Backed out changeset ae8d72538dee (bug 897484) for b2g bustage
authorCarsten "Tomcat" Book <cbook@mozilla.com>
Fri, 26 Jul 2013 12:34:25 +0200
changeset 140150 0621ef3a01da803d6f7465d0f5fdc447ff020610
parent 140149 35f1055fd2179c264946c5007496a89fe4045eb2
child 140151 9a1a962eaa193b39ca238a46ff6c865455f75572
push id1945
push userryanvm@gmail.com
push dateSat, 27 Jul 2013 02:27:26 +0000
treeherderfx-team@4874fa438b1c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs897484
milestone25.0a1
backs outae8d72538dee1b99fa67fcebca8ecd8deadda517
Backed out changeset ae8d72538dee (bug 897484) for b2g bustage
caps/src/nsSecurityManagerFactory.cpp
content/base/src/nsFrameMessageManager.cpp
content/xbl/src/nsXBLBinding.cpp
content/xbl/src/nsXBLProtoImplField.cpp
dom/audiochannel/AudioChannelService.cpp
dom/base/nsDOMClassInfo.cpp
dom/bindings/BindingUtils.cpp
dom/bindings/CallbackInterface.cpp
dom/bindings/Codegen.py
dom/bluetooth/BluetoothHfpManager.cpp
dom/bluetooth/BluetoothService.cpp
dom/indexedDB/KeyPath.cpp
dom/network/src/TCPSocketParent.cpp
dom/plugins/base/nsJSNPRuntime.cpp
dom/src/geolocation/nsGeolocation.cpp
dom/src/json/nsJSON.cpp
dom/system/OSFileConstants.cpp
dom/system/gonk/AudioManager.cpp
dom/system/gonk/AutoMounterSetting.cpp
dom/system/gonk/TimeZoneSettingObserver.cpp
dom/workers/ChromeWorkerScope.cpp
dom/workers/EventListenerManager.cpp
dom/workers/Events.cpp
dom/workers/WorkerScope.cpp
ipc/testshell/XPCShellEnvironment.cpp
js/ipc/JavaScriptChild.cpp
js/ipc/JavaScriptShared.cpp
js/jsd/jsd_val.cpp
js/src/ctypes/CTypes.cpp
js/src/jsapi-tests/testArrayBuffer.cpp
js/src/jsapi-tests/testException.cpp
js/src/jsapi-tests/testFunctionProperties.cpp
js/src/jsapi-tests/testGetPropertyDefault.cpp
js/src/jsapi-tests/testParseJSON.cpp
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsdbgapi.cpp
js/src/jsexn.cpp
js/src/shell/js.cpp
js/src/shell/jsheaptools.cpp
js/src/vm/Debugger.cpp
js/xpconnect/loader/mozJSComponentLoader.cpp
js/xpconnect/src/XPCComponents.cpp
js/xpconnect/src/XPCWrappedJSClass.cpp
js/xpconnect/src/XPCWrappedNative.cpp
js/xpconnect/src/XPCWrappedNativeJSOps.cpp
js/xpconnect/src/dictionary_helper_gen.py
media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
startupcache/test/TestStartupCache.cpp
toolkit/components/ctypes/ctypes.cpp
toolkit/components/perf/PerfMeasurement.cpp
toolkit/components/places/History.cpp
--- a/caps/src/nsSecurityManagerFactory.cpp
+++ b/caps/src/nsSecurityManagerFactory.cpp
@@ -80,27 +80,27 @@ nsSecurityNameSet::InitializeNameSet(nsI
         MOZ_ALWAYS_TRUE(JS_GetPrototype(cx, obj, proto.address()));
         if (!proto)
             break;
         obj = proto;
     }
     JSClass *objectClass = JS_GetClass(obj);
 
     JS::Rooted<JS::Value> v(cx);
-    if (!JS_GetProperty(cx, global, "netscape", &v))
+    if (!JS_GetProperty(cx, global, "netscape", v.address()))
         return NS_ERROR_FAILURE;
 
     JS::Rooted<JSObject*> securityObj(cx);
     if (v.isObject()) {
         /*
          * "netscape" property of window object exists; get the
          * "security" property.
          */
         obj = &v.toObject();
-        if (!JS_GetProperty(cx, obj, "security", &v) || !v.isObject())
+        if (!JS_GetProperty(cx, obj, "security", v.address()) || !v.isObject())
             return NS_ERROR_FAILURE;
         securityObj = &v.toObject();
     } else {
         /* define netscape.security object */
         obj = JS_DefineObject(cx, global, "netscape", objectClass, nullptr, 0);
         if (obj == nullptr)
             return NS_ERROR_FAILURE;
         securityObj = JS_DefineObject(cx, obj, "security", objectClass,
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -743,17 +743,18 @@ nsFrameMessageManager::ReceiveMessage(ns
           } else {
             defaultThisValue = aTarget;
           }
           JS::Rooted<JSObject*> global(ctx, JS_GetGlobalForObject(ctx, object));
           nsContentUtils::WrapNative(ctx, global, defaultThisValue,
                                      thisValue.address(), nullptr, true);
         } else {
           // If the listener is a JS object which has receiveMessage function:
-          if (!JS_GetProperty(ctx, object, "receiveMessage", &funval) ||
+          if (!JS_GetProperty(ctx, object, "receiveMessage",
+                              funval.address()) ||
               !funval.isObject())
             return NS_ERROR_UNEXPECTED;
 
           // Check if the object is even callable.
           NS_ENSURE_STATE(JS_ObjectIsCallable(ctx, &funval.toObject()));
           thisValue.setObject(*object);
         }
 
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1158,17 +1158,17 @@ nsXBLBinding::LookupMemberInternal(JSCon
     }
     return mNextBinding->LookupMemberInternal(aCx, aName, aNameAsId,
                                               aDesc, aXBLScope);
   }
 
   // Find our class object. It's in a protected scope and permanent just in case,
   // so should be there no matter what.
   JS::RootedValue classObject(aCx);
-  if (!JS_GetProperty(aCx, aXBLScope, mJSClass->name, &classObject)) {
+  if (!JS_GetProperty(aCx, aXBLScope, mJSClass->name, classObject.address())) {
     return false;
   }
 
   // The bound element may have been adoped by a document and have a different
   // wrapper (and different xbl scope) than when the binding was applied, in
   // this case getting the class object will fail. Behave as if the class
   // object did not exist.
   if (classObject.isUndefined()) {
--- a/content/xbl/src/nsXBLProtoImplField.cpp
+++ b/content/xbl/src/nsXBLProtoImplField.cpp
@@ -239,17 +239,17 @@ FieldGetterImpl(JSContext *cx, JS::CallA
   }
 
   if (!installed) {
     args.rval().setUndefined();
     return true;
   }
 
   JS::Rooted<JS::Value> v(cx);
-  if (!JS_GetPropertyById(cx, thisObj, id, &v)) {
+  if (!JS_GetPropertyById(cx, thisObj, id, v.address())) {
     return false;
   }
   args.rval().set(v);
   return true;
 }
 
 static JSBool
 FieldGetter(JSContext *cx, unsigned argc, JS::Value *vp)
--- a/dom/audiochannel/AudioChannelService.cpp
+++ b/dom/audiochannel/AudioChannelService.cpp
@@ -536,32 +536,32 @@ AudioChannelService::Observe(nsISupports
     JS::Rooted<JS::Value> val(cx);
     if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
         !val.isObject()) {
       return NS_OK;
     }
 
     JS::Rooted<JSObject*> obj(cx, &val.toObject());
     JS::Rooted<JS::Value> key(cx);
-    if (!JS_GetProperty(cx, obj, "key", &key) ||
+    if (!JS_GetProperty(cx, obj, "key", key.address()) ||
         !key.isString()) {
       return NS_OK;
     }
 
     JS::RootedString jsKey(cx, JS_ValueToString(cx, key));
     if (!jsKey) {
       return NS_OK;
     }
     nsDependentJSString keyStr;
     if (!keyStr.init(cx, jsKey) || keyStr.Find("audio.volume.", 0, false)) {
       return NS_OK;
     }
 
     JS::Rooted<JS::Value> value(cx);
-    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isInt32()) {
+    if (!JS_GetProperty(cx, obj, "value", value.address()) || !value.isInt32()) {
       return NS_OK;
     }
 
     nsCOMPtr<nsIAudioManager> audioManager = do_GetService(NS_AUDIOMANAGER_CONTRACTID);
     NS_ENSURE_TRUE(audioManager, NS_OK);
 
     int32_t index = value.toInt32();
     if (keyStr.EqualsLiteral("audio.volume.content")) {
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -2716,17 +2716,17 @@ BaseStubConstructor(nsIWeakReference* aW
       }
 
       nsCxPusher pusher;
       pusher.Push(cx);
 
       JSAutoCompartment ac(cx, thisObject);
 
       JS::Rooted<JS::Value> funval(cx);
-      if (!JS_GetProperty(cx, thisObject, "constructor", &funval) ||
+      if (!JS_GetProperty(cx, thisObject, "constructor", funval.address()) ||
           !funval.isObject()) {
         return NS_ERROR_UNEXPECTED;
       }
 
       // Check if the object is even callable.
       NS_ENSURE_STATE(JS_ObjectIsCallable(cx, &funval.toObject()));
       {
         // wrap parameters in the target compartment
@@ -3221,17 +3221,17 @@ nsDOMConstructor::HasInstance(nsIXPConne
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (!name_struct) {
     // This isn't a normal DOM object, see if this constructor lives on its
     // prototype chain.
     JS::Rooted<JS::Value> val(cx);
-    if (!JS_GetProperty(cx, obj, "prototype", &val)) {
+    if (!JS_GetProperty(cx, obj, "prototype", val.address())) {
       return NS_ERROR_UNEXPECTED;
     }
 
     if (JSVAL_IS_PRIMITIVE(val)) {
       return NS_OK;
     }
 
     JS::Rooted<JSObject*> dot_prototype(cx, val.toObjectOrNull());
@@ -3962,20 +3962,17 @@ nsWindowSH::GlobalResolve(nsGlobalWindow
 // window._content to window.content for backwards compatibility only.
 static JSBool
 ContentWindowGetter(JSContext *cx, unsigned argc, jsval *vp)
 {
   JSObject *obj = JS_THIS_OBJECT(cx, vp);
   if (!obj)
     return JS_FALSE;
 
-  JS::Rooted<JS::Value> value(cx);
-  bool result = ::JS_GetProperty(cx, obj, "content", &value);
-  *vp = value;
-  return result;
+  return ::JS_GetProperty(cx, obj, "content", vp);
 }
 
 template<class Interface>
 static nsresult
 LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp)
 {
   // This function duplicates some of the logic in XPC_WN_HelperSetProperty
   obj = js::CheckedUnwrap(obj, /* stopAtOuter = */ false);
@@ -4112,17 +4109,17 @@ DefineComponentsShim(JSContext *cx, JS::
   for (uint32_t i = 0; i < ArrayLength(kInterfaceShimMap); ++i) {
 
     // Grab the names from the table.
     const char *geckoName = kInterfaceShimMap[i].geckoName;
     const char *domName = kInterfaceShimMap[i].domName;
 
     // Look up the appopriate interface object on the global.
     JS::Rooted<JS::Value> v(cx, JS::UndefinedValue());
-    ok = JS_GetProperty(cx, global, domName, &v);
+    ok = JS_GetProperty(cx, global, domName, v.address());
     NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
     if (!v.isObject()) {
       NS_WARNING("Unable to find interface object on global");
       continue;
     }
 
     // Define the shim on the interfaces object.
     ok = JS_DefineProperty(cx, interfaces, geckoName, v,
@@ -4643,17 +4640,17 @@ nsGenericArraySH::NewResolve(nsIXPConnec
 
 nsresult
 nsGenericArraySH::GetLength(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *obj, uint32_t *length)
 {
   *length = 0;
 
   JS::Rooted<JS::Value> lenval(cx);
-  if (!JS_GetProperty(cx, obj, "length", &lenval)) {
+  if (!JS_GetProperty(cx, obj, "length", lenval.address())) {
     return NS_ERROR_UNEXPECTED;
   }
 
   if (!JSVAL_IS_INT(lenval)) {
     // This can apparently happen with some sparse array impls falling back
     // onto this code.
     return NS_OK;
   }
@@ -4682,17 +4679,17 @@ nsGenericArraySH::Enumerate(nsIXPConnect
   if (sCurrentlyEnumerating) {
     // Don't recurse to death.
     return NS_OK;
   }
 
   sCurrentlyEnumerating = true;
 
   JS::Rooted<JS::Value> len_val(cx);
-  JSBool ok = ::JS_GetProperty(cx, obj, "length", &len_val);
+  JSBool ok = ::JS_GetProperty(cx, obj, "length", len_val.address());
 
   if (ok && JSVAL_IS_INT(len_val)) {
     int32_t length = JSVAL_TO_INT(len_val);
 
     for (int32_t i = 0; ok && i < length; ++i) {
       ok = ::JS_DefineElement(cx, obj, i, JSVAL_VOID, nullptr, nullptr,
                               JSPROP_ENUMERATE | JSPROP_SHARED);
     }
@@ -5030,23 +5027,17 @@ nsHTMLDocumentSH::CallToGetPropMapper(JS
 
   size_t length;
   JS::Anchor<JSString *> anchor(str);
   const jschar *chars = ::JS_GetStringCharsAndLength(cx, str, &length);
   if (!chars) {
     return JS_FALSE;
   }
 
