--- a/js/public/Debug.h
+++ b/js/public/Debug.h
@@ -6,17 +6,16 @@
 
 // Interfaces by which the embedding can interact with the Debugger API.
 
 #ifndef js_Debug_h
 #define js_Debug_h
 
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/MemoryReporting.h"
 #include "mozilla/Move.h"
 
 #include "jspubtd.h"
 
 #include "js/RootingAPI.h"
 #include "js/TypeDecls.h"
 
 namespace js {
@@ -245,26 +244,13 @@ class BuilderOrigin : public Builder {
   public:
     BuilderOrigin(JSContext *cx, js::Debugger *debugger_)
       : Builder(cx, debugger_)
     { }
 
     JSObject *unwrap(Object &object) { return unwrapAny(object); }
 };
 
-
-// Finding the size of blocks allocated with malloc
-// ------------------------------------------------
-//
-// Debugger.Memory wants to be able to report how many bytes items in memory are
-// consuming. To do this, it needs a function that accepts a pointer to a block,
-// and returns the number of bytes allocated to that block. SpiderMonkey itself
-// doesn't know which function is appropriate to use, but the embedding does.
-
-// Tell Debuggers in |runtime| to use |mallocSizeOf| to find the size of
-// malloc'd blocks.
-void SetDebuggerMallocSizeOf(JSRuntime *runtime, mozilla::MallocSizeOf mallocSizeOf);
-
 } // namespace dbg
 } // namespace JS
 
 
 #endif /* js_Debug_h */

--- a/js/public/UbiNode.h
+++ b/js/public/UbiNode.h
@@ -5,17 +5,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef js_UbiNode_h
 #define js_UbiNode_h
 
 #include "mozilla/Alignment.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/MemoryReporting.h"
 #include "mozilla/Move.h"
 
 #include "jspubtd.h"
 
 #include "js/GCAPI.h"
 #include "js/HashTable.h"
 #include "js/TypeDecls.h"
 
@@ -133,19 +132,25 @@
 //
 // If this restriction prevents us from implementing interesting tools, we may
 // teach the GC how to root ubi::Nodes, fix up hash tables that use them as
 // keys, etc.
 
 
 // Forward declarations of SpiderMonkey's ubi::Node reference types.
 namespace js {
+class LazyScript;
+class Shape;
+class BaseShape;
 namespace jit {
 class JitCode;
 }
+namespace types {
+struct TypeObject;
+}
 }
 
 
 namespace JS {
 namespace ubi {
 
 class Edge;
 class EdgeRange;
@@ -182,19 +187,17 @@ class Base {
     // be statically allocated. (You can use MOZ_UTF16("strings") for this.)
     //
     // This must always return Concrete<T>::concreteTypeName; we use that
     // pointer as a tag for this particular referent type.
     virtual const jschar *typeName() const = 0;
 
     // Return the size of this node, in bytes. Include any structures that this
     // node owns exclusively that are not exposed as their own ubi::Nodes.
-    // |mallocSizeOf| should be a malloc block sizing function; see
-    // |mfbt/MemoryReporting.h.
-    virtual size_t size(mozilla::MallocSizeOf mallocSizeof) const = 0;
+    virtual size_t size() const = 0;
 
     // Return an EdgeRange that initially contains all the referent's outgoing
     // edges. The EdgeRange should be freed with 'js_delete'. (You could use
     // ScopedDJSeletePtr<EdgeRange> to manage it.) On OOM, report an exception
     // on |cx| and return nullptr.
     //
     // If wantNames is true, compute names for edges. Doing so can be expensive
     // in time and memory.
@@ -277,17 +280,17 @@ class Node {
     }
     template<typename T>
     Node &operator=(const Rooted<T *> &root) {
         construct(root.get());
         return *this;
     }
 
     // Constructors accepting SpiderMonkey's other generic-pointer-ish types.
-    Node(JS::HandleValue value);
+    explicit Node(JS::Value value);
     Node(JSGCTraceKind kind, void *ptr);
 
