunction (cx, obj, "ppfun", fun->nargs, argnames,
+        fun = JS_CompileUCFunction (cx, obj, "ppfun", nargs, argnames,
                                     JS_GetStringChars(jsstr),
                                     JS_GetStringLength(jsstr),
                                     "x-jsd:ppbuffer?type=function", 3);
         if (!fun || !(script = JS_GetFunctionScript(cx, fun)))
             return nsnull;
         baseLine = 3;
     } else {
         JSString *jsstr = JS_DecompileScript (cx, JSD_GetJSScript(mCx, mScript),
@@ -1227,60 +1226,55 @@ jsdScript::GetParameterNames(PRUint32* c
     if (!cx) {
         NS_WARNING("No default context !?");
         return NS_ERROR_FAILURE;
     }
     JSFunction *fun = JSD_GetJSFunction (mCx, mScript);
 
     JSAutoRequest ar(cx);
 
-    if (!fun || !fun->hasLocalNames() || fun->nargs == 0) {
+    uintN nargs = JS_GetFunctionArgumentCount(cx, fun);
+    if (!fun || !JS_FunctionHasLocalNames(cx, fun) || nargs == 0) {
         *count = 0;
         *paramNames = nsnull;
         return NS_OK;
     }
 
     PRUnichar **ret =
-        static_cast<PRUnichar**>(NS_Alloc(fun->nargs * sizeof(PRUnichar*)));
+        static_cast<PRUnichar**>(NS_Alloc(nargs * sizeof(PRUnichar*)));
     if (!ret)
         return NS_ERROR_OUT_OF_MEMORY;
 
-    void *mark = JS_ARENA_MARK(&cx->tempPool);
-    jsuword *names = js_GetLocalNameArray(cx, fun, &cx->tempPool);
+    void *mark;
+    jsuword *names = JS_GetFunctionLocalNameArray(cx, fun, &mark);
     if (!names) {
         NS_Free(ret);
         return NS_ERROR_OUT_OF_MEMORY;
     }
 
     nsresult rv = NS_OK;
-    for (uintN i = 0; i < fun->nargs; ++i) {
-        JSAtom *atom = JS_LOCAL_NAME_TO_ATOM(names[i]);
+    for (uintN i = 0; i < nargs; ++i) {
+        JSAtom *atom = JS_LocalNameToAtom(names[i]);
         if (!atom) {
             ret[i] = 0;
         } else {
-            jsval atomVal = ATOM_KEY(atom);
-            if (!JSVAL_IS_STRING(atomVal)) {
-                NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(i, ret);
-                rv = NS_ERROR_UNEXPECTED;
-                break;
-            }
-            JSString *str = JSVAL_TO_STRING(atomVal);
+            JSString *str = JS_AtomKey(atom);
             ret[i] = NS_strndup(reinterpret_cast<PRUnichar*>(JS_GetStringChars(str)),
                                 JS_GetStringLength(str));
             if (!ret[i]) {
                 NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(i, ret);
                 rv = NS_ERROR_OUT_OF_MEMORY;
                 break;
             }
         }
     }
-    JS_ARENA_RELEASE(&cx->tempPool, mark);
+    JS_ReleaseFunctionLocalNameArray(cx, mark);
     if (NS_FAILED(rv))
         return rv;
-    *count = fun->nargs;
+    *count = nargs;
     *paramNames = ret;
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdScript::GetFunctionObject(jsdIValue **_rval)
 {
     JSFunction *fun = JSD_GetJSFunction(mCx, mScript);
@@ -1479,18 +1473,17 @@ jsdScript::IsLineExecutable(PRUint32 aLi
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdScript::SetBreakpoint(PRUint32 aPC)
 {
     ASSERT_VALID_EPHEMERAL;
     jsuword pc = mFirstPC + aPC;
-    JSD_SetExecutionHook (mCx, mScript, pc, jsds_ExecutionHookProc,
-                          reinterpret_cast<void *>(PRIVATE_TO_JSVAL(NULL)));
+    JSD_SetExecutionHook (mCx, mScript, pc, jsds_ExecutionHookProc, NULL);
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdScript::ClearBreakpoint(PRUint32 aPC)
 {
     ASSERT_VALID_EPHEMERAL;    
     jsuword pc = mFirstPC + aPC;
@@ -1985,17 +1978,17 @@ jsdStackFrame::Eval (const nsAString &by
                                               mStackFrameInfo,
                                               char_bytes, bytes.Length(),
                                               PromiseFlatCString(fileName).get(),
                                               line, &jv);
     if (!*_rval) {
         if (JS_IsExceptionPending(cx))
             JS_GetPendingException (cx, &jv);
         else
-            jv = 0;
+            jv = JSVAL_NULL;
     }
 
     JS_RestoreExceptionState (cx, estate);
 
 #ifdef DEBUG
     JSContext* poppedCX;
     rv = stack->Pop(&poppedCX);
     NS_ASSERTION(NS_SUCCEEDED(rv) && poppedCX == cx, "bad pop");
@@ -2190,20 +2183,17 @@ jsdValue::GetBooleanValue(PRBool *_rval)
     *_rval = JSD_GetValueBoolean (mCx, mValue);
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdValue::GetDoubleValue(double *_rval)
 {
     ASSERT_VALID_EPHEMERAL;
-    double *dp = JSD_GetValueDouble (mCx, mValue);
-    if (!dp)
-        return NS_ERROR_FAILURE;
-    *_rval = *dp;
+    *_rval = JSD_GetValueDouble (mCx, mValue);
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdValue::GetIntValue(PRInt32 *_rval)
 {
     ASSERT_VALID_EPHEMERAL;
     *_rval = JSD_GetValueInt (mCx, mValue);
@@ -2902,17 +2892,17 @@ jsdService::WrapValue(jsdIValue **_rval)
     rv = cc->GetArgvPtr (&argv);
     if (NS_FAILED(rv))
         return rv;
 
     return WrapJSValue(argv[0], _rval);
 }
 
 NS_IMETHODIMP
-jsdService::WrapJSValue(jsval value, jsdIValue** _rval)
+jsdService::WrapJSValue(const jsval &value, jsdIValue** _rval)
 {
     JSDValue *jsdv = JSD_NewValue(mCx, value);
     if (!jsdv)
         return NS_ERROR_FAILURE;
     
     *_rval = jsdValue::FromPtr (mCx, jsdv);
     return NS_OK;
 }
--- a/js/jsd/jsdebug.c
+++ b/js/jsd/jsdebug.c
@@ -1107,17 +1107,17 @@ JSD_GetValueBoolean(JSDContext* jsdc, JS
 JSD_PUBLIC_API(int32)
 JSD_GetValueInt(JSDContext* jsdc, JSDValue* jsdval)
 {
     JSD_ASSERT_VALID_CONTEXT(jsdc);
     JSD_ASSERT_VALID_VALUE(jsdval);
     return jsd_GetValueInt(jsdc, jsdval);
 }
 
-JSD_PUBLIC_API(jsdouble*)
+JSD_PUBLIC_API(jsdouble)
 JSD_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval)
 {
     JSD_ASSERT_VALID_CONTEXT(jsdc);
     JSD_ASSERT_VALID_VALUE(jsdval);
     return jsd_GetValueDouble(jsdc, jsdval);
 }
 
 JSD_PUBLIC_API(JSString*)
--- a/js/jsd/jsdebug.h
+++ b/js/jsd/jsdebug.h
@@ -49,23 +49,21 @@
 extern "C"
 {
 #endif
 #include "jstypes.h"
 #ifdef __cplusplus
 }
 #endif
 
-JS_BEGIN_EXTERN_C
 #include "jsapi.h"
 #include "jsdbgapi.h"
 #ifdef LIVEWIRE
 #include "lwdbgapi.h"
 #endif
-JS_END_EXTERN_C
 
 JS_BEGIN_EXTERN_C
 
 /*
  * The linkage of JSD API functions differs depending on whether the file is
  * used within the JSD library or not.  Any source file within the JSD
  * libraray should define EXPORT_JSD_API whereas any client of the library
  * should not.
@@ -1265,17 +1263,17 @@ JSD_GetValueBoolean(JSDContext* jsdc, JS
 */
 extern JSD_PUBLIC_API(int32)
 JSD_GetValueInt(JSDContext* jsdc, JSDValue* jsdval);
 
 /*
 * Return double value (does NOT do conversion).
 * *** new for version 1.1 ****
 */
-extern JSD_PUBLIC_API(jsdouble*)
+extern JSD_PUBLIC_API(jsdouble)
 JSD_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval);
 