-  JS::Rooted<JS::Value> value(cx);
-  if (!::JS_GetUCProperty(cx, self, chars, length, &value)) {
-    return false;
-  }
-
-  *vp = value;
-  return true;
+  return ::JS_GetUCProperty(cx, self, chars, length, vp);
 }
 
 // StringArray helper
 
 NS_IMETHODIMP
 nsStringArraySH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *aObj, jsid aId, jsval *vp,
                              bool *_retval)
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1317,23 +1317,17 @@ GetPropertyOnPrototype(JSContext* cx, JS
     return false;
   }
 
   *found = hasProp;
   if (!hasProp || !vp) {
     return true;
   }
 
-  JS::Rooted<JS::Value> value(cx);
-  if (!JS_ForwardGetPropertyTo(cx, proto, id, proxy, &value)) {
-    return false;
-  }
-
-  *vp = value;
-  return true;
+  return JS_ForwardGetPropertyTo(cx, proto, id, proxy, vp);
 }
 
 bool
 HasPropertyOnPrototype(JSContext* cx, JS::Handle<JSObject*> proxy,
                        DOMProxyHandler* handler,
                        JS::Handle<jsid> id)
 {
   JS::Rooted<JSObject*> obj(cx, proxy);
@@ -1742,17 +1736,17 @@ InterfaceHasInstance(JSContext* cx, JS::
 
   if (domClass &&
       domClass->mInterfaceChain[clasp->mDepth] == clasp->mPrototypeID) {
     *bp = true;
     return true;
   }
 
   JS::Rooted<JS::Value> protov(cx);
-  DebugOnly<bool> ok = JS_GetProperty(cx, obj, "prototype", &protov);
+  DebugOnly<bool> ok = JS_GetProperty(cx, obj, "prototype", protov.address());
   MOZ_ASSERT(ok, "Someone messed with our prototype property?");
 
   JS::Rooted<JSObject*> interfacePrototype(cx, &protov.toObject());
   MOZ_ASSERT(IsDOMIfaceAndProtoClass(js::GetObjectClass(interfacePrototype)),
              "Someone messed with our prototype property?");
 
   JS::Rooted<JSObject*> proto(cx);
   if (!JS_GetPrototype(cx, instance, proto.address())) {
@@ -1846,17 +1840,17 @@ GetWindowForJSImplementedObject(JSContex
   // Be very careful to not get tricked here.
   MOZ_ASSERT(NS_IsMainThread());
   if (!xpc::AccessCheck::isChrome(js::GetObjectCompartment(obj))) {
     NS_RUNTIMEABORT("Should have a chrome object here");
   }
 
   // Look up the content-side object.
   JS::Rooted<JS::Value> domImplVal(cx);
-  if (!JS_GetProperty(cx, obj, "__DOM_IMPL__", &domImplVal)) {
+  if (!JS_GetProperty(cx, obj, "__DOM_IMPL__", domImplVal.address())) {
     return false;
   }
 
   if (!domImplVal.isObject()) {
     ThrowErrorMessage(cx, MSG_NOT_OBJECT, "Value");
     return false;
   }
 
--- a/dom/bindings/CallbackInterface.cpp
+++ b/dom/bindings/CallbackInterface.cpp
@@ -11,17 +11,17 @@
 
 namespace mozilla {
 namespace dom {
 
 bool
 CallbackInterface::GetCallableProperty(JSContext* cx, const char* aPropName,
                                        JS::MutableHandle<JS::Value> aCallable)
 {
-  if (!JS_GetProperty(cx, mCallback, aPropName, aCallable)) {
+  if (!JS_GetProperty(cx, mCallback, aPropName, aCallable.address())) {
     return false;
   }
   if (!aCallable.isObject() ||
       !JS_ObjectIsCallable(cx, &aCallable.toObject())) {
     nsPrintfCString description("Property '%s'", aPropName);
     ThrowErrorMessage(cx, MSG_NOT_CALLABLE, description.get());
     return false;
   }
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5473,17 +5473,17 @@ class CGSpecializedForwardingSetter(CGSp
 
     def definition_body(self):
         attrName = self.attr.identifier.name
         forwardToAttrName = self.attr.getExtendedAttribute("PutForwards")[0]
         # JS_GetProperty and JS_SetProperty can only deal with ASCII
         assert all(ord(c) < 128 for c in attrName)
         assert all(ord(c) < 128 for c in forwardToAttrName)
         return CGIndenter(CGGeneric("""JS::RootedValue v(cx);
-if (!JS_GetProperty(cx, obj, "%s", &v)) {
+if (!JS_GetProperty(cx, obj, "%s", v.address())) {
   return false;
 }
 
 if (!v.isObject()) {
   return ThrowErrorMessage(cx, MSG_NOT_OBJECT, "%s.%s");
 }
 
 return JS_SetProperty(cx, &v.toObject(), "%s", args[0]);""" % (attrName, self.descriptor.interface.identifier.name, attrName, forwardToAttrName))).define()
@@ -7333,31 +7333,31 @@ class CGDOMJSProxyHandler_get(ClassMetho
     def getBody(self):
         if UseHolderForUnforgeable(self.descriptor):
             hasUnforgeable = (
                 "JSBool hasUnforgeable;\n"
                  "if (!JS_AlreadyHasOwnPropertyById(cx, ${holder}, id, &hasUnforgeable)) {\n"
                  "  return false;\n"
                  "}\n"
                  "if (hasUnforgeable) {\n"
-                 "  return JS_ForwardGetPropertyTo(cx, ${holder}, id, proxy, vp);\n"
+                 "  return JS_ForwardGetPropertyTo(cx, ${holder}, id, proxy, vp.address());\n"
                  "}")
             getUnforgeableOrExpando = CallOnUnforgeableHolder(self.descriptor,
                                                               hasUnforgeable)
         else:
             getUnforgeableOrExpando = ""
         getUnforgeableOrExpando += """JS::Rooted<JSObject*> expando(cx, DOMProxyHandler::GetExpandoObject(proxy));
 if (expando) {
   JSBool hasProp;
   if (!JS_HasPropertyById(cx, expando, id, &hasProp)) {
     return false;
   }
 
   if (hasProp) {
-    return JS_GetPropertyById(cx, expando, id, vp);
+    return JS_GetPropertyById(cx, expando, id, vp.address());
   }
 }"""
 
         templateValues = {'jsvalRef': 'vp', 'jsvalHandle': 'vp', 'obj': 'proxy'}
 
         if self.descriptor.supportsIndexedProperties():
             getIndexedOrExpando = ("int32_t index = GetArrayIndexFromId(cx, id);\n" +
                                    "if (IsArrayIndex(index)) {\n" +
@@ -8001,21 +8001,21 @@ class CGDictionary(CGThing):
         if conversionInfo.dealWithOptional:
             replacements["declName"] = "(" + replacements["declName"] + ".Value())"
         if member.defaultValue:
             replacements["haveValue"] = "!isNull && !temp.ref().isUndefined()"
 
         # NOTE: jsids are per-runtime, so don't use them in workers
         if self.workers:
             propName = member.identifier.name
-            propGet = ('JS_GetProperty(cx, &val.toObject(), "%s", &temp.ref())' %
+            propGet = ('JS_GetProperty(cx, &val.toObject(), "%s", temp.ref().address())' %
                        propName)
         else:
             propId = self.makeIdName(member.identifier.name);
-            propGet = ("JS_GetPropertyById(cx, &val.toObject(), %s, &temp.ref())" %
+            propGet = ("JS_GetPropertyById(cx, &val.toObject(), %s, temp.ref().address())" %
                        propId)
 
         conversionReplacements = {
             "prop": self.makeMemberName(member.identifier.name),
             "convert": string.Template(conversionInfo.template).substitute(replacements),
             "propGet": propGet
             }
         conversion = ("if (!isNull && !${propGet}) {\n"
@@ -9902,17 +9902,17 @@ class CallbackGetter(CallbackMember):
         return "JS::Rooted<JS::Value> rval(cx, JS::UndefinedValue());\n"
 
     def getCall(self):
         replacements = {
             "errorReturn" : self.getDefaultRetval(),
             "attrName": self.attrName
             }
         return string.Template(
-            'if (!JS_GetProperty(cx, mCallback, "${attrName}", &rval)) {\n'
+            'if (!JS_GetProperty(cx, mCallback, "${attrName}", rval.address())) {\n'
             '  aRv.Throw(NS_ERROR_UNEXPECTED);\n'
             '  return${errorReturn};\n'
             '}\n').substitute(replacements);
 
 class CallbackSetter(CallbackMember):
     def __init__(self, attr, descriptor):
         self.ensureASCIIName(attr)
         self.attrName = attr.identifier.name
--- a/dom/bluetooth/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/BluetoothHfpManager.cpp
@@ -532,28 +532,28 @@ BluetoothHfpManager::HandleVolumeChanged
   NS_ENSURE_TRUE_VOID(cx);
 
   JS::Rooted<JS::Value> val(cx);
   NS_ENSURE_TRUE_VOID(JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val));
   NS_ENSURE_TRUE_VOID(val.isObject());
 
   JS::Rooted<JSObject*> obj(cx, &val.toObject());
   JS::Rooted<JS::Value> key(cx);
-  if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
+  if (!JS_GetProperty(cx, obj, "key", key.address()) || !key.isString()) {
     return;
   }
 
   JSBool match;
   if (!JS_StringEqualsAscii(cx, key.toString(), AUDIO_VOLUME_BT_SCO_ID, &match) ||
       (match != JS_TRUE)) {
     return;
   }
 
   JS::Rooted<JS::Value> value(cx);
-  if (!JS_GetProperty(cx, obj, "value", &value)||
+  if (!JS_GetProperty(cx, obj, "value", value.address())||
       !value.isNumber()) {
     return;
   }
 
   mCurrentVgs = value.toNumber();
 
   // Adjust volume by headset and we don't have to send volume back to headset
   if (mReceiveVgsFlag) {
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@@ -561,17 +561,17 @@ BluetoothService::HandleSettingsChanged(
   }
 
   if (!val.isObject()) {
     return NS_OK;
   }
 
   JSObject& obj(val.toObject());
 
-  JS::Rooted<JS::Value> key(cx);
+  JS::Value key;
   if (!JS_GetProperty(cx, &obj, "key", &key)) {
     MOZ_ASSERT(!JS_IsExceptionPending(cx));
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   if (!key.isString()) {
     return NS_OK;
   }
@@ -579,17 +579,17 @@ BluetoothService::HandleSettingsChanged(
   // First, check if the string equals to BLUETOOTH_DEBUGGING_SETTING
   JSBool match;
   if (!JS_StringEqualsAscii(cx, key.toString(), BLUETOOTH_DEBUGGING_SETTING, &match)) {
     MOZ_ASSERT(!JS_IsExceptionPending(cx));
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   if (match) {
-    JS::Rooted<JS::Value> value;
+    JS::Value value;
     if (!JS_GetProperty(cx, &obj, "value", &value)) {
       MOZ_ASSERT(!JS_IsExceptionPending(cx));
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
     if (!value.isBoolean()) {
       MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.debugging.enabled'!");
       return NS_ERROR_UNEXPECTED;
--- a/dom/indexedDB/KeyPath.cpp
+++ b/dom/indexedDB/KeyPath.cpp
@@ -112,17 +112,18 @@ GetJSValFromKeyPathString(JSContext* aCx
 
       JSBool ok = JS_HasUCProperty(aCx, obj, keyPathChars, keyPathLen,
                                    &hasProp);
       NS_ENSURE_TRUE(ok, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
       if (hasProp) {
         // Get if the property exists...
         JS::Rooted<JS::Value> intermediate(aCx);
-        JSBool ok = JS_GetUCProperty(aCx, obj, keyPathChars, keyPathLen, &intermediate);
+        JSBool ok = JS_GetUCProperty(aCx, obj, keyPathChars, keyPathLen,
+                                     intermediate.address());
         NS_ENSURE_TRUE(ok, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
         // Treat explicitly undefined as an error.
         if (intermediate == JSVAL_VOID) {
           return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
         }
         if (tokenizer.hasMoreTokens()) {
           // ...and walk to it if there are more steps...
--- a/dom/network/src/TCPSocketParent.cpp
+++ b/dom/network/src/TCPSocketParent.cpp
@@ -166,17 +166,17 @@ TCPSocketParent::SendCallback(const nsAS
       InfallibleTArray<uint8_t> arr;
       arr.SwapElements(fallibleArr);
       data = SendableData(arr);
 
     } else {
       nsDependentJSString name;
 
       JS::Rooted<JS::Value> val(aCx);
-      if (!JS_GetProperty(aCx, obj, "name", &val)) {
+      if (!JS_GetProperty(aCx, obj, "name", val.address())) {
         NS_ERROR("No name property on supposed error object");
       } else if (JSVAL_IS_STRING(val)) {
         if (!name.init(aCx, JSVAL_TO_STRING(val))) {
           NS_WARNING("couldn't initialize string");
         }
       }
 
       data = TCPError(name);
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -535,17 +535,17 @@ nsJSObjWrapper::NP_Invalidate(NPObject *
     }
 
     // Forget our reference to the JSObject.
     jsnpobj->mJSObj = nullptr;
   }
 }
 
 static JSBool
-GetProperty(JSContext *cx, JSObject *obj, NPIdentifier id, JS::MutableHandle<JS::Value> rval)
+GetProperty(JSContext *cx, JSObject *obj, NPIdentifier id, JS::Value *rval)
 {
   NS_ASSERTION(NPIdentifierIsInt(id) || NPIdentifierIsString(id),
                "id must be either string or int!\n");
   return ::JS_GetPropertyById(cx, obj, NPIdentifierToJSId(id), rval);
 }
 