     // copy construction and copy assignment just use memcpy, since we know
     // instances contain nothing but a vtable pointer and a data pointer.
     //
     // To be completely correct, concrete classes could provide a virtual
     // 'construct' member function, which we could invoke on rhs to construct an
     // instance in our storage. But this is good enough; there's no need to jump
@@ -327,23 +330,19 @@ class Node {
 
     // If this node refers to something that can be represented as a JavaScript
     // value that is safe to expose to JavaScript code, return that value.
     // Otherwise return UndefinedValue(). JSStrings, JS::Symbols, and some (but
     // not all!) JSObjects can be exposed.
     JS::Value exposeToJS() const;
 
     const jschar *typeName()        const { return base()->typeName(); }
+    size_t size()                   const { return base()->size(); }
     JS::Zone *zone()                const { return base()->zone(); }
     JSCompartment *compartment()    const { return base()->compartment(); }
-
-    size_t size(mozilla::MallocSizeOf mallocSizeof) const {
-        return base()->size(mallocSizeof);
-    }
-
     EdgeRange *edges(JSContext *cx, bool wantNames = true) const {
         return base()->edges(cx, wantNames);
     }
 
     // A hash policy for ubi::Nodes.
     // This simply uses the stock PointerHasher on the ubi::Node's pointer.
     // We specialize DefaultHasher below to make this the default.
     class HashPolicy {
@@ -429,19 +428,17 @@ class EdgeRange {
 
 // Concrete classes for ubi::Node referent types.
 
 // A reusable ubi::Concrete specialization base class for types supported by
 // JS_TraceChildren.
 template<typename Referent>
 class TracerConcrete : public Base {
     const jschar *typeName() const MOZ_OVERRIDE { return concreteTypeName; }
-    size_t size(mozilla::MallocSizeOf mallocSizeof) const MOZ_OVERRIDE {
-        return 0; // not implemented yet; bug 1011300
-    }
+    size_t size() const MOZ_OVERRIDE { return 0; } // not implemented yet; bug 1011300
     EdgeRange *edges(JSContext *, bool wantNames) const MOZ_OVERRIDE;
     JS::Zone *zone() const MOZ_OVERRIDE { return get().zone(); }
     JSCompartment *compartment() const MOZ_OVERRIDE { return nullptr; }
 
   protected:
     explicit TracerConcrete(Referent *ptr) : Base(ptr) { }
     Referent &get() const { return *static_cast<Referent *>(ptr); }
 
@@ -465,23 +462,27 @@ class TracerConcreteWithCompartment : pu
         new (storage) TracerConcreteWithCompartment(ptr);
     }
 };
 
 template<> struct Concrete<JSObject> : TracerConcreteWithCompartment<JSObject> { };
 template<> struct Concrete<JSString> : TracerConcrete<JSString> { };
 template<> struct Concrete<JS::Symbol> : TracerConcrete<JS::Symbol> { };
 template<> struct Concrete<JSScript> : TracerConcreteWithCompartment<JSScript> { };
+template<> struct Concrete<js::LazyScript> : TracerConcrete<js::LazyScript> { };
 template<> struct Concrete<js::jit::JitCode> : TracerConcrete<js::jit::JitCode> { };
+template<> struct Concrete<js::Shape> : TracerConcreteWithCompartment<js::Shape> { };
+template<> struct Concrete<js::BaseShape> : TracerConcreteWithCompartment<js::BaseShape> { };
+template<> struct Concrete<js::types::TypeObject> : TracerConcrete<js::types::TypeObject> { };
 
 // The ubi::Node null pointer. Any attempt to operate on a null ubi::Node asserts.
 template<>
 class Concrete<void> : public Base {
     const jschar *typeName() const MOZ_OVERRIDE;
-    size_t size(mozilla::MallocSizeOf mallocSizeOf) const MOZ_OVERRIDE;
+    size_t size() const MOZ_OVERRIDE;
     EdgeRange *edges(JSContext *cx, bool wantNames) const MOZ_OVERRIDE;
     JS::Zone *zone() const MOZ_OVERRIDE;
     JSCompartment *compartment() const MOZ_OVERRIDE;
 
     explicit Concrete(void *ptr) : Base(ptr) { }
 
   public:
     static void construct(void *storage, void *ptr) { new (storage) Concrete(ptr); }

