--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -515,25 +515,25 @@ js::SetIntegrityLevel(JSContext* cx, Han
         RootedShape last(cx, EmptyShape::getInitialShape(cx, nobj->getClass(),
                                                          nobj->getTaggedProto(),
                                                          nobj->numFixedSlots(),
                                                          nobj->lastProperty()->getObjectFlags()));
         if (!last)
             return false;
 
         // Get an in-order list of the shapes in this object.
-        AutoShapeVector shapes(cx);
+        Rooted<ShapeVector> shapes(cx, ShapeVector(cx));
         for (Shape::Range<NoGC> r(nobj->lastProperty()); !r.empty(); r.popFront()) {
             if (!shapes.append(&r.front()))
                 return false;
         }
         Reverse(shapes.begin(), shapes.end());
 
-        for (size_t i = 0; i < shapes.length(); i++) {
-            StackShape unrootedChild(shapes[i]);
+        for (Shape* shape : shapes) {
+            StackShape unrootedChild(shape);
             RootedGeneric<StackShape*> child(cx, &unrootedChild);
             child->attrs |= GetSealedOrFrozenAttributes(child->attrs, level);
 
             if (!JSID_IS_EMPTY(child->propid) && level == IntegrityLevel::Frozen)
                 MarkTypePropertyNonWritable(cx, nobj, child->propid);
 
             last = cx->compartment()->propertyTree.getChild(cx, last, *child);
             if (!last)
@@ -1346,25 +1346,25 @@ InitializePropertiesFromCompatibleNative
         // the property information from src.  Note that we asserted above that
         // dst's object flags are 0.
         shape = EmptyShape::getInitialShape(cx, dst->getClass(), dst->getTaggedProto(),
                                             dst->numFixedSlots(), 0);
         if (!shape)
             return false;
 
         // Get an in-order list of the shapes in the src object.
-        AutoShapeVector shapes(cx);
+        Rooted<ShapeVector> shapes(cx, ShapeVector(cx));
         for (Shape::Range<NoGC> r(src->lastProperty()); !r.empty(); r.popFront()) {
             if (!shapes.append(&r.front()))
                 return false;
         }
         Reverse(shapes.begin(), shapes.end());
 
-        for (size_t i = 0; i < shapes.length(); i++) {
-            StackShape unrootedChild(shapes[i]);
+        for (Shape* shape : shapes) {
+            StackShape unrootedChild(shape);
             RootedGeneric<StackShape*> child(cx, &unrootedChild);
             shape = cx->compartment()->propertyTree.getChild(cx, shape, *child);
             if (!shape)
                 return false;
         }
     }
     size_t span = shape->slotSpan();
     if (!dst->setLastProperty(cx, shape))