 /*
 * Return JSString value (DOES do conversion if necessary).
 * NOTE that the JSString returned is not protected from garbage
 * collection. It should be immediately read or wrapped using
 * JSD_NewValue(jsdc,STRING_TO_JSVAL(str)) if necessary.
 * *** new for version 1.1 ****
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -221,29 +221,32 @@ INSTALLED_HEADERS = \
 		jsprvtd.h \
 		jspubtd.h \
 		jsregexp.h \
 		jsscan.h \
 		jsscope.h \
 		jsscript.h \
 		jsscriptinlines.h \
 		jsstaticcheck.h \
+		jsstdint.h \
 		jsstr.h \
 		jstask.h \
 		jstracer.h \
 		jstypedarray.h \
 		jstypes.h \
 		jsutil.h \
 		jsvector.h \
 		jstl.h \
 		jshashtable.h \
 		jsversion.h \
 		jswrapper.h \
 		jsxdrapi.h \
 		jsxml.h \
+		jsval.h \
+		jsvalue.h \
 		prmjtime.h \
 		$(NULL)
 
 ifdef ENABLE_TRACEJIT
 VPATH		+= $(srcdir)/nanojit
 
 INSTALLED_HEADERS += \
 		jsbuiltins.h    \
deleted file mode 100644
--- a/js/src/builtins.tbl
+++ /dev/null
@@ -1,91 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set ts=8 sw=4 et tw=0 ft=C:
- *
- * ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla SpiderMonkey JavaScript 1.9 code, released
- * June 22, 2008.
- *
- * The Initial Developer of the Original Code is
- *   Andreas Gal <gal@uci.edu>
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/**
- * This file declares builtin functions that can be called from JITted code.
- * Each line starts with "BUILTIN" and an integer, the number of arguments the
- * builtin takes.  Builtins with no arguments are not supported.
- *
- * The macro arguments are:
- *
- * - 'extern' to indicate extern linkage for these functions and the associated
- *   CallInfo.
- *
- * - The return type. This identifier must name one of the _JS_TYPEINFO_*
- *   macros defined in jsbuiltins.h.
- *
- * - The builtin name. Prefixed with "js_" this gives the native function name.
- *
- * - The parameter types.
- *
- * - The cse flag. 1 if the builtin call can be optimized away by common
- *   subexpression elimination; otherwise 0. This should be 1 only if the
- *   function is idempotent and the return value is determined solely by the
- *   arguments.
- *
- * - The fold flag. Reserved. The same as cse for now.
- */
-
-/*
- * NB: bool FASTCALL is not compatible with Nanojit's calling convention usage.
- * Do not use bool FASTCALL, use JSBool only!
- */
-
-BUILTIN2(extern, JSVAL,     js_BoxDouble, CONTEXT, DOUBLE,                      1, 1)
-BUILTIN2(extern, JSVAL,     js_BoxInt32, CONTEXT, INT32,                        1, 1)
-BUILTIN1(extern, DOUBLE,    js_UnboxDouble, JSVAL,                              1, 1)
-BUILTIN1(extern, INT32,     js_UnboxInt32, JSVAL,                               1, 1)
-BUILTIN2(extern, DOUBLE,    js_dmod, DOUBLE, DOUBLE,                            1, 1)
-BUILTIN2(extern, INT32,     js_imod, INT32, INT32,                              1, 1)
-BUILTIN1(extern, INT32,     js_DoubleToInt32, DOUBLE,                           1, 1)
-BUILTIN1(extern, UINT32,    js_DoubleToUint32, DOUBLE,                          1, 1)
-
-BUILTIN2(extern, DOUBLE,    js_StringToNumber, CONTEXT, STRING,                 1, 1)
-BUILTIN2(extern, INT32,     js_StringToInt32, CONTEXT, STRING,                  1, 1)
-BUILTIN2(FRIEND, BOOL,      js_CloseIterator, CONTEXT, JSVAL,                   0, 0)
-BUILTIN2(extern, SIDEEXIT,  js_CallTree, INTERPSTATE, FRAGMENT,                 0, 0)
-BUILTIN3(extern, BOOL,      js_AddProperty, CONTEXT, OBJECT, SCOPEPROP,         0, 0)
-BUILTIN3(extern, BOOL,      js_HasNamedProperty, CONTEXT, OBJECT, STRING,       0, 0)
-BUILTIN3(extern, BOOL,      js_HasNamedPropertyInt32, CONTEXT, OBJECT, INT32,   0, 0)
-BUILTIN3(extern, JSVAL,     js_CallGetter, CONTEXT, OBJECT, SCOPEPROP,          0, 0)
-BUILTIN2(extern, STRING,    js_TypeOfObject, CONTEXT, OBJECT,                   1, 1)
-BUILTIN2(extern, STRING,    js_TypeOfBoolean, CONTEXT, INT32,                   1, 1)
-BUILTIN2(extern, DOUBLE,    js_BooleanOrUndefinedToNumber, CONTEXT, INT32,      1, 1)
-BUILTIN2(extern, STRING,    js_BooleanOrUndefinedToString, CONTEXT, INT32,      1, 1)
-BUILTIN2(extern, OBJECT,    js_Arguments, CONTEXT, OBJECT                       0, 0)
-BUILTIN4(extern, OBJECT,    js_NewNullClosure, CONTEXT, OBJECT, OBJECT, OBJECT, 0, 0)
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -514,17 +514,18 @@ case "$target" in
     if test "$GCC" != "yes"; then
         # Check to see if we are really running in a msvc environemnt
         _WIN32_MSVC=1
 
         # Make sure compilers are valid
         CFLAGS="$CFLAGS -TC -nologo"
         CXXFLAGS="$CXXFLAGS -TP -nologo"
         # MSVC warning C4345 warns of newly conformant behavior as of VS2003.
-        CXXFLAGS="$CXXFLAGS -wd4345"
+        # MSVC warning C4800 is ubiquitous, useless, and annoying.
+        CXXFLAGS="$CXXFLAGS -wd4345 -wd4800"
         AC_LANG_SAVE
         AC_LANG_C
         AC_TRY_COMPILE([#include <stdio.h>],
             [ printf("Hello World\n"); ],,
             AC_MSG_ERROR([\$(CC) test failed.  You must have MS VC++ in your path to build.]) )
 
         AC_LANG_CPLUSPLUS
         AC_TRY_COMPILE([#include <new.h>],
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -84,104 +84,104 @@ namespace CType {
     jsval* argv, jsval* rval);
   static JSBool ConstructBasic(JSContext* cx, JSObject* obj, uintN argc,
     jsval* argv, jsval* rval);
 
   static void Trace(JSTracer* trc, JSObject* obj);
   static void Finalize(JSContext* cx, JSObject* obj);
   static void FinalizeProtoClass(JSContext* cx, JSObject* obj);
 
-  static JSBool PrototypeGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool PrototypeGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool NameGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool NameGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool SizeGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool SizeGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool PtrGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp);
+  static JSBool PtrGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp);
   static JSBool CreateArray(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ToString(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ToSource(JSContext* cx, uintN argc, jsval* vp);
-  static JSBool HasInstance(JSContext* cx, JSObject* obj, jsval v, JSBool* bp);
+  static JSBool HasInstance(JSContext* cx, JSObject* obj, const jsval *v, JSBool* bp);
 }
 
 namespace PointerType {
   static JSBool Create(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ConstructData(JSContext* cx, JSObject* obj, uintN argc,
     jsval* argv, jsval* rval);
 
-  static JSBool TargetTypeGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool TargetTypeGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool ContentsGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ContentsGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool ContentsSetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ContentsSetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
   static JSBool IsNull(JSContext* cx, uintN argc, jsval* vp);
 }
 
 namespace ArrayType {
   static JSBool Create(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ConstructData(JSContext* cx, JSObject* obj, uintN argc,
     jsval* argv, jsval* rval);
 
-  static JSBool ElementTypeGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ElementTypeGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool LengthGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool LengthGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool Getter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp);
-  static JSBool Setter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp);
+  static JSBool Getter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp);
+  static JSBool Setter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp);
   static JSBool AddressOfElement(JSContext* cx, uintN argc, jsval* vp);
 }
 
 namespace StructType {
   static JSBool Create(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ConstructData(JSContext* cx, JSObject* obj, uintN argc,
     jsval* argv, jsval* rval);
 
-  static JSBool FieldsArrayGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool FieldsArrayGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool FieldGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool FieldGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool FieldSetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool FieldSetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
   static JSBool AddressOfField(JSContext* cx, uintN argc, jsval* vp);
   static JSBool Define(JSContext* cx, uintN argc, jsval* vp);
 }
 
 namespace FunctionType {
   static JSBool Create(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ConstructData(JSContext* cx, JSObject* typeObj,
     JSObject* dataObj, JSObject* fnObj, JSObject* thisObj);
 
   static JSBool Call(JSContext* cx, JSObject* obj, uintN argc, jsval* argv,
     jsval* rval);
 
-  static JSBool ArgTypesGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ArgTypesGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool ReturnTypeGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ReturnTypeGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool ABIGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp);
-  static JSBool IsVariadicGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ABIGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp);
+  static JSBool IsVariadicGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
 }
 
 namespace CClosure {
   static void Trace(JSTracer* trc, JSObject* obj);
   static void Finalize(JSContext* cx, JSObject* obj);
 
   // libffi callback
   static void ClosureStub(ffi_cif* cif, void* result, void** args,
     void* userData);
 }
 
 namespace CData {
   static void Finalize(JSContext* cx, JSObject* obj);
 