--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1987,29 +1987,16 @@ IsSimdAvailable(JSContext *cx, unsigned 
     bool available = false;
 #else
     bool available = cx->jitSupportsSimd();
 #endif
     args.rval().set(BooleanValue(available));
     return true;
 }
 
-static bool
-ByteSize(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    mozilla::MallocSizeOf mallocSizeOf = cx->runtime()->debuggerMallocSizeOf;
-    JS::ubi::Node node = args.get(0);
-    if (node)
-        args.rval().set(NumberValue(node.size(mallocSizeOf)));
-    else
-        args.rval().setUndefined();
-    return true;
-}
-
 static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
 "  Run the garbage collector. When obj is given, GC only its compartment.\n"
 "  If 'compartment' is given, GC any compartments that were scheduled for\n"
 "  GC via schedulegc."),
 
     JS_FN_HELP("minorgc", ::MinorGC, 0, 0,
@@ -2320,21 +2307,16 @@ static const JSFunctionSpecWithHelp Test
     JS_FN_HELP("getBacktrace", GetBacktrace, 1, 0,
 "getBacktrace([options])",
 "  Return the current stack as a string. Takes an optional options object,\n"
 "  which may contain any or all of the boolean properties\n"
 "    options.args - show arguments to each function\n"
 "    options.locals - show local variables in each frame\n"
 "    options.thisprops - show the properties of the 'this' object of each frame\n"),
 
-    JS_FN_HELP("byteSize", ByteSize, 1, 0,
-"byteSize(value)",
-"  Return the size in bytes occupied by |value|, or |undefined| if value\n"
-"  is not allocated in memory.\n"),
-
     JS_FS_HELP_END
 };
 
 static const JSPropertySpec TestingProperties[] = {
     JS_PSG("timesAccessed", TimesAccessed, 0),
     JS_PS_END
 };
 

--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -3909,18 +3909,18 @@ dnl top-level configure may override thi
 MOZ_CONFIG_ICU()
 
 MOZ_SUBCONFIGURE_ICU()
 
 dnl ========================================================
 dnl JavaScript shell
 dnl ========================================================
 
-AC_CHECK_HEADERS(malloc.h)
-AC_CHECK_FUNCS(setlocale localeconv malloc_usable_size)
+AC_HAVE_FUNCS(setlocale)
+AC_HAVE_FUNCS(localeconv)
 
 AC_SUBST(MOZILLA_VERSION)
 
 AC_SUBST(ac_configure_args)
 
 AC_SUBST(TOOLCHAIN_PREFIX)
 
 if test -n "$JS_STANDALONE"; then

--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1042,19 +1042,16 @@ TypeObjectKey::ensureTrackedProperty(JSC
         JS_ASSERT(CurrentThreadCanAccessRuntime(cx->runtime()));
         if (JSObject *obj = singleton()) {
             if (obj->isNative() && obj->nativeLookupPure(id))
                 EnsureTrackPropertyTypes(cx, obj, id);
         }
     }
 }
 
-template<> const jschar JS::ubi::TracerConcrete<TypeObject>::concreteTypeName[] =
-    MOZ_UTF16("js::types::TypeObject");
-
 bool
 HeapTypeSetKey::instantiate(JSContext *cx)
 {
     if (maybeTypes())
         return true;
     if (object()->isSingleObject() && !object()->asSingleObject()->getType(cx)) {
         cx->clearPendingException();
         return false;

--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -16,17 +16,16 @@
 #include "jsfriendapi.h"
 #include "jstypes.h"
 
 #include "ds/IdValuePair.h"
 #include "ds/LifoAlloc.h"
 #include "gc/Barrier.h"
 #include "gc/Marking.h"
 #include "jit/IonTypes.h"
-#include "js/UbiNode.h"
 #include "js/Utility.h"
 #include "js/Vector.h"
 
 namespace js {
 
 class TypeDescr;
 
 class TaggedProto
@@ -1719,20 +1718,9 @@ inline const char * TypeObjectString(Typ
 #endif
 