 // static
 bool
@@ -569,17 +569,17 @@ nsJSObjWrapper::NP_HasMethod(NPObject *n
 
   nsCxPusher pusher;
   pusher.Push(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
 
   AutoJSExceptionReporter reporter(cx);
 
   JS::Rooted<JS::Value> v(cx);
-  JSBool ok = GetProperty(cx, npjsobj->mJSObj, id, &v);
+  JSBool ok = GetProperty(cx, npjsobj->mJSObj, id, v.address());
 
   return ok && !JSVAL_IS_PRIMITIVE(v) &&
     ::JS_ObjectIsFunction(cx, JSVAL_TO_OBJECT(v));
 }
 
 static bool
 doInvoke(NPObject *npobj, NPIdentifier method, const NPVariant *args,
          uint32_t argCount, bool ctorCall, NPVariant *result)
@@ -605,17 +605,17 @@ doInvoke(NPObject *npobj, NPIdentifier m
   nsCxPusher pusher;
   pusher.Push(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
   JS::Rooted<JS::Value> fv(cx);
 
   AutoJSExceptionReporter reporter(cx);
 
   if (method != NPIdentifier_VOID) {
-    if (!GetProperty(cx, npjsobj->mJSObj, method, &fv) ||
+    if (!GetProperty(cx, npjsobj->mJSObj, method, fv.address()) ||
         ::JS_TypeOfValue(cx, fv) != JSTYPE_FUNCTION) {
       return false;
     }
   } else {
     fv = OBJECT_TO_JSVAL(npjsobj->mJSObj);
   }
 
   JS::Value jsargs_buf[8];
@@ -747,17 +747,17 @@ nsJSObjWrapper::NP_GetProperty(NPObject 
   nsJSObjWrapper *npjsobj = (nsJSObjWrapper *)npobj;
 
   nsCxPusher pusher;
   pusher.Push(cx);
   AutoJSExceptionReporter reporter(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
 
   JS::Rooted<JS::Value> v(cx);
-  return (GetProperty(cx, npjsobj->mJSObj, id, &v) &&
+  return (GetProperty(cx, npjsobj->mJSObj, id, v.address()) &&
           JSValToNPVariant(npp, cx, v, result));
 }
 
 // static
 bool
 nsJSObjWrapper::NP_SetProperty(NPObject *npobj, NPIdentifier id,
                                const NPVariant *value)
 {
@@ -1616,17 +1616,17 @@ NPObjWrapper_Convert(JSContext *cx, JS::
   // either property with a value that isn't callable, will cause that property
   // to simply be ignored.  But there is a problem in one specific case: Java,
   // specifically java.lang.Integer.  The Integer class has static valueOf
   // methods, none of which are nullary, so the JS-reflected method will behave
   // poorly when called with no arguments.  We work around this problem by
   // giving plugins a [[DefaultValue]] which uses only toString and not valueOf.
 
   JS::Rooted<JS::Value> v(cx, JSVAL_VOID);
-  if (!JS_GetProperty(cx, obj, "toString", &v))
+  if (!JS_GetProperty(cx, obj, "toString", v.address()))
     return false;
   if (!JSVAL_IS_PRIMITIVE(v) && JS_ObjectIsCallable(cx, JSVAL_TO_OBJECT(v))) {
     if (!JS_CallFunctionValue(cx, obj, v, 0, NULL, vp.address()))
       return false;
     if (JSVAL_IS_PRIMITIVE(vp))
       return true;
   }
 
--- a/dom/src/geolocation/nsGeolocation.cpp
+++ b/dom/src/geolocation/nsGeolocation.cpp
@@ -713,27 +713,27 @@ nsGeolocationService::HandleMozsettingCh
     nsDependentString dataStr(aData);
     JS::Rooted<JS::Value> val(cx);
     if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) || !val.isObject()) {
       return;
     }
 
     JS::Rooted<JSObject*> obj(cx, &val.toObject());
     JS::Rooted<JS::Value> key(cx);
-    if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
+    if (!JS_GetProperty(cx, obj, "key", key.address()) || !key.isString()) {
       return;
     }
 
     JSBool match;
     if (!JS_StringEqualsAscii(cx, key.toString(), GEO_SETINGS_ENABLED, &match) || (match != JS_TRUE)) {
       return;
     }
 
     JS::Rooted<JS::Value> value(cx);
-    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isBoolean()) {
+    if (!JS_GetProperty(cx, obj, "value", value.address()) || !value.isBoolean()) {
       return;
     }
 
     HandleMozsettingValue(value.toBoolean());
 }
 
 void
 nsGeolocationService::HandleMozsettingValue(const bool aValue)
--- a/dom/src/json/nsJSON.cpp
+++ b/dom/src/json/nsJSON.cpp
@@ -206,17 +206,17 @@ nsJSON::EncodeInternal(JSContext* cx, co
   /* Backward compatibility:
    * Manually call toJSON if implemented by the object and check that
    * the result is still an object
    * Note: It is perfectly fine to not implement toJSON, so it is
    * perfectly fine for GetMethod to fail
    */
   JS::Rooted<JS::Value> val(cx, aValue);
   JS::Rooted<JS::Value> toJSON(cx);
-  if (JS_GetProperty(cx, obj, "toJSON", &toJSON) &&
+  if (JS_GetProperty(cx, obj, "toJSON", toJSON.address()) &&
       toJSON.isObject() &&
       JS_ObjectIsCallable(cx, &toJSON.toObject())) {
     // If toJSON is implemented, it must not throw
     if (!JS_CallFunctionValue(cx, obj, toJSON, 0, NULL, val.address())) {
       if (JS_IsExceptionPending(cx))
         // passing NS_OK will throw the pending exception
         return NS_OK;
 
--- a/dom/system/OSFileConstants.cpp
+++ b/dom/system/OSFileConstants.cpp
@@ -600,17 +600,17 @@ static dom::ConstantSpec gWinProperties[
  *
  * If the field does not exist, create it. If it exists but is not an
  * object, throw a JS error.
  */
 JSObject *GetOrCreateObjectProperty(JSContext *cx, JS::Handle<JSObject*> aObject,
                                     const char *aProperty)
 {
   JS::Rooted<JS::Value> val(cx);
-  if (!JS_GetProperty(cx, aObject, aProperty, &val)) {
+  if (!JS_GetProperty(cx, aObject, aProperty, val.address())) {
     return NULL;
   }
   if (!val.isUndefined()) {
     if (val.isObject()) {
       return &val.toObject();
     }
 
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
--- a/dom/system/gonk/AudioManager.cpp
+++ b/dom/system/gonk/AudioManager.cpp
@@ -214,46 +214,46 @@ AudioManager::Observe(nsISupports* aSubj
                                             audioState, address.get());
       if (audioState == AUDIO_POLICY_DEVICE_STATE_AVAILABLE) {
         String8 cmd("bluetooth_enabled=true");
         AudioSystem::setParameters(0, cmd);
         cmd.setTo("A2dpSuspended=false");
         AudioSystem::setParameters(0, cmd);
       }
     }
-  }
+  } 
   // To process the volume control on each audio channel according to
   // change of settings
   else if (!strcmp(aTopic, "mozsettings-changed")) {
     AutoSafeJSContext cx;
     nsDependentString dataStr(aData);
     JS::Rooted<JS::Value> val(cx);
     if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
         !val.isObject()) {
       return NS_OK;
     }
 
     JS::Rooted<JSObject*> obj(cx, &val.toObject());
     JS::Rooted<JS::Value> key(cx);
-    if (!JS_GetProperty(cx, obj, "key", &key) ||
+    if (!JS_GetProperty(cx, obj, "key", key.address()) ||
         !key.isString()) {
       return NS_OK;
     }
 
     JS::RootedString jsKey(cx, JS_ValueToString(cx, key));
     if (!jsKey) {
       return NS_OK;
     }
     nsDependentJSString keyStr;
     if (!keyStr.init(cx, jsKey) || keyStr.EqualsLiteral("audio.volume.bt_sco")) {
       return NS_OK;
     }
 
     JS::Rooted<JS::Value> value(cx);
-    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isInt32()) {
+    if (!JS_GetProperty(cx, obj, "value", value.address()) || !value.isInt32()) {
       return NS_OK;
     }
 
     int32_t index = value.toInt32();
     SetStreamVolumeIndex(AUDIO_STREAM_BLUETOOTH_SCO, index);
 
     return NS_OK;
   }
--- a/dom/system/gonk/AutoMounterSetting.cpp
+++ b/dom/system/gonk/AutoMounterSetting.cpp
@@ -181,29 +181,29 @@ AutoMounterSetting::Observe(nsISupports*
   mozilla::AutoSafeJSContext cx;
   nsDependentString dataStr(aData);
   JS::Rooted<JS::Value> val(cx);
   if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
       !val.isObject()) {
     return NS_OK;
   }
   JSObject& obj(val.toObject());
-  JS::Rooted<JS::Value> key(cx);
+  JS::Value key;
   if (!JS_GetProperty(cx, &obj, "key", &key) ||
       !key.isString()) {
     return NS_OK;
   }
 
   JSString *jsKey = JS_ValueToString(cx, key);
   nsDependentJSString keyStr;
   if (!keyStr.init(cx, jsKey)) {
     return NS_OK;
   }
 
-  JS::Rooted<JS::Value> value(cx);
+  JS::Value value;
   if (!JS_GetProperty(cx, &obj, "value", &value)) {
     return NS_OK;
   }
 
   // Check for ums.mode changes
   if (keyStr.EqualsLiteral(UMS_MODE)) {
     if (!value.isInt32()) {
       return NS_OK;
--- a/dom/system/gonk/TimeZoneSettingObserver.cpp
+++ b/dom/system/gonk/TimeZoneSettingObserver.cpp
@@ -175,29 +175,29 @@ TimeZoneSettingObserver::Observe(nsISupp
   JS::Rooted<JS::Value> val(cx);
   if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
       !val.isObject()) {
     return NS_OK;
   }
 
   // Get the key, which should be the JS string "time.timezone".
   JSObject &obj(val.toObject());
-  JS::Rooted<JS::Value> key(cx);
+  JS::Value key;
   if (!JS_GetProperty(cx, &obj, "key", &key) ||
       !key.isString()) {
     return NS_OK;
   }
   JSBool match;
   if (!JS_StringEqualsAscii(cx, key.toString(), TIME_TIMEZONE, &match) ||
       match != JS_TRUE) {
     return NS_OK;
   }
 
   // Get the value, which should be a JS string like "America/Chicago".
-  JS::Rooted<JS::Value> value(cx);
+  JS::Value value;
   if (!JS_GetProperty(cx, &obj, "value", &value) ||
       !value.isString()) {
     return NS_OK;
   }
 
   // Set the system timezone.
   return SetTimeZone(value, cx);
 }
--- a/dom/workers/ChromeWorkerScope.cpp
+++ b/dom/workers/ChromeWorkerScope.cpp
@@ -50,17 +50,17 @@ BEGIN_WORKERS_NAMESPACE
 bool
 DefineChromeWorkerFunctions(JSContext* aCx, JS::Handle<JSObject*> aGlobal)
 {
   // Currently ctypes is the only special property given to ChromeWorkers.
 #ifdef BUILD_CTYPES
   {
     JS::Rooted<JS::Value> ctypes(aCx);
     if (!JS_InitCTypesClass(aCx, aGlobal) ||
-        !JS_GetProperty(aCx, aGlobal, "ctypes", &ctypes)) {
+        !JS_GetProperty(aCx, aGlobal, "ctypes", ctypes.address())) {
       return false;
     }
 
     static JSCTypesCallbacks callbacks = {
       UnicodeToNative
     };
 
     JS_SetCTypesCallbacks(JSVAL_TO_OBJECT(ctypes), &callbacks);
--- a/dom/workers/EventListenerManager.cpp
+++ b/dom/workers/EventListenerManager.cpp
@@ -293,17 +293,17 @@ EventListenerManager::DispatchEvent(JSCo
   using namespace mozilla::dom::workers::events;
 
   if (!IsSupportedEventClass(aEvent)) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   JS::Rooted<JS::Value> val(aCx);
-  if (!JS_GetProperty(aCx, aEvent, "target", &val)) {
+  if (!JS_GetProperty(aCx, aEvent, "target", val.address())) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   if (!JSVAL_IS_NULL(val)) {
     // Already has a target, must be recursively dispatched. Throw.
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
@@ -311,26 +311,26 @@ EventListenerManager::DispatchEvent(JSCo
 
   if (mCollections.isEmpty()) {
     return false;
   }
 
   JS::Rooted<JSString*> eventType(aCx);
   JSBool eventIsTrusted;
 