-  static JSBool ValueGetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ValueGetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
-  static JSBool ValueSetter(JSContext* cx, JSObject* obj, jsval idval,
+  static JSBool ValueSetter(JSContext* cx, JSObject* obj, jsid idval,
     jsval* vp);
   static JSBool Address(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ReadString(JSContext* cx, uintN argc, jsval* vp);
   static JSBool ToSource(JSContext* cx, uintN argc, jsval* vp);
 }
 
 // Int64Base provides functions common to Int64 and UInt64.
 namespace Int64Base {
@@ -509,17 +509,17 @@ GetErrorMessage(void* userRef, const cha
     return &ErrorFormatString[errorNumber];
   return NULL;
 }
 
 JSBool
 TypeError(JSContext* cx, const char* expected, jsval actual)
 {
   JSString* str = JS_ValueToSource(cx, actual);
-  js::AutoValueRooter root(cx, str);
+  js::AutoStringRooter root(cx, str);
 
   const char* src;
   if (str) {
     src = JS_GetStringBytesZ(cx, str);
     if (!src)
       return false;
   } else {
     JS_ClearPendingException(cx);
@@ -677,17 +677,17 @@ InitTypeConstructor(JSContext* cx,
 
   // Create an object to serve as the common ancestor for all CData objects
   // created from the given type constructor. This has ctypes.CData.prototype
   // as its prototype, such that it inherits the properties and functions
   // common to all CDatas.
   dataProto = JS_NewObject(cx, &sCDataProtoClass, CDataProto, parent);
   if (!dataProto)
     return false;
-  js::AutoValueRooter protoroot(cx, dataProto);
+  js::AutoObjectRooter protoroot(cx, dataProto);
 
   // Define functions and properties on the 'dataProto' object that are common
   // to all CData objects created from this type constructor. (These will
   // become functions and properties on CData objects created from this type.)
   if (instanceFns && !JS_DefineFunctions(cx, dataProto, instanceFns))
     return false;
 
   if (instanceProps && !JS_DefineProperties(cx, dataProto, instanceProps))
@@ -811,37 +811,37 @@ InitTypeClasses(JSContext* cx, JSObject*
   //     * __proto__ === 'p', the prototype object from above
   //     * 'constructor' property === 't'
   JSObject* protos[CTYPEPROTO_SLOTS];
   if (!InitTypeConstructor(cx, parent, CTypeProto, CDataProto,
          sPointerFunction, NULL, sPointerProps,
          sPointerInstanceFunctions, sPointerInstanceProps,
          protos[SLOT_POINTERPROTO], protos[SLOT_POINTERDATAPROTO]))
     return false;
-  js::AutoValueRooter proot(cx, protos[SLOT_POINTERDATAPROTO]);
+  js::AutoObjectRooter proot(cx, protos[SLOT_POINTERDATAPROTO]);
 
   if (!InitTypeConstructor(cx, parent, CTypeProto, CDataProto,
          sArrayFunction, NULL, sArrayProps,
          sArrayInstanceFunctions, sArrayInstanceProps,
          protos[SLOT_ARRAYPROTO], protos[SLOT_ARRAYDATAPROTO]))
     return false;
-  js::AutoValueRooter aroot(cx, protos[SLOT_ARRAYDATAPROTO]);
+  js::AutoObjectRooter aroot(cx, protos[SLOT_ARRAYDATAPROTO]);
 
   if (!InitTypeConstructor(cx, parent, CTypeProto, CDataProto,
          sStructFunction, sStructFunctions, sStructProps,
          sStructInstanceFunctions, NULL,
          protos[SLOT_STRUCTPROTO], protos[SLOT_STRUCTDATAPROTO]))
     return false;
-  js::AutoValueRooter sroot(cx, protos[SLOT_STRUCTDATAPROTO]);
+  js::AutoObjectRooter sroot(cx, protos[SLOT_STRUCTDATAPROTO]);
 
   if (!InitTypeConstructor(cx, parent, CTypeProto, CDataProto,
          sFunctionFunction, NULL, sFunctionProps, NULL, NULL,
          protos[SLOT_FUNCTIONPROTO], protos[SLOT_FUNCTIONDATAPROTO]))
     return false;
-  js::AutoValueRooter froot(cx, protos[SLOT_FUNCTIONDATAPROTO]);
+  js::AutoObjectRooter froot(cx, protos[SLOT_FUNCTIONDATAPROTO]);
 
   protos[SLOT_CDATAPROTO] = CDataProto;
 
   // Create and attach the ctypes.{Int64,UInt64} constructors.
   // Each of these has, respectively:
   //   * [[Class]] "Function"
   //   * __proto__ === Function.prototype
   //   * A constructor that creates a ctypes.{Int64,UInt64} object, respectively.
@@ -1101,17 +1101,17 @@ jsvalToBool(JSContext* cx, jsval val, bo
     return true;
   }
   if (JSVAL_IS_INT(val)) {
     jsint i = JSVAL_TO_INT(val);
     *result = i != 0;
     return i == 0 || i == 1;
   }
   if (JSVAL_IS_DOUBLE(val)) {
-    jsdouble d = *JSVAL_TO_DOUBLE(val);
+    jsdouble d = JSVAL_TO_DOUBLE(val);
     *result = d != 0;
     // Allow -0.
     return d == 1 || d == 0;
   }
   // Don't silently convert null to bool. It's probably a mistake.
   return false;
 }
 
@@ -1128,17 +1128,17 @@ jsvalToInteger(JSContext* cx, jsval val,
     // Make sure the integer fits in the alotted precision, and has the right
     // sign.
     jsint i = JSVAL_TO_INT(val);
     return ConvertExact(i, result);
   }
   if (JSVAL_IS_DOUBLE(val)) {
     // Don't silently lose bits here -- check that val really is an
     // integer value, and has the right sign.
-    jsdouble d = *JSVAL_TO_DOUBLE(val);
+    jsdouble d = JSVAL_TO_DOUBLE(val);
     return ConvertExact(d, result);
   }
   if (!JSVAL_IS_PRIMITIVE(val)) {
     JSObject* obj = JSVAL_TO_OBJECT(val);
     if (CData::IsCData(cx, obj)) {
       JSObject* typeObj = CData::GetCType(cx, obj);
       void* data = CData::GetData(cx, obj);
 
@@ -1209,17 +1209,17 @@ jsvalToFloat(JSContext *cx, jsval val, F
   // no good way around it. Sternly requiring that the 64-bit double
   // argument be exactly representable as a 32-bit float is
   // unrealistic: it would allow 1/2 to pass but not 1/3.
   if (JSVAL_IS_INT(val)) {
     *result = FloatType(JSVAL_TO_INT(val));
     return true;
   }
   if (JSVAL_IS_DOUBLE(val)) {
-    *result = FloatType(*JSVAL_TO_DOUBLE(val));
+    *result = FloatType(JSVAL_TO_DOUBLE(val));
     return true;
   }
   if (!JSVAL_IS_PRIMITIVE(val)) {
     JSObject* obj = JSVAL_TO_OBJECT(val);
     if (CData::IsCData(cx, obj)) {
       JSObject* typeObj = CData::GetCType(cx, obj);
       void* data = CData::GetData(cx, obj);
 
@@ -1271,17 +1271,17 @@ jsvalToBigInteger(JSContext* cx,
     // Make sure the integer fits in the alotted precision, and has the right
     // sign.
     jsint i = JSVAL_TO_INT(val);
     return ConvertExact(i, result);
   }
   if (JSVAL_IS_DOUBLE(val)) {
     // Don't silently lose bits here -- check that val really is an
     // integer value, and has the right sign.
-    jsdouble d = *JSVAL_TO_DOUBLE(val);
+    jsdouble d = JSVAL_TO_DOUBLE(val);
     return ConvertExact(d, result);
   }
   if (allowString && JSVAL_IS_STRING(val)) {
     // Allow conversion from base-10 or base-16 strings, provided the result
     // fits in IntegerType. (This allows an Int64 or UInt64 object to be passed
     // to the JS array element operator, which will automatically call
     // toString() on the object for us.)
     return StringToInteger(cx, JSVAL_TO_STRING(val), result);
@@ -1312,16 +1312,72 @@ jsvalToSize(JSContext* cx, jsval val, bo
 {
   if (!jsvalToBigInteger(cx, val, allowString, result))
     return false;
 
   // Also check that the result fits in a jsdouble.
   return Convert<size_t>(jsdouble(*result)) == *result;
 }
 