 /* Print a warning, dump state and abort the program. */
 MOZ_NORETURN void TypeFailure(JSContext *cx, const char *fmt, ...);
 
 } /* namespace types */
 } /* namespace js */
 
-namespace JS {
-namespace ubi {
-// JS::ubi::Node can trace TypeObjects using JS_TraceChildren, and TypeObject
-// instances don't belong to any particular compartment, so we can use the
-// generic JS::ubi::TracerConcrete template for their JS::ubi::Concrete
-// specialization.
-template<> struct Concrete<js::types::TypeObject> : TracerConcrete<js::types::TypeObject> { };
-}
-}
-
-
 #endif /* jsinfer_h */

--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -3747,19 +3747,16 @@ LazyScript::staticLevel(JSContext *cx) c
 {
     for (StaticScopeIter<NoGC> ssi(enclosingScope()); !ssi.done(); ssi++) {
         if (ssi.type() == StaticScopeIter<NoGC>::FUNCTION)
             return ssi.funScript()->staticLevel() + 1;
     }
     return 1;
 }
 
-template<> const jschar JS::ubi::TracerConcrete<LazyScript>::concreteTypeName[] =
-    MOZ_UTF16("js::LazyScript");
-
 void
 JSScript::updateBaselineOrIonRaw()
 {
     if (hasIonScript()) {
         baselineOrIonRaw = ion->method()->raw();
         baselineOrIonSkipArgCheck = ion->method()->raw() + ion->getSkipArgCheckEntryOffset();
     } else if (hasBaselineScript()) {
         baselineOrIonRaw = baseline->method()->raw();

--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -17,17 +17,16 @@
 #include "jslock.h"
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jstypes.h"
 
 #include "gc/Barrier.h"
 #include "gc/Rooting.h"
 #include "jit/IonCode.h"
-#include "js/UbiNode.h"
 #include "vm/Shape.h"
 
 namespace JS {
 struct ScriptSourceInfo;
 }
 
 namespace js {
 
@@ -2033,20 +2032,9 @@ CloneFunctionScript(JSContext *cx, Handl
 static inline JSPrincipals *
 NormalizeOriginPrincipals(JSPrincipals *principals, JSPrincipals *originPrincipals)
 {
     return originPrincipals ? originPrincipals : principals;
 }
 
 } /* namespace js */
 
-namespace JS {
-namespace ubi {
-
-// A LazyScript can be traced with JS_TraceChildren, and belongs to no
-// particular compartment, so we can use the generic JS::ubi::TracerConcrete
-// template for LazyScript's JS::ubi::Concrete specialization..
-template<> struct Concrete<js::LazyScript> : TracerConcrete<js::LazyScript> { };
-
-} // namespace ubi
-} // namespace JS
-
 #endif /* jsscript_h */

--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -16,19 +16,16 @@
 # include <process.h>
 #endif
 #include <errno.h>
 #include <fcntl.h>
 #if defined(XP_WIN)
 # include <io.h>     /* for isatty() */
 #endif
 #include <locale.h>
-#ifdef HAVE_MALLOC_H
-#include <malloc.h>
-#endif
 #include <math.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #ifdef XP_UNIX
@@ -54,17 +51,16 @@
 #endif
 #include "jswrapper.h"
 #include "prmjtime.h"
 
 #include "builtin/TestingFunctions.h"
 #include "frontend/Parser.h"
 #include "jit/arm/Simulator-arm.h"
 #include "jit/Ion.h"
-#include "js/Debug.h"
 #include "js/OldDebugAPI.h"
 #include "js/StructuredClone.h"
 #include "perf/jsperf.h"
 #include "shell/jsheaptools.h"
 #include "shell/jsoptparse.h"
 #include "vm/ArgumentsObject.h"
 #include "vm/Debugger.h"
 #include "vm/HelperThreads.h"
@@ -5994,31 +5990,16 @@ MaybeOverrideOutFileFromEnv(const char* 
 