-  if (!JS_GetProperty(aCx, aEvent, "type", &val) ||
+  if (!JS_GetProperty(aCx, aEvent, "type", val.address()) ||
       !(eventType = JS_ValueToString(aCx, val)) ||
       !(eventType = JS_InternJSString(aCx, eventType))) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   // We have already ensure that the event is one of our types of events so
   // there is no need to worry about this property being faked.
-  if (!JS_GetProperty(aCx, aEvent, "isTrusted", &val) ||
+  if (!JS_GetProperty(aCx, aEvent, "isTrusted", val.address()) ||
       !JS_ValueToBoolean(aCx, val, &eventIsTrusted)) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   ListenerCollection* collection =
     GetCollectionForType(mCollections, INTERNED_STRING_TO_JSID(aCx, eventType));
   if (!collection) {
@@ -403,17 +403,17 @@ EventListenerManager::DispatchEvent(JSCo
       if (!JS_ReportPendingException(aCx)) {
         aRv.Throw(NS_ERROR_FAILURE);
         return false;
       }
       continue;
     }
 
     if (hasHandleEvent) {
-      if (!JS_GetProperty(aCx, listenerObj, sHandleEventChars, &listenerVal)) {
+      if (!JS_GetProperty(aCx, listenerObj, sHandleEventChars, listenerVal.address())) {
         if (!JS_ReportPendingException(aCx)) {
           aRv.Throw(NS_ERROR_FAILURE);
           return false;
         }
         continue;
       }
 
       thisObj = listenerObj;
--- a/dom/workers/Events.cpp
+++ b/dom/workers/Events.cpp
@@ -52,24 +52,24 @@ public:
 
   static JSObject*
   InitClass(JSContext* aCx, JS::Handle<JSObject*> aObj, bool aMainRuntime)
   {
     JS::Rooted<JSObject*> parentProto(aCx);
 
     if (aMainRuntime) {
       JS::Rooted<JS::Value> windowPropVal(aCx);
-      if (!JS_GetProperty(aCx, aObj, sClass.name, &windowPropVal)) {
+      if (!JS_GetProperty(aCx, aObj, sClass.name, windowPropVal.address())) {
         return NULL;
       }
 
       if (!JSVAL_IS_PRIMITIVE(windowPropVal)) {
         JS::Rooted<JS::Value> protoVal(aCx);
         if (!JS_GetProperty(aCx, JSVAL_TO_OBJECT(windowPropVal), "prototype",
-                            &protoVal)) {
+                            protoVal.address())) {
           return NULL;
         }
 
         if (!JSVAL_IS_PRIMITIVE(protoVal)) {
           parentProto = JSVAL_TO_OBJECT(protoVal);
         }
       }
     }
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -261,20 +261,19 @@ private:
     JS::Rooted<JS::Value> scope(aCx, js::GetFunctionNativeReserved(wrapper, SLOT_wrappedScope));
     JS::Rooted<JS::Value> listener(aCx, js::GetFunctionNativeReserved(wrapper, SLOT_wrappedFunction));
 
     JS_ASSERT(scope.isObject());
 
     JS::Rooted<JSObject*> event(aCx, &JS_ARGV(aCx, aVp)[0].toObject());
 
     jsval argv[3] = { JSVAL_VOID, JSVAL_VOID, JSVAL_VOID };
-    JS::AutoArrayRooter rootedArgv(aCx, ArrayLength(argv), argv);
-    if (!JS_GetProperty(aCx, event, "message", rootedArgv.handleAt(0)) ||
-        !JS_GetProperty(aCx, event, "filename", rootedArgv.handleAt(1)) ||
-        !JS_GetProperty(aCx, event, "lineno", rootedArgv.handleAt(2))) {
+    if (!JS_GetProperty(aCx, event, "message", &argv[0]) ||
+        !JS_GetProperty(aCx, event, "filename", &argv[1]) ||
+        !JS_GetProperty(aCx, event, "lineno", &argv[2])) {
       return false;
     }
 
     JS::Rooted<JS::Value> rval(aCx, JS::UndefinedValue());
     if (!JS_CallFunctionValue(aCx, JSVAL_TO_OBJECT(scope), listener,
                               ArrayLength(argv), argv, rval.address())) {
       JS_ReportPendingException(aCx);
       return false;
--- a/ipc/testshell/XPCShellEnvironment.cpp
+++ b/ipc/testshell/XPCShellEnvironment.cpp
@@ -73,17 +73,17 @@ private:
 };
 
 inline XPCShellEnvironment*
 Environment(JSObject* global)
 {
     AutoSafeJSContext cx;
     JSAutoCompartment ac(cx, global);
     Rooted<Value> v(cx);
-    if (!JS_GetProperty(cx, global, "__XPCShellEnvironment", &v) ||
+    if (!JS_GetProperty(cx, global, "__XPCShellEnvironment", v.address()) ||
         !v.get().isDouble())
     {
         return nullptr;
     }
     return static_cast<XPCShellEnvironment*>(v.get().toPrivate());
 }
 
 static JSBool
--- a/js/ipc/JavaScriptChild.cpp
+++ b/js/ipc/JavaScriptChild.cpp
@@ -367,17 +367,17 @@ JavaScriptChild::AnswerGet(const ObjectI
         return false;
 
     JSAutoCompartment comp(cx, obj);
 
     RootedId internedId(cx);
     if (!convertGeckoStringToId(cx, id, &internedId))
         return fail(cx, rs);
 
-    JS::Rooted<JS::Value> val(cx);
+    JS::Value val;
     if (!JS_ForwardGetPropertyTo(cx, obj, internedId, receiver, &val))
         return fail(cx, rs);
 
     if (!toVariant(cx, val, result))
         return fail(cx, rs);
 
     return ok(rs);
 }
@@ -511,17 +511,17 @@ JavaScriptChild::AnswerCall(const Object
 
     // Go through each argument that was an outparam, retrieve the "value"
     // field, and add it to a temporary list. We need to do this separately
     // because the outparams vector is not rooted.
     vals.clear();
     for (size_t i = 0; i < outobjects.length(); i++) {
         RootedObject obj(cx, &outobjects[i].toObject());
 
-        RootedValue v(cx);
+        jsval v;
         JSBool found;
         if (JS_HasProperty(cx, obj, "value", &found)) {
             if (!JS_GetProperty(cx, obj, "value", &v))
                 return fail(cx, rs);
         } else {
             v = UndefinedValue();
         }
         if (!vals.append(v))
--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -452,17 +452,17 @@ JavaScriptShared::Wrap(JSContext *cx, Ha
     RootedValue v(cx);
     for (size_t i = 0; i < ids.length(); i++) {
         id = ids[i];
 
         nsString str;
         if (!convertIdToGeckoString(cx, id, &str))
             return false;
 
-        if (!JS_GetPropertyById(cx, aObj, id, &v))
+        if (!JS_GetPropertyById(cx, aObj, id, v.address()))
             return false;
 
         JSVariant var;
         if (!toVariant(cx, v, &var))
             return false;
 
         outCpows->AppendElement(CpowEntry(str, var));
     }
--- a/js/jsd/jsd_val.cpp
+++ b/js/jsd/jsd_val.cpp
@@ -504,17 +504,17 @@ jsd_GetValueProperty(JSDContext* jsdc, J
         JS_GetUCPropertyAttributes(cx, obj, nameChars, nameLen, &attrs, &found);
         if (!found)
         {
             return NULL;
         }
 
         JS_ClearPendingException(cx);
 
-        if(!JS_GetUCProperty(cx, obj, nameChars, nameLen, &val))
+        if(!JS_GetUCProperty(cx, obj, nameChars, nameLen, val.address()))
         {
             if (JS_IsExceptionPending(cx))
             {
                 if (!JS_GetPendingException(cx, &pd.value))
                 {
                     return NULL;
                 }
                 pd.flags = JSPD_EXCEPTION;
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -1252,17 +1252,17 @@ GetCallbacks(JSObject* obj)
 
 // Utility function to access a property of an object as an object
 // returns false and sets the error if the property does not exist
 // or is not an object
 static bool GetObjectProperty(JSContext *cx, HandleObject obj,
                               const char *property, MutableHandleObject result)
 {
   RootedValue val(cx);
-  if (!JS_GetProperty(cx, obj, property, &val)) {
+  if (!JS_GetProperty(cx, obj, property, val.address())) {
     return false;
   }
 
   if (JSVAL_IS_PRIMITIVE(val)) {
     JS_ReportError(cx, "missing or non-object field");
     return false;
   }
 
@@ -2539,17 +2539,17 @@ ImplicitConvert(JSContext* cx,
         }
 
         JSFlatString *name = JSID_TO_FLAT_STRING(id);
         const FieldInfo* field = StructType::LookupField(cx, targetType, name);
         if (!field)
           return false;
 
         RootedValue prop(cx);
-        if (!JS_GetPropertyById(cx, valObj, id, &prop))
+        if (!JS_GetPropertyById(cx, valObj, id, prop.address()))
           return false;
 
         // Convert the field via ImplicitConvert().
         char* fieldData = intermediate.get() + field->mOffset;
         if (!ImplicitConvert(cx, prop, field->mType, fieldData, false, NULL))
           return false;
 
         ++i;
@@ -4287,17 +4287,17 @@ ArrayType::ConstructData(JSContext* cx,
       // Have a length, rather than an object to initialize from.
       convertObject = false;
 
     } else if (!JSVAL_IS_PRIMITIVE(args[0])) {
       // We were given an object with a .length property.
       // This could be a JS array, or a CData array.
       RootedObject arg(cx, &args[0].toObject());
       RootedValue lengthVal(cx);
-      if (!JS_GetProperty(cx, arg, "length", &lengthVal) ||
+      if (!JS_GetProperty(cx, arg, "length", lengthVal.address()) ||
           !jsvalToSize(cx, lengthVal, false, &length)) {
         JS_ReportError(cx, "argument must be an array object or length");
         return JS_FALSE;
       }
 
     } else if (args[0].isString()) {
       // We were given a string. Size the array to the appropriate length,
       // including space for the terminator.
@@ -4639,17 +4639,17 @@ ExtractStructField(JSContext* cx, jsval 
   if (!JS_NextProperty(cx, iter, &id))
     return NULL;
   if (!JSID_IS_VOID(id)) {
     JS_ReportError(cx, "struct field descriptors must contain one property");
     return NULL;
   }
 
   RootedValue propVal(cx);
-  if (!JS_GetPropertyById(cx, obj, nameid, &propVal))
+  if (!JS_GetPropertyById(cx, obj, nameid, propVal.address()))
     return NULL;
 
   if (propVal.isPrimitive() || !CType::IsCType(&propVal.toObject())) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
 
   // Undefined size or zero size struct members are illegal.
@@ -7406,17 +7406,17 @@ Int64::Construct(JSContext* cx,
 
   int64_t i = 0;
   if (!jsvalToBigInteger(cx, args[0], true, &i))
     return TypeError(cx, "int64", args[0]);
 
   // Get ctypes.Int64.prototype from the 'prototype' property of the ctor.
   RootedValue slot(cx);
   RootedObject callee(cx, &args.callee());
-  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", &slot));
+  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", slot.address()));
   RootedObject proto(cx, JSVAL_TO_OBJECT(slot));
   JS_ASSERT(JS_GetClass(proto) == &sInt64ProtoClass);
 
   JSObject* result = Int64Base::Construct(cx, proto, i, false);
   if (!result)
     return JS_FALSE;
 
   args.rval().setObject(*result);
@@ -7576,17 +7576,17 @@ UInt64::Construct(JSContext* cx,
 
   uint64_t u = 0;
   if (!jsvalToBigInteger(cx, args[0], true, &u))
     return TypeError(cx, "uint64", args[0]);
 
   // Get ctypes.UInt64.prototype from the 'prototype' property of the ctor.
   RootedValue slot(cx);
   RootedObject callee(cx, &args.callee());
-  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", &slot));
+  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", slot.address()));
   RootedObject proto(cx, &slot.toObject());
   JS_ASSERT(JS_GetClass(proto) == &sUInt64ProtoClass);
 
   JSObject* result = Int64Base::Construct(cx, proto, u, true);
   if (!result)
     return JS_FALSE;
 
   args.rval().setObject(*result);
--- a/js/src/jsapi-tests/testArrayBuffer.cpp
+++ b/js/src/jsapi-tests/testArrayBuffer.cpp
@@ -34,19 +34,19 @@ BEGIN_TEST(testArrayBuffer_bug720949_ste
         JS::HandleObject obj = testBuf[i];
         JS::HandleObject view = testArray[i];
         uint32_t size = sizes[i];
         JS::RootedValue v(cx);
 
         // Byte lengths should all agree
         CHECK(JS_IsArrayBufferObject(obj));
         CHECK_EQUAL(JS_GetArrayBufferByteLength(obj), size);
-        JS_GetProperty(cx, obj, "byteLength", &v);
+        JS_GetProperty(cx, obj, "byteLength", v.address());
         CHECK_SAME(v, INT_TO_JSVAL(size));
-        JS_GetProperty(cx, view, "byteLength", &v);
+        JS_GetProperty(cx, view, "byteLength", v.address());
         CHECK_SAME(v, INT_TO_JSVAL(size));
 
         // Modifying the underlying data should update the value returned through the view
         uint8_t *data = JS_GetArrayBufferData(obj);
         CHECK(data != NULL);
         *reinterpret_cast<uint32_t*>(data) = MAGIC_VALUE_2;
         CHECK(JS_GetElement(cx, view, 0, v.address()));
         CHECK_SAME(v, INT_TO_JSVAL(MAGIC_VALUE_2));
@@ -54,23 +54,23 @@ BEGIN_TEST(testArrayBuffer_bug720949_ste
         // Steal the contents
         void *contents;
         CHECK(JS_StealArrayBufferContents(cx, obj, &contents, &data));
         CHECK(contents != NULL);
         CHECK(data != NULL);
 