+// Implicitly convert val to IntegerType, allowing jsint, jsdouble,
+// Int64, UInt64, and optionally a decimal or hexadecimal string argument.
+// (This is common code shared by jsvalToSize and the Int64/UInt64 constructors.)
+template<class IntegerType>
+static bool
+jsidToBigInteger(JSContext* cx,
+                  jsid val,
+                  bool allowString,
+                  IntegerType* result)
+{
+  JS_STATIC_ASSERT(numeric_limits<IntegerType>::is_exact);
+
+  if (JSID_IS_INT(val)) {
+    // Make sure the integer fits in the alotted precision, and has the right
+    // sign.
+    jsint i = JSID_TO_INT(val);
+    return ConvertExact(i, result);
+  }
+  if (allowString && JSID_IS_STRING(val)) {
+    // Allow conversion from base-10 or base-16 strings, provided the result
+    // fits in IntegerType. (This allows an Int64 or UInt64 object to be passed
+    // to the JS array element operator, which will automatically call
+    // toString() on the object for us.)
+    return StringToInteger(cx, JSID_TO_STRING(val), result);
+  }
+  if (JSID_IS_OBJECT(val)) {
+    // Allow conversion from an Int64 or UInt64 object directly.
+    JSObject* obj = JSID_TO_OBJECT(val);
+
+    if (UInt64::IsUInt64(cx, obj)) {
+      // Make sure the integer fits in IntegerType.
+      JSUint64 i = Int64Base::GetInt(cx, obj);
+      return ConvertExact(i, result);
+    }
+
+    if (Int64::IsInt64(cx, obj)) {
+      // Make sure the integer fits in IntegerType.
+      JSInt64 i = Int64Base::GetInt(cx, obj);
+      return ConvertExact(i, result);
+    }
+  }
+  return false;
+}
+
+// Implicitly convert val to a size value, where the size value is represented
+// by size_t but must also fit in a jsdouble.
+static bool
+jsidToSize(JSContext* cx, jsid val, bool allowString, size_t* result)
+{
+  if (!jsidToBigInteger(cx, val, allowString, result))
+    return false;
+
+  // Also check that the result fits in a jsdouble.
+  return Convert<size_t>(jsdouble(*result)) == *result;
+}
+
 // Implicitly convert a size value to a jsval, ensuring that the size_t value
 // fits in a jsdouble.
 static JSBool
 SizeTojsval(JSContext* cx, size_t size, jsval* result)
 {
   if (Convert<size_t>(jsdouble(size)) != size) {
     JS_ReportError(cx, "size overflow");
     return false;
@@ -1334,17 +1390,17 @@ SizeTojsval(JSContext* cx, size_t size, 
 template<class IntegerType>
 static bool
 jsvalToIntegerExplicit(JSContext* cx, jsval val, IntegerType* result)
 {
   JS_STATIC_ASSERT(numeric_limits<IntegerType>::is_exact);
 
   if (JSVAL_IS_DOUBLE(val)) {
     // Convert -Inf, Inf, and NaN to 0; otherwise, convert by C-style cast.
-    jsdouble d = *JSVAL_TO_DOUBLE(val);
+    jsdouble d = JSVAL_TO_DOUBLE(val);
     *result = FloatIsFinite(d) ? IntegerType(d) : 0;
     return true;
   }
   if (!JSVAL_IS_PRIMITIVE(val)) {
     // Convert Int64 and UInt64 values by C-style cast.
     JSObject* obj = JSVAL_TO_OBJECT(val);
     if (Int64::IsInt64(cx, obj)) {
       JSInt64 i = Int64Base::GetInt(cx, obj);
@@ -1367,17 +1423,17 @@ jsvalToPtrExplicit(JSContext* cx, jsval 
   if (JSVAL_IS_INT(val)) {
     // jsint always fits in intptr_t. If the integer is negative, cast through
     // an intptr_t intermediate to sign-extend.
     jsint i = JSVAL_TO_INT(val);
     *result = i < 0 ? uintptr_t(intptr_t(i)) : uintptr_t(i);
     return true;
   }
   if (JSVAL_IS_DOUBLE(val)) {
-    jsdouble d = *JSVAL_TO_DOUBLE(val);
+    jsdouble d = JSVAL_TO_DOUBLE(val);
     if (d < 0) {
       // Cast through an intptr_t intermediate to sign-extend.
       intptr_t i = Convert<intptr_t>(d);
       if (jsdouble(i) != d)
         return false;
 
       *result = uintptr_t(i);
       return true;
@@ -1854,21 +1910,21 @@ ImplicitConvert(JSContext* cx,
       AutoPtr<char>::Array intermediate(new char[arraySize]);
       if (!intermediate) {
         JS_ReportAllocationOverflow(cx);
         return false;
       }
 
       for (jsuint i = 0; i < sourceLength; ++i) {
         js::AutoValueRooter item(cx);
-        if (!JS_GetElement(cx, sourceArray, i, item.addr()))
+        if (!JS_GetElement(cx, sourceArray, i, item.jsval_addr()))
           return false;
 
         char* data = intermediate.get() + elementSize * i;
-        if (!ImplicitConvert(cx, item.value(), baseType, data, false, NULL))
+        if (!ImplicitConvert(cx, item.jsval_value(), baseType, data, false, NULL))
           return false;
       }
 
       memcpy(buffer, intermediate.get(), arraySize);
 
     } else {
       // Don't implicitly convert to string. Users can implicitly convert
       // with `String(x)` or `""+x`.
@@ -1879,55 +1935,54 @@ ImplicitConvert(JSContext* cx,
   case TYPE_struct: {
     if (!JSVAL_IS_PRIMITIVE(val) && !sourceData) {
       // Enumerate the properties of the object; if they match the struct
       // specification, convert the fields.
       JSObject* obj = JSVAL_TO_OBJECT(val);
       JSObject* iter = JS_NewPropertyIterator(cx, obj);
       if (!iter)
         return false;
-      js::AutoValueRooter iterroot(cx, iter);
+      js::AutoObjectRooter iterroot(cx, iter);
 
       // Convert into an intermediate, in case of failure.
       size_t structSize = CType::GetSize(cx, targetType);
       AutoPtr<char>::Array intermediate(new char[structSize]);
       if (!intermediate) {
         JS_ReportAllocationOverflow(cx);
         return false;
       }
 
       jsid id;
       size_t i = 0;
       while (1) {
         if (!JS_NextProperty(cx, iter, &id))
           return false;
-        if (JSVAL_IS_VOID(id))
+        if (JSID_IS_VOID(id))
           break;
 
         js::AutoValueRooter fieldVal(cx);
-        if (!JS_IdToValue(cx, id, fieldVal.addr()))
-          return false;
-        if (!JSVAL_IS_STRING(fieldVal.value())) {
+        JS_IdToValue(cx, id, fieldVal.jsval_addr());
+        if (!JSVAL_IS_STRING(fieldVal.jsval_value())) {
           JS_ReportError(cx, "property name is not a string");
           return false;
         }
 
         const FieldInfo* field = StructType::LookupField(cx, targetType,
-          fieldVal.value());
+                                                         JSVAL_TO_STRING(fieldVal.jsval_value()));
         if (!field)
           return false;
 
-        JSString* name = JSVAL_TO_STRING(fieldVal.value());
+        JSString* name = JSVAL_TO_STRING(fieldVal.jsval_value());
         js::AutoValueRooter prop(cx);
-        if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), prop.addr()))
+        if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), prop.jsval_addr()))
           return false;
 
         // Convert the field via ImplicitConvert().
         char* fieldData = intermediate.get() + field->mOffset;
-        if (!ImplicitConvert(cx, prop.value(), field->mType, fieldData, false, NULL))
+        if (!ImplicitConvert(cx, prop.jsval_value(), field->mType, fieldData, false, NULL))
           return false;
 
         ++i;
       }
 
       const FieldInfoHash* fields = StructType::GetFieldInfo(cx, targetType);
       if (i != fields->count()) {
         JS_ReportError(cx, "missing fields");
@@ -1958,17 +2013,17 @@ ExplicitConvert(JSContext* cx, jsval val
   // If ImplicitConvert succeeds, use that result.
   if (ImplicitConvert(cx, val, targetType, buffer, false, NULL))
     return true;
 
   // If ImplicitConvert failed, and there is no pending exception, then assume
   // hard failure (out of memory, or some other similarly serious condition).
   // We store any pending exception in case we need to re-throw it.
   js::AutoValueRooter ex(cx);
-  if (!JS_GetPendingException(cx, ex.addr()))
+  if (!JS_GetPendingException(cx, ex.jsval_addr()))
     return false;
 
   // Otherwise, assume soft failure. Clear the pending exception so that we
   // can throw a different one as required.
   JS_ClearPendingException(cx);
 
   TypeCode type = CType::GetTypeCode(cx, targetType);
 
@@ -2006,17 +2061,17 @@ ExplicitConvert(JSContext* cx, jsval val
   }
   case TYPE_float32_t:
   case TYPE_float64_t:
   case TYPE_float:
   case TYPE_double:
   case TYPE_array:
   case TYPE_struct:
     // ImplicitConvert is sufficient. Re-throw the exception it generated.
-    JS_SetPendingException(cx, ex.value());
+    JS_SetPendingException(cx, ex.jsval_value());
     return false;
   case TYPE_void_t:
   case TYPE_function:
     JS_NOT_REACHED("invalid type");
     return false;
   }
   return true;
 }
@@ -2524,32 +2579,32 @@ CType::Create(JSContext* cx,
   //       'typeProto'. (For instance, this could be ctypes.CData.prototype
   //       for simple types, or something representing structs for StructTypes.)
   //     * 'constructor' property === 't'
   //     * Additional properties specified by 'ps', as appropriate for the
   //       specific type instance 't'.
   JSObject* typeObj = JS_NewObject(cx, &sCTypeClass, typeProto, parent);
   if (!typeObj)
     return NULL;
-  js::AutoValueRooter root(cx, typeObj);
+  js::AutoObjectRooter root(cx, typeObj);
 