 /* Pretend we can always preserve wrappers for dummy DOM objects. */
 static bool
 DummyPreserveWrapperCallback(JSContext *cx, JSObject *obj)
 {
     return true;
 }
 
-size_t
-ShellMallocSizeOf(const void *ptr)
-{
-    if (!ptr)
-        return 0;
-
-#if defined(HAVE_MALLOC_USABLE_SIZE)
-    return malloc_usable_size((void *) ptr);
-#elif defined(HAVE_MALLOC_SIZE)
-    return malloc_size((void *) ptr);
-#else
-    return 0;
-#endif
-}
-
 int
 main(int argc, char **argv, char **envp)
 {
     sArgc = argc;
     sArgv = argv;
 
     JSRuntime *rt;
     JSContext *cx;
@@ -6256,18 +6237,16 @@ main(int argc, char **argv, char **envp)
     JS_SetSecurityCallbacks(rt, &ShellPrincipals::securityCallbacks);
     JS_InitDestroyPrincipalsCallback(rt, ShellPrincipals::destroy);
 
     JS_SetInterruptCallback(rt, ShellInterruptCallback);
     JS::SetAsmJSCacheOps(rt, &asmJSCacheOps);
 
     JS_SetNativeStackQuota(rt, gMaxStackSize);
 
-    JS::dbg::SetDebuggerMallocSizeOf(rt, ShellMallocSizeOf);
-
     if (!offThreadState.init())
         return 1;
 
     if (!InitWatchdog(rt))
         return 1;
 
     cx = NewContext(rt);
     if (!cx)

--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@@ -10,17 +10,16 @@
 #include "mozilla/Move.h"
 #include "mozilla/Vector.h"
 
 #include <stdlib.h>
 
 #include "jscompartment.h"
 
 #include "gc/Marking.h"
-#include "js/Debug.h"
 #include "js/UbiNode.h"
 #include "js/UbiNodeTraverse.h"
 #include "vm/Debugger.h"
 #include "vm/GlobalObject.h"
 #include "vm/SavedStacks.h"
 
 #include "vm/Debugger-inl.h"
 
@@ -245,21 +244,16 @@ DebuggerMemory::setMaxAllocationsLogLeng
     args.rval().setUndefined();
     return true;
 }
 
 
 
 /* Debugger.Memory.prototype.takeCensus */
 
-void
-JS::dbg::SetDebuggerMallocSizeOf(JSRuntime *rt, mozilla::MallocSizeOf mallocSizeOf) {
-    rt->debuggerMallocSizeOf = mallocSizeOf;
-}
-
 namespace js {
 namespace dbg {
 
 // Common data for census traversals.
 struct Census {
     JSContext * const cx;
     Zone::ZoneSet debuggeeZones;
     Zone *atomsZone;

--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -116,22 +116,16 @@ PerThreadData::init()
     return true;
 }
 
 static const JSWrapObjectCallbacks DefaultWrapObjectCallbacks = {
     TransparentObjectWrapper,
     nullptr
 };
 
-static size_t
-ReturnZeroSize(const void *p)
-{
-    return 0;
-}
-
 JSRuntime::JSRuntime(JSRuntime *parentRuntime)
   : JS::shadow::Runtime(
 #ifdef JSGC_GENERATIONAL
         &gc.storeBuffer
 #endif
     ),
     mainThread(this),
     parentRuntime(parentRuntime),
@@ -224,18 +218,17 @@ JSRuntime::JSRuntime(JSRuntime *parentRu
     ctypesActivityCallback(nullptr),
     forkJoinWarmup(0),
     offthreadIonCompilationEnabled_(true),
     parallelParsingEnabled_(true),
 #ifdef DEBUG
     enteredPolicy(nullptr),
 #endif
     largeAllocationFailureCallback(nullptr),
-    oomCallback(nullptr),
-    debuggerMallocSizeOf(ReturnZeroSize)
+    oomCallback(nullptr)
 {
     liveRuntimesCount++;
 