         // Check that the original ArrayBuffer is neutered
         CHECK_EQUAL(JS_GetArrayBufferByteLength(obj), 0);
-        CHECK(JS_GetProperty(cx, obj, "byteLength", &v));
+        CHECK(JS_GetProperty(cx, obj, "byteLength", v.address()));
         CHECK_SAME(v, INT_TO_JSVAL(0));
-        CHECK(JS_GetProperty(cx, view, "byteLength", &v));
+        CHECK(JS_GetProperty(cx, view, "byteLength", v.address()));
         CHECK_SAME(v, INT_TO_JSVAL(0));
-        CHECK(JS_GetProperty(cx, view, "byteOffset", &v));
+        CHECK(JS_GetProperty(cx, view, "byteOffset", v.address()));
         CHECK_SAME(v, INT_TO_JSVAL(0));
-        CHECK(JS_GetProperty(cx, view, "length", &v));
+        CHECK(JS_GetProperty(cx, view, "length", v.address()));
         CHECK_SAME(v, INT_TO_JSVAL(0));
         CHECK_EQUAL(JS_GetArrayBufferByteLength(obj), 0);
         v = JSVAL_VOID;
         JS_GetElement(cx, obj, 0, v.address());
         CHECK_SAME(v, JSVAL_VOID);
 
         // Transfer to a new ArrayBuffer
         JS::RootedObject dst(cx, JS_NewArrayBufferWithContents(cx, contents));
@@ -159,12 +159,12 @@ BEGIN_TEST(testArrayBuffer_bug720949_vie
         GC(cx);
     }
 
     return true;
 }
 
 bool isNeutered(JS::HandleObject obj) {
     JS::RootedValue v(cx);
-    return JS_GetProperty(cx, obj, "byteLength", &v) && v.toInt32() == 0;
+    return JS_GetProperty(cx, obj, "byteLength", v.address()) && v.toInt32() == 0;
 }
 
 END_TEST(testArrayBuffer_bug720949_viewList)
--- a/js/src/jsapi-tests/testException.cpp
+++ b/js/src/jsapi-tests/testException.cpp
@@ -13,13 +13,13 @@ BEGIN_TEST(testException_bug860435)
 
     EVAL("ReferenceError", fun.address());
     CHECK(fun.isObject());
 
     JS::RootedValue v(cx);
     JS_CallFunctionValue(cx, global, fun, 0, v.address(), v.address());
     CHECK(v.isObject());
 
-    JS_GetProperty(cx, &v.toObject(), "stack", &v);
+    JS_GetProperty(cx, &v.toObject(), "stack", v.address());
     CHECK(v.isString());
     return true;
 }
 END_TEST(testException_bug860435)
--- a/js/src/jsapi-tests/testFunctionProperties.cpp
+++ b/js/src/jsapi-tests/testFunctionProperties.cpp
@@ -10,17 +10,17 @@
 BEGIN_TEST(testFunctionProperties)
 {
     JS::RootedValue x(cx);
     EVAL("(function f() {})", x.address());
 
     JS::RootedObject obj(cx, JSVAL_TO_OBJECT(x));
 
     JS::RootedValue y(cx);
-    CHECK(JS_GetProperty(cx, obj, "arguments", &y));
+    CHECK(JS_GetProperty(cx, obj, "arguments", y.address()));
     CHECK_SAME(y, JSVAL_NULL);
 
-    CHECK(JS_GetProperty(cx, obj, "caller", &y));
+    CHECK(JS_GetProperty(cx, obj, "caller", y.address()));
     CHECK_SAME(y, JSVAL_NULL);
 
     return true;
 }
 END_TEST(testFunctionProperties)
--- a/js/src/jsapi-tests/testGetPropertyDefault.cpp
+++ b/js/src/jsapi-tests/testGetPropertyDefault.cpp
@@ -27,21 +27,21 @@ BEGIN_TEST(testGetPropertyDefault_bug594
 
         JS::RootedObject obj(cx, JS_NewObject(cx, NULL, NULL, NULL));
         CHECK(obj);
 
         JS::RootedValue v0(cx, JSVAL_TRUE);
         CHECK(JS_SetProperty(cx, obj, "here", v0));
 
         JS::RootedValue v1(cx);
-        CHECK(JS_GetPropertyDefault(cx, obj, "here", JSVAL_FALSE, &v1));
+        CHECK(JS_GetPropertyDefault(cx, obj, "here", JSVAL_FALSE, v1.address()));
         CHECK(JSVAL_IS_TRUE(v1));
 
         JS::RootedValue v2(cx);
-        CHECK(JS_GetPropertyDefault(cx, obj, "nothere", JSVAL_FALSE, &v2));
+        CHECK(JS_GetPropertyDefault(cx, obj, "nothere", JSVAL_FALSE, v2.address()));
         CHECK(JSVAL_IS_FALSE(v2));
     }
 
     {
         // Check JS_GetPropertyByIdDefault
 
         JS::RootedObject obj(cx, JS_NewObject(cx, NULL, NULL, NULL));
         CHECK(obj);
@@ -51,19 +51,19 @@ BEGIN_TEST(testGetPropertyDefault_bug594
 
         JS::RootedId nothereid(cx);
         CHECK(stringToId(cx, "nothere", nothereid.address()));
 
         JS::RootedValue v0(cx, JSVAL_TRUE);
         CHECK(JS_SetPropertyById(cx, obj, hereid, v0));
 
         JS::RootedValue v1(cx);
-        CHECK(JS_GetPropertyByIdDefault(cx, obj, hereid, JSVAL_FALSE, &v1));
+        CHECK(JS_GetPropertyByIdDefault(cx, obj, hereid, JSVAL_FALSE, v1.address()));
         CHECK(JSVAL_IS_TRUE(v1));
 
         JS::RootedValue v2(cx);
-        CHECK(JS_GetPropertyByIdDefault(cx, obj, nothereid, JSVAL_FALSE, &v2));
+        CHECK(JS_GetPropertyByIdDefault(cx, obj, nothereid, JSVAL_FALSE, v2.address()));
         CHECK(JSVAL_IS_FALSE(v2));
     }
 
     return true;
 }
 END_TEST(testGetPropertyDefault_bug594060)
--- a/js/src/jsapi-tests/testParseJSON.cpp
+++ b/js/src/jsapi-tests/testParseJSON.cpp
@@ -109,40 +109,40 @@ BEGIN_TEST(testParseJSON_success)
     // Arrays
     JS::RootedValue v(cx), v2(cx);
     JS::RootedObject obj(cx);
 
     CHECK(Parse(cx, "[]", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(JS_IsArrayObject(cx, obj));
-    CHECK(JS_GetProperty(cx, obj, "length", &v2));
+    CHECK(JS_GetProperty(cx, obj, "length", v2.address()));
     CHECK_SAME(v2, JSVAL_ZERO);
 
     CHECK(Parse(cx, "[1]", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(JS_IsArrayObject(cx, obj));
-    CHECK(JS_GetProperty(cx, obj, "0", &v2));
+    CHECK(JS_GetProperty(cx, obj, "0", v2.address()));
     CHECK_SAME(v2, JSVAL_ONE);
-    CHECK(JS_GetProperty(cx, obj, "length", &v2));
+    CHECK(JS_GetProperty(cx, obj, "length", v2.address()));
     CHECK_SAME(v2, JSVAL_ONE);
 
 
     // Objects
     CHECK(Parse(cx, "{}", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(!JS_IsArrayObject(cx, obj));
 
     CHECK(Parse(cx, "{ \"f\": 17 }", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(!JS_IsArrayObject(cx, obj));
-    CHECK(JS_GetProperty(cx, obj, "f", &v2));
+    CHECK(JS_GetProperty(cx, obj, "f", v2.address()));
     CHECK_SAME(v2, INT_TO_JSVAL(17));
 
     return true;
 }
 
 template<size_t N> inline bool
 Parse(JSContext *cx, const char (&input)[N], JS::MutableHandleValue vp)
 {
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4192,47 +4192,55 @@ JS_SetUCPropertyAttributes(JSContext *cx
 {
     RootedObject obj(cx, objArg);
     JSAtom *atom = AtomizeChars<CanGC>(cx, name, AUTO_NAMELEN(name, namelen));
     RootedId id(cx, AtomToId(atom));
     return atom && SetPropertyAttributesById(cx, obj, id, attrs, foundp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetPropertyById(JSContext *cx, JSObject *objArg, jsid idArg, MutableHandleValue vp)
+JS_GetPropertyById(JSContext *cx, JSObject *objArg, jsid idArg, jsval *vp)
 {
     return JS_ForwardGetPropertyTo(cx, objArg, idArg, objArg, vp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_ForwardGetPropertyTo(JSContext *cx, JSObject *objArg, jsid idArg, JSObject *onBehalfOfArg,
-                        MutableHandleValue vp)
+JS_ForwardGetPropertyTo(JSContext *cx, JSObject *objArg, jsid idArg, JSObject *onBehalfOfArg, jsval *vp)
 {
     RootedObject obj(cx, objArg);
     RootedObject onBehalfOf(cx, onBehalfOfArg);
     RootedId id(cx, idArg);
 
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, id);
     assertSameCompartment(cx, onBehalfOf);
     JSAutoResolveFlags rf(cx, 0);
 
-    return JSObject::getGeneric(cx, obj, onBehalfOf, id, vp);
-}
-
-JS_PUBLIC_API(JSBool)
-JS_GetPropertyByIdDefault(JSContext *cx, JSObject *objArg, jsid idArg, jsval defArg,
-                          MutableHandleValue vp)
+    RootedValue value(cx);
+    if (!JSObject::getGeneric(cx, obj, onBehalfOf, id, &value))
+        return false;
+
+    *vp = value;
+    return true;
+}
+
+JS_PUBLIC_API(JSBool)
+JS_GetPropertyByIdDefault(JSContext *cx, JSObject *objArg, jsid idArg, jsval defArg, jsval *vp)
 {
     RootedObject obj(cx, objArg);
     RootedId id(cx, idArg);
     RootedValue def(cx, defArg);
 
-    return baseops::GetPropertyDefault(cx, obj, id, def, vp);
+    RootedValue value(cx);
+    if (!baseops::GetPropertyDefault(cx, obj, id, def, &value))
+        return false;
+
+    *vp = value;
+    return true;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetElement(JSContext *cx, JSObject *objArg, uint32_t index, jsval *vp)
 {
     return JS_ForwardGetElementTo(cx, objArg, index, objArg, vp);
 }
 
@@ -4270,36 +4278,34 @@ JS_GetElementIfPresent(JSContext *cx, JS
         return false;
 
     *vp = value;
     *present = isPresent;
     return true;
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetProperty(JSContext *cx, JSObject *objArg, const char *name, MutableHandleValue vp)
+JS_GetProperty(JSContext *cx, JSObject *objArg, const char *name, jsval *vp)
 {
     RootedObject obj(cx, objArg);
     JSAtom *atom = Atomize(cx, name, strlen(name));
     return atom && JS_GetPropertyById(cx, obj, AtomToId(atom), vp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetPropertyDefault(JSContext *cx, JSObject *objArg, const char *name, jsval defArg,
-                      MutableHandleValue vp)
+JS_GetPropertyDefault(JSContext *cx, JSObject *objArg, const char *name, jsval defArg, jsval *vp)
 {
     RootedObject obj(cx, objArg);
     RootedValue def(cx, defArg);
     JSAtom *atom = Atomize(cx, name, strlen(name));
     return atom && JS_GetPropertyByIdDefault(cx, obj, AtomToId(atom), def, vp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetUCProperty(JSContext *cx, JSObject *objArg, const jschar *name, size_t namelen,
-                 MutableHandleValue vp)
+JS_GetUCProperty(JSContext *cx, JSObject *objArg, const jschar *name, size_t namelen, jsval *vp)
 {
     RootedObject obj(cx, objArg);
     JSAtom *atom = AtomizeChars<CanGC>(cx, name, AUTO_NAMELEN(name, namelen));
     return atom && JS_GetPropertyById(cx, obj, AtomToId(atom), vp);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_SetPropertyById(JSContext *cx, JSObject *objArg, jsid idArg, HandleValue v)
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -3469,32 +3469,29 @@ class MutableHandleBase<JSPropertyDescri
 extern JS_PUBLIC_API(JSBool)
 JS_GetPropertyDescriptorById(JSContext *cx, JSObject *obj, jsid id, unsigned flags,
                              JSPropertyDescriptor *desc);
 
 extern JS_PUBLIC_API(JSBool)
 JS_GetOwnPropertyDescriptor(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetProperty(JSContext *cx, JSObject *obj, const char *name, JS::MutableHandle<JS::Value> vp);
+JS_GetProperty(JSContext *cx, JSObject *obj, const char *name, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetPropertyDefault(JSContext *cx, JSObject *obj, const char *name, jsval def,
-                      JS::MutableHandle<JS::Value> vp);
+JS_GetPropertyDefault(JSContext *cx, JSObject *obj, const char *name, jsval def, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetPropertyById(JSContext *cx, JSObject *obj, jsid id, JS::MutableHandle<JS::Value> vp);
+JS_GetPropertyById(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetPropertyByIdDefault(JSContext *cx, JSObject *obj, jsid id, jsval def,
-                          JS::MutableHandle<JS::Value> vp);
+JS_GetPropertyByIdDefault(JSContext *cx, JSObject *obj, jsid id, jsval def, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_ForwardGetPropertyTo(JSContext *cx, JSObject *obj, jsid id, JSObject *onBehalfOf,
-                        JS::MutableHandle<JS::Value> vp);
+JS_ForwardGetPropertyTo(JSContext *cx, JSObject *obj, jsid id, JSObject *onBehalfOf, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_SetProperty(JSContext *cx, JSObject *obj, const char *name, JS::Handle<JS::Value> v);
 
 extern JS_PUBLIC_API(JSBool)
 JS_SetPropertyById(JSContext *cx, JSObject *obj, jsid id, JS::Handle<JS::Value> v);
 
 extern JS_PUBLIC_API(JSBool)
@@ -3570,17 +3567,17 @@ JS_HasUCProperty(JSContext *cx, JSObject
 extern JS_PUBLIC_API(JSBool)
 JS_LookupUCProperty(JSContext *cx, JSObject *obj,
                     const jschar *name, size_t namelen,
                     jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_GetUCProperty(JSContext *cx, JSObject *obj,
                  const jschar *name, size_t namelen,
-                 JS::MutableHandle<JS::Value> vp);
+                 jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_SetUCProperty(JSContext *cx, JSObject *obj,
                  const jschar *name, size_t namelen,
                  JS::Handle<JS::Value> v);
 
 extern JS_PUBLIC_API(JSBool)
 JS_DeleteUCProperty2(JSContext *cx, JSObject *obj,
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -1100,28 +1100,28 @@ FormatFrame(JSContext *cx, const NonBuil
                                     desc->value.isString() ? "\"" : "");
             if (!buf)
                 return buf;
             namedArgCount++;
         }
 