   // Set up the reserved slots.
   if (!JS_SetReservedSlot(cx, typeObj, SLOT_TYPECODE, INT_TO_JSVAL(type)) ||
       (ffiType && !JS_SetReservedSlot(cx, typeObj, SLOT_FFITYPE, PRIVATE_TO_JSVAL(ffiType))) ||
       (name && !JS_SetReservedSlot(cx, typeObj, SLOT_NAME, STRING_TO_JSVAL(name))) ||
       !JS_SetReservedSlot(cx, typeObj, SLOT_SIZE, size) ||
       !JS_SetReservedSlot(cx, typeObj, SLOT_ALIGN, align))
     return NULL;
 
   if (dataProto) {
     // Set up the 'prototype' and 'prototype.constructor' properties.
     JSObject* prototype = JS_NewObject(cx, &sCDataProtoClass, dataProto, parent);
     if (!prototype)
       return NULL;
-    js::AutoValueRooter protoroot(cx, prototype);
+    js::AutoObjectRooter protoroot(cx, prototype);
 
     if (!JS_DefineProperty(cx, prototype, "constructor", OBJECT_TO_JSVAL(typeObj),
            NULL, NULL, JSPROP_READONLY | JSPROP_PERMANENT))
       return NULL;
 
     // Set the 'prototype' object.
     if (//!JS_SealObject(cx, prototype, JS_FALSE) || // XXX fixme - see bug 541212!
         !JS_SetReservedSlot(cx, typeObj, SLOT_PROTO, OBJECT_TO_JSVAL(prototype)))
@@ -2577,17 +2632,17 @@ CType::DefineBuiltin(JSContext* cx,
                      TypeCode type,
                      jsval size,
                      jsval align,
                      ffi_type* ffiType)
 {
   JSString* nameStr = JS_NewStringCopyZ(cx, name);
   if (!nameStr)
     return NULL;
-  js::AutoValueRooter nameRoot(cx, nameStr);
+  js::AutoStringRooter nameRoot(cx, nameStr);
 
   // Create a new CType object with the common properties and slots.
   JSObject* typeObj = Create(cx, typeProto, dataProto, type, nameStr, size,
                         align, ffiType);
   if (!typeObj)
     return NULL;
 
   // Define the CType as a 'propName' property on 'parent'.
@@ -2803,17 +2858,17 @@ CType::GetSafeSize(JSContext* cx, JSObje
 
   // The "size" property can be a jsint, a jsdouble, or JSVAL_VOID
   // (for arrays of undefined length), and must always fit in a size_t.
   if (JSVAL_IS_INT(size)) {
     *result = JSVAL_TO_INT(size);
     return true;
   }
   if (JSVAL_IS_DOUBLE(size)) {
-    *result = Convert<size_t>(*JSVAL_TO_DOUBLE(size));
+    *result = Convert<size_t>(JSVAL_TO_DOUBLE(size));
     return true;
   }
 
   JS_ASSERT(JSVAL_IS_VOID(size));
   return false;
 }
 
 size_t
@@ -2826,17 +2881,17 @@ CType::GetSize(JSContext* cx, JSObject* 
 
   JS_ASSERT(!JSVAL_IS_VOID(size));
 
   // The "size" property can be a jsint, a jsdouble, or JSVAL_VOID
   // (for arrays of undefined length), and must always fit in a size_t.
   // For callers who know it can never be JSVAL_VOID, return a size_t directly.
   if (JSVAL_IS_INT(size))
     return JSVAL_TO_INT(size);
-  return Convert<size_t>(*JSVAL_TO_DOUBLE(size));
+  return Convert<size_t>(JSVAL_TO_DOUBLE(size));
 }
 
 bool
 CType::IsSizeDefined(JSContext* cx, JSObject* obj)
 {
   JS_ASSERT(CType::IsCType(cx, obj));
 
   jsval size;
@@ -2939,59 +2994,59 @@ CType::GetProtoFromType(JSContext* cx, J
 
   // Get the requested ctypes.{Pointer,Array,Struct,Function}Type.prototype.
   jsval result;
   ASSERT_OK(JS_GetReservedSlot(cx, proto, slot, &result));
   return JSVAL_TO_OBJECT(result);
 }
 
 JSBool
-CType::PrototypeGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+CType::PrototypeGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CType::IsCType(cx, obj)) {
     JS_ReportError(cx, "not a CType");
     return JS_FALSE;
   }
 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_PROTO, vp));
   JS_ASSERT(!JSVAL_IS_PRIMITIVE(*vp) || JSVAL_IS_VOID(*vp));
   return JS_TRUE;
 }
 
 JSBool
-CType::NameGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+CType::NameGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CType::IsCType(cx, obj)) {
     JS_ReportError(cx, "not a CType");
     return JS_FALSE;
   }
 
   JSString* name = CType::GetName(cx, obj);
   if (!name)
     return JS_FALSE;
 
   *vp = STRING_TO_JSVAL(name);
   return JS_TRUE;
 }
 
 JSBool
-CType::SizeGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+CType::SizeGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CType::IsCType(cx, obj)) {
     JS_ReportError(cx, "not a CType");
     return JS_FALSE;
   }
 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_SIZE, vp));
   JS_ASSERT(JSVAL_IS_NUMBER(*vp) || JSVAL_IS_VOID(*vp));
   return JS_TRUE;
 }
 
 JSBool
-CType::PtrGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+CType::PtrGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CType::IsCType(cx, obj)) {
     JS_ReportError(cx, "not a CType");
     return JS_FALSE;
   }
 
   JSObject* pointerType = PointerType::CreateInternal(cx, obj);
   if (!pointerType)
@@ -3074,31 +3129,31 @@ CType::ToSource(JSContext* cx, uintN arg
   if (!result)
     return JS_FALSE;
   
   JS_SET_RVAL(cx, vp, STRING_TO_JSVAL(result));
   return JS_TRUE;
 }
 
 JSBool
-CType::HasInstance(JSContext* cx, JSObject* obj, jsval v, JSBool* bp)
+CType::HasInstance(JSContext* cx, JSObject* obj, const jsval *v, JSBool* bp)
 {
   JS_ASSERT(CType::IsCType(cx, obj));
 
   jsval slot;
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_PROTO, &slot));
   JSObject* prototype = JSVAL_TO_OBJECT(slot);
   JS_ASSERT(prototype);
   JS_ASSERT(JS_GET_CLASS(cx, prototype) == &sCDataProtoClass);
 
   *bp = JS_FALSE;
-  if (JSVAL_IS_PRIMITIVE(v))
+  if (JSVAL_IS_PRIMITIVE(*v))
     return JS_TRUE;
 
-  JSObject* proto = JSVAL_TO_OBJECT(v);
+  JSObject* proto = JSVAL_TO_OBJECT(*v);
   while ((proto = JS_GetPrototype(cx, proto))) {
     if (proto == prototype) {
       *bp = JS_TRUE;
       break;
     }
   }
   return JS_TRUE;
 }
@@ -3148,17 +3203,17 @@ PointerType::CreateInternal(JSContext* c
 
   // Create a new CType object with the common properties and slots.
   JSObject* typeObj = CType::Create(cx, typeProto, dataProto, TYPE_pointer,
                         NULL, INT_TO_JSVAL(sizeof(void*)),
                         INT_TO_JSVAL(ffi_type_pointer.alignment),
                         &ffi_type_pointer);
   if (!typeObj)
     return NULL;
-  js::AutoValueRooter root(cx, typeObj);
+  js::AutoObjectRooter root(cx, typeObj);
 
   // Set the target type. (This will be 'null' for an opaque pointer type.)
   if (!JS_SetReservedSlot(cx, typeObj, SLOT_TARGET_T, OBJECT_TO_JSVAL(baseType)))
     return NULL;
 
   // Finally, cache our newly-created PointerType on our pointed-to CType.
   if (!JS_SetReservedSlot(cx, baseType, SLOT_PTR, OBJECT_TO_JSVAL(typeObj)))
     return NULL;
@@ -3233,17 +3288,17 @@ PointerType::GetBaseType(JSContext* cx, 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_TARGET_T, &type));
   JS_ASSERT(!JSVAL_IS_NULL(type));
   return JSVAL_TO_OBJECT(type);
 }
 