     /* Initialize infallibly first, so we can goto bad and JS_DestroyRuntime. */
     JS_INIT_CLIST(&onNewGlobalObjectWatchers);
 
     PodArrayZero(nativeStackQuota);
     PodZero(&asmJSCacheOps);

--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -1422,22 +1422,16 @@ struct JSRuntime : public JS::shadow::Ru
         if (MOZ_LIKELY(!!p2))
             return p2;
         if (newSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
             reportAllocationOverflow();
             return nullptr;
         }
         return (T *)onOutOfMemoryCanGC(p, newSize * sizeof(T));
     }
-
-    /*
-     * Debugger.Memory functions like takeCensus use this embedding-provided
-     * function to assess the size of malloc'd blocks of memory.
-     */
-    mozilla::MallocSizeOf debuggerMallocSizeOf;
 };
 
 namespace js {
 
 // When entering JIT code, the calling JSContext* is stored into the thread's
 // PerThreadData. This function retrieves the JSContext with the pre-condition
 // that the caller is JIT code or C++ called directly from JIT code. This
 // function should not be called from arbitrary locations since the JSContext

--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1433,19 +1433,16 @@ Shape::setObjectFlag(ExclusiveContext *c
 
     StackBaseShape base(last);
     base.flags |= flag;
 
     RootedShape lastRoot(cx, last);
     return replaceLastProperty(cx, base, proto, lastRoot);
 }
 
-template<> const jschar JS::ubi::TracerConcrete<Shape>::concreteTypeName[] =
-    MOZ_UTF16("js::Shape");
-
 /* static */ inline HashNumber
 StackBaseShape::hash(const StackBaseShape *base)
 {
     HashNumber hash = base->flags;
     hash = RotateLeft(hash, 4) ^ (uintptr_t(base->clasp) >> 3);
     hash = RotateLeft(hash, 4) ^ (uintptr_t(base->parent) >> 3);
     hash = RotateLeft(hash, 4) ^ (uintptr_t(base->metadata) >> 3);
     hash = RotateLeft(hash, 4) ^ uintptr_t(base->rawGetter);
@@ -1567,19 +1564,16 @@ void
 BaseShape::finalize(FreeOp *fop)
 {
     if (table_) {
         fop->delete_(table_);
         table_ = nullptr;
     }
 }
 
-template<> const jschar JS::ubi::TracerConcrete<BaseShape>::concreteTypeName[] =
-    MOZ_UTF16("js::BaseShape");
-
 inline
 InitialShapeEntry::InitialShapeEntry() : shape(nullptr), proto(nullptr)
 {
 }
 
 inline
 InitialShapeEntry::InitialShapeEntry(const ReadBarrieredShape &shape, TaggedProto proto)
   : shape(shape), proto(proto)

--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -23,17 +23,16 @@
 
 #include "gc/Barrier.h"
 #include "gc/Heap.h"
 #include "gc/Marking.h"
 #include "gc/Rooting.h"
 #include "js/HashTable.h"
 #include "js/MemoryMetrics.h"
 #include "js/RootingAPI.h"
-#include "js/UbiNode.h"
 #include "vm/PropDesc.h"
 
 #ifdef _MSC_VER
 #pragma warning(push)
 #pragma warning(disable:4800)
 #pragma warning(push)
 #pragma warning(disable:4100) /* Silence unreferenced formal parameter warnings */
 #endif
@@ -1451,21 +1450,11 @@ IsImplicitDenseOrTypedArrayElement(Shape
 #ifdef _MSC_VER
 #pragma warning(pop)
 #pragma warning(pop)
 #endif
 
 namespace JS {
 template<> class AnchorPermitted<js::Shape *> { };
 template<> class AnchorPermitted<const js::Shape *> { };
-
-namespace ubi {
-
-// JS::ubi::Node can trace Shapes and BaseShapes with JS_TraceChildren, and both
-// have a 'compartment' method, so we can use the generic
-// JS::ubi::TracerConcrete template for their JS::ubi::Concrete specialization.
-template<> struct Concrete<js::Shape> : TracerConcreteWithCompartment<js::Shape> { };
-template<> struct Concrete<js::BaseShape> : TracerConcreteWithCompartment<js::BaseShape> { };
-
-} // namespace ubi
-} // namespace JS
+}
 