         // print any unnamed trailing args (found in 'arguments' object)
         RootedValue val(cx);
-        if (JS_GetProperty(cx, callObj, "arguments", &val) && val.isObject()) {
+        if (JS_GetProperty(cx, callObj, "arguments", val.address()) && val.isObject()) {
             uint32_t argCount;
             RootedObject argsObj(cx, &val.toObject());
-            if (JS_GetProperty(cx, argsObj, "length", &val) &&
+            if (JS_GetProperty(cx, argsObj, "length", val.address()) &&
                 ToUint32(cx, val, &argCount) &&
                 argCount > namedArgCount)
             {
                 for (uint32_t k = namedArgCount; k < argCount; k++) {
                     char number[8];
                     JS_snprintf(number, 8, "%d", (int) k);
 
-                    if (JS_GetProperty(cx, argsObj, number, &val)) {
+                    if (JS_GetProperty(cx, argsObj, number, val.address())) {
                         JSAutoByteString valueBytes;
                         const char *value = FormatValue(cx, val, valueBytes);
                         buf = JS_sprintf_append(buf, "%s%s%s%s",
                                                 k ? ", " : "",
                                                 val.isString() ? "\"" : "",
                                                 value ? value : "?unknown?",
                                                 val.isString() ? "\"" : "");
                         if (!buf)
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -1043,24 +1043,24 @@ js_ReportUncaughtException(JSContext *cx
         roots[1] = StringValue(str);
 
     const char *filename_str = js_fileName_str;
     JSAutoByteString filename;
     if (!reportp && exnObject &&
         (exnObject->is<ErrorObject>() || IsDuckTypedErrorObject(cx, exnObject, &filename_str)))
     {
         RootedString name(cx);
-        if (JS_GetProperty(cx, exnObject, js_name_str, tvr.handleAt(2)) &&
+        if (JS_GetProperty(cx, exnObject, js_name_str, &roots[2]) &&
             JSVAL_IS_STRING(roots[2]))
         {
             name = JSVAL_TO_STRING(roots[2]);
         }
 
         RootedString msg(cx);
-        if (JS_GetProperty(cx, exnObject, js_message_str, tvr.handleAt(3)) &&
+        if (JS_GetProperty(cx, exnObject, js_message_str, &roots[3]) &&
             JSVAL_IS_STRING(roots[3]))
         {
             msg = JSVAL_TO_STRING(roots[3]);
         }
 
         if (name && msg) {
             RootedString colon(cx, JS_NewStringCopyZ(cx, ": "));
             if (!colon)
@@ -1072,31 +1072,31 @@ js_ReportUncaughtException(JSContext *cx
             if (!str)
                 return false;
         } else if (name) {
             str = name;
         } else if (msg) {
             str = msg;
         }
 
-        if (JS_GetProperty(cx, exnObject, filename_str, tvr.handleAt(4))) {
+        if (JS_GetProperty(cx, exnObject, filename_str, &roots[4])) {
             JSString *tmp = ToString<CanGC>(cx, HandleValue::fromMarkedLocation(&roots[4]));
             if (tmp)
                 filename.encodeLatin1(cx, tmp);
         }
 
         uint32_t lineno;
-        if (!JS_GetProperty(cx, exnObject, js_lineNumber_str, tvr.handleAt(5)) ||
+        if (!JS_GetProperty(cx, exnObject, js_lineNumber_str, &roots[5]) ||
             !ToUint32(cx, roots[5], &lineno))
         {
             lineno = 0;
         }
 
         uint32_t column;
-        if (!JS_GetProperty(cx, exnObject, js_columnNumber_str, tvr.handleAt(5)) ||
+        if (!JS_GetProperty(cx, exnObject, js_columnNumber_str, &roots[5]) ||
             !ToUint32(cx, roots[5], &column))
         {
             column = 0;
         }
 
         reportp = &report;
         PodZero(&report);
         report.filename = filename.ptr();
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -929,104 +929,104 @@ Evaluate(JSContext *cx, unsigned argc, j
     global = JS_GetGlobalForObject(cx, &args.callee());
     if (!global)
         return false;
 
     if (args.length() == 2) {
         RootedObject opts(cx, &args[1].toObject());
         RootedValue v(cx);
 
-        if (!JS_GetProperty(cx, opts, "newContext", &v))
+        if (!JS_GetProperty(cx, opts, "newContext", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             newContext = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "compileAndGo", &v))
+        if (!JS_GetProperty(cx, opts, "compileAndGo", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             compileAndGo = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "noScriptRval", &v))
+        if (!JS_GetProperty(cx, opts, "noScriptRval", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             noScriptRval = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "fileName", &v))
+        if (!JS_GetProperty(cx, opts, "fileName", v.address()))
             return false;
         if (JSVAL_IS_NULL(v)) {
             fileName = NULL;
         } else if (!JSVAL_IS_VOID(v)) {
             JSString *s = JS_ValueToString(cx, v);
             if (!s)
                 return false;
             fileName = fileNameBytes.encodeLatin1(cx, s);
             if (!fileName)
                 return false;
         }
 
-        if (!JS_GetProperty(cx, opts, "element", &v))
+        if (!JS_GetProperty(cx, opts, "element", v.address()))
             return false;
         if (!JSVAL_IS_PRIMITIVE(v))
             element = JSVAL_TO_OBJECT(v);
 
-        if (!JS_GetProperty(cx, opts, "sourceMapURL", &v))
+        if (!JS_GetProperty(cx, opts, "sourceMapURL", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             sourceMapURL = JS_ValueToString(cx, v);
             if (!sourceMapURL)
                 return false;
         }
 
-        if (!JS_GetProperty(cx, opts, "lineNumber", &v))
+        if (!JS_GetProperty(cx, opts, "lineNumber", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             uint32_t u;
             if (!JS_ValueToECMAUint32(cx, v, &u))
                 return false;
             lineNumber = u;
         }
 
-        if (!JS_GetProperty(cx, opts, "global", &v))
+        if (!JS_GetProperty(cx, opts, "global", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             global = JSVAL_IS_PRIMITIVE(v) ? NULL : JSVAL_TO_OBJECT(v);
             if (global) {
                 global = js::UncheckedUnwrap(global);
                 if (!global)
                     return false;
             }
             if (!global || !(JS_GetClass(global)->flags & JSCLASS_IS_GLOBAL)) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                                      "\"global\" passed to evaluate()", "not a global object");
                 return false;
             }
         }
 
-        if (!JS_GetProperty(cx, opts, "catchTermination", &v))
+        if (!JS_GetProperty(cx, opts, "catchTermination", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             catchTermination = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "saveFrameChain", &v))
+        if (!JS_GetProperty(cx, opts, "saveFrameChain", v.address()))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             saveFrameChain = b;
         }
     }
@@ -2460,31 +2460,31 @@ typedef struct ComplexObject {
 } ComplexObject;
 
 static JSBool
 sandbox_enumerate(JSContext *cx, HandleObject obj)
 {
     RootedValue v(cx);
     JSBool b;
 
-    if (!JS_GetProperty(cx, obj, "lazy", &v))
+    if (!JS_GetProperty(cx, obj, "lazy", v.address()))
         return false;
 
     JS_ValueToBoolean(cx, v, &b);
     return !b || JS_EnumerateStandardClasses(cx, obj);
 }
 
 static JSBool
 sandbox_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
                 MutableHandleObject objp)
 {
     RootedValue v(cx);
     JSBool b, resolved;
 
-    if (!JS_GetProperty(cx, obj, "lazy", &v))
+    if (!JS_GetProperty(cx, obj, "lazy", v.address()))
         return false;
 
     JS_ValueToBoolean(cx, v, &b);
     if (b) {
         if (!JS_ResolveStandardClass(cx, obj, id, &resolved))
             return false;
         if (resolved) {
             objp.set(obj);
--- a/js/src/shell/jsheaptools.cpp
+++ b/js/src/shell/jsheaptools.cpp
@@ -501,17 +501,17 @@ ReferenceFinder::addReferrer(jsval refer
 
     ScopedJSFreePtr<char> pathName(path->computeName(context));
     if (!pathName)
         return false;
 
     /* Find the property of the results object named |pathName|. */
     RootedValue v(context);
 
-    if (!JS_GetProperty(context, result, pathName, &v))
+    if (!JS_GetProperty(context, result, pathName, v.address()))
         return false;
     if (v.isUndefined()) {
         /* Create an array to accumulate referents under this path. */
         JSObject *array = JS_NewArrayObject(context, 1, referrer.address());
         if (!array)
             return false;
         v.setObject(*array);
         return !!JS_SetProperty(context, result, pathName, v);
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -4189,26 +4189,26 @@ DebuggerGenericEval(JSContext *cx, const
     /* Set options from object if provided. */
     char *url = NULL;
     unsigned lineNumber = 1;
 
     if (options.isObject()) {
         RootedObject opts(cx, &options.toObject());
         RootedValue v(cx);
 
-        if (!JS_GetProperty(cx, opts, "url", &v))
+        if (!JS_GetProperty(cx, opts, "url", v.address()))
             return false;
         if (!v.isUndefined()) {
             RootedString url_str(cx, JS_ValueToString(cx, v));
             if (!url_str)
                 return false;
             url = JS_EncodeString(cx, url_str);
         }
 
-        if (!JS_GetProperty(cx, opts, "lineNumber", &v))
+        if (!JS_GetProperty(cx, opts, "lineNumber", v.address()))
             return false;
         if (!v.isUndefined()) {
             uint32_t lineno;
             if (!JS_ValueToECMAUint32(cx, v, &lineno))
                 return false;
             lineNumber = lineno;
         }
     }
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -513,17 +513,17 @@ mozJSComponentLoader::LoadModule(FileLoc
     JSObject* file_jsobj = file_holder->GetJSObject();
     if (!file_jsobj) {
         return NULL;
     }
 
     JSCLAutoErrorReporterSetter aers(cx, xpc::SystemErrorReporter);
 
     RootedValue NSGetFactory_val(cx);
-    if (!JS_GetProperty(cx, entry->obj, "NSGetFactory", &NSGetFactory_val) ||
+    if (!JS_GetProperty(cx, entry->obj, "NSGetFactory", NSGetFactory_val.address()) ||
         JSVAL_IS_VOID(NSGetFactory_val)) {
         return NULL;
     }
 
     if (JS_TypeOfValue(cx, NSGetFactory_val) != JSTYPE_FUNCTION) {
         nsAutoCString spec;
         uri->GetSpec(spec);
         JS_ReportError(cx, "%s has NSGetFactory property that is not a function",
@@ -1276,17 +1276,17 @@ mozJSComponentLoader::ImportInto(const n
     vp.set(mod->obj);
 
     if (targetObj) {
         JSCLContextHelper cxhelper(mContext);
         JSAutoCompartment ac(mContext, mod->obj);
 
         RootedValue symbols(mContext);
         if (!JS_GetProperty(mContext, mod->obj,
-                            "EXPORTED_SYMBOLS", &symbols)) {
+                            "EXPORTED_SYMBOLS", symbols.address())) {
             return ReportOnCaller(cxhelper, ERROR_NOT_PRESENT,
                                   PromiseFlatCString(aLocation).get());
         }
 
         if (!symbols.isObject() ||
             !JS_IsArrayObject(mContext, &symbols.toObject())) {
             return ReportOnCaller(cxhelper, ERROR_NOT_AN_ARRAY,
                                   PromiseFlatCString(aLocation).get());
@@ -1311,17 +1311,17 @@ mozJSComponentLoader::ImportInto(const n
         for (uint32_t i = 0; i < symbolCount; ++i) {
             if (!JS_GetElement(mContext, symbolsObj, i, value.address()) ||
                 !value.isString() ||
                 !JS_ValueToId(mContext, value, symbolId.address())) {
                 return ReportOnCaller(cxhelper, ERROR_ARRAY_ELEMENT,
                                       PromiseFlatCString(aLocation).get(), i);
             }
 
-            if (!JS_GetPropertyById(mContext, mod->obj, symbolId, &value)) {
+            if (!JS_GetPropertyById(mContext, mod->obj, symbolId, value.address())) {
                 JSAutoByteString bytes(mContext, JSID_TO_STRING(symbolId));
                 if (!bytes)
                     return NS_ERROR_FAILURE;
                 return ReportOnCaller(cxhelper, ERROR_GETTING_SYMBOL,
                                       PromiseFlatCString(aLocation).get(),
                                       bytes.ptr());
             }
 
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -1911,17 +1911,17 @@ struct MOZ_STACK_CLASS ExceptionArgParse
 
         // If it wasn't found, indicate with undefined.
         if (!found) {
             rv.setUndefined();
             return true;
         }
 