 JSBool
 PointerType::TargetTypeGetter(JSContext* cx,
                               JSObject* obj,
-                              jsval idval,
+                              jsid idval,
                               jsval* vp)
 {
   if (!CType::IsCType(cx, obj) || CType::GetTypeCode(cx, obj) != TYPE_pointer) {
     JS_ReportError(cx, "not a PointerType");
     return JS_FALSE;
   }
 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_TARGET_T, vp));
@@ -3273,17 +3328,17 @@ PointerType::IsNull(JSContext* cx, uintN
   jsval result = BOOLEAN_TO_JSVAL(data == NULL);
   JS_SET_RVAL(cx, vp, result);
   return JS_TRUE;
 }
 
 JSBool
 PointerType::ContentsGetter(JSContext* cx,
                             JSObject* obj,
-                            jsval idval,
+                            jsid idval,
                             jsval* vp)
 {
   if (!CData::IsCData(cx, obj)) {
     JS_ReportError(cx, "not a CData");
     return JS_FALSE;
   }
 
   // Get pointer type and base type.
@@ -3311,17 +3366,17 @@ PointerType::ContentsGetter(JSContext* c
 
   JS_SET_RVAL(cx, vp, result);
   return JS_TRUE;
 }
 
 JSBool
 PointerType::ContentsSetter(JSContext* cx,
                             JSObject* obj,
-                            jsval idval,
+                            jsid idval,
                             jsval* vp)
 {
   if (!CData::IsCData(cx, obj)) {
     JS_ReportError(cx, "not a CData");
     return JS_FALSE;
   }
 
   // Get pointer type and base type.
@@ -3418,17 +3473,17 @@ ArrayType::CreateInternal(JSContext* cx,
 
   size_t align = CType::GetAlignment(cx, baseType);
 
   // Create a new CType object with the common properties and slots.
   JSObject* typeObj = CType::Create(cx, typeProto, dataProto, TYPE_array, NULL,
                         sizeVal, INT_TO_JSVAL(align), NULL);
   if (!typeObj)
     return NULL;
-  js::AutoValueRooter root(cx, typeObj);
+  js::AutoObjectRooter root(cx, typeObj);
 
   // Set the element type.
   if (!JS_SetReservedSlot(cx, typeObj, SLOT_ELEMENT_T, OBJECT_TO_JSVAL(baseType)))
     return NULL;
 
   // Set the length.
   if (!JS_SetReservedSlot(cx, typeObj, SLOT_LENGTH, lengthVal))
     return NULL;
@@ -3473,18 +3528,18 @@ ArrayType::ConstructData(JSContext* cx,
       // Have a length, rather than an object to initialize from.
       convertObject = false;
 
     } else if (!JSVAL_IS_PRIMITIVE(argv[0])) {
       // We were given an object with a .length property.
       // This could be a JS array, or a CData array.
       JSObject* arg = JSVAL_TO_OBJECT(argv[0]);
       js::AutoValueRooter lengthVal(cx);
-      if (!JS_GetProperty(cx, arg, "length", lengthVal.addr()) ||
-          !jsvalToSize(cx, lengthVal.value(), false, &length)) {
+      if (!JS_GetProperty(cx, arg, "length", lengthVal.jsval_addr()) ||
+          !jsvalToSize(cx, lengthVal.jsval_value(), false, &length)) {
         JS_ReportError(cx, "argument must be an array object or length");
         return JS_FALSE;
       }
 
     } else if (JSVAL_IS_STRING(argv[0])) {
       // We were given a string. Size the array to the appropriate length,
       // including space for the terminator.
       JSString* sourceString = JSVAL_TO_STRING(argv[0]);
@@ -3517,17 +3572,17 @@ ArrayType::ConstructData(JSContext* cx,
 
     // Construct a new ArrayType of defined length, for the new CData object.
     obj = CreateInternal(cx, baseType, length, true);
     if (!obj)
       return JS_FALSE;
   }
 
   // Root the CType object, in case we created one above.
-  js::AutoValueRooter root(cx, obj);
+  js::AutoObjectRooter root(cx, obj);
 
   JSObject* result = CData::Create(cx, obj, NULL, NULL, true);
   if (!result)
     return JS_FALSE;
 
   *rval = OBJECT_TO_JSVAL(result);
 
   if (convertObject) {
@@ -3561,17 +3616,17 @@ ArrayType::GetSafeLength(JSContext* cx, 
 
   // The "length" property can be a jsint, a jsdouble, or JSVAL_VOID
   // (for arrays of undefined length), and must always fit in a size_t.
   if (JSVAL_IS_INT(length)) {
     *result = JSVAL_TO_INT(length);
     return true;
   }
   if (JSVAL_IS_DOUBLE(length)) {
-    *result = Convert<size_t>(*JSVAL_TO_DOUBLE(length));
+    *result = Convert<size_t>(JSVAL_TO_DOUBLE(length));
     return true;
   }
 
   JS_ASSERT(JSVAL_IS_VOID(length));
   return false;
 }
 
 size_t
@@ -3585,17 +3640,17 @@ ArrayType::GetLength(JSContext* cx, JSOb
 
   JS_ASSERT(!JSVAL_IS_VOID(length));
 
   // The "length" property can be a jsint, a jsdouble, or JSVAL_VOID
   // (for arrays of undefined length), and must always fit in a size_t.
   // For callers who know it can never be JSVAL_VOID, return a size_t directly.
   if (JSVAL_IS_INT(length))
     return JSVAL_TO_INT(length);
-  return Convert<size_t>(*JSVAL_TO_DOUBLE(length));
+  return Convert<size_t>(JSVAL_TO_DOUBLE(length));
 }
 
 ffi_type*
 ArrayType::BuildFFIType(JSContext* cx, JSObject* obj)
 {
   JS_ASSERT(CType::IsCType(cx, obj));
   JS_ASSERT(CType::GetTypeCode(cx, obj) == TYPE_array);
   JS_ASSERT(CType::IsSizeDefined(cx, obj));
@@ -3632,30 +3687,30 @@ ArrayType::BuildFFIType(JSContext* cx, J
   for (size_t i = 0; i < length; ++i)
     ffiType->elements[i] = ffiBaseType;
   ffiType->elements[length] = NULL;
 
   return ffiType.forget();
 }
 
 JSBool
-ArrayType::ElementTypeGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+ArrayType::ElementTypeGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CType::IsCType(cx, obj) || CType::GetTypeCode(cx, obj) != TYPE_array) {
     JS_ReportError(cx, "not an ArrayType");
     return JS_FALSE;
   }
 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_ELEMENT_T, vp));
   JS_ASSERT(!JSVAL_IS_PRIMITIVE(*vp));
   return JS_TRUE;
 }
 
 JSBool
-ArrayType::LengthGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+ArrayType::LengthGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   // This getter exists for both CTypes and CDatas of the ArrayType persuasion.
   // If we're dealing with a CData, get the CType from it.
   if (CData::IsCData(cx, obj))
     obj = CData::GetCType(cx, obj);
 
   if (!CType::IsCType(cx, obj) || CType::GetTypeCode(cx, obj) != TYPE_array) {
     JS_ReportError(cx, "not an ArrayType");
@@ -3663,70 +3718,70 @@ ArrayType::LengthGetter(JSContext* cx, J
   }
 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_LENGTH, vp));
   JS_ASSERT(JSVAL_IS_NUMBER(*vp) || JSVAL_IS_VOID(*vp));
   return JS_TRUE;
 }
 
 JSBool
-ArrayType::Getter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+ArrayType::Getter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   // This should never happen, but we'll check to be safe.
   if (!CData::IsCData(cx, obj)) {
     JS_ReportError(cx, "not a CData");
     return JS_FALSE;
   }
 
   // Bail early if we're not an ArrayType. (This setter is present for all
   // CData, regardless of CType.)
   JSObject* typeObj = CData::GetCType(cx, obj);
   if (CType::GetTypeCode(cx, typeObj) != TYPE_array)
     return JS_TRUE;
 
   // Convert the index to a size_t and bounds-check it.
   size_t index;
   size_t length = GetLength(cx, typeObj);
-  bool ok = jsvalToSize(cx, idval, true, &index);
-  if (!ok && JSVAL_IS_STRING(idval)) {
+  bool ok = jsidToSize(cx, idval, true, &index);
+  if (!ok && JSID_IS_STRING(idval)) {
     // String either isn't a number, or doesn't fit in size_t.
     // Chances are it's a regular property lookup, so return.
     return JS_TRUE;
   }
   if (!ok || index >= length) {
     JS_ReportError(cx, "invalid index");
     return JS_FALSE;
   }
 
   JSObject* baseType = GetBaseType(cx, typeObj);
   size_t elementSize = CType::GetSize(cx, baseType);
   char* data = static_cast<char*>(CData::GetData(cx, obj)) + elementSize * index;
   return ConvertToJS(cx, baseType, obj, data, false, false, vp);
 }
 
 JSBool
-ArrayType::Setter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+ArrayType::Setter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   // This should never happen, but we'll check to be safe.
   if (!CData::IsCData(cx, obj)) {
     JS_ReportError(cx, "not a CData");
     return JS_FALSE;
   }
 