 #endif /* vm_Shape_h */

--- a/js/src/vm/UbiNode.cpp
+++ b/js/src/vm/UbiNode.cpp
@@ -24,26 +24,21 @@ using JS::Value;
 using JS::ubi::Concrete;
 using JS::ubi::Edge;
 using JS::ubi::EdgeRange;
 using JS::ubi::Node;
 using JS::ubi::TracerConcrete;
 
 // All operations on null ubi::Nodes crash.
 const jschar *Concrete<void>::typeName() const            { MOZ_CRASH("null ubi::Node"); }
+size_t Concrete<void>::size() const                       { MOZ_CRASH("null ubi::Node"); }
 EdgeRange *Concrete<void>::edges(JSContext *, bool) const { MOZ_CRASH("null ubi::Node"); }
 JS::Zone *Concrete<void>::zone() const                    { MOZ_CRASH("null ubi::Node"); }
 JSCompartment *Concrete<void>::compartment() const        { MOZ_CRASH("null ubi::Node"); }
 
-size_t
-Concrete<void>::size(mozilla::MallocSizeOf mallocSizeof) const
-{
-    MOZ_CRASH("null ubi::Node");
-}
-
 Node::Node(JSGCTraceKind kind, void *ptr)
 {
     switch (kind) {
       case JSTRACE_OBJECT:      construct(static_cast<JSObject *>(ptr));              break;
       case JSTRACE_STRING:      construct(static_cast<JSString *>(ptr));              break;
       case JSTRACE_SYMBOL:      construct(static_cast<JS::Symbol *>(ptr));            break;
       case JSTRACE_SCRIPT:      construct(static_cast<JSScript *>(ptr));              break;
       case JSTRACE_LAZY_SCRIPT: construct(static_cast<js::LazyScript *>(ptr));        break;
@@ -52,17 +47,17 @@ Node::Node(JSGCTraceKind kind, void *ptr
       case JSTRACE_BASE_SHAPE:  construct(static_cast<js::BaseShape *>(ptr));         break;
       case JSTRACE_TYPE_OBJECT: construct(static_cast<js::types::TypeObject *>(ptr)); break;
 
       default:
         MOZ_CRASH("bad JSGCTraceKind passed to JS::ubi::Node::Node");
     }
 }
 
-Node::Node(HandleValue value)
+Node::Node(Value value)
 {
     if (value.isObject())
         construct(&value.toObject());
     else if (value.isString())
         construct(value.toString());
     else if (value.isSymbol())
         construct(value.toSymbol());
     else
@@ -230,10 +225,18 @@ TracerConcrete<Referent>::edges(JSContex
 template<> const jschar TracerConcrete<JSObject>::concreteTypeName[] =
     MOZ_UTF16("JSObject");
 template<> const jschar TracerConcrete<JSString>::concreteTypeName[] =
     MOZ_UTF16("JSString");
 template<> const jschar TracerConcrete<JS::Symbol>::concreteTypeName[] =
     MOZ_UTF16("JS::Symbol");
 template<> const jschar TracerConcrete<JSScript>::concreteTypeName[] =
     MOZ_UTF16("JSScript");
+template<> const jschar TracerConcrete<js::LazyScript>::concreteTypeName[] =
+    MOZ_UTF16("js::LazyScript");
 template<> const jschar TracerConcrete<js::jit::JitCode>::concreteTypeName[] =
     MOZ_UTF16("js::jit::JitCode");
+template<> const jschar TracerConcrete<js::Shape>::concreteTypeName[] =
+    MOZ_UTF16("js::Shape");
+template<> const jschar TracerConcrete<js::BaseShape>::concreteTypeName[] =
+    MOZ_UTF16("js::BaseShape");
+template<> const jschar TracerConcrete<js::types::TypeObject>::concreteTypeName[] =
+    MOZ_UTF16("js::types::TypeObject");