         // Get the property.
-        return JS_GetProperty(cx, obj, name, rv);
+        return JS_GetProperty(cx, obj, name, rv.address());
     }
 
     /*
      * Internal data members.
      */
 
     // If there's a non-default exception string, hold onto the allocated bytes.
     JSAutoByteString messageBytes;
@@ -2238,17 +2238,17 @@ nsXPCConstructor::CallOrConstruct(nsIXPC
 
     args.rval().set(rval);
 
     // call initializer method if supplied
     if (mInitializer) {
         RootedObject newObj(cx, &rval.toObject());
         // first check existence of function property for better error reporting
         RootedValue fun(cx);
-        if (!JS_GetProperty(cx, newObj, mInitializer, &fun) ||
+        if (!JS_GetProperty(cx, newObj, mInitializer, fun.address()) ||
             fun.isPrimitive()) {
             return ThrowAndFail(NS_ERROR_XPC_BAD_INITIALIZER_NAME, cx, _retval);
         }
 
         RootedValue dummy(cx);
         if (!JS_CallFunctionValue(cx, newObj, fun, args.length(), args.array(), dummy.address())) {
             // function should have thrown an exception
             *_retval = false;
@@ -2487,17 +2487,17 @@ nsXPCComponents_Constructor::CallOrConst
         }
 
         RootedString str(cx, JS_ValueToString(cx, args[1]));
         RootedId id(cx);
         if (!str || !JS_ValueToId(cx, StringValue(str), id.address()))
             return ThrowAndFail(NS_ERROR_XPC_BAD_CONVERT_JS, cx, _retval);
 
         RootedValue val(cx);
-        if (!JS_GetPropertyById(cx, ifacesObj, id, &val) || val.isPrimitive())
+        if (!JS_GetPropertyById(cx, ifacesObj, id, val.address()) || val.isPrimitive())
             return ThrowAndFail(NS_ERROR_XPC_BAD_IID, cx, _retval);
 
         nsCOMPtr<nsIXPConnectWrappedNative> wn;
         if (NS_FAILED(xpc->GetWrappedNativeOfJSObject(cx, &val.toObject(),
                                                       getter_AddRefs(wn))) || !wn ||
             !(cInterfaceID = do_QueryWrappedNative(wn))) {
             return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
         }
@@ -2536,17 +2536,17 @@ nsXPCComponents_Constructor::CallOrConst
         }
 
         RootedString str(cx, JS_ValueToString(cx, args[0]));
         RootedId id(cx);
         if (!str || !JS_ValueToId(cx, StringValue(str), id.address()))
             return ThrowAndFail(NS_ERROR_XPC_BAD_CONVERT_JS, cx, _retval);
 
         RootedValue val(cx);
-        if (!JS_GetPropertyById(cx, classesObj, id, &val) || val.isPrimitive())
+        if (!JS_GetPropertyById(cx, classesObj, id, val.address()) || val.isPrimitive())
             return ThrowAndFail(NS_ERROR_XPC_BAD_CID, cx, _retval);
 
         nsCOMPtr<nsIXPConnectWrappedNative> wn;
         if (NS_FAILED(xpc->GetWrappedNativeOfJSObject(cx, JSVAL_TO_OBJECT(val),
                                                       getter_AddRefs(wn))) || !wn ||
             !(cClassID = do_QueryWrappedNative(wn))) {
             return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
         }
@@ -3521,17 +3521,17 @@ GetExpandedPrincipal(JSContext *cx, Hand
 // helper that tries to get a property form the options object
 nsresult
 GetPropFromOptions(JSContext *cx, HandleObject from, const char *name, MutableHandleValue prop,
                    JSBool *found)
 {
     if (!JS_HasProperty(cx, from, name, found))
         return NS_ERROR_INVALID_ARG;
 
-    if (found && !JS_GetProperty(cx, from, name, prop))
+    if (found && !JS_GetProperty(cx, from, name, prop.address()))
         return NS_ERROR_INVALID_ARG;
 
     return NS_OK;
 }
 
 // helper that tries to get a boolean property form the options object
 nsresult
 GetBoolPropFromOptions(JSContext *cx, HandleObject from, const char *name, bool *prop)
@@ -4270,17 +4270,17 @@ nsXPCComponents_Utils::MakeObjectPropsNo
     if (!ida)
         return NS_ERROR_FAILURE;
 
     RootedId id(cx);
     RootedValue v(cx);
     for (size_t i = 0; i < ida.length(); ++i) {
         id = ida[i];
 
-        if (!JS_GetPropertyById(cx, obj, id, &v))
+        if (!JS_GetPropertyById(cx, obj, id, v.address()))
             return NS_ERROR_FAILURE;
 
         if (v.isPrimitive())
             continue;
 
         RootedObject propobj(cx, &v.toObject());
         // TODO Deal with non-functions.
         if (!js::IsWrapper(propobj) || !JS_ObjectIsCallable(cx, propobj))
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -225,17 +225,17 @@ nsXPCWrappedJSClass::CallQueryInterfaceO
 
     // XXX we should install an error reporter that will send reports to
     // the JS error console service.
     if (!scriptEval.StartEvaluating(jsobj))
         return nullptr;
 
     // check upfront for the existence of the function property
     funid = mRuntime->GetStringID(XPCJSRuntime::IDX_QUERY_INTERFACE);
-    if (!JS_GetPropertyById(cx, jsobj, funid, &fun) || JSVAL_IS_PRIMITIVE(fun))
+    if (!JS_GetPropertyById(cx, jsobj, funid, fun.address()) || JSVAL_IS_PRIMITIVE(fun))
         return nullptr;
 
     // Ensure that we are asking for a scriptable interface.
     // NB:  It's important for security that this check is here rather
     // than later, since it prevents untrusted objects from implementing
     // some interfaces in JS and aggregating a trusted object to
     // implement intentionally (for security) unscriptable interfaces.
     // We so often ask for nsISupports that we can short-circuit the test...
@@ -325,17 +325,17 @@ GetNamedPropertyAsVariantRaw(XPCCallCont
                              JSObject* aJSObj,
                              jsid aName,
                              nsIVariant** aResult,
                              nsresult* pErr)
 {
     nsXPTType type = nsXPTType((uint8_t)TD_INTERFACE_TYPE);
     RootedValue val(ccx);
 
-    return JS_GetPropertyById(ccx, aJSObj, aName, &val) &&
+    return JS_GetPropertyById(ccx, aJSObj, aName, val.address()) &&
            // Note that this always takes the T_INTERFACE path through
            // JSData2Native, so the value passed for useAllocator
            // doesn't really matter. We pass true for consistency.
            XPCConvert::JSData2Native(aResult, val, type, true,
                                      &NS_GET_IID(nsIVariant), pErr);
 }
 
 // static
@@ -1259,17 +1259,17 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWra
                                 if (!JS_WrapObject(cx, thisObj.address()))
                                     goto pre_call_clean_up;
                             }
                         }
                     }
                 }
             }
         } else {
-            if (!JS_GetProperty(cx, obj, name, &fval))
+            if (!JS_GetProperty(cx, obj, name, fval.address()))
                 goto pre_call_clean_up;
             // XXX We really want to factor out the error reporting better and
             // specifically report the failure to find a function with this name.
             // This is what we do below if the property is found but is not a
             // function. We just need to factor better so we can get to that
             // reporting path from here.
 
             thisObj = obj;
@@ -1426,17 +1426,17 @@ pre_call_clean_up:
         return retval;
 
     // do the deed - note exceptions
 
     JS_ClearPendingException(cx);
 
     RootedValue rval(cx);
     if (XPT_MD_IS_GETTER(info->flags)) {
-        success = JS_GetProperty(cx, obj, name, &rval);
+        success = JS_GetProperty(cx, obj, name, rval.address());
     } else if (XPT_MD_IS_SETTER(info->flags)) {
         rval = *argv;
         success = JS_SetProperty(cx, obj, name, rval);
     } else {
         if (!JSVAL_IS_PRIMITIVE(fval)) {
             uint32_t oldOpts = JS_GetOptions(cx);
             JS_SetOptions(cx, oldOpts | JSOPTION_DONT_REPORT_UNCAUGHT);
 
@@ -1509,17 +1509,17 @@ pre_call_clean_up:
         else
             pv = (nsXPTCMiniVariant*) nativeParams[i].val.p;
 
         if (param.IsRetval())
             val = rval;
         else if (JSVAL_IS_PRIMITIVE(argv[i]) ||
                  !JS_GetPropertyById(cx, JSVAL_TO_OBJECT(argv[i]),
                                      mRuntime->GetStringID(XPCJSRuntime::IDX_VALUE),
-                                     &val))
+                                     val.address()))
             break;
 
         // setup allocator and/or iid
 
         if (type_tag == nsXPTType::T_INTERFACE) {
             if (NS_FAILED(GetInterfaceInfo()->
                           GetIIDForParamNoAlloc(methodIndex, &param,
                                                 &param_iid)))
@@ -1553,17 +1553,17 @@ pre_call_clean_up:
                     type.TagPart() == nsXPTType::T_PWSTRING_SIZE_IS;
 
             pv = (nsXPTCMiniVariant*) nativeParams[i].val.p;
 
             if (param.IsRetval())
                 val = rval;
             else if (!JS_GetPropertyById(cx, JSVAL_TO_OBJECT(argv[i]),
                                          mRuntime->GetStringID(XPCJSRuntime::IDX_VALUE),
-                                         &val))
+                                         val.address()))
                 break;
 
             // setup allocator and/or iid
 
             if (isArray) {
                 if (NS_FAILED(mInfo->GetTypeForParam(methodIndex, &param, 1,
                                                      &datum_type)))
                     break;
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1988,17 +1988,17 @@ class CallMethodHelper
     GetArraySizeFromParam(uint8_t paramIndex, uint32_t* result) const;
 
     JS_ALWAYS_INLINE JSBool
     GetInterfaceTypeFromParam(uint8_t paramIndex,
                               const nsXPTType& datum_type,
                               nsID* result) const;
 
     JS_ALWAYS_INLINE JSBool
-    GetOutParamSource(uint8_t paramIndex, MutableHandleValue srcp) const;
+    GetOutParamSource(uint8_t paramIndex, jsval* srcp) const;
 
     JS_ALWAYS_INLINE JSBool
     GatherAndConvertResults();
 
     JS_ALWAYS_INLINE JSBool
     QueryInterfaceFastPath() const;
 
     nsXPTCVariant*
@@ -2244,17 +2244,17 @@ CallMethodHelper::GetInterfaceTypeFromPa
             return ThrowBadParam(NS_ERROR_XPC_CANT_GET_PARAM_IFACE_INFO,
                                  paramIndex, mCallContext);
         *result = *p;
     }
     return true;
 }
 
 JSBool
-CallMethodHelper::GetOutParamSource(uint8_t paramIndex, MutableHandleValue srcp) const
+CallMethodHelper::GetOutParamSource(uint8_t paramIndex, jsval* srcp) const
 {
     const nsXPTParamInfo& paramInfo = mMethodInfo->GetParam(paramIndex);
 
     if ((paramInfo.IsOut() || paramInfo.IsDipper()) &&
         !paramInfo.IsRetval()) {
         NS_ASSERTION(paramIndex < mArgc || paramInfo.IsOptional(),
                      "Expected either enough arguments or an optional argument");
         jsval arg = paramIndex < mArgc ? mArgv[paramIndex] : JSVAL_NULL;
@@ -2524,17 +2524,17 @@ CallMethodHelper::ConvertIndependentPara
         dp->SetValNeedsCleanup();
 
     // Even if there's nothing to convert, we still need to examine the
     // JSObject container for out-params. If it's null or otherwise invalid,
     // we want to know before the call, rather than after.
     //
     // This is a no-op for 'in' params.
     RootedValue src(mCallContext);
-    if (!GetOutParamSource(i, &src))
+    if (!GetOutParamSource(i, src.address()))
         return false;
 
     // All that's left to do is value conversion. Bail early if we don't need
     // to do that.
     if (!paramInfo.IsIn())
         return true;
 
     // We're definitely some variety of 'in' now, so there's something to
@@ -2629,17 +2629,17 @@ CallMethodHelper::ConvertDependentParam(
         dp->SetValNeedsCleanup();
 
     // Even if there's nothing to convert, we still need to examine the
     // JSObject container for out-params. If it's null or otherwise invalid,
     // we want to know before the call, rather than after.
     //
     // This is a no-op for 'in' params.
     RootedValue src(mCallContext);
-    if (!GetOutParamSource(i, &src))
+    if (!GetOutParamSource(i, src.address()))
         return false;
 
     // All that's left to do is value conversion. Bail early if we don't need
     // to do that.
     if (!paramInfo.IsIn())
         return true;
 
     // We're definitely some variety of 'in' now, so there's something to
--- a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
@@ -116,17 +116,17 @@ GetDoubleWrappedJSObject(XPCCallContext&
         RootedObject mainObj(ccx, underware->GetJSObject());
         if (mainObj) {
             RootedId id(ccx, ccx.GetRuntime()->
                             GetStringID(XPCJSRuntime::IDX_WRAPPED_JSOBJECT));
 
             JSAutoCompartment ac(ccx, mainObj);
 
             RootedValue val(ccx);
-            if (JS_GetPropertyById(ccx, mainObj, id, &val) &&
+            if (JS_GetPropertyById(ccx, mainObj, id, val.address()) &&
                 !JSVAL_IS_PRIMITIVE(val)) {
                 obj = JSVAL_TO_OBJECT(val);
             }
         }
     }
     return obj;
 }
 