   // Bail early if we're not an ArrayType. (This setter is present for all
   // CData, regardless of CType.)
   JSObject* typeObj = CData::GetCType(cx, obj);
   if (CType::GetTypeCode(cx, typeObj) != TYPE_array)
     return JS_TRUE;
 
   // Convert the index to a size_t and bounds-check it.
   size_t index;
   size_t length = GetLength(cx, typeObj);
-  bool ok = jsvalToSize(cx, idval, true, &index);
-  if (!ok && JSVAL_IS_STRING(idval)) {
+  bool ok = jsidToSize(cx, idval, true, &index);
+  if (!ok && JSID_IS_STRING(idval)) {
     // String either isn't a number, or doesn't fit in size_t.
     // Chances are it's a regular property lookup, so return.
     return JS_TRUE;
   }
   if (!ok || index >= length) {
     JS_ReportError(cx, "invalid index");
     return JS_FALSE;
   }
@@ -3758,17 +3813,17 @@ ArrayType::AddressOfElement(JSContext* c
     JS_ReportError(cx, "addressOfElement takes one argument");
     return JS_FALSE;
   }
 
   JSObject* baseType = GetBaseType(cx, typeObj);
   JSObject* pointerType = PointerType::CreateInternal(cx, baseType);
   if (!pointerType)
     return JS_FALSE;
-  js::AutoValueRooter root(cx, pointerType);
+  js::AutoObjectRooter root(cx, pointerType);
 
   // Create a PointerType CData object containing null.
   JSObject* result = CData::Create(cx, pointerType, NULL, NULL, true);
   if (!result)
     return JS_FALSE;
 
   JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(result));
 
@@ -3801,53 +3856,56 @@ ExtractStructField(JSContext* cx, jsval 
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
 
   JSObject* obj = JSVAL_TO_OBJECT(val);
   JSObject* iter = JS_NewPropertyIterator(cx, obj);
   if (!iter)
     return NULL;
-  js::AutoValueRooter iterroot(cx, iter);
+  js::AutoObjectRooter iterroot(cx, iter);
 
   jsid id;
   if (!JS_NextProperty(cx, iter, &id))
     return NULL;
+  if (JSID_IS_VOID(id)) {
+    JS_ReportError(cx, "struct field descriptors require a valid name and type");
+    return NULL;
+  }
 
   js::AutoValueRooter nameVal(cx);
-  if (!JS_IdToValue(cx, id, nameVal.addr()))
-    return NULL;
-  if (!JSVAL_IS_STRING(nameVal.value())) {
+  JS_IdToValue(cx, id, nameVal.jsval_addr());
+  if (!JSVAL_IS_STRING(nameVal.jsval_value())) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
-  JSString* name = JSVAL_TO_STRING(nameVal.value());
+  JSString* name = JSVAL_TO_STRING(nameVal.jsval_value());
 
   // make sure we have one, and only one, property
   if (!JS_NextProperty(cx, iter, &id))
     return NULL;
-  if (!JSVAL_IS_VOID(id)) {
+  if (!JSID_IS_VOID(id)) {
     JS_ReportError(cx, "struct field descriptors must contain one property");
     return NULL;
   }
 
   js::AutoValueRooter propVal(cx);
-  if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), propVal.addr()))
+  if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), propVal.jsval_addr()))
     return NULL;
 
-  if (JSVAL_IS_PRIMITIVE(propVal.value()) ||
-      !CType::IsCType(cx, JSVAL_TO_OBJECT(propVal.value()))) {
+  if (propVal.value().isPrimitive() ||
+      !CType::IsCType(cx, JSVAL_TO_OBJECT(propVal.jsval_value()))) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
 
   // Undefined size or zero size struct members are illegal.
   // (Zero-size arrays are legal as struct members in C++, but libffi will
   // choke on a zero-size struct, so we disallow them.)
-  *typeObj = JSVAL_TO_OBJECT(propVal.value());
+  *typeObj = JSVAL_TO_OBJECT(propVal.jsval_value());
   size_t size;
   if (!CType::GetSafeSize(cx, *typeObj, &size) || size == 0) {
     JS_ReportError(cx, "struct field types must have defined and nonzero size");
     return NULL;
   }
 
   return name;
 }
@@ -3898,17 +3956,17 @@ StructType::Create(JSContext* cx, uintN 
 
   // Create a simple StructType with no defined fields. The result will be
   // non-instantiable as CData, will have no 'prototype' property, and will
   // have undefined size and alignment and no ffi_type.
   JSObject* result = CType::Create(cx, typeProto, NULL, TYPE_struct,
                        JSVAL_TO_STRING(name), JSVAL_VOID, JSVAL_VOID, NULL);
   if (!result)
     return JS_FALSE;
-  js::AutoValueRooter root(cx, result);
+  js::AutoObjectRooter root(cx, result);
 
   if (argc == 2) {
     if (JSVAL_IS_PRIMITIVE(argv[1]) ||
         !JS_IsArrayObject(cx, JSVAL_TO_OBJECT(argv[1]))) {
       JS_ReportError(cx, "second argument must be an array");
       return JS_FALSE;
     }
 
@@ -3933,17 +3991,17 @@ StructType::DefineInternal(JSContext* cx
     CType::GetProtoFromType(cx, typeObj, SLOT_STRUCTDATAPROTO);
 
   // Set up the 'prototype' and 'prototype.constructor' properties.
   // The prototype will reflect the struct fields as properties on CData objects
   // created from this type.
   JSObject* prototype = JS_NewObject(cx, &sCDataProtoClass, dataProto, NULL);
   if (!prototype)
     return JS_FALSE;
-  js::AutoValueRooter protoroot(cx, prototype);
+  js::AutoObjectRooter protoroot(cx, prototype);
 
   if (!JS_DefineProperty(cx, prototype, "constructor", OBJECT_TO_JSVAL(typeObj),
          NULL, NULL, JSPROP_READONLY | JSPROP_PERMANENT))
     return JS_FALSE;
 
   // Create a hash of FieldInfo objects to stash on the type object.
   FieldInfoHash* fields(new FieldInfoHash);
   if (!fields || !fields->init(len)) {
@@ -3963,21 +4021,21 @@ StructType::DefineInternal(JSContext* cx
   // Process the field types.
   size_t structSize, structAlign;
   if (len != 0) {
     structSize = 0;
     structAlign = 0;
 
     for (jsuint i = 0; i < len; ++i) {
       js::AutoValueRooter item(cx);
-      if (!JS_GetElement(cx, fieldsObj, i, item.addr()))
+      if (!JS_GetElement(cx, fieldsObj, i, item.jsval_addr()))
         return JS_FALSE;
 
       JSObject* fieldType;
-      JSString* name = ExtractStructField(cx, item.value(), &fieldType);
+      JSString* name = ExtractStructField(cx, item.jsval_value(), &fieldType);
       if (!name)
         return JS_FALSE;
 
       // Make sure each field name is unique, and add it to the hash.
       FieldInfoHash::AddPtr entryPtr = fields->lookupForAdd(name);
       if (entryPtr) {
         JS_ReportError(cx, "struct fields must have unique names");
         return JS_FALSE;
@@ -4233,22 +4291,21 @@ StructType::GetFieldInfo(JSContext* cx, 
   jsval slot;
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_FIELDINFO, &slot));
   JS_ASSERT(!JSVAL_IS_VOID(slot) && JSVAL_TO_PRIVATE(slot));
 
   return static_cast<const FieldInfoHash*>(JSVAL_TO_PRIVATE(slot));
 }
 
 const FieldInfo*
-StructType::LookupField(JSContext* cx, JSObject* obj, jsval idval)
+StructType::LookupField(JSContext* cx, JSObject* obj, JSString *name)
 {
   JS_ASSERT(CType::IsCType(cx, obj));
   JS_ASSERT(CType::GetTypeCode(cx, obj) == TYPE_struct);
 
-  JSString* name = JSVAL_TO_STRING(idval);
   FieldInfoHash::Ptr ptr = GetFieldInfo(cx, obj)->lookup(name);
   if (ptr)
     return &ptr->value;
 
   const char* bytes = JS_GetStringBytesZ(cx, name);
   if (!bytes)
     return NULL;
 
@@ -4267,17 +4324,17 @@ StructType::BuildFieldsArray(JSContext* 
   size_t len = fields->count();
 
   // Prepare a new array for the 'fields' property of the StructType.
   jsval* fieldsVec;
   JSObject* fieldsProp =
     js_NewArrayObjectWithCapacity(cx, len, &fieldsVec);
   if (!fieldsProp)
     return NULL;
-  js::AutoValueRooter root(cx, fieldsProp);
+  js::AutoObjectRooter root(cx, fieldsProp);
   JS_ASSERT(len == 0 || fieldsVec);
 
   for (FieldInfoHash::Range r = fields->all(); !r.empty(); r.popFront()) {
     const FieldInfoHash::Entry& entry = r.front();
     // Add the field descriptor to the array.
     if (!AddFieldToArray(cx, fieldsProp, &fieldsVec[entry.value.mIndex],
            entry.key, entry.value.mType))
       return NULL;
@@ -4286,17 +4343,17 @@ StructType::BuildFieldsArray(JSContext* 
   // Seal the fields array.
   if (!JS_SealObject(cx, fieldsProp, JS_FALSE))
     return NULL;
 
   return fieldsProp;
 }
 
 JSBool
-StructType::FieldsArrayGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+StructType::FieldsArrayGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CType::IsCType(cx, obj) || CType::GetTypeCode(cx, obj) != TYPE_struct) {
     JS_ReportError(cx, "not a StructType");
     return JS_FALSE;
   }
 
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_FIELDS, vp));
 
@@ -4316,52 +4373,52 @@ StructType::FieldsArrayGetter(JSContext*
   }
 
   JS_ASSERT(!JSVAL_IS_PRIMITIVE(*vp) &&
             JS_IsArrayObject(cx, JSVAL_TO_OBJECT(*vp)));
   return JS_TRUE;
 }
 
 JSBool
-StructType::FieldGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+StructType::FieldGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CData::IsCData(cx, obj)) {
     JS_ReportError(cx, "not a CData");
     return JS_FALSE;
   }
 
   JSObject* typeObj = CData::GetCType(cx, obj);
   if (CType::GetTypeCode(cx, typeObj) != TYPE_struct) {
     JS_ReportError(cx, "not a StructType");
     return JS_FALSE;
   }
 
-  const FieldInfo* field = LookupField(cx, typeObj, idval);
+  const FieldInfo* field = LookupField(cx, typeObj, JSID_TO_STRING(idval));
   if (!field)
     return JS_FALSE;
 
   char* data = static_cast<char*>(CData::GetData(cx, obj)) + field->mOffset;
   return ConvertToJS(cx, field->mType, obj, data, false, false, vp);
 }
 
 JSBool
-StructType::FieldSetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+StructType::FieldSetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CData::IsCData(cx, obj)) {
     JS_ReportError(cx, "not a CData");
     return JS_FALSE;
   }
 
   JSObject* typeObj = CData::GetCType(cx, obj);
   if (CType::GetTypeCode(cx, typeObj) != TYPE_struct) {
     JS_ReportError(cx, "not a StructType");
     return JS_FALSE;
   }
 
-  const FieldInfo* field = LookupField(cx, typeObj, idval);
+  const FieldInfo* field = LookupField(cx, typeObj, JSID_TO_STRING(idval));
   if (!field)
     return JS_FALSE;
 
   char* data = static_cast<char*>(CData::GetData(cx, obj)) + field->mOffset;
   return ImplicitConvert(cx, *vp, field->mType, data, false, NULL);
 }
 
 JSBool
@@ -4381,25 +4438,26 @@ StructType::AddressOfField(JSContext* cx
     return JS_FALSE;
   }
 
   if (argc != 1) {
     JS_ReportError(cx, "addressOfField takes one argument");
     return JS_FALSE;
   }
 
-  const FieldInfo* field = LookupField(cx, typeObj, JS_ARGV(cx, vp)[0]);
+  const FieldInfo* field = LookupField(cx, typeObj,
+                                       JSVAL_TO_STRING(JS_ARGV(cx, vp)[0]));
   if (!field)
     return JS_FALSE;
 
   JSObject* baseType = field->mType;
   JSObject* pointerType = PointerType::CreateInternal(cx, baseType);
   if (!pointerType)
     return JS_FALSE;
-  js::AutoValueRooter root(cx, pointerType);
+  js::AutoObjectRooter root(cx, pointerType);
 
   // Create a PointerType CData object containing null.
   JSObject* result = CData::Create(cx, pointerType, NULL, NULL, true);
   if (!result)
     return JS_FALSE;
 
   JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(result));
 
@@ -4724,17 +4782,17 @@ FunctionType::CreateInternal(JSContext* 
   JSObject* dataProto = CType::GetProtoFromType(cx, fninfo->mReturnType,
                                                 SLOT_FUNCTIONDATAPROTO);
 
   // Create a new CType object with the common properties and slots.
   JSObject* typeObj = CType::Create(cx, typeProto, dataProto, TYPE_function,
                         NULL, JSVAL_VOID, JSVAL_VOID, NULL);
   if (!typeObj)
     return NULL;
-  js::AutoValueRooter root(cx, typeObj);
+  js::AutoObjectRooter root(cx, typeObj);
 
   // Stash the FunctionInfo in a reserved slot.
   if (!JS_SetReservedSlot(cx, typeObj, SLOT_FNINFO,
          PRIVATE_TO_JSVAL(fninfo.get())))
     return NULL;
   fninfo.forget();
 
   return typeObj;
@@ -4755,17 +4813,17 @@ FunctionType::ConstructData(JSContext* c
   if (fninfo->mIsVariadic) {
     JS_ReportError(cx, "Can't declare a variadic callback function");
     return JS_FALSE;
   }
 
   JSObject* closureObj = CClosure::Create(cx, typeObj, fnObj, thisObj, data);
   if (!closureObj)
     return JS_FALSE;
-  js::AutoValueRooter root(cx, closureObj);
+  js::AutoObjectRooter root(cx, closureObj);
 
   // Set the closure object as the referent of the new CData object.
   if (!JS_SetReservedSlot(cx, dataObj, SLOT_REFERENT,
          OBJECT_TO_JSVAL(closureObj)))
     return JS_FALSE;
 
   // Seal the CData object, to prevent modification of the function pointer.
   // This permanently associates this object with the closure, and avoids
@@ -4940,17 +4998,17 @@ CheckFunctionType(JSContext* cx, JSObjec
   if (!CType::IsCType(cx, obj) || CType::GetTypeCode(cx, obj) != TYPE_function) {
     JS_ReportError(cx, "not a FunctionType");
     return JS_FALSE;
   }
   return JS_TRUE;
 }
 
 JSBool
-FunctionType::ArgTypesGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+FunctionType::ArgTypesGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CheckFunctionType(cx, obj))
     return JS_FALSE;
 
   // Check if we have a cached argTypes array.
   ASSERT_OK(JS_GetReservedSlot(cx, obj, SLOT_ARGS_T, vp));
   if (!JSVAL_IS_VOID(*vp))
     return JS_TRUE;
@@ -4959,55 +5017,55 @@ FunctionType::ArgTypesGetter(JSContext* 
   size_t len = fninfo->mArgTypes.length();
 
   // Prepare a new array.
   jsval* vec;
   JSObject* argTypes =
     js_NewArrayObjectWithCapacity(cx, len, &vec);
   if (!argTypes)
     return JS_FALSE;
-  js::AutoValueRooter argsroot(cx, argTypes);
+  js::AutoObjectRooter argsroot(cx, argTypes);
   JS_ASSERT(len == 0 || vec);
 
   for (size_t i = 0; i < len; ++i)
     vec[i] = OBJECT_TO_JSVAL(fninfo->mArgTypes[i]);
 
   // Seal and cache it.
   if (!JS_SealObject(cx, argTypes, JS_FALSE) ||
       !JS_SetReservedSlot(cx, obj, SLOT_ARGS_T, OBJECT_TO_JSVAL(argTypes)))
     return JS_FALSE;
 
   *vp = OBJECT_TO_JSVAL(argTypes);
   return JS_TRUE;
 }
 
 JSBool
-FunctionType::ReturnTypeGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+FunctionType::ReturnTypeGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CheckFunctionType(cx, obj))
     return JS_FALSE;
 
   // Get the returnType object from the FunctionInfo.
   *vp = OBJECT_TO_JSVAL(GetFunctionInfo(cx, obj)->mReturnType);
   return JS_TRUE;
 }
 
 JSBool
-FunctionType::ABIGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+FunctionType::ABIGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CheckFunctionType(cx, obj))
     return JS_FALSE;
 
   // Get the abi object from the FunctionInfo.
   *vp = OBJECT_TO_JSVAL(GetFunctionInfo(cx, obj)->mABI);
   return JS_TRUE;
 }
 
 JSBool
-FunctionType::IsVariadicGetter(JSContext* cx, JSObject* obj, jsval idval, jsval* vp)
+FunctionType::IsVariadicGetter(JSContext* cx, JSObject* obj, jsid idval, jsval* vp)
 {
   if (!CheckFunctionType(cx, obj))
     return JS_FALSE;
 
   *vp = BOOLEAN_TO_JSVAL(GetFunctionInfo(cx, obj)->mIsVariadic);
   return JS_TRUE;
 }
 
@@ -5020,17 +5078,17 @@ CClosure::Create(JSContext* cx,
                  JSObject* typeObj,
                  JSObject* fnObj,
                  JSObject* thisObj,
                  PRFuncPtr* fnptr)
 {
   JSObject* result = JS_NewObject(cx, &sCClosureClass, NULL, NULL);
   if (!result)
     return NULL;
-  js::AutoValueRooter root(cx, result);
+  js::AutoObjectRooter root(cx, result);
 
   // Get the FunctionInfo from the FunctionType.
   FunctionInfo* fninfo = FunctionType::GetFunctionInfo(cx, typeObj);