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -274,21 +274,23 @@ def write_header(iface, fd):
 
     for member in attributes:
         fd.write("  %s;\n" % attributeVariableTypeAndName(member))
 
     fd.write("};\n\n")
 
 def write_getter(a, iface, fd):
     realtype = a.realtype.nativeType('in')
-    fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, &v));\n"
-             % get_jsid(a.name))
     if realtype.count("JS::Value"):
-        fd.write("    aDict.%s = v;\n" % a.name)
-    elif realtype.count("bool"):
+        fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, &aDict.%s));\n"
+                 % (get_jsid(a.name), a.name))
+    else:
+        fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, v.address()));\n"
+                 % get_jsid(a.name))
+    if realtype.count("bool"):
         fd.write("    JSBool b;\n")
         fd.write("    MOZ_ALWAYS_TRUE(JS_ValueToBoolean(aCx, v, &b));\n")
         fd.write("    aDict.%s = b;\n" % a.name)
     elif realtype.count("uint16_t"):
         fd.write("    uint32_t u;\n")
         fd.write("    NS_ENSURE_STATE(JS_ValueToECMAUint32(aCx, v, &u));\n")
         fd.write("    aDict.%s = u;\n" % a.name)
     elif realtype.count("int16_t"):
@@ -366,21 +368,25 @@ def write_cpp(iface, fd):
              (iface.name, iface.name))
     fd.write("{\n")
     if iface.base is not None:
         fd.write("  nsresult rv = %s_InitInternal(aDict, aCx, aObj);\n" %
                  iface.base)
         fd.write("  NS_ENSURE_SUCCESS(rv, rv);\n")
 
     fd.write("  JSBool found = JS_FALSE;\n")
+    needjsval = False
     needccx = False
     for a in attributes:
+        if not a.realtype.nativeType('in').count("JS::Value"):
+            needjsval = True
         if a.realtype.nativeType('in').count("nsIVariant"):
             needccx = True
-    fd.write("  JS::RootedValue v(aCx, JSVAL_VOID);\n")
+    if needjsval:
+        fd.write("  JS::RootedValue v(aCx, JSVAL_VOID);\n")
     if needccx:
         fd.write("  XPCCallContext ccx(NATIVE_CALLER, aCx);\n")
         fd.write("  NS_ENSURE_STATE(ccx.IsValid());\n")
     for a in attributes:
         fd.write("  NS_ENSURE_STATE(JS_HasPropertyById(aCx, aObj, %s, &found));\n"
                  % get_jsid(a.name))
         fd.write("  if (found) {\n")
         write_getter(a, iface, fd)
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -900,47 +900,47 @@ PeerConnectionImpl::NotifyDataChannel(al
 nsresult
 PeerConnectionImpl::ConvertConstraints(
   const JS::Value& aConstraints, MediaConstraints* aObj, JSContext* aCx)
 {
   JS::Rooted<JS::Value> mandatory(aCx), optional(aCx);
   JS::Rooted<JSObject*> constraints(aCx, &aConstraints.toObject());
 
   // Mandatory constraints.  Note that we only care if the constraint array exists
-  if (!JS_GetProperty(aCx, constraints, "mandatory", &mandatory)) {
+  if (!JS_GetProperty(aCx, constraints, "mandatory", mandatory.address())) {
     return NS_ERROR_FAILURE;
   }
   if (!mandatory.isNullOrUndefined()) {
     if (!mandatory.isObject()) {
       return NS_ERROR_FAILURE;
     }
 
     JS::Rooted<JSObject*> opts(aCx, &mandatory.toObject());
     JS::AutoIdArray mandatoryOpts(aCx, JS_Enumerate(aCx, opts));
 
     // Iterate over each property.
     for (size_t i = 0; i < mandatoryOpts.length(); i++) {
       JS::Rooted<JS::Value> option(aCx), optionName(aCx);
-      if (!JS_GetPropertyById(aCx, opts, mandatoryOpts[i], &option) ||
+      if (!JS_GetPropertyById(aCx, opts, mandatoryOpts[i], option.address()) ||
           !JS_IdToValue(aCx, mandatoryOpts[i], optionName.address()) ||
           // We only support boolean constraints for now.
           !option.isBoolean()) {
         return NS_ERROR_FAILURE;
       }
       JSString* optionNameString = JS_ValueToString(aCx, optionName);
       if (!optionNameString) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
       NS_ConvertUTF16toUTF8 stringVal(JS_GetStringCharsZ(aCx, optionNameString));
       aObj->setBooleanConstraint(stringVal.get(), JSVAL_TO_BOOLEAN(option), true);
     }
   }
 
   // Optional constraints.
-  if (!JS_GetProperty(aCx, constraints, "optional", &optional)) {
+  if (!JS_GetProperty(aCx, constraints, "optional", optional.address())) {
     return NS_ERROR_FAILURE;
   }
   if (!optional.isNullOrUndefined()) {
     if (!optional.isObject()) {
       return NS_ERROR_FAILURE;
     }
 
     JS::Rooted<JSObject*> array(aCx, &optional.toObject());
@@ -956,17 +956,17 @@ PeerConnectionImpl::ConvertConstraints(
       }
       JS::Rooted<JSObject*> opts(aCx, &element.toObject());
       JS::AutoIdArray optionalOpts(aCx, JS_Enumerate(aCx, opts));
       // Expect one property per entry.
       if (optionalOpts.length() != 1) {
         return NS_ERROR_FAILURE;
       }
       JS::Rooted<JS::Value> option(aCx), optionName(aCx);
-      if (!JS_GetPropertyById(aCx, opts, optionalOpts[0], &option) ||
+      if (!JS_GetPropertyById(aCx, opts, optionalOpts[0], option.address()) ||
           !JS_IdToValue(aCx, optionalOpts[0], optionName.address())) {
         return NS_ERROR_FAILURE;
       }
       // Ignore constraints other than boolean, as that's all we support.
       if (option.isBoolean()) {
         JSString* optionNameString = JS_ValueToString(aCx, optionName);
         if (!optionNameString) {
           return NS_ERROR_OUT_OF_MEMORY;
--- a/startupcache/test/TestStartupCache.cpp
+++ b/startupcache/test/TestStartupCache.cpp
@@ -411,21 +411,21 @@ GetHistogramCounts(const char *testmsg, 
     return false;
   }
   passed(testmsg);
 
   Rooted<Value> snapshot_val(cx);
   JSFunction *snapshot_fn = NULL;
   Rooted<Value> ss(cx);
   return (JS_GetProperty(cx, JSVAL_TO_OBJECT(h), "snapshot",
-                         &snapshot_val)
+                         snapshot_val.address())
           && (snapshot_fn = JS_ValueToFunction(cx, snapshot_val))
           && JS::Call(cx, JSVAL_TO_OBJECT(h),
                       snapshot_fn, 0, NULL, &ss)
-          && JS_GetProperty(cx, JSVAL_TO_OBJECT(ss), "counts", counts));
+          && JS_GetProperty(cx, JSVAL_TO_OBJECT(ss), "counts", counts.address()));
 }
 
 nsresult
 CompareCountArrays(JSContext *cx, JSObject *aBefore, JSObject *aAfter)
 {
   uint32_t before_size, after_size;
   JS::RootedObject before(cx, aBefore);
   JS::RootedObject after(cx, aAfter);
--- a/toolkit/components/ctypes/ctypes.cpp
+++ b/toolkit/components/ctypes/ctypes.cpp
@@ -62,42 +62,42 @@ Module::~Module()
 #define XPC_MAP_WANT_CALL
 #define XPC_MAP_FLAGS nsIXPCScriptable::WANT_CALL
 #include "xpc_map_end.h"
 
 static JSBool
 SealObjectAndPrototype(JSContext* cx, JSObject* parent, const char* name)
 {
   JS::Rooted<JS::Value> prop(cx);
-  if (!JS_GetProperty(cx, parent, name, &prop))
+  if (!JS_GetProperty(cx, parent, name, prop.address()))
     return false;
 
   if (prop.isUndefined()) {
     // Pretend we sealed the object.
     return true;
   }
 
   JS::Rooted<JSObject*> obj(cx, prop.toObjectOrNull());
-  if (!JS_GetProperty(cx, obj, "prototype", &prop))
+  if (!JS_GetProperty(cx, obj, "prototype", prop.address()))
     return false;
 
   JS::Rooted<JSObject*> prototype(cx, prop.toObjectOrNull());
   return JS_FreezeObject(cx, obj) && JS_FreezeObject(cx, prototype);
 }
 
 static JSBool
 InitAndSealCTypesClass(JSContext* cx, JS::Handle<JSObject*> global)
 {
   // Init the ctypes object.
   if (!JS_InitCTypesClass(cx, global))
     return false;
 
   // Set callbacks for charset conversion and such.
   JS::Rooted<JS::Value> ctypes(cx);
-  if (!JS_GetProperty(cx, global, "ctypes", &ctypes))
+  if (!JS_GetProperty(cx, global, "ctypes", ctypes.address()))
     return false;
 
   JS_SetCTypesCallbacks(JSVAL_TO_OBJECT(ctypes), &sCallbacks);
 
   // Seal up Object, Function, Array and Error and their prototypes.  (This
   // single object instance is shared amongst everyone who imports the ctypes
   // module.)
   if (!SealObjectAndPrototype(cx, global, "Object") ||
--- a/toolkit/components/perf/PerfMeasurement.cpp
+++ b/toolkit/components/perf/PerfMeasurement.cpp
@@ -37,26 +37,26 @@ Module::~Module()
 #define XPC_MAP_WANT_CALL
 #define XPC_MAP_FLAGS nsIXPCScriptable::WANT_CALL
 #include "xpc_map_end.h"
 
 static JSBool
 SealObjectAndPrototype(JSContext* cx, JSObject* parent, const char* name)
 {
   JS::Rooted<JS::Value> prop(cx);
-  if (!JS_GetProperty(cx, parent, name, &prop))
+  if (!JS_GetProperty(cx, parent, name, prop.address()))
     return false;
 
   if (prop.isUndefined()) {
     // Pretend we sealed the object.
     return true;
   }
 
   JS::Rooted<JSObject*> obj(cx, prop.toObjectOrNull());
-  if (!JS_GetProperty(cx, obj, "prototype", &prop))
+  if (!JS_GetProperty(cx, obj, "prototype", prop.address()))
     return false;
 
   JS::Rooted<JSObject*> prototype(cx, prop.toObjectOrNull());
   return JS_FreezeObject(cx, obj) && JS_FreezeObject(cx, prototype);
 }
 
 static JSBool
 InitAndSealPerfMeasurementClass(JSContext* cx, JS::Handle<JSObject*> global)
--- a/toolkit/components/places/History.cpp
+++ b/toolkit/components/places/History.cpp
@@ -292,17 +292,17 @@ GetJSValueAsURI(JSContext* aCtx,
  * @return the URI if it exists.
  */
 already_AddRefed<nsIURI>
 GetURIFromJSObject(JSContext* aCtx,
                    JSObject* aObject,
                    const char* aProperty)
 {
   JS::Rooted<JS::Value> uriVal(aCtx);
-  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, &uriVal);
+  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, uriVal.address());
   NS_ENSURE_TRUE(rc, nullptr);
   return GetJSValueAsURI(aCtx, uriVal);
 }
 
 /**
  * Attemps to convert a JS value to a string.
  * @param aCtx
  *        The JSContext for aObject.
@@ -350,17 +350,17 @@ GetJSValueAsString(JSContext* aCtx,
  */
 void
 GetStringFromJSObject(JSContext* aCtx,
                       JSObject* aObject,
                       const char* aProperty,
                       nsString& _string)
 {
   JS::Rooted<JS::Value> val(aCtx);
-  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, &val);
+  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, val.address());
   if (!rc) {
     _string.SetIsVoid(true);
     return;
   }
   else {
     GetJSValueAsString(aCtx, val, _string);
   }
 }
@@ -380,17 +380,17 @@ GetStringFromJSObject(JSContext* aCtx,
 template <typename IntType>
 nsresult
 GetIntFromJSObject(JSContext* aCtx,
                    JSObject* aObject,
                    const char* aProperty,
                    IntType* _int)
 {
   JS::Rooted<JS::Value> value(aCtx);
-  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, &value);
+  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, value.address());
   NS_ENSURE_TRUE(rc, NS_ERROR_UNEXPECTED);
   if (JSVAL_IS_VOID(value)) {
     return NS_ERROR_INVALID_ARG;
   }
   NS_ENSURE_ARG(JSVAL_IS_PRIMITIVE(value));
   NS_ENSURE_ARG(JSVAL_IS_NUMBER(value));
 
   double num;
@@ -2803,17 +2803,17 @@ History::UpdatePlaces(const JS::Value& a
     NS_ENSURE_ARG(guid.IsVoid() || isValidGUID);
 
     nsString title;
     GetStringFromJSObject(aCtx, info, "title", title);
 
     JS::Rooted<JSObject*> visits(aCtx, nullptr);
     {
       JS::Rooted<JS::Value> visitsVal(aCtx);
-      JSBool rc = JS_GetProperty(aCtx, info, "visits", &visitsVal);
+      JSBool rc = JS_GetProperty(aCtx, info, "visits", visitsVal.address());
       NS_ENSURE_TRUE(rc, NS_ERROR_UNEXPECTED);
       if (!JSVAL_IS_PRIMITIVE(visitsVal)) {
         visits = JSVAL_TO_OBJECT(visitsVal);
         NS_ENSURE_ARG(JS_IsArrayObject(aCtx, visits));
       }
     }
     NS_ENSURE_ARG(